io.github.kalehdoo/warehouse-mcp MCP Server

io.github.kalehdoo/warehouse-mcp

Repository Registry

What is the io.github.kalehdoo/warehouse-mcp MCP server?

Production MCP server for Postgres, Oracle, Snowflake, BigQuery, Redshift, DuckDB, MotherDuck.

How to install io.github.kalehdoo/warehouse-mcp

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

MCP_TRANSPORT
Set to 'stdio' for desktop AI clients (Claude Desktop, Cursor). Defaults to 'http'.
WAREHOUSE_TYPE
required
Which warehouse to connect to. One of: postgres, oracle, redshift, snowflake, bigquery, duckdb. (DuckDB also handles MotherDuck via DUCKDB_PATH=md:<db>.)
MCP_API_KEYS
secret
Comma-separated bearer keys with role and optional warehouse-role impersonation: 'key1:reader,key2:admin', 'key3:reader:set_role=alice'. Leave empty for stdio (OS process boundary is the trust boundary). Required for HTTP.
DUCKDB_PATH
DuckDB file path, ':memory:', or 'md:<database>' for MotherDuck. Required when WAREHOUSE_TYPE=duckdb.
MOTHERDUCK_TOKEN
secret
MotherDuck service token. Required when DUCKDB_PATH starts with 'md:'.
PG_HOST
Postgres host. Required when WAREHOUSE_TYPE=postgres. (Use REDSHIFT_HOST for Redshift.)
PG_DATABASE
Postgres database name.
PG_USER
Postgres user.
PG_PASSWORD
secret
Postgres password.
ORACLE_USER
Oracle user. Required when WAREHOUSE_TYPE=oracle.
ORACLE_PASSWORD
secret
Oracle password.
ORACLE_CONNECT_STRING
Oracle Easy Connect (e.g. host:1521/SERVICE), TNS descriptor, or alias.
SNOWFLAKE_ACCOUNT
Snowflake account identifier (e.g. xy12345.us-east-1). Required when WAREHOUSE_TYPE=snowflake.
SNOWFLAKE_USER
Snowflake username.
SNOWFLAKE_PRIVATE_KEY_PATH
Path to PKCS8 private key (.p8). Snowflake auth is key-pair only; password auth is not supported.
BIGQUERY_PROJECT
GCP project id. Required when WAREHOUSE_TYPE=bigquery.
GOOGLE_APPLICATION_CREDENTIALS
Path to BigQuery service-account JSON. Omit on GKE / Cloud Run with workload identity.
GUARDRAIL_PII_MASK
Set to 'on' to enable role-aware PII masking on result rows (emails, SSNs, phones, IPs, Luhn-validated CCs). Off by default.
MCP_RATE_LIMIT_RPM
Per-principal token-bucket rate limit on tool invocations. 0 = disabled. Recommend 60 for production.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "warehouse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "warehouse-mcp",
        "start"
      ],
      "env": {
        "MCP_TRANSPORT": "<YOUR_MCP_TRANSPORT>",
        "WAREHOUSE_TYPE": "<YOUR_WAREHOUSE_TYPE>",
        "MCP_API_KEYS": "<YOUR_MCP_API_KEYS>",
        "DUCKDB_PATH": "<YOUR_DUCKDB_PATH>",
        "MOTHERDUCK_TOKEN": "<YOUR_MOTHERDUCK_TOKEN>",
        "PG_HOST": "<YOUR_PG_HOST>",
        "PG_DATABASE": "<YOUR_PG_DATABASE>",
        "PG_USER": "<YOUR_PG_USER>",
        "PG_PASSWORD": "<YOUR_PG_PASSWORD>",
        "ORACLE_USER": "<YOUR_ORACLE_USER>",
        "ORACLE_PASSWORD": "<YOUR_ORACLE_PASSWORD>",
        "ORACLE_CONNECT_STRING": "<YOUR_ORACLE_CONNECT_STRING>",
        "SNOWFLAKE_ACCOUNT": "<YOUR_SNOWFLAKE_ACCOUNT>",
        "SNOWFLAKE_USER": "<YOUR_SNOWFLAKE_USER>",
        "SNOWFLAKE_PRIVATE_KEY_PATH": "<YOUR_SNOWFLAKE_PRIVATE_KEY_PATH>",
        "BIGQUERY_PROJECT": "<YOUR_BIGQUERY_PROJECT>",
        "GOOGLE_APPLICATION_CREDENTIALS": "<YOUR_GOOGLE_APPLICATION_CREDENTIALS>",
        "GUARDRAIL_PII_MASK": "<YOUR_GUARDRAIL_PII_MASK>",
        "MCP_RATE_LIMIT_RPM": "<YOUR_MCP_RATE_LIMIT_RPM>"
      }
    }
  }
}