MCP for Data Analysts: Query Warehouses and Metrics With AI, Safely

For data analysts, MCP lets an AI assistant work directly with your warehouse, semantic layer and BI metadata. You can ask "which tables hold order refunds?" or "what was weekly revenue by region last quarter?" and the assistant explores schemas, writes SQL and runs it through an MCP server, using your permissions.

The upside is speed on routine questions. The risk is confident answers built on the wrong table, or queries that change data. This guide covers the main data servers, analyst workflows, example prompts and the guardrails that matter. Vendor details were checked on 2 November 2026.

MCP in two minutes

The Model Context Protocol is an open standard that connects AI apps to other systems through MCP servers. A data platform's MCP server offers tools such as "list tables," "get schema" and "run query." Your AI app decides which to call based on your question. Our plain-English MCP guide covers the basics.

The main data servers

Google BigQuery

Google's BigQuery MCP docs give the endpoint https://bigquery.googleapis.com/mcp and six tools: list_dataset_ids, list_table_ids, get_dataset_info, get_table_info, execute_sql and execute_sql_readonly. Google says "The only MCP tool that isn't read-only is execute_sql," and you can block it with an IAM deny policy. Queries are limited "to three minutes" by default, and "Query results are limited to a maximum of 3,000 rows." Sign-in uses OAuth 2.0 with IAM, and Google recommends a separate identity for agents. See our BigQuery MCP server profile.

dbt

The dbt MCP docs describe two options. The self-hosted server "runs on your machine" and suits development work such as authoring models and tests; it gives "Full access to dbt commands (dbt run, dbt build, dbt test, and more)." The remote server "is ideal for data consumption use cases," such as "querying metrics, exploring metadata, viewing lineage." The docs add that text_to_sql "is also the only tool that consumes your dbt Copilot action allotment." See our dbt MCP server profile.

Snowflake and Databricks

Both offer managed MCP servers with their own governance. Snowflake's server is defined in SQL and often exposes a Cortex Agent; Databricks offers managed endpoints including Genie. Details change often, so read our Snowflake and Databricks profiles and the vendors' current docs before you connect.

Workflows for analysts

Find the right table

New to a dataset? Ask the assistant to list datasets and describe the tables that mention refunds, returns or cancellations. It uses listing and info tools, which are read-only. This alone can save an hour of hunting in a catalog.

Answer routine questions

For "how many active customers last month?" style questions, the assistant writes and runs SQL. Ask it to show the query and explain each filter. Compare with a known figure before you rely on it.

Use governed metrics

If your company has a semantic layer, such as dbt's, ask for metrics by name instead of raw SQL. Defined metrics give the same answer every time, which matters for reporting.

Draft the analysis, not the conclusion

Ask the assistant to pull the numbers, build a table and suggest what might explain a change. You decide what is true and what goes in the deck.

Document as you go

Ask for a short note of the tables, filters and assumptions used. That makes your work easy to review and repeat.

Example prompts

• "In BigQuery, list the tables in the sales dataset and describe the columns of any table with 'refund' in its name."
• "Using read-only SQL, count orders by week for Q3 2026 in the orders table. Show the query before the result."
• "From the dbt semantic layer, get monthly revenue by region for the last six months."
• "Show the lineage for the fct_orders model and tell me which sources feed it."
• "The weekly signups number dropped 18%. Check whether the drop is in one channel, one country or across the board."

Guardrails for analysts

Use read-only access

Ask your data team for a read-only role for AI work. On BigQuery, use execute_sql_readonly and ask an admin to deny execute_sql. The MCP tools specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations," so keep confirmation prompts on.

Watch cost and scope

Warehouse queries cost money. Ask for date filters and limits in every question. A three-minute limit and a 3,000-row cap help, but a full table scan can still be expensive.

Protect sensitive data

Personal data, salaries and health data should not be in the datasets your AI role can reach. Ask for a curated, de-identified schema for AI use. Our guide to MCP data exfiltration explains how data can leak through tools.

Check before you share

• Read the SQL.
• Confirm the table and filters match the business definition.
• Compare at least one number with a trusted dashboard.
• Note any assumptions in your write-up.

Analytics and marketing data

For web analytics, Google publishes an experimental, read-focused Google Analytics MCP server; see our Google Analytics MCP server profile. Our list of MCP servers for data analytics compares more options.

Next step

Ask your data team for a read-only, curated dataset and try one routine question this week. If your company needs a custom MCP server over an internal data API, with row limits and logging built in, our MCP development team can build it.

Frequently asked questions