CockroachDB Cloud MCP Server – Database Access
CockroachDB Cloud provides a managed MCP server that lets AI tools inspect, query, and, when explicitly enabled, modify CockroachDB Cloud clusters. It is designed for AI-assisted development and operations workflows that need live database context with Cloud authentication, RBAC, and guardrails.
Overview
CockroachDB Cloud MCP Server is a managed Model Context Protocol endpoint operated by Cockroach Labs for CockroachDB Cloud. It gives MCP-compatible AI tools a governed way to work with CockroachDB Cloud clusters without deploying a separate local server. The server is intended for AI-assisted database development, troubleshooting, schema exploration, and operational workflows where current cluster context matters.
What the MCP server enables
The managed endpoint exposes tools for inspecting and querying CockroachDB Cloud clusters. Official documentation describes support for listing databases and tables, describing schemas and indexes, inspecting cluster health and running queries, and running read-only SQL and EXPLAIN statements. When write access is explicitly enabled, the server can also create databases, create tables, and insert rows.
Cockroach Labs describes the managed server as using existing Cloud authentication, RBAC, SQL proxy paths, rate limits, logging, and observability rather than introducing a separate data-plane access path. This makes it useful for agents that need live CockroachDB context while keeping access aligned with Cloud controls.
When to use it
Use this MCP server when an AI assistant needs to answer questions or perform tasks against a CockroachDB Cloud cluster. Examples include listing the tables in a development database, explaining query plans, identifying running queries, inspecting schema and index definitions, or helping generate SQL based on real cluster metadata. It is also useful during prototyping and onboarding because the managed endpoint removes the need to host an MCP bridge yourself.
Connection and authentication
Cockroach Labs documents the managed endpoint at https://cockroachlabs.cloud/mcp and recommends HTTP transport. SSE is intentionally excluded because it is deprecated in MCP. Authentication is handled through CockroachDB Cloud mechanisms, including OAuth 2.1 Authorization Code Flow with PKCE for interactive workflows and service account API keys for autonomous environments. Permissions are scoped through Cloud RBAC, with mcp:read and mcp:write scopes described for controlled access.
Key considerations
Read-only access is the safe default, and write operations require explicit opt-in or consent. Any production use should rely on least-privilege Cloud RBAC roles, limited service account keys, and careful review of write permissions before allowing an AI agent to mutate data. This provider is for CockroachDB Cloud clusters; Cockroach Labs also provides a separate documentation MCP server for grounding coding assistants in product documentation without connecting to cluster data.
Supported Transports
streamable_http
URL: https://cockroachlabs.cloud/mcp
Frequently Asked Questions
- When should an AI agent use the CockroachDB Cloud MCP server?
- Use it when an agent needs live CockroachDB Cloud cluster context, such as listing databases and tables, describing schemas, inspecting indexes, reviewing cluster health, checking running queries, or running read-only SQL and EXPLAIN statements.
- What does this MCP server add to an AI agent's capabilities?
- It gives the agent governed access to CockroachDB Cloud tools and metadata through MCP, so responses and actions can be based on the current state of a real cluster rather than static training data or copied connection details.
- What can the AI agent access or manage through this server?
- The documented tools include listing databases and tables, describing schemas and indexes, inspecting cluster health and running queries, and executing read-only SQL and EXPLAIN. If write access is explicitly enabled, the server can create databases, create tables, and insert rows.
- How is authentication configured for this MCP server?
- Cockroach Labs documents OAuth 2.1 with PKCE for interactive user workflows and service account API keys for autonomous environments. Access is controlled by CockroachDB Cloud RBAC and MCP scopes such as mcp:read and mcp:write, so credentials should be scoped to the minimum permissions required.
- Which transport should be used for this MCP server?
- Use the managed HTTP endpoint at https://cockroachlabs.cloud/mcp. Cockroach Labs documents HTTP transport as supported and recommended, and states that SSE is intentionally excluded because it is deprecated in MCP.