GOOGLE OAUTH

BigQuery MCP server, with a policy gate.

Statement-typed SQL grants for AI agents: Gentkey classifies every BigQuery statement with Google's own parser before it runs, so “the agent can UPDATE this warehouse” and “the agent can DROP tables” are different grants — not one scary checkbox.

Connect BigQuery Setup in 3 steps

Your agents connect tohttps://app.gentkey.com/mcpclaude.ai (web & mobile) · Claude Code · Cursor · any MCP client

ACCESS MODEL

What’s free, what needs a grant.

Reads: Dataset and table browsing plus execute_sql_readonly (enforced read-only by Google server-side) work with no grant.

Writes: Arbitrary SQL is classified per call by Google's own parser — a free dry run returns the statement type — so grants mirror GCP IAM's taxonomy. Scripts, EXECUTE IMMEDIATE, and deliberately unmapped statements like CALL need the full write grant.

Gentkey proxies the Google's BigQuery MCP server (https://bigquery.googleapis.com/mcp) — you get the vendor’s own tools, with custody, gating, and audit added in front.

Grant	What it governs
`mcp-bigquery.tables.updateData`	INSERT, UPDATE, DELETE, MERGE, TRUNCATE — changing data in existing tables
`mcp-bigquery.tables.create`	CREATE TABLE, tables from SELECT, views, materialized views, external tables — CREATE OR REPLACE included, which overwrites
`mcp-bigquery.tables.update`	ALTER TABLE, ALTER VIEW, ALTER MATERIALIZED VIEW — schemas and options
`mcp-bigquery.tables.delete`	DROP TABLE, DROP VIEW, DROP EXTERNAL TABLE, DROP MATERIALIZED VIEW
`mcp-bigquery.datasets.create`	CREATE SCHEMA / dataset creation
`mcp-bigquery.write`	Everything else: SELECT via execute_sql, scripts and EXECUTE IMMEDIATE, CALL (deliberately unmapped), dataset alter and drop, snapshots, exports and loads, UDFs that can reach the network

SETUP

Connect once, use everywhere.

Sign in at gentkey.com, add BigQuery (google oauth), then point each client at your endpoint. Every client completes a standard OAuth flow and lands in your Gentkey — your connections, nobody else’s.

claude.ai (web & mobile)

Settings → Connectors
Add custom connector
Paste https://app.gentkey.com/mcp and finish the OAuth prompt

Claude Code

claude mcp add --transport http \
  gentkey https://app.gentkey.com/mcp

Cursor

// .cursor/mcp.json
{
  "mcpServers": {
    "gentkey": { "url": "https://app.gentkey.com/mcp" }
  }
}

IN PRACTICE

Things agents do with BigQuery here.

What tables are in the analytics dataset and what do they contain?
How many signups did we get per week over the last quarter?
Backfill the daily_metrics table for yesterday.
Which queries would this month's cost spike trace back to?

SECURITY

Custody, gating, and audit — built in.

aes-256-gcm

The model never sees a credential

Your BigQuery token is encrypted at rest and injected server-side at call time. Your stored credential never enters a context window.

grants

Writes need a grant

Anything that changes state needs a capability you granted explicitly — revoke it and the next call is denied.

audit_log

A trail you can act on

Every decision is attributed to the agent that made it — allowed, denied, or denied by constraint.

FAQ

Fair questions.

How does Gentkey know whether SQL is a read or a write?

It asks Google. Every execute_sql call is classified with a free dry-run job first; BigQuery's own parser returns the statement type, and the policy gate matches it against your grants. Gentkey never parses SQL itself, and anything Google can't classify fails closed to the full write grant.

What happens when an agent calls a BigQuery write tool it hasn't been granted?

The call is denied at the gateway — nothing reaches BigQuery — and the denial is recorded in the audit log along with the grant that would have authorized it, so you can decide deliberately instead of finding out later.

Where are my credentials stored?

Encrypted at rest (AES-256-GCM) on Gentkey's server and injected server-side at call time. No credential you store with Gentkey ever enters a model's context window or an agent's config file.

Can I use this from claude.ai's free plan?

Yes — and it's the strongest case for a gateway: free claude.ai accounts currently get a single custom connector, so pointing that one slot at Gentkey puts every connector you've linked behind it.

How do I revoke an agent's access?

Revoke the grant (the next write is denied) or revoke the agent's tokens entirely in one click. Other agents and their grants are untouched — no shared key to rotate.

Is Gentkey affiliated with BigQuery?

No. Gentkey is an independent MCP gateway. Trademarks belong to their owners; where an official BigQuery MCP server exists, Gentkey proxies it and adds custody, gating, and audit on top.

Cut BigQuery a smaller key.

Create your Gentkey Sign in