BigQuery MCP Server
This guide walks through connecting the BigQuery MCP server to auxilia. BigQuery uses Google OAuth 2.0 with static credentials.
1. Create a Google Cloud OAuth client
- Go to the Google Cloud Console
- Select (or create) your project
- APIs & Services → Credentials
- Create Credentials → OAuth client ID
- If prompted, configure the OAuth consent screen first:
- User Type: External (or Internal for Google Workspace)
- App name: auxilia MCP
- Scopes: add
https://www.googleapis.com/auth/bigquery
- Back in Create OAuth client ID:
- Application type: Web application
- Name: auxilia MCP
- Authorized redirect URIs:
For local development:
<FRONTEND_URL>/api/backend/mcp-servers/oauth/callbackhttp://localhost:3000/api/backend/mcp-servers/oauth/callback
- Click Create
- Copy the Client ID and Client Secret
2. Enable the BigQuery API
gcloud services enable bigquery.googleapis.com \
--project=your-project-id3. Install the BigQuery MCP server
In auxilia:
- Find BigQuery in the official servers list
- Click Install
- Enter the Client ID and Client Secret from step 1
4. Connect your account
- Click Connect on the BigQuery server card
- Pick your Google account on the consent screen
- Grant BigQuery access
auxilia requests the https://www.googleapis.com/auth/bigquery scope automatically.
5. Add to an agent
- Open an agent’s configuration page
- Add MCP Server → BigQuery
- Configure tool settings —
execute_sql_readonlyis safe to auto-approve;execute_sql(write) is a good candidate for needs approval
Available tools
The BigQuery MCP server provides tools for:
list_dataset_ids,list_table_idsget_dataset_info,get_table_infoexecute_sql_readonly,execute_sql
Troubleshooting
”Access denied”
- The BigQuery API must be enabled in your Google Cloud project
- The Google account you connected must have BigQuery permissions on the target project
- The OAuth consent screen must include the BigQuery scope
”Redirect URI mismatch”
The redirect URI in your Google Cloud OAuth client must match <FRONTEND_URL>/api/backend/mcp-servers/oauth/callback exactly — no trailing slashes, no protocol mismatches.