Prebuilt database tools
Expose generic schema and SQL operations such as list_tables and execute_sql for supported databases.
Documentation ↗MCP server / databases / source-linked
Google Gen AI Toolbox
Google’s open-source database MCP server is now called MCP Toolbox for Databases. It combines prebuilt database tools for agent clients with a framework for defining restricted, structured, or semantic custom tools. It is a local or self-hosted service rather than a Google-hosted data connector. The rename matters when searching releases and packages.
Before you choose.
Identify the implementation and the job it supports.
Google’s open-source database MCP server is now called MCP Toolbox for Databases. It combines prebuilt database tools for agent clients with a framework for defining restricted, structured, or semantic custom tools. It is a local or self-hosted service rather than a Google-hosted data connector. The rename matters when searching releases and packages.
Setup and connection.
The documented interface, authentication and installation path.
- Connection / transport
- stdio or Streamable HTTP
- Authentication
- Database credentials or cloud IAM are supplied to the local server; no hosted OAuth flow is implied by the repository.
Install a binary, Homebrew package, container, or npm runner; configure a database source/toolset; add the server to the client config. Use the official config reference for source-specific environment variables.
Setup reference ↗Documented setup example. Review the source and credentials before running; this command was not executed for this article.
{"mcpServers":{"toolbox-postgres":{"command":"npx","args":["-y","@toolbox-sdk/server","--prebuilt=postgres","--stdio"]}}}What it actually exposes.
Concrete capabilities with maintainer sources.
Custom tool definitions
Define sources, tools, toolsets, prompts, and resources in tools.yaml to constrain agent behavior.
Documentation ↗Operational integrations
The project documents connection pooling, IAM integration, OpenTelemetry, and SDK access for agent applications.
Documentation ↗Evidence and method.
What was checked and what was not tested.
HOW
Source method
Public maintainer documentation and repositories. This is not a hands-on product review.
WHEN
Last checked 2026-10-01
Setup examples are documented examples. Suggested trials and comparison advice are editorial guidance.
Sources support the adjacent factual statements. A source review does not establish uptime, performance, security or current account eligibility. Read the editorial policy.
Community signals.
Concrete reports from public community discussions, kept separate from product documentation.
Signal: local vs deployed lifecycle
An ADK agent worked locally with HTTP Toolbox but emitted unclosed-session errors after deployment to Agent Engine, showing an environment-specific lifecycle gap.
“It works fine when I execute locally ... when I deploy ... 'Unclosed client session'”Open community source ↗
Signal: custom tool and local file gap
A feature request asks for plugins that can ingest local CSV files and then use configured database sources, indicating that Toolbox's database-first tool model does not cover every local-file workflow.
“hard or impossible to add a custom tool that performs local non-database work”Open community source ↗
Community evidence is anecdotal and may reflect one setup, version or account. It is included for discovery and risk-sensing, not as a representative rating or independent benchmark. Verify the current official documentation before acting on a report.
Try a specific task.
A bounded evaluation you can reproduce in your own environment.
Database-aware code review
Suggested evaluation, not an observed test result.
- Choose a database-specific prebuilt or custom toolset and scope its credentials.
- Ask the agent to inspect schema and produce a migration or query plan.
- Review generated SQL, run it in a safe environment, and capture the resulting diff.
What to inspect: A traceable plan and reviewed database change, rather than an unrestricted SQL session. Proposed workflow; not tested by clawbot.ai.
Workflow reference ↗Permissions and limitations.
Read these constraints before granting access.
Inference: broad database credentials make least-privilege configuration essential; the generic SQL surface can be riskier than a curated toolset.
Boundary reference ↗The former genai-toolbox repository name is obsolete; users following old package or remote URLs may need to update them.
Boundary reference ↗Decide by workflow.
Make the expected output explicit before you connect.
A traceable plan and reviewed database change, rather than an unrestricted SQL session. Proposed workflow; not tested by clawbot.ai.
Keep the task inputs, tool calls, output and any errors together when you evaluate. The trial above is a proposal, not a recorded result.
Compare the alternatives.
Specific reasons to choose another route, with the tradeoff shown.
| Alternative | Choose it when | Tradeoff |
|---|---|---|
| Supabase MCP | Choose when the data already lives in Supabase and project-scoped OAuth/read-only controls matter. | Less portable across database vendors; tied to Supabase’s hosted service. Documentation ↗ |
| Neon MCP | Choose when you need Neon branches, endpoints, and managed Postgres operations. | Neon-specific rather than a generic multi-database tool framework. Documentation ↗ |
Questions before setup.
Answers specific to this implementation.
Is this still called Gen AI Toolbox?
Google’s repository was renamed to mcp-toolbox; keep the old name as an alias when searching historical material.
Documentation ↗
Can I restrict tools?
Yes. Use a named toolset and define only the sources and tools an agent should receive.
Documentation ↗
Source trail.
Maintainer documentation used in this record.