---
title: 'Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations'
description: 'Databend MCP enforces production read-only with allowlisted sandbox actions so AI can validate ETL safely while blocking production writes, updates, and deletes.'
date: 2026-01-28
slug: category-product/databend-mcp
cover_url: '202601/mcp/databend-mcp-title-en.png'
image: '202601/mcp/databend-mcp-title-en.png'
tags: [databend, MCP, AI, Security]
category: Product
authors:
  - DatabendLabs
---

import BlogSignupAD from '@site/src/components/blog-signup-ad';

# Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations

**MCP (Model Context Protocol)** is reshaping how AI connects with data services. In database scenarios, however, balancing open data access with strict security is often a delicate challenge. How can we empower AI with full data processing and logic verification capabilities without compromising the security of production data?

Databend MCP offers a solution: **Production Read-Only + Session Sandbox**.

{/* truncate */}

![Databend MCP Architecture](/img/blog/202601/mcp/databend-mcp-architecture.png)

## 🛡️ The Core of Safety: Session Sandbox

To resolve the conflict between security and capability, Databend MCP introduces the "Session Sandbox" mechanism. By strictly enforcing permission boundaries, it ensures absolute operational safety:

1.  **Read-Only Production**: For production environment objects, only read operations like `SELECT`, `SHOW`, and `DESCRIBE` are permitted. Any attempt to modify production data—such as `UPDATE`, `DELETE`, or `DROP`—will be intercepted and blocked by the server.
2.  **Isolated Sandboxes**: Each MCP session is assigned a unique, isolated namespace prefix: `mcp_sandbox_{session_id}_`.
3.  **Write Isolation**: All data writing and modification operations (e.g., creating temporary tables, ETL cleaning) are restricted exclusively to the sandbox prefix belonging to that session.

### ✅ Safety Guarantees (Supported Commands)

Databend MCP implements a strict allowlist mechanism. The supported commands are as follows:

**1. Allowed Read Operations (Global Read-Only):**
*   `SELECT`, `SHOW`, `DESCRIBE`, `EXPLAIN`, `LIST`

**2. Supported Object Types:**
*   `CATALOG`, `DATABASE`, `TABLE`, `VIEW`, `STAGE`
*   `FUNCTION`, `USER`, `ROLE`, `TASK`
*   `PIPE`, `STREAM`, `CONNECTION`
*   `WAREHOUSE`, `SEQUENCE`
*   `PROCEDURE`, `DICTIONARY`
*   `TAG`, `FILE FORMAT`
*   `NETWORK POLICY`, `PASSWORD POLICY`, `MASKING POLICY`, `ROW ACCESS POLICY`
*   `NOTIFICATION INTEGRATION`, `WORKLOAD GROUP`
*   `DYNAMIC TABLE`, `INDEX`

**3. Allowed Write Operations (Sandbox Only):**
*   `CREATE`, `CREATE OR REPLACE`, `DROP`, `ALTER`
*   `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, `COPY`, `MERGE`, `REPLACE`
*   `GRANT`, `REVOKE`

> ⚠️ Note: All write operations are strictly limited to objects prefixed with `mcp_sandbox_{session_id}_`.

### Why is "Read-Only" Not Enough?

If we grant AI only read permissions, it becomes helpless when facing complex data tasks. Real-world data processing is rarely just about "querying"—it involves "cleaning," "transforming," and "verifying."

*   **Cannot Verify Logic**: If AI generates `DELETE` or `UPDATE` logic but cannot actually run it, there is no way to confirm its correctness.
*   **Cannot Staging Data**: Complex analysis often requires creating temporary tables to store intermediate results. Read-only permissions directly block this path.

The **Session Sandbox** bridges this gap, enabling AI to complete the full "Sampling -> Simulation -> Verification" loop within an isolated environment.

## 🔧 Core Capabilities: Full-Link Verification

Building on the secure sandbox architecture, Databend MCP provides AI with comprehensive data interaction capabilities:

*   **Schema Discovery**: Automatically retrieves table structures, field types, and function metadata helping AI understand data semantics.
*   **SQL Execution & Verification**: Supports multi-statement execution, allowing complex ETL logic to run within the sandbox with immediate feedback.
*   **Resource & Connection Management**: Supports managing databases, internal stages, and various connections within the sandbox, meeting diverse task requirements.

### 🛠️ Available Tools

`execute_sql`, `execute_multi_sql`, `show_databases`, `show_tables`, `describe_table`, `show_stages`, `list_stage_files`, `create_stage`, `show_connections`, `get_session_sandbox_prefix`, `list_session_sandbox_databases`, `create_session_sandbox_database`

## 💡 Practical Scenario: Getting Verified Stream Usage

For features you might be unfamiliar with (like Databend Stream), you can ask the Agent directly for usage examples. The Agent won't hallucinate; instead, it will **write code, run verification, and then return the result**—all within the sandbox.

The following example demonstrates the entire interaction process:

**1. User Prompt:**
> "Please use Databend MCP to provide an example of how to use Databend Stream, and verify it."

**2. MCP Execution (Auto-Verification):**
The Agent automatically constructs test cases in the sandbox to ensure the provided example is 100% functional:
*   **Build**: Creates a test table `user_log` and a corresponding stream `user_log_stream`.
*   **Verify**: Inserts data to simulate business changes and queries the Stream to confirm successful capture.

**3. Final Response:**
The Agent summarizes the verified SQL and execution results, returning a reliable developer guide.

![Databend MCP Usage Example](/img/blog/202601/mcp/databend-mcp-stream-example-en.png)

<BlogSignupAD title="Need AI data operations verified without touching production?" />

## 🚀 Quick Start (Supported Clients)

Databend MCP is compatible with standard protocols and supports direct integration with mainstream AI development tools.

> ⚠️ **Prerequisite**: Please ensure [uv](https://docs.astral.sh/uv/) (Python package manager) is installed.

Simply configure the DSN to get started.

### Codex CLI

```bash
codex mcp add databend \
  --env DATABEND_DSN='databend://user:password@host:port/database?warehouse=your_warehouse' \
  -- uv tool run --from mcp-databend@latest mcp-databend
```

### Claude Code CLI

```bash
claude mcp add databend \
  --env DATABEND_DSN='databend://user:password@host:port/database?warehouse=your_warehouse' \
  -- uv tool run --from mcp-databend@latest mcp-databend
```

### Cursor

Add configuration in **Settings -> MCP**:

*   **Name**: `Databend`
*   **Command**: `uv tool run --from mcp-databend@latest mcp-databend`
*   **Env**: `DATABEND_DSN=databend://user:password@host:port/database?warehouse=your_warehouse`

## Conclusion

Through its "**Production Read-Only + Sandbox Read-Write**" architecture, Databend MCP guarantees the absolute security of production data while providing AI with the necessary experimental environment. This not only resolves data security concerns but also truly empowers AI to build reliable Data Pipelines.

---

*   GitHub: [databendlabs/mcp-databend](https://github.com/databendlabs/mcp-databend)
*   Docs: [Connect AI Agents](https://www.databend.com/mcp/)