When you ask Claude "how many orders shipped late last week," Claude does not know your database exists. It has never seen your orders table. Something has to hand it your schema, take the SQL it writes, run that SQL safely, and return the rows. That something is a database MCP server.
This is the piece that turns a general AI tool into one that can answer questions about your specific data. This guide explains what a database MCP server is, the exact lifecycle of a query, and what separates a server you can trust in production from one you cannot. For the protocol itself, start with what MCP is.
What a database MCP server is
A database MCP server sits between an AI tool and your database. It speaks the Model Context Protocol to the AI tool and SQL to your database. To the AI host, it is just another MCP server. To your database, it is just another client running queries.
Its job is two things: give the model enough context to write a correct query, and run that query without putting your data at risk. Sequel's MCP server does both, and works across Claude, Cursor, and ChatGPT from a single connection.
The lifecycle of one query
Here is what happens, in order, when you ask a question. The sequence below traces a plain-English prompt from the AI tool to your database and back.
Each stage maps to a concrete action. This table is the same flow, described step by step.
| Stage | What the server does |
|---|---|
| Discovery | Tells the host which tools and resources it offers |
| Schema introspection | Reads system catalogs for tables, columns, types, and keys |
| Context delivery | Exposes that schema to the model as a resource |
| Generation | The host's model writes SQL from your question and the schema |
| Execution | Runs the query against your database, read-only |
| Response | Returns rows, which the model turns into an answer |
The pgEdge Postgres MCP server documents this same pattern: discovery, then schema introspection from catalogs like pg_class and pg_attribute, then tool execution, then response. It is the standard shape of a database MCP server.
Schema as a resource, queries as a tool
A database MCP server exposes your database through two of MCP's three primitives.
- The schema is a resource. Read-only context. The model reads your tables, columns, types, primary keys, and foreign keys so it knows how data connects.
- Query execution is a tool. The model calls it with a SQL statement. A safe server restricts this to SELECT.
The official docs give this exact example: an MCP server for a database "can expose tools for querying the database, a resource that contains the schema of the database, and a prompt that includes few-shot examples." That is the blueprint every database server follows.
Why schema context is the whole game
The model only writes good SQL when it understands your data model. This is the step people underestimate, and it is where most naive setups fail.
Pinterest, which has "hundreds of thousands" of tables in its warehouse, found that the hard part was "identifying the correct tables," not writing the query once the tables were known. Finding the right three tables among hundreds of thousands is the real problem.
Schema alone is not always enough, either. As one data engineer put it on r/dataengineering, "knowing what columns and data types are in tables does not include business context." A column named status means nothing without knowing what its values represent. The best database MCP servers add that context. We unpack how in how text-to-SQL works.
Read-only by design
A database MCP server should never be able to change your data. The control is simple: connect through a read-only database user.
A read-only role can run SELECT statements but cannot INSERT, UPDATE, DELETE, or DROP. Even if the model generates a destructive query, and even if untrusted input tries to trick it, the database itself refuses. Our guide on read-only users in Postgres shows how to create one in a few lines.
Sequel runs read-only by default. This is not a setting you have to remember to enable. It is the baseline, because connecting an AI agent to a production database with write access is the mistake that causes incidents. We cover why in MCP security and governance.
Which databases work over MCP
A database MCP server can expose a transactional database or a warehouse using the same pattern. Sequel supports the common ones, each with a setup guide.
| Database | Type | Setup guide |
|---|---|---|
| PostgreSQL | Transactional | Connect PostgreSQL to Claude Code |
| MySQL | Transactional | Connect MySQL to Claude Code |
| ClickHouse | Analytical | Connect ClickHouse to Claude Code |
| BigQuery | Warehouse | Connect BigQuery to Claude Code |
Because the server normalizes everything to MCP, you can ask one question that joins data across these sources. The model sees a unified schema, not four disconnected ones.
Build your own, or use a managed server
You can build a database MCP server. The SDKs and open-source reference servers make a basic one approachable. The question is what happens past the demo.
| Concern | DIY server | Managed server (Sequel) |
|---|---|---|
| Basic schema introspection | You build it | Built in |
| Table selection at scale | Hard, you tune it | Handled |
| Read-only enforcement | You configure it | Default |
| Cross-database joins | You wire each source | Built in |
| Audit logging | You add it | Built in |
| Works across AI tools | You test each | One connection |
A weekend project gets you a server that queries one database from one tool. Production-grade schema context, table selection across a large warehouse, and audit logging are the work. That is the gap a managed AI data analyst fills.
A note on accuracy
The query the model writes is a draft, not gospel. On the BIRD benchmark, the best models reach about 82% execution accuracy against real databases, versus roughly 93% for humans, as of December 2025. A good database MCP server shows you the SQL it ran so you can check it. We cover the numbers in how accurate text-to-SQL is.
The takeaway
A database MCP server is the bridge that gives an AI tool your schema and runs its queries safely. Get the schema context and the read-only enforcement right, and any AI tool can answer questions about your data. Want the bridge without building it? Get started free or read how to query your database with AI using MCP.