Google's MCP Toolbox: exposing databases to AI agents over MCP

Google has released version 1.0 of the Java SDK for its MCP Toolbox for Databases. Heise Developer reported it on 12 October 2026. The toolbox itself is an open-source server on GitHub that gives agents, IDEs and applications database access over the Model Context Protocol. The idea: the model usually writes no SQL, it picks from a list of allowed queries; only the prebuilt execute_sql tool allows arbitrary SQL.

GitHub mark — The repo is now named googleapis/mcp-toolbox. License: Apache 2.0, about 16,700 stars and 1,800 forks when we retrieved the page. (Quelle: Simple Icons, file github.svg (CC0))

How the toolbox works

Developers declare in a file called tools.yaml which sources (database connections), tools (actions), toolsets (groups of tools), prompts and resources exist. The file is loaded with the --config flag. A tool there is, for example, a parameterized SQL query. The agent picks the matching tool and supplies the parameters; it does not write the query.

The queries are fixed in the configuration. The model sees only tool name, description and parameters. (Quelle: heise Developer, 12 October 2026)

There are also prebuilt tools, switched on with --prebuilt=<database> and narrowed to a toolset such as postgres/data. Both routes lead to the same server.

What the Java SDK 1.0 brings

Version 1.0.0 (release notes dated 9 September, year not given by Heise) adds default values for tool parameters and hooks that run before and after a tool call. It needs Java 17 or newer, Java 21 also gives virtual threads, it is Apache 2.0 licensed and available as com.google.cloud.mcp:mcp-toolbox-sdk-java:1.0.0.

One change breaks existing setups: parameters bound in advance with bindParam, such as the logged-in user's name, no longer appear in the tool definition the model sees. Anyone upgrading from 0.2 should check whether prompts or tests rely on them. Heise also notes that the Java SDK trails the Python, TypeScript and Go SDKs and has no packages yet for LangChain, LlamaIndex or Google's ADK. The example application combines Spring Boot, LangChain4j and AlloyDB.

Supported databases

For the Java side Heise names AlloyDB, BigQuery, Cloud SQL, Spanner, PostgreSQL, MySQL, SQL Server, Oracle, MongoDB and Snowflake. The GitHub page is broader, adding Firestore, MariaDB, Redis, Elasticsearch, CockroachDB, ClickHouse, Couchbase, Neo4j and Trino. The list in the repo is authoritative, so check it there if you need a specific database.

Settle before connecting

The security notes come from Heise and the GitHub page, the weighting is ours.

An agent with fixed, parameterized queries can do less than one with free SQL. That is the real gain of the concept.
The prebuilt tools include execute_sql, which runs arbitrary SQL, according to the GitHub page. If you use them, limit the toolsets and databases you expose.
The sample tools.yaml on GitHub puts a password in plaintext. In practice that belongs in secrets management.
By default the toolbox reloads its configuration when the file changes. --disable-reload turns that off.
npx @toolbox-sdk/server always starts the latest published version. The GitHub docs recommend the binary or a container image for reliable installs; our addition: use a fixed version in operations.
The SDK prints a warning if credentials would travel over unencrypted HTTP. Authentication is separated from the client (CredentialsProvider, AuthMethods), and Google OIDC tokens come from Application Default Credentials.

A read-only database account remains the last line of defense whatever the configuration says. About 15 MCP sidecars hang off our LibreChat. For every new MCP server the same question applies: what happens when the model uses it wrongly?