MCP Toolbox for Databases

MCP Toolbox for Databases is Google's open-source server and framework for connecting database systems to agents through the Model Context Protocol. It offers a fast path through prebuilt configurations and a more controlled path through custom tools whose SQL, parameters, authentication, and toolsets are defined by the operator. The distinction matters: the repository explicitly treats arbitrary-SQL prebuilt tools as a developer-in-the-loop convenience, not a safe production authorization model.

Start locally with one prebuilt database and a dedicated read-only identity, keep all secrets outside the MCP configuration, then verify discovery and one harmless query before considering custom tools or network deployment.

Help me install and configure MCP Toolbox for Databases from https://github.com/googleapis/mcp-toolbox. Read the current README, prebuilt-config documentation, license, and security guidance first. Confirm my MCP host, operating system, target database, transport, and secret-management method. Start with the repository's documented npx stdio setup for one database unless I choose another supported method. Create or identify a dedicated least-privilege, preferably read-only database identity; never print, log, hardcode, or commit its password or tokens. Show the exact client configuration path and proposed changes before editing it. After setup, restart the client, inspect the available tools, and perform only one harmless read against non-sensitive data. Report the commands, files changed, tool list, permissions used, and verification result. Stop and ask before enabling arbitrary SQL for untrusted users, network exposure, write access, telemetry export, or broader scopes.

{"mcpServers":{"toolbox-postgres":{"command":"npx","args":["-y","@toolbox-sdk/server","--prebuilt=postgres","--stdio"],"env":{"POSTGRES_HOST":"127.0.0.1","POSTGRES_PORT":"5432","POSTGRES_DATABASE":"YOUR_DATABASE","POSTGRES_USER":"YOUR_READONLY_USER","POSTGRES_PASSWORD":"SET_IN_A_SECRET_STORE"}}}}

1. 1
   Choose a narrow connection boundary

   Select one supported database and decide whether a prebuilt configuration is appropriate for trusted development. Create a dedicated database identity with only the required schemas and operations; use SELECT-only access for exploration where possible.

2. 2
   Provide credentials outside configuration files

   Set the database values through environment injection or a secret manager. For PostgreSQL, the bundled prebuilt file expects POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DATABASE, POSTGRES_USER, POSTGRES_PASSWORD, and an optional POSTGRES_QUERY_PARAMS value.

3. 3
   Register the stdio server

   Add an MCP server entry that runs: npx -y @toolbox-sdk/server --prebuilt=postgres --stdio Keep the real secret outside any shared or committed client configuration. A narrower PostgreSQL toolset can be selected with --prebuilt=postgres/<toolset>.

4. 4
   Verify discovery and database enforcement

   Restart the MCP client, confirm the server and expected tools are visible, then list one known table or run one harmless SELECT against non-sensitive data. Verify that the database itself denies writes and out-of-scope data.

5. 5
   Harden before application use

   Replace arbitrary-SQL tools with custom parameterized tools for fixed workflows. Add authenticated parameters or MCP authorization where needed; add TLS and host/origin restrictions before network exposure, and review telemetry before exporting it.

MCP Toolbox stands out because it combines a broad database catalog with an explicit path from developer convenience to constrained production tools. The documentation, release cadence, security policy, tests, and Apache-2.0 license provide strong public evidence. The main risk is equally clear: its fastest prebuilt path can expose arbitrary SQL, so database-native least privilege and custom parameterized tools are essential rather than optional polish. This assessment does not claim installation or functional testing.