warehouse-mcp

Production MCP server for Postgres, Oracle, Snowflake, BigQuery, Redshift, DuckDB, MotherDuck.

stdiocommunityapplication

Package Details

warehouse-mcp

0.3.4•https://www.npmjs.com/package/warehouse-mcp

Transportstdio

Runtime Arguments

Positional

Position 0Required

startBoots the MCP server. Use 'init' for interactive setup or 'doctor' to diagnose configuration.

Environment Variables

MCP_TRANSPORT

Default:stdio

Set to 'stdio' for desktop AI clients (Claude Desktop, Cursor). Defaults to 'http'.

WAREHOUSE_TYPE(str)

Required

Which warehouse to connect to. One of: postgres, oracle, redshift, snowflake, bigquery, duckdb. (DuckDB also handles MotherDuck via DUCKDB_PATH=md:<db>.)

MCP_API_KEYS(str)

Secret

Comma-separated bearer keys with role and optional warehouse-role impersonation: 'key1:reader,key2:admin', 'key3:reader:set_role=alice'. Leave empty for stdio (OS process boundary is the trust boundary). Required for HTTP.

DUCKDB_PATH(str)

DuckDB file path, ':memory:', or 'md:<database>' for MotherDuck. Required when WAREHOUSE_TYPE=duckdb.

MOTHERDUCK_TOKEN(str)

Secret

MotherDuck service token. Required when DUCKDB_PATH starts with 'md:'.

PG_HOST

Postgres host. Required when WAREHOUSE_TYPE=postgres. (Use REDSHIFT_HOST for Redshift.)

PG_DATABASE

Postgres database name.

PG_USER

Postgres user.

PG_PASSWORD

Secret

Postgres password.

ORACLE_USER

Oracle user. Required when WAREHOUSE_TYPE=oracle.

ORACLE_PASSWORD

Secret

Oracle password.

ORACLE_CONNECT_STRING

Oracle Easy Connect (e.g. host:1521/SERVICE), TNS descriptor, or alias.

SNOWFLAKE_ACCOUNT

Snowflake account identifier (e.g. xy12345.us-east-1). Required when WAREHOUSE_TYPE=snowflake.

SNOWFLAKE_USER

Snowflake username.

SNOWFLAKE_PRIVATE_KEY_PATH

Path to PKCS8 private key (.p8). Snowflake auth is key-pair only; password auth is not supported.

BIGQUERY_PROJECT

GCP project id. Required when WAREHOUSE_TYPE=bigquery.

GOOGLE_APPLICATION_CREDENTIALS

Path to BigQuery service-account JSON. Omit on GKE / Cloud Run with workload identity.

GUARDRAIL_PII_MASK

Default:off

Set to 'on' to enable role-aware PII masking on result rows (emails, SSNs, phones, IPs, Luhn-validated CCs). Off by default.

MCP_RATE_LIMIT_RPM

Default:0

Per-principal token-bucket rate limit on tool invocations. 0 = disabled. Recommend 60 for production.