{"name":"com.googleapis.sqladmin/mcp","slug":"sqladmin-mcp","title":null,"description":"Create, manage, and query your Google Cloud SQL resources.","url":"https://mcp.market/server/sqladmin-mcp","rating":null,"grade":"C","score":55,"certified":false,"status":"active","category":"data","tags":["data"],"presence":{"score":5,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-10-13T03:21:18.865Z","last_ok_at":"2026-10-13T03:21:18.865Z","latency_ms":70},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":null,"version":"1.0.0","remotes":[{"type":"streamable-http","url":"https://sqladmin.googleapis.com/mcp"}],"packages":[],"tools":[{"name":"clone_instance","description":"Create a Cloud SQL instance as a clone of a source instance.\n\n* This tool returns a long-running operation. Use the `get_operation` tool to poll its\n  status until the operation completes.\n* The clone operation can take several minutes. Use a command line tool to pause for 30\n  seconds before rechecking the status.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/InstancesCloneRequest"},"instance":{"description":"Required. The ID of the Cloud SQL instance to be cloned (source). This does not include the project ID.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"project":{"description":"Required. Project ID of the source Cloud SQL instance.","type":"string"}},"required":["instance","project","body"],"$defs":{"BinLogCoordinates":{"description":"Binary log coordinates.","properties":{"binLogFileName":{"description":"Name of the binary log file for a Cloud SQL instance.","type":"string"},"binLogPosition":{"description":"Position (offset) within the binary log file.","format":"int64","type":"string"},"kind":{"description":"This is always `sql#binLogCoordinates`.","type":"string"}},"type":"object"},"CloneContext":{"description":"Database instance clone context.","properties":{"allocatedIpRange":{"description":"The name of the allocated ip range for the private ip Cloud SQL instance. For example: \"google-managed-services-default\". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. Reserved for future use.","type":"string"},"binLogCoordinates":{"$ref":"#/$defs/BinLogCoordinates","description":"Binary log coordinates, if specified, identify the position up to which the source instance is cloned. If not specified, the source instance is cloned up to the most recent binary log coordinates."},"databaseNames":{"description":"(SQL Server only) Clone only the specified databases from the source instance. Clone all databases if empty.","items":{"type":"string"},"type":"array"},"destinationInstanceName":{"description":"Required. Name of the Cloud SQL instance to be created as a clone.","type":"string"},"destinationNetwork":{"description":"Optional. The fully qualified URI of the VPC network to which the cloned instance will be connected via private services access for private IP. For example:`projects/my-network-project/global/networks/my-network`. This field is only required for cross-project cloning.","type":"string"},"destinationProject":{"description":"Optional. The project ID of the destination project where the cloned instance will be created. To perform a cross-project clone, this field is required. If not specified, the clone is created in the same project as the source instance.","type":"string"},"kind":{"description":"This is always `sql#cloneContext`.","type":"string"},"pitrTimestampMs":{"description":"Reserved for future use.","format":"int64","type":"string"},"pointInTime":{"description":"Timestamp, if specified, identifies the time to which the source instance is cloned.","format":"date-time","type":"string"},"preferredSecondaryZone":{"description":"Optional. Copy clone and point-in-time recovery clone of a regional instance in the specified zones. If not specified, clone to the same secondary zone as the source instance. This value cannot be the same as the preferred_zone field. This field applies to all DB types.","type":"string"},"preferredZone":{"description":"Optional. Copy clone and point-in-time recovery clone of an instance to the specified zone. If no zone is specified, clone to the same primary zone as the source instance. This field applies to all DB types.","type":"string"},"sourceInstanceDeletionTime":{"description":"The timestamp used to identify the time when the source instance is deleted. If this instance is deleted, then you must set the timestamp.","format":"date-time","type":"string"}},"required":["destinationInstanceName"],"type":"object"},"InstancesCloneRequest":{"description":"Database instance clone request.","properties":{"cloneContext":{"$ref":"#/$defs/CloneContext","description":"Required. Contains details about the clone operation."}},"required":["cloneContext"],"type":"object"}},"description":"Instance clone request."}},{"name":"create_backup","description":"Takes a backup on a Cloud SQL instance. Always populate the project and instance fields on\nthe request. The location (region) and description of the backup may also be optionally\nprovided, in which case the corresponding request fields should also be populated.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"description":{"description":"Optional. The description of this backup run.","type":"string"},"instance":{"description":"Required. Cloud SQL instance ID. This does not include the project ID.","type":"string"},"location":{"description":"Optional. Location of the backup run.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"}},"required":["instance","project"],"description":"Backup runs insert request for MCP."}},{"name":"create_instance","description":"Initiates the creation of a Cloud SQL instance.\n\n* The tool returns a long-running operation. Use the `get_operation` tool to poll its status\n  until the operation completes.\n* The instance creation operation can take several minutes. Use a command line tool to pause\n  for 30 seconds before rechecking the status.\n* After you use the `create_instance` tool to create an instance,\n  you can use the `create_user` tool to create an\n  IAM user account for the user currently logged in to the project.\n* IMPORTANT: Set `ipv4_enabled` to 'false' if creating a Private Service Connect\n  or a Private Service Access instance.\n* Set `free_trial` to 'true' to create a free trial instance. Free trial instances\n  let you test majority of Cloud SQL features for up to 30 days without financial\n  commitment. Subject to eligibility and availability.\n\n* The value of `data_api_access` is set to `ALLOW_DATA_API` by default. This setting\n  lets you execute SQL statements using the `execute_sql` tool and the `executeSql` API.\n\n  Unless otherwise specified, a newly created instance uses the default\n  instance configuration of a development environment.\n\n  The following is the default configuration for an instance in a\n  development environment:\n\n```\n{\n  \"tier\": \"db-perf-optimized-N-2\",\n  \"data_disk_size_gb\": 100,\n  \"region\": \"us-central1\",\n  \"database_version\": \"POSTGRES_18\",\n  \"edition\": \"ENTERPRISE_PLUS\",\n  \"availability_type\": \"ZONAL\",\n  \"tags\": [{\"environment\": \"dev\"}]\n}\n```\n\nThe following configuration is recommended for an instance in a\nproduction environment:\n\n```\n{\n  \"tier\": \"db-perf-optimized-N-8\",\n  \"data_disk_size_gb\": 250,\n  \"region\": \"us-central1\",\n  \"database_version\": \"POSTGRES_18\",\n  \"edition\": \"ENTERPRISE_PLUS\",\n  \"availability_type\": \"REGIONAL\",\n  \"tags\": [{\"environment\": \"prod\"}]\n}\n```\n\nThe following instance configuration is recommended for SQL Server:\n\n```\n{\n  \"tier\": \"db-perf-optimized-N-8\",\n  \"data_disk_size_gb\": 250,\n  \"region\": \"us-central1\",\n  \"database_version\": \"SQLSERVER_2022_STANDARD\",\n  \"edition\": \"ENTERPRISE\",\n  \"availability_type\": \"REGIONAL\",\n  \"tags\": [{\"environment\": \"prod\"}]\n}\n```\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"availabilityType":{"description":"Optional. Availability type. Potential values: * `ZONAL`: The instance serves data from only one zone. Outages in that zone affect data accessibility. This is the default value. * `REGIONAL`: The instance can serve data from more than one zone in a region (it is highly available).","type":"string"},"dataCacheEnabled":{"description":"Optional. Whether data cache is enabled for the instance.","type":"boolean"},"dataDiskSizeGb":{"description":"Optional. Data disk size in GB. Default value is 100.","format":"int64","type":"string"},"databaseVersion":{"description":"Optional. The database engine type and version. The default value is `POSTGRES_18`. For Mysql, it can be `MYSQL_8_4`, `MYSQL_8_0`, `MYSQL_5_7`, etc. For Postgres, it can be `POSTGRES_18`, `POSTGRES_17`, `POSTGRES_16`, etc. For SQL Server, it can be SQLSERVER_2022_STANDARD, SQLSERVER_2022_EXPRESS, SQLSERVER_2022_ENTERPRISE, etc.","type":"string"},"edition":{"description":"Optional. The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS. If not specified: - For Postgres and Mysql, the default value is ENTERPRISE_PLUS. - For SQL Server, the default value is ENTERPRISE.","type":"string"},"enableGoogleMlIntegration":{"description":"Optional. When this parameter is set to true, Cloud SQL instances can connect to Vertex AI to pass requests for real-time predictions and insights to the AI. The default value is false. This applies only to Cloud SQL for MySQL and Cloud SQL for PostgreSQL instances.","type":"boolean"},"freeTrial":{"description":"Optional. Whether the instance is a free trial instance. If true, the instance will be created with a free trial configuration.","type":"boolean"},"ipv4Enabled":{"description":"Optional. Whether to enable public IP for the instance. Enabling this flag makes the resource accessible from the public internet, which is a security risk if not properly managed. It is recommended to keep resources private whenever possible. This field defaults to 'false' if either `psc_mcp_config` or `psa_mcp_config` is set, or creating a Private Service Connect (PSC) or Private Service Access (PSA) instance.","type":"boolean"},"name":{"description":"Required. Name of the Cloud SQL instance. This does not include the project ID.","type":"string"},"project":{"description":"Required. Project ID of the project to which the newly created Cloud SQL instances should belong.","type":"string"},"psaMcpConfig":{"$ref":"#/$defs/PsaMcpConfig","description":"Optional. Use this to connect to the Cloud SQL instance using Private Service Access."},"pscMcpConfig":{"$ref":"#/$defs/PscMcpConfig","description":"Optional. Configuration for Private Service Connect (PSC) instance creation."},"region":{"description":"Optional. The geographical region of the Cloud SQL instance. For example, `us-central1`, `europe-west1`, and `asia-east1`. If not specified, the default value is `us-central1`.","type":"string"},"tags":{"additionalProperties":{"type":"string"},"description":"Optional. Input only. Tag keys and tag values that are bound to this instance. You must represent each item in the map as: `\"\" : \"\"`. For example, a single resource can have the following tags: ``` \"environment\": \"prod\", ```","type":"object","writeOnly":true},"tier":{"description":"Optional. The tier (or machine type) for this instance. If not specified: - For `ENTERPRISE_PLUS` edition, the default tier is `db-perf-optimized-N-2`, which gives you 2 vCPUs and 16 GB of RAM. - For `ENTERPRISE` edition, the default tier is `db-custom-2-3840`, which gives you 2 vCPUs and 3.75 GB of RAM. ENTERPRISE_PLUS edition needs to use N2 machine series. ENTERPRISE edition can use custom machine type names use the following format: db-custom-{CPUs}-{Memory}.","type":"string"}},"required":["project","name"],"$defs":{"PsaMcpConfig":{"description":"Configuration for creating a Cloud SQL instance with Private Service Access.","properties":{"allocatedIpRange":{"description":"Optional: The name of an allocated IP range in the consumer VPC.","type":"string"},"network":{"description":"Required. The full resource name of the VPC network to connect to via PSA. Format: projects/{project}/global/networks/{network} REQUIRED if enabling PSA.","type":"string"}},"required":["network"],"type":"object"},"PscMcpConfig":{"description":"Configuration for Private Service Connect (PSC) endpoint creation for MCP. psc_enabled is the only field needed for instance creation with Private Service Connect enabled. Other optional fields will be added later.","properties":{"network":{"description":"Optional. The consumer network of this consumer endpoint. This must be a resource path that includes both the host project and the network name. For example, `projects/project1/global/networks/network1`. The consumer host project of this network might be different from the consumer service project.","type":"string"},"project":{"description":"Optional. The project ID of the service project of this PSC consumer endpoint. This is only applicable if `network` is a shared VPC network.","type":"string"},"pscEnabled":{"description":"Optional. Whether PSC connectivity is enabled for this instance.","type":"boolean"}},"type":"object"}},"description":"Instance insert request for MCP."}},{"name":"create_user","description":"Create a database user for a Cloud SQL instance.\n\n* This tool returns a long-running operation. Use the `get_operation` tool to poll\n  its status until the operation completes.\n* When you use the `create_user` tool, specify the type of user:\n `CLOUD_IAM_USER`, `CLOUD_IAM_SERVICE_ACCOUNT`, or `BUILT_IN`.\n* By default the newly created user is assigned the `cloudsqlsuperuser` role, unless\n  you specify other database roles explicitly in the request.\n* You can use a newly created user with the `execute_sql` tool if the user is a\n  currently logged in IAM user. The `execute_sql` tool executes the SQL statements\n  using the privileges of the database user logged in using IAM database\n  authentication.\n\nThe `create_user` tool has the following limitations:\n\n* To create a built-in user with password, use the `password_secret_version` field to provide password using the\n  Google Cloud Secret Manager. The value of `password_secret_version` should be the resource name of\n  the secret version, like `projects/12345/locations/us-central1/secrets/my-password-secret/versions/1` or\n  `projects/12345/locations/us-central1/secrets/my-password-secret/versions/latest`. The caller needs to have\n  `secretmanager.secretVersions.access` permission on the secret version.\n* The `create_user` tool doesn't support creating a user for SQL Server.\n\nTo create an IAM user in PostgreSQL:\n\n* The database username must be the IAM user's email address and all lowercase.\n  For example, to create user for PostgreSQL IAM user `example-user@example.com`,\n  you can use the following request:\n\n```\n{\n  \"name\": \"example-user@example.com\",\n  \"type\": \"CLOUD_IAM_USER\",\n  \"instance\":\"test-instance\",\n  \"project\": \"test-project\"\n}\n```\n\nThe created database username for the IAM user is `example-user@example.com`.\n\nTo create an IAM service account in PostgreSQL:\n\n* The database username must be created without the `.gserviceaccount.com` suffix even though\n  the full email address for the account is`service-account-name@project-id.iam.gserviceaccount.com`.\n  For example, to create an IAM service account for PostgreSQL you can use the following request\n  format:\n\n```\n{\n   \"name\": \"test@test-project.iam\",\n   \"type\": \"CLOUD_IAM_SERVICE_ACCOUNT\",\n   \"instance\": \"test-instance\",\n   \"project\": \"test-project\"\n}\n```\n\nThe created database username for the IAM service account is `test@test-project.iam`.\n\nTo create an IAM user or IAM service account in MySQL:\n\n* When Cloud SQL for MySQL stores a username, it truncates the @ and the domain name from\n  the user or service account's email address.\n  For example, `example-user@example.com` becomes `example-user`.\n* For this reason, you can't add two IAM users or service accounts\n with the same username but different domain names to the same Cloud SQL instance.\n* For example, to create user for the MySQL IAM user `example-user@example.com`,\n  use the following request:\n\n```\n{\n   \"name\": \"example-user@example.com\",\n   \"type\": \"CLOUD_IAM_USER\",\n   \"instance\": \"test-instance\",\n   \"project\": \"test-project\"\n}\n```\n\nThe created database username for the IAM user is `example-user`.\n\n* For example, to create the MySQL IAM service account\n`service-account-name@project-id.iam.gserviceaccount.com`, use the\nfollowing request:\n\n```\n{\n   \"name\": \"service-account-name@project-id.iam.gserviceaccount.com\",\n   \"type\": \"CLOUD_IAM_SERVICE_ACCOUNT\",\n   \"instance\": \"test-instance\",\n   \"project\": \"test-project\"\n}\n```\n\nThe created database username for the IAM service account is\n`service-account-name`.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"databaseRoles":{"description":"Optional. Role memberships of the user. Default value is [cloudsqlsuperuser].","items":{"type":"string"},"type":"array"},"instance":{"description":"Required. Database instance ID. This does not include the project ID.","type":"string"},"name":{"description":"Required. The name of the user in the Cloud SQL instance.","type":"string"},"passwordSecretVersion":{"description":"Optional. Input only. The resource name of the Secret Manager secret holding the password for the user, only needed if `type` is `BUILT_IN`. The expected format is `projects/{project}/secrets/{secret}/versions/{secret_version}`. The secret resource name will not be stored.","type":"string","writeOnly":true},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"},"type":{"description":"Required. The user type. It determines the method to authenticate the user during login. Use type CLOUD_IAM_USER when authenticating with a Cloud IAM user. Use type CLOUD_IAM_SERVICE_ACCOUNT when authenticating with a Cloud IAM service account.","enum":["BUILT_IN","CLOUD_IAM_USER","CLOUD_IAM_SERVICE_ACCOUNT","CLOUD_IAM_GROUP","CLOUD_IAM_GROUP_USER","CLOUD_IAM_GROUP_SERVICE_ACCOUNT","CLOUD_IAM_WORKFORCE_IDENTITY","ENTRAID_USER"],"type":"string","x-google-enum-descriptions":["The database's built-in user type.","Cloud IAM user.","Cloud IAM service account.","Cloud IAM group. Not used for login.","Read-only. Login for a user that belongs to the Cloud IAM group.","Read-only. Login for a service account that belongs to the Cloud IAM group.","Cloud IAM workforce identity managed by Workforce Identity Federation.","Microsoft Entra ID user."]}},"required":["project","instance","type","name"],"description":"User insert request for MCP."}},{"name":"execute_sql","description":"Execute any valid SQL statement, including data definition language (DDL),\ndata control language (DCL), data query language (DQL), or\ndata manipulation language (DML) statements, on a Cloud SQL instance.\n\nTo support the `execute_sql` tool, a Cloud SQL instance must meet\nthe following requirements:\n\n* The value of `data_api_access` must be set to `ALLOW_DATA_API`.\n* For built_in users password_secret_version must be set.\n* Otherwise, for IAM users, for a MySQL instance, the database flag\n  `cloudsql_iam_authentication` must be set to `on`.\n  For a PostgreSQL instance, the database flag `cloudsql.iam_authentication` must be set\n  to `on`.\n* After you use the `create_instance` tool to create an instance,\n  you can use the `create_user` tool to create an\n  IAM user account for the user currently logged in to the project.\n\n  The `execute_sql` tool has the following limitations:\n\n* If a SQL statement returns a response larger than 10 MB,\n  then the response will be truncated.\n* The `execute_sql` tool has a default timeout of 30 seconds.\n  If a query runs longer than 30 seconds, then the tool returns a\n `DEADLINE_EXCEEDED` error.\n\n If you receive errors similar to \"IAM authentication is not enabled for the instance\",\n then you can use the `get_instance` tool to check the value of the IAM\n database authentication flag for the instance.\n\n If you receive errors like \"The instance doesn't allow using executeSql to access this\n instance\", then you can use `get_instance` tool to check the `data_api_access` setting.\n\n When you receive authentication errors:\n\n 1. Check if the currently logged-in user account exists as an IAM user on the\n    instance using the `list_users` tool.\n 2. If the IAM user account doesn't exist, then use the `create_user` tool to\n    create the IAM user account for the logged-in user.\n 3. If the currently logged in user doesn't have the proper database user roles, then\n    you can use `update_user` tool to grant database roles to the user. For example,\n    `cloudsqlsuperuser` role can provide an IAM user with many required permissions.\n 4. Check if the currently logged in user has the correct IAM permissions assigned for\n    the project. You can use `gcloud projects get-iam-policy [PROJECT_ID]` command to\n    check if the user has the proper IAM roles or permissions assigned for the project.\n\n     * The user must have `cloudsql.instance.login` permission to do automatic IAM database\n       authentication.\n     * The user must have `cloudsql.instances.executeSql` permission to execute SQL statements\n       using the `execute_sql` tool or `executeSql` API.\n    *  Common IAM roles that contain the required permissions: Cloud SQL Instance User\n      (`roles/cloudsql.instanceUser`) or Cloud SQL Admin (`roles/cloudsql.admin`)\n\nWhen receiving an `ExecuteSqlResponse`, always check the `message` and `status` fields\nwithin the response body. A successful HTTP status code doesn't guarantee full success of\nall SQL statements.\nThe `message` and `status` fields will indicate if there were any partial errors or\nwarnings during SQL statement execution.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"database":{"description":"Optional. Name of the database on which the statement will be executed. For Postgres it's required, for MySQL it's optional. For Postgres, if your query is not scoped to an existings database, like list databases / create new database / grant roles, you can pass in default value as postgres.","type":"string"},"instance":{"description":"Required. Database instance ID. This does not include the project ID.","type":"string"},"passwordSecretVersion":{"description":"Optional. The resource name of the Secret Manager secret holding the password for the user to log into the database. The secret should be created using the regional endpoint (for API) or from the Regional Secrets page (for UI), and stored in the same region as the Cloud SQL instance. The expected resource name format is `projects/{project}/locations/{location}/secrets/{secret}/versions/{secret_version}`. This field is used together with the `user` field. When not both are set, the API caller's identity is used for database authentication. The secret resource name will not be stored.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"},"sqlCommenterEnabled":{"description":"Optional. If set to true, enables sqlcommenter-style tagging. Automatically collects and populates mcp.server, mcp.tool, mcp.client, and user.identity. See https://google.github.io/sqlcommenter/ for detail about sqlcommenter.","type":"boolean"},"sqlStatement":{"description":"Required. SQL statements to run on the database. It can be a single statement or a sequence of statements separated by semicolons.","type":"string"},"user":{"description":"Optional. The name of an existing database user to connect to the database. This field is used together with the `password_secret_version` field. When not both are set, the API caller's identity is used for database authentication.","type":"string"}},"required":["instance","project","sqlStatement"],"description":"Instance execute sql request for MCP."}},{"name":"execute_sql_readonly","description":"Execute any valid read only SQL statement on a Cloud SQL instance.\n\nTo support the `execute_sql_readonly` tool, a Cloud SQL instance must meet\nthe following requirements:\n\n* The value of `data_api_access` must be set to `ALLOW_DATA_API`.\n* For a MySQL instance, the database flag `cloudsql_iam_authentication` must be set to `on`.\n  For a PostgreSQL instance, the database flag `cloudsql.iam_authentication` must be set\n  to `on`.\n* An IAM user account or IAM service account (`CLOUD_IAM_USER` or `CLOUD_IAM_SERVICE_ACCOUNT`)\n  is required to call the `execute_sql_readonly` tool.\n  The tool executes the SQL statements using the privileges of the database user\n  logged with IAM database authentication.\n\n  After you use the `create_instance` tool to create an instance,\n  you can use the `create_user` tool to create an\n  IAM user account for the user currently logged in to the project.\n\n  The `execute_sql_readonly` tool has the following limitations:\n\n* If a SQL statement returns a response larger than 10 MB,\n  then the response will be truncated.\n* The tool has a default timeout of 30 seconds.\n  If a query runs longer than 30 seconds, then the tool returns a\n `DEADLINE_EXCEEDED` error.\n\n If you receive errors similar to \"IAM authentication is not enabled for the instance\",\n then you can use the `get_instance` tool to check the value of the IAM\n database authentication flag for the instance.\n\n If you receive errors like \"The instance doesn't allow using executeSql to access this\n instance\", then you can use `get_instance` tool to check the `data_api_access` setting.\n\n When you receive authentication errors:\n\n 1. Check if the currently logged-in user account exists as an IAM user on the\n    instance using the `list_users` tool.\n 2. If the IAM user account doesn't exist, then use the `create_user` tool to\n    create the IAM user account for the logged-in user.\n 3. If the currently logged in user doesn't have the proper database user roles, then\n    you can use `update_user` tool to grant database roles to the user. For example,\n    `cloudsqlsuperuser` role can provide an IAM user with many required permissions.\n 4. Check if the currently logged in user has the correct IAM permissions assigned for\n    the project. You can use `gcloud projects get-iam-policy [PROJECT_ID]` command to\n    check if the user has the proper IAM roles or permissions assigned for the project.\n\n     * The user must have `cloudsql.instance.login` permission to do automatic IAM database\n       authentication.\n     * The user must have `cloudsql.instances.executeSql` permission to execute SQL statements\n       using the `execute_sql_readonly` tool or `executeSql` API.\n    *  Common IAM roles that contain the required permissions: Cloud SQL Instance User\n      (`roles/cloudsql.instanceUser`) or Cloud SQL Admin (`roles/cloudsql.admin`)\n\nWhen receiving an `ExecuteSqlResponse`, always check the `message` and `status` fields\nwithin the response body. A successful HTTP status code doesn't guarantee full success of\nall SQL statements.\nThe `message` and `status` fields will indicate if there were any partial errors or\nwarnings during SQL statement execution.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"database":{"description":"Optional. Name of the database on which the statement will be executed. For Postgres it's required, for MySQL it's optional. For Postgres, if your query is not scoped to an existings database, like list databases / create new database / grant roles, you can pass in default value as postgres.","type":"string"},"instance":{"description":"Required. Database instance ID. This does not include the project ID.","type":"string"},"passwordSecretVersion":{"description":"Optional. The resource name of the Secret Manager secret holding the password for the user to log into the database. The secret should be created using the regional endpoint (for API) or from the Regional Secrets page (for UI), and stored in the same region as the Cloud SQL instance. The expected resource name format is `projects/{project}/locations/{location}/secrets/{secret}/versions/{secret_version}`. This field is used together with the `user` field. When not both are set, the API caller's identity is used for database authentication. The secret resource name will not be stored.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"},"sqlCommenterEnabled":{"description":"Optional. If set to true, enables sqlcommenter-style tagging. Automatically collects and populates mcp.server, mcp.tool, mcp.client, and user.identity. See https://google.github.io/sqlcommenter/ for detail about sqlcommenter.","type":"boolean"},"sqlStatement":{"description":"Required. SQL statements to run on the database. It can be a single statement or a sequence of statements separated by semicolons.","type":"string"},"user":{"description":"Optional. The name of an existing database user to connect to the database. This field is used together with the `password_secret_version` field. When not both are set, the API caller's identity is used for database authentication.","type":"string"}},"required":["instance","project","sqlStatement"],"description":"Instance execute sql request for MCP."}},{"name":"get_instance","description":"Get the details of a Cloud SQL instance.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"instance":{"description":"Required. Database instance ID. This does not include the project ID.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"}},"required":["instance","project"],"description":"Instance get request."}},{"name":"get_operation","description":"Get the status of a long-running operation. A long-running operation can take several\nminutes to complete. If an operation takes an extended amount of time, then use a command\nline tool to pause for 30 seconds before rechecking the status of the operation.\n","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"operation":{"description":"Required. Instance operation ID.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"}},"required":["operation","project"],"description":"Operations get request."}},{"name":"import_data","description":"Import data into a Cloud SQL instance.\n\nIf the file doesn't start with `gs://`, then the assumption is that the file is stored\nlocally. If the file is local, then the file must be uploaded to Cloud Storage\nbefore you can make the actual `import_data` call. To upload the file to Cloud Storage,\nyou can use the `gcloud` or `gsutil` commands.\n\nBefore you upload the file to Cloud Storage, consider whether you want to use an existing\nbucket or create a new bucket in the provided project.\n\nAfter the file is uploaded to Cloud Storage, the instance service account must have\nsufficient permissions to read the uploaded file from the Cloud Storage bucket.\n\nThis can be accomplished as follows:\n\n1. Use the `get_instance` tool to get the email address of the instance service account.\n   From the output of the tool, get the value of the `serviceAccountEmailAddress` field.\n2. Grant the instance service account the `storage.objectAdmin` role on the\n   provided Cloud Storage bucket. Use a command like `gcloud storage buckets\n   add-iam-policy-binding` or a request to the Cloud Storage API. It can take from\n   two to up to seven minutes or more for the role to be granted and the permissions to be\n   propagated to the service account in Cloud Storage. If you encounter a permissions error\n   after updatingthe IAM policy, then wait a few minutes and try again.\n\nAfter permissions are granted, you can import the data. We recommend that you leave optional\nparameters empty and use the system defaults. The file type can typically be determined by\nthe file extension. For example, if the file is a SQL file, `.sql` or `.csv` for CSV file.\n\nThe following is a sample SQL `importContext` for MySQL.\n\n```\n{\n  \"uri\": \"gs://sample-gcs-bucket/sample-file.sql\",\n  \"kind\": \"sql#importContext\",\n  \"fileType\": \"SQL\"\n}\n```\n\nThere is no `database` parameter present for MySQL since the database name is\nexpected to be present in the SQL file. Specify only one URI.\nNo other fields are required outside of `importContext`.\n\nFor PostgreSQL, the `database` field is required. The following is a sample\nPostgreSQL `importContext` with the `database` field specified.\n\n```\n{\n  \"uri\": \"gs://sample-gcs-bucket/sample-file.sql\",\n  \"kind\": \"sql#importContext\",\n  \"fileType\": \"SQL\",\n  \"database\": \"sample-db\"\n}\n```\n\nThe `import_data` tool returns a long-running operation. Use the `get_operation` tool\nto poll its status until the operation completes.\n","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/InstancesImportRequest"},"instance":{"description":"Cloud SQL instance ID. This does not include the project ID.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"project":{"description":"Project ID of the project that contains the instance.","type":"string"}},"$defs":{"EncryptionOptions":{"properties":{"certPath":{"description":"Path to the Certificate (.cer) in Cloud Storage, in the form `gs://bucketName/fileName`. The instance must have write permissions to the bucket and read access to the file.","type":"string"},"keepEncrypted":{"description":"Optional. Whether the imported file remains encrypted.","type":"boolean"},"pvkPassword":{"description":"Password that encrypts the private key","type":"string"},"pvkPath":{"description":"Path to the Certificate Private Key (.pvk) in Cloud Storage, in the form `gs://bucketName/fileName`. The instance must have write permissions to the bucket and read access to the file.","type":"string"}},"type":"object"},"ImportContext":{"description":"Database instance import context.","properties":{"bakImportOptions":{"$ref":"#/$defs/SqlBakImportOptions","description":"Import parameters specific to SQL Server .BAK files"},"csvImportOptions":{"$ref":"#/$defs/SqlCsvImportOptions","description":"Options for importing data as CSV."},"database":{"description":"The target database for the import. If `fileType` is `SQL`, this field is required only if the import file does not specify a database, and is overridden by any database specification in the import file. For entire instance parallel import operations, the database is overridden by the database name stored in subdirectory name. If `fileType` is `CSV`, one database must be specified.","type":"string"},"fileType":{"description":"The file type for the specified uri.\\`SQL`: The file contains SQL statements. \\`CSV`: The file contains CSV data.","enum":["SQL_FILE_TYPE_UNSPECIFIED","SQL","CSV","BAK","TDE"],"type":"string","x-google-enum-descriptions":["Unknown file type.","File containing SQL statements.","File in CSV format.","","TDE certificate."]},"importUser":{"description":"The PostgreSQL user for this import operation. PostgreSQL instances only.","type":"string"},"kind":{"description":"This is always `sql#importContext`.","type":"string"},"sqlImportOptions":{"$ref":"#/$defs/SqlImportOptions","description":"Optional. Options for importing data from SQL statements."},"tdeImportOptions":{"$ref":"#/$defs/SqlTdeImportOptions","description":"Optional. Import parameters specific to SQL Server TDE certificates"},"uri":{"description":"Path to the import file in Cloud Storage, in the form `gs://bucketName/fileName`. Compressed gzip files (.gz) are supported when `fileType` is `SQL`. The instance must have write permissions to the bucket and read access to the file.","type":"string"}},"type":"object"},"InstancesImportRequest":{"description":"Database instance import request.","properties":{"importContext":{"$ref":"#/$defs/ImportContext","description":"Contains details about the import operation."}},"type":"object"},"PostgresImportOptions":{"properties":{"clean":{"description":"Optional. The --clean flag for the pg_restore utility. This flag applies only if you enabled Cloud SQL to import files in parallel.","type":"boolean"},"ifExists":{"description":"Optional. The --if-exists flag for the pg_restore utility. This flag applies only if you enabled Cloud SQL to import files in parallel.","type":"boolean"}},"type":"object"},"SqlBakImportOptions":{"properties":{"bakType":{"description":"Type of the bak content, FULL or DIFF","enum":["BAK_TYPE_UNSPECIFIED","FULL","DIFF","TLOG"],"type":"string","x-google-enum-descriptions":["Default type.","Full backup.","Differential backup.","Transaction Log backup"]},"encryptionOptions":{"$ref":"#/$defs/EncryptionOptions"},"noRecovery":{"description":"Whether or not the backup importing will restore database with NORECOVERY option. Applies only to Cloud SQL for SQL Server.","type":"boolean"},"recoveryOnly":{"description":"Whether or not the backup importing request will just bring database online without downloading Bak content only one of \"no_recovery\" and \"recovery_only\" can be true otherwise error will return. Applies only to Cloud SQL for SQL Server.","type":"boolean"},"stopAt":{"description":"Optional. The timestamp when the import should stop. This timestamp is in the [RFC 3339](https://tools.ietf.org/html/rfc3339) format (for example, `2023-10-01T16:19:00.094`). This field is equivalent to the STOPAT keyword and applies to Cloud SQL for SQL Server only.","format":"date-time","type":"string"},"stopAtMark":{"description":"Optional. The marked transaction where the import should stop. This field is equivalent to the STOPATMARK keyword and applies to Cloud SQL for SQL Server only.","type":"string"},"striped":{"description":"Whether or not the backup set being restored is striped. Applies only to Cloud SQL for SQL Server.","type":"boolean"}},"type":"object"},"SqlCsvImportOptions":{"properties":{"columns":{"description":"The columns to which CSV data is imported. If not specified, all columns of the database table are loaded with CSV data.","items":{"type":"string"},"type":"array"},"escapeCharacter":{"description":"Specifies the character that should appear before a data character that needs to be escaped.","type":"string"},"fieldsTerminatedBy":{"description":"Specifies the character that separates columns within each row (line) of the file.","type":"string"},"linesTerminatedBy":{"description":"This is used to separate lines. If a line does not contain all fields, the rest of the columns are set to their default values.","type":"string"},"quoteCharacter":{"description":"Specifies the quoting character to be used when a data value is quoted.","type":"string"},"table":{"description":"The table to which CSV data is imported.","type":"string"}},"type":"object"},"SqlImportOptions":{"properties":{"parallel":{"description":"Optional. Whether or not the import should be parallel.","type":"boolean"},"postgresImportOptions":{"$ref":"#/$defs/PostgresImportOptions","description":"Optional. Options for importing from a Cloud SQL for PostgreSQL instance."},"threads":{"description":"Optional. The number of threads to use for parallel import.","format":"int32","type":"integer"}},"type":"object"},"SqlTdeImportOptions":{"properties":{"certificatePath":{"description":"Required. Path to the TDE certificate public key in the form gs://bucketName/fileName. The instance must have read access to the file. Applicable only for SQL Server instances.","type":"string"},"name":{"description":"Required. Certificate name. Applicable only for SQL Server instances.","type":"string"},"privateKeyPassword":{"description":"Required. Password that encrypts the private key.","type":"string"},"privateKeyPath":{"description":"Required. Path to the TDE certificate private key in the form gs://bucketName/fileName. The instance must have read access to the file. Applicable only for SQL Server instances.","type":"string"}},"required":["certificatePath","privateKeyPath","privateKeyPassword","name"],"type":"object"}},"description":"Instance import request."}},{"name":"list_instances","description":"List all Cloud SQL instances in the project.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"filter":{"description":"A filter expression that filters resources listed in the response. The expression is in the form of field:value. For example, 'instanceType:CLOUD_SQL_INSTANCE'. Fields can be nested as needed as per their JSON representation, such as 'settings.userLabels.auto_start:true'. Multiple filter queries are space-separated. For example. 'state:RUNNABLE instanceType:CLOUD_SQL_INSTANCE'. By default, each expression is an AND expression. However, you can include AND and OR expressions explicitly.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"maxResults":{"description":"The maximum number of instances to return. The service may return fewer than this value. If unspecified, at most 500 instances are returned. The maximum value is 1000; values above 1000 are coerced to 1000.","format":"int64","maximum":4294967295,"minimum":0,"type":"integer"},"pageToken":{"description":"A previously-returned page token representing part of the larger set of results to view.","type":"string"},"project":{"description":"Project ID of the project for which to list Cloud SQL instances.","type":"string"}},"description":"Instance list request."}},{"name":"list_users","description":"List all database users for a Cloud SQL instance.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"instance":{"description":"Database instance ID. This does not include the project ID.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"project":{"description":"Project ID of the project that contains the instance.","type":"string"}}}},{"name":"postgres_upgrade_precheck","description":"Checks if a Cloud SQL for PostgreSQL instance is ready for a major version upgrade to the\nspecified target version.\n\nThe `target_database_version` MUST be provided in the request (e.g., `POSTGRES_15`).\n\nThis tool helps identify potential issues *before*\nattempting the actual upgrade, reducing the risk of failure or downtime.\n\nThis tool is only supported for PostgreSQL primary instances and does not run on read replicas.\n\nThe precheck typically evaluates:\n\n- Database schema compatibility with the target version.\n- Cloud SQL limitations and unsupported features.\n- Instance resource constraints (e.g., number of relations).\n- Compatibility of current database settings and extensions.\n- Overall instance health and readiness.\n\nThis tool returns a long-running operation. Use the `get_operation`\ntool with the operation name returned by this call to poll its status.\n\nIMPORTANT: Once the operation status is DONE, the detailed precheck results are\navailable within the `Operation` resource. You will need to inspect\nthe response from `get_operation`. The findings are located in the\n`pre_check_major_version_upgrade_context.pre_check_response` field.\n\nThe findings are structured, indicating:\n\n  - INFO: General information.\n  - WARNING: Potential issues that don't block the upgrade but should be reviewed.\n  - ERROR: Critical issues that MUST be resolved before attempting the upgrade.\n\nEach finding should include a message and any required actions. Addressing\nany reported issues is crucial before proceeding with the major version upgrade.\nIf `pre_check_response` is empty or missing, it indicates that no issues were\nidentified during the precheck.\n\nRunning this precheck does not impact the instance's availability.\n","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"body":{"$ref":"#/$defs/InstancesPreCheckMajorVersionUpgradeRequest","description":"Required. The context for request to perform the pre-check major version upgrade operation."},"instance":{"description":"Required. Cloud SQL instance ID. This does not include the project ID.","type":"string"},"location":{"description":"Optional. Region of the Cloud SQL instance.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"}},"required":["instance","project","body"],"$defs":{"InstancesPreCheckMajorVersionUpgradeRequest":{"description":"Request for Pre-checks for MVU","properties":{"preCheckMajorVersionUpgradeContext":{"$ref":"#/$defs/PreCheckMajorVersionUpgradeContext","description":"Required. Contains details about the pre-check major version upgrade operation."}},"required":["preCheckMajorVersionUpgradeContext"],"type":"object"},"PreCheckMajorVersionUpgradeContext":{"description":"Pre-check major version upgrade context.","properties":{"kind":{"description":"Optional. This is always `sql#preCheckMajorVersionUpgradeContext`.","type":"string"},"preCheckResponse":{"description":"Output only. The responses from the precheck operation.","items":{"$ref":"#/$defs/PreCheckResponse"},"readOnly":true,"type":"array"},"targetDatabaseVersion":{"description":"Required. The target database version to upgrade to.","enum":["SQL_DATABASE_VERSION_UNSPECIFIED","MYSQL_5_1","MYSQL_5_5","MYSQL_5_6","MYSQL_5_7","MYSQL_8_0","MYSQL_8_0_18","MYSQL_8_0_26","MYSQL_8_0_27","MYSQL_8_0_28","MYSQL_8_0_29","MYSQL_8_0_30","MYSQL_8_0_31","MYSQL_8_0_32","MYSQL_8_0_33","MYSQL_8_0_34","MYSQL_8_0_35","MYSQL_8_0_36","MYSQL_8_0_37","MYSQL_8_0_39","MYSQL_8_0_40","MYSQL_8_0_41","MYSQL_8_0_42","MYSQL_8_0_43","MYSQL_8_0_44","MYSQL_8_0_45","MYSQL_8_0_46","MYSQL_8_4","MYSQL_9_7","SQLSERVER_2017_STANDARD","SQLSERVER_2017_ENTERPRISE","SQLSERVER_2017_EXPRESS","SQLSERVER_2017_WEB","POSTGRES_9_6","POSTGRES_10","POSTGRES_11","POSTGRES_12","POSTGRES_13","POSTGRES_14","POSTGRES_15","POSTGRES_16","POSTGRES_17","POSTGRES_18","POSTGRES_19","POSTGRES_20","SQLSERVER_2019_STANDARD","SQLSERVER_2019_ENTERPRISE","SQLSERVER_2019_EXPRESS","SQLSERVER_2019_WEB","SQLSERVER_2022_STANDARD","SQLSERVER_2022_ENTERPRISE","SQLSERVER_2022_EXPRESS","SQLSERVER_2022_WEB","SQLSERVER_2025_STANDARD","SQLSERVER_2025_ENTERPRISE","SQLSERVER_2025_EXPRESS"],"type":"string","x-google-enum-deprecated":[false,true,true,false,false,false,false,false,false,false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false],"x-google-enum-descriptions":["This is an unknown database version.","The database version is MySQL 5.1.","The database version is MySQL 5.5.","The database version is MySQL 5.6.","The database version is MySQL 5.7.","The database version is MySQL 8.","The database major version is MySQL 8.0 and the minor version is 18.","The database major version is MySQL 8.0 and the minor version is 26.","The database major version is MySQL 8.0 and the minor version is 27.","The database major version is MySQL 8.0 and the minor version is 28.","The database major version is MySQL 8.0 and the minor version is 29.","The database major version is MySQL 8.0 and the minor version is 30.","The database major version is MySQL 8.0 and the minor version is 31.","The database major version is MySQL 8.0 and the minor version is 32.","The database major version is MySQL 8.0 and the minor version is 33.","The database major version is MySQL 8.0 and the minor version is 34.","The database major version is MySQL 8.0 and the minor version is 35.","The database major version is MySQL 8.0 and the minor version is 36.","The database major version is MySQL 8.0 and the minor version is 37.","The database major version is MySQL 8.0 and the minor version is 39.","The database major version is MySQL 8.0 and the minor version is 40.","The database major version is MySQL 8.0 and the minor version is 41.","The database major version is MySQL 8.0 and the minor version is 42.","The database major version is MySQL 8.0 and the minor version is 43.","The database major version is MySQL 8.0 and the minor version is 44.","The database major version is MySQL 8.0 and the minor version is 45.","The database major version is MySQL 8.0 and the minor version is 46.","The database version is MySQL 8.4.","The database version is MySQL 9.7.","The database version is SQL Server 2017 Standard.","The database version is SQL Server 2017 Enterprise.","The database version is SQL Server 2017 Express.","The database version is SQL Server 2017 Web.","The database version is PostgreSQL 9.6.","The database version is PostgreSQL 10.","The database version is PostgreSQL 11.","The database version is PostgreSQL 12.","The database version is PostgreSQL 13.","The database version is PostgreSQL 14.","The database version is PostgreSQL 15.","The database version is PostgreSQL 16.","The database version is PostgreSQL 17.","The database version is PostgreSQL 18.","The database version is PostgreSQL 19.","The database version is PostgreSQL 20.","The database version is SQL Server 2019 Standard.","The database version is SQL Server 2019 Enterprise.","The database version is SQL Server 2019 Express.","The database version is SQL Server 2019 Web.","The database version is SQL Server 2022 Standard.","The database version is SQL Server 2022 Enterprise.","The database version is SQL Server 2022 Express.","The database version is SQL Server 2022 Web.","The database version is SQL Server 2025 Standard.","The database version is SQL Server 2025 Enterprise.","The database version is SQL Server 2025 Express."]}},"required":["targetDatabaseVersion"],"type":"object"},"PreCheckResponse":{"description":"Structured PreCheckResponse containing message, type, and required actions.","properties":{"actionsRequired":{"description":"The actions that the user needs to take. Use repeated for multiple actions.","items":{"type":"string"},"type":"array"},"message":{"description":"The message to be displayed to the user.","type":"string"},"messageType":{"description":"The type of message whether it is an info, warning, or error.","enum":["MESSAGE_TYPE_UNSPECIFIED","INFO","WARNING","ERROR"],"type":"string","x-google-enum-descriptions":["Default unspecified value to prevent unintended behavior changes.","General informational messages that don't require action.","Warnings that might impact the upgrade but don't block it.","Errors that a user must resolve before proceeding with the upgrade."]}},"type":"object"}},"description":"Request for Pre-checks for MVU"}},{"name":"restore_backup","description":"Restores a backup to a Cloud SQL instance.\n\nThe target_instance and target_project must be provided and populated in the request.\n\nThe backup identifier can be provided in several ways:\n\n1. A backup_run_id (which is an integer).\n2. A backup URI of the format `projects/{project-id}/backups/{backup-uid}`.\n3. A backup URI of the format `projects/{project-id}/locations/{location}/backupVaults/{backupvault}/dataSources/{datasource}/backups/{backup-uid}`.\n\nUse the identifier to populate the `backup_id` field in the request.\n\nThe source_project must be populated in the request. If the identifier is a backup_run_id,\nthe source_project will be provided. If the identifier is a backup URI, the source_project\nmay need to be extracted from the URI. Do not confuse the extracted source_project with the\ntarget_project, which will be provided in other ways.\n\nIn addition, if the identifier is a backup_run_id, the source_instance must be provided and\npopulated in the request.\n\nDo not try to create the instance before the restore, the restore itself will create the\ninstance if needed.\n\nConfirm the parameters with the user before executing the restore.\n","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"backupId":{"description":"Required. The identifier of the backup to restore. This will be one of the following: 1. An int64 containing a backup_run_id. 2. A backup name of the format 'projects/{project}/backups/{backup-uid}'. 3. A backupDR name of the format 'projects/{project}/locations/{location}/backupVaults/{backupvault}/dataSources/{datasource}/backups/{backup-uid}'.","type":"string"},"sourceInstance":{"description":"Optional. The Cloud SQL instance ID of the source instance containing the backup. Only necessary if the backup_id is a backup_run_id.","type":"string"},"sourceProject":{"description":"Required. The project ID of the source instance containing the backup.","type":"string"},"targetInstance":{"description":"Required. Cloud SQL instance ID of the target. This does not include the project ID.","type":"string"},"targetProject":{"description":"Required. Project ID of the target project.","type":"string"}},"required":["targetProject","targetInstance","backupId","sourceProject"],"description":"Instance restore backup request for MCP."}},{"name":"update_instance","description":"Partially updates the configuration settings of a Cloud SQL instance.\n\n* This tool returns a long-running operation. Use the `get_operation` tool to poll\n  its status until the operation completes.\n* Some update operations, such as changing the edition upgrade or instance tier, etc might\n  cause the instance to restart, resulting in downtime. Before you proceed with such\n  operations, get confirmation from the user.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"dataApiAccess":{"description":"Optional. The settings for controlling data API access to an instance.","enum":["DATA_API_ACCESS_UNSPECIFIED","DISALLOW_DATA_API","ALLOW_DATA_API"],"type":"string","x-google-enum-descriptions":["Unspecified, effectively the same as `DISALLOW_DATA_API`.","Disallow using ExecuteSql API to connect to the instance.","Allow using ExecuteSql API to connect to the instance. For private IP instances, this allows authorized users to access the instance from the public internet using ExecuteSql API."]},"dataCacheConfig":{"$ref":"#/$defs/DataCacheConfig","description":"Optional. Configuration for the data cache. A data cache can improve performance for read-heavy workloads by caching frequently accessed data in-memory."},"dataDiskSizeGb":{"description":"Optional. Data disk size in GB.","format":"int64","type":"string"},"databaseFlags":{"description":"Optional. The database flags.","items":{"$ref":"#/$defs/DatabaseFlags"},"type":"array"},"edition":{"description":"Optional. The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS.","type":"string"},"googleMlIntegrationEnabled":{"description":"Optional. Enables Cloud SQL instances to connect to Vertex AI to pass requests for real-time predictions and insights to the AI. The default value is false. This applies only to Cloud SQL for MySQL and Cloud SQL for PostgreSQL instances.","type":"boolean"},"instance":{"description":"Required. Cloud SQL instance ID. This does not include the project ID.","type":"string"},"ipv4Enabled":{"description":"Optional. Whether to enable public IP for the instance. Enabling this flag makes the resource accessible from the public internet, which is a security risk if not properly managed. It is recommended to keep resources private whenever possible.","type":"boolean"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"},"psaMcpConfig":{"$ref":"#/$defs/PsaMcpConfig","description":"Optional. Configuration for Private Service Access (PSA) instance update."},"pscMcpConfig":{"$ref":"#/$defs/PscMcpConfig","description":"Optional. Configuration for Private Service Connect (PSC) instance update."},"tier":{"description":"Optional. The tier (or machine type) for this instance. format: db-custom-{CPUs}-{Memory}.","type":"string"}},"required":["project","instance"],"$defs":{"DataCacheConfig":{"description":"Data cache configurations.","properties":{"dataCacheEnabled":{"description":"Whether data cache is enabled for the instance.","type":"boolean"}},"type":"object"},"DatabaseFlags":{"description":"Database flags for Cloud SQL instances.","properties":{"name":{"description":"The name of the flag. These flags are passed at instance startup, so include both server options and system variables. Flags are specified with underscores, not hyphens. For more information, see [Configuring Database Flags](https://cloud.google.com/sql/docs/mysql/flags) in the Cloud SQL documentation.","type":"string"},"value":{"description":"The value of the flag. Boolean flags are set to `on` for true and `off` for false. This field must be omitted if the flag doesn't take a value.","type":"string"}},"type":"object"},"PsaMcpConfig":{"description":"Configuration for creating a Cloud SQL instance with Private Service Access.","properties":{"allocatedIpRange":{"description":"Optional: The name of an allocated IP range in the consumer VPC.","type":"string"},"network":{"description":"Required. The full resource name of the VPC network to connect to via PSA. Format: projects/{project}/global/networks/{network} REQUIRED if enabling PSA.","type":"string"}},"required":["network"],"type":"object"},"PscMcpConfig":{"description":"Configuration for Private Service Connect (PSC) endpoint creation for MCP. psc_enabled is the only field needed for instance creation with Private Service Connect enabled. Other optional fields will be added later.","properties":{"network":{"description":"Optional. The consumer network of this consumer endpoint. This must be a resource path that includes both the host project and the network name. For example, `projects/project1/global/networks/network1`. The consumer host project of this network might be different from the consumer service project.","type":"string"},"project":{"description":"Optional. The project ID of the service project of this PSC consumer endpoint. This is only applicable if `network` is a shared VPC network.","type":"string"},"pscEnabled":{"description":"Optional. Whether PSC connectivity is enabled for this instance.","type":"boolean"}},"type":"object"}},"description":"Instance patch request for MCP."}},{"name":"update_user","description":"Update a database user for a Cloud SQL instance. A common use case for\nthe `update_user` is to grant a user the `cloudsqlsuperuser` role,\nwhich can provide a user with many required permissions.\n\nThis tool only supports updating users to assign database roles.\n\n* This tool returns a long-running operation. Use the `get_operation` tool to poll its status\n  until the operation completes.\n* Before calling the `update_user` tool, always check the existing configuration of the user\n  such as the user type with `list_users` tool.\n* As a special case for MySQL,  if the `list_users` tool returns a full email address for\n  the `iamEmail` field, for example `{name=test-account,\n  iamEmail=test-account@project-id.iam.gserviceaccount.com}`, then in your `update_user`\n  request, use the full email address in the `iamEmail` field in the `name` field of your\n  toolrequest. For example, `name=test-account@project-id.iam.gserviceaccount.com`.\n\nKey parameters for updating user roles:\n\n* `database_roles`: A list of database roles to be assigned to the user.\n* `revokeExistingRoles`: A boolean field (default: false) that controls how existing roles\n   are handled.\n\nHow role updates work:\n\n1.  **If `revokeExistingRoles` is true:**\n\n    *  Any existing roles granted to the user but NOT in the provided `database_roles` list\n       will be REVOKED.\n    *  Revoking only applies to non-system roles. System roles like `cloudsqliamuser` etc won't be revoked.\n    *  Any roles in the `database_roles` list that the user does NOT already have will be GRANTED.\n    *  If `database_roles` is empty, then ALL existing non-system roles are revoked.\n\n2.  **If `revokeExistingRoles` is false (default):**\n\n    *  Any roles in the `database_roles` list that the user does NOT already have will be GRANTED.\n    *  Existing roles NOT in the `database_roles` list are KEPT.\n    *  If `database_roles` is empty, then there is no change to the user's roles.\n\nExamples:\n\n*   Existing Roles: `[roleA, roleB]`\n\n    *   Request: `database_roles: [roleB, roleC], revokeExistingRoles: true`\n    *   Result: Revokes `roleA`, Grants `roleC`. User roles become `[roleB, roleC]`.\n\n    *   Request: `database_roles: [roleB, roleC], revokeExistingRoles: false`\n    *   Result: Grants `roleC`. User roles become `[roleA, roleB, roleC]`.\n\n    *   Request: `database_roles: [], revokeExistingRoles: true`\n    *   Result: Revokes `roleA`, Revokes `roleB`. User roles become `[]`.\n\n    *   Request: `database_roles: [], revokeExistingRoles: false`\n    *   Result: No change. User roles remain `[roleA, roleB]`.\n","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"databaseRoles":{"description":"Optional. List of database roles to grant to the user. body.database_roles will be ignored for update request.","items":{"type":"string"},"type":"array"},"host":{"description":"Optional. Host of the user in the instance.","type":"string"},"instance":{"description":"Required. Database instance ID. This does not include the project ID.","type":"string"},"name":{"description":"Required. Name of the user in the instance.","type":"string"},"project":{"description":"Required. Project ID of the project that contains the instance.","type":"string"},"revokeExistingRoles":{"description":"Optional. revoke the existing roles granted to the user.","type":"boolean"},"type":{"description":"Required. The user type. It determines the method to authenticate the user during login. The default is the database's built-in user type.","enum":["BUILT_IN","CLOUD_IAM_USER","CLOUD_IAM_SERVICE_ACCOUNT","CLOUD_IAM_GROUP","CLOUD_IAM_GROUP_USER","CLOUD_IAM_GROUP_SERVICE_ACCOUNT","CLOUD_IAM_WORKFORCE_IDENTITY","ENTRAID_USER"],"type":"string","x-google-enum-descriptions":["The database's built-in user type.","Cloud IAM user.","Cloud IAM service account.","Cloud IAM group. Not used for login.","Read-only. Login for a user that belongs to the Cloud IAM group.","Read-only. Login for a service account that belongs to the Cloud IAM group.","Cloud IAM workforce identity managed by Workforce Identity Federation.","Microsoft Entra ID user."]}},"required":["instance","name","project","type"],"description":"User update request for MCP."}}],"scan":{"score":55,"grade":"C","scanned_at":"2026-09-27T22:32:49.618Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-27T22:32:49.621Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 629ms"]},"poisoning":{"score":13,"max":15,"notes":["15 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 8 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":2,"max":10,"notes":["no repository or website to verify"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"poison.long-description","severity":"low","component":"poisoning","title":"Unusually long tool description (over 2,000 characters)","evidence":"tool create_instance: …Initiates the creation of a Cloud SQL instance. * The tool returns a long-running operation. Use the `get_operation` tool to poll its status until the operation completes. * The instance creation operation can take several minutes. Use a command line tool to pause for 30 seconds before rechecking the status. * After you use the `create_instance` tool to create an instance, you can use the `create_user` tool to create an IAM user account for the user currently logged in to the project. * IMPORTANT: Set `ipv4_enabled` to 'false' if creating a Private Service Connect or a Private Service Access instance. * Set `free_trial` to 'true' to create a free trial instance. Free trial instances let you test majority of Cloud SQL features for up to 30 days without financial commitment. Subject to eligibility and availability. * The value of `data_api_access` is set to `ALLOW_DATA_API` by default. This setting lets you execute SQL statements using the `execute_sql` tool and the `executeSql` API. Unless otherwise specified, a newly created instance uses the default instance configuration of a development environment. The following is the default configuration for an instance in a development environment: ``` { \"tier\": \"db-perf-optimized-N-2\", \"data_disk_size_gb\": 100, \"region\": \"us-central1\", \"database_version\": \"POSTGRES_18\", \"edition\": \"ENTERPRISE_PLUS\", \"availability_type\": \"ZONAL\", \"tags\": [{\"environment\": \"dev\"}] } ``` The following configuration is recommended for an instance in a production environment: ``` { \"tier\": \"db-perf-optimized-N-8\", \"data_disk_size_gb\": 250, \"region\": \"us-central1\", \"database_version\": \"POSTGRES_18\", \"edition\": \"ENTERPRISE_PLUS\", \"availability_type\": \"REGIONAL\", \"tags\": [{\"environment\": \"prod\"}] } ``` The following instance configuration is recommended for SQL Server: ``` { \"tier\": \"db-perf-optimized-N-8\", \"data_disk_size_gb\": 250, \"region\": \"us-central1\", \"database_version\": \"SQLSERVER_2022_STANDARD\", \"edition\": \"ENTERPRISE\", \"availability_type\": \"REGIONAL\", \"tags\": [{\"environment\": \"prod\"}] } ``` …"},{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://sqladmin.googleapis.com/mcp","reachable":true,"authRequired":false,"latencyMs":629,"serverInfo":{"name":"StatelessServer","version":"ESF"}}],"packages":[],"repo":{"found":false},"icon":{"url":null,"source":"none"},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":5}}}},"grade_history":[],"reviews":[]}