ClickHouse MCP

Query ClickHouse databases through the official MCP server, with read-only SQL enforced by default and separate write opt-ins.

Install Source repository

Quick verdict

A strong official data profile when the default read-only posture is preserved and the optional scope-widening flags are treated as separate security decisions.

MaintainerClickHouse (official)
Security scopeRead-only
Transportsstdio, streamable-http, sse
Install channelpypi · mcp-clickhouse
EvidenceSource Validated
LicenseApache-2.0 · Open source

ClickHouse MCP is the vendor's official server for listing databases and tables and running SQL against a configured ClickHouse deployment. The recommended profile stays on the default read-only path over stdio; writes, destructive statements, embedded chDB access and network transports each require deliberate additional configuration.

MCP security best practices

Install ClickHouse MCP

uv run --with

Config entry (mcpServers)

{
  "mcpServers": {
    "clickhouse-mcp": {
      "command": "uv",
      "args": ["run", "--with", "mcp-clickhouse", "--python", "3.10", "mcp-clickhouse"],
      "env": {
        "CLICKHOUSE_HOST": "sql-clickhouse.clickhouse.com",
        "CLICKHOUSE_USER": "demo",
        "CLICKHOUSE_PASSWORD": "",
        "CLICKHOUSE_SECURE": "true"
      }
    }
  }
}

Runs via `uv run --with mcp-clickhouse --python 3.10 mcp-clickhouse` (uvx mcp-clickhouse is equivalent). The starter configuration points at ClickHouse's public SQL playground; point CLICKHOUSE_HOST/USER/PASSWORD at your own deployment for real use. An optional chdb extra runs embedded ClickHouse queries in the local process — not part of this profile.

Credentials

Name	Required	What it is for
`CLICKHOUSE_HOST`	Required	ClickHouse hostname. The starter template uses ClickHouse's public SQL playground; replace it with the intended deployment.
`CLICKHOUSE_USER`	Required	ClickHouse user. Use a dedicated account with database-level read-only permissions.
`CLICKHOUSE_PASSWORD`	Optional	Password when required by the selected ClickHouse deployment. The public playground template uses an empty password.
`CLICKHOUSE_SECURE`	Required	Non-secret connection setting. The starter template keeps TLS enabled.

Verified configurations

Not run by us yet. This profile is Source Validated: the install channel, config entry, credentials and license were checked against the source and upstream metadata, but no configuration has been installed, discovered and executed in a recorded environment. When one is, it appears here with the eight scope dimensions below.

Best for

Analysts and developers who want an assistant to inspect ClickHouse schemas and run controlled analytical queries without granting write access.

Why use it

It exposes first-party ClickHouse discovery and query tools with explicit read-only, write and destructive-operation boundaries instead of leaving those boundaries to prompt wording.

Tradeoffs

SQL can still expose sensitive data or create expensive scans, and the MCP process holds whatever database authority its ClickHouse user has. Write access, DROP/TRUNCATE support and chDB are available but intentionally outside this starter profile. Use a dedicated read-only user, query limits and a non-production target for validation.

Upstream state

pypi package published · repository active · in the official MCP Registry (active). Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.

Official MCP Registry name: io.github.ClickHouse/mcp-clickhouse

Editorial review

Reviewed byOpenSourcesAI EditorialLast updatedAugust 2026SourcesOfficial ClickHouse MCP repository and documentation; ClickHouse MCP license; mcp-clickhouse on PyPI; Official MCP Registry — ClickHouse

Grade B — Source Validated. Re-review is due by 2027-02-18. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.

Sources

Official ClickHouse MCP repository and documentation (tier 1, checked 2026-08-19)
ClickHouse MCP license (tier 1, checked 2026-08-19)
mcp-clickhouse on PyPI (tier 2, checked 2026-08-19)
Official MCP Registry — ClickHouse (tier 2, checked 2026-08-19)

Cloudflare API MCPSearch and operate the Cloudflare API through a compact Code Mode MCP server with OAuth-scoped account access.
DuckDB / MotherDuck MCPQuery local DuckDB files or MotherDuck through MCP, with read-only defaults and optional write-enabled SQL.
Hugging Face MCPSearch Hugging Face models, datasets, Spaces, papers and docs through MCP, with optional Hub and compute tools.

Related guides

All MCP servers →