MCP servers that execute SQL
Let your AI run SQL queries against a real database.
11 servers · Last updated June 17, 2026
TL;DR: These MCP servers expose tools that run SQL — from read-only SELECTs to full read/write — so your AI agent can query and inspect a live database instead of guessing. The key differences are which engine they target, whether writes are allowed, and how they guard against destructive or injection-prone queries.
Bottom line: if you only try one, MCP Toolbox for Databases (BigQuery) is the most popular, verified option for this (15,600★). 10 more compared below.
Compare 11 servers
| Server | Transport | Auth | Verified | Stars | Tools for this |
|---|---|---|---|---|---|
| MCP Toolbox for Databases (BigQuery) | Local (stdio) | OAuth | 15,600 | bigquery-execute-sql, bigquery-sql | |
| AWS S3 Tables MCP Server | Local (stdio) | API key | 9,200 | run_sql_query | |
| Postgres MCP Pro | Local (stdio) | API key | 2,900 | execute_sql | |
| Supabase MCP Server | Remote (HTTP) | OAuth | 2,700 | execute_sql | |
| Neon MCP Server | Remote (HTTP) | OAuth | 2,100 | run_sql / run_sql_transaction, list_slow_queries / explain_sql_statement | |
| ClickHouse MCP Server | Local (stdio) | API key | 1,000 | run_query | |
| MotherDuck / DuckDB MCP Server | Local (stdio) | API key | 800 | execute_query | |
| Elasticsearch MCP Server | Local (stdio) | API key | 700 | esql | |
| PostHog MCP Server (Official Remote) | Local (stdio) | API key | 350 | execute-sql | |
| Prometheus MCP Server | Local (stdio) | No auth | 340 | execute_query | |
| Honeycomb MCP Server | Local (stdio) | API key | 250 | run_query |
The servers
Google's official MCP server with prebuilt BigQuery tools, querying datasets via Application Default Credentials.
Official AWS Labs MCP server to manage and query S3 Tables (table buckets, namespaces, tables).
Read/write Postgres access plus index tuning, EXPLAIN plans, and database health analysis for AI agents.
Official Supabase server: manage tables, run SQL, branches, configs and edge functions from your AI client.
Manage serverless Postgres on Neon with natural language: projects, branches, migrations, and SQL.
Official ClickHouse server: read-only SQL queries plus database/table exploration and chDB support.
Query local DuckDB files, in-memory DBs, S3, or MotherDuck cloud with read/write SQL.
Official Elastic server: list indices, read mappings, and search with Query DSL.
Official PostHog server: product analytics, feature flags, experiments, error tracking and SQL.
Run PromQL queries and analyze Prometheus metrics from any MCP client.
Honeycomb observability via AI: query datasets, alerts and boards (community + official).
Use these in a stack
FAQ
Which MCP server is safest for running SQL?
Prefer servers that default to read-only mode and parse SQL before executing (e.g. Postgres MCP Pro). Grant write access only when the agent genuinely needs it, and connect with a least-privilege database role.
Can these run against my production database?
Technically yes, but point them at a read replica or a least-privilege role first. Check each server's security notes — some support read-only mode and safe-SQL parsing, others execute whatever the model sends.