Clickhouse MCP server
ClickHouse query & management for AI agents — SQL-classified read/write/destructive gating.
2 stars266 downloads/wk
Reviews
Write oneNobody has reviewed Clickhouse yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Clickhouse tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-10-03 · same rubric, same numbers if you re-run it
- Code scan25 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 1 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
How Clickhouse compares
Against every graded Databases MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 80/100
- higher than 50% of 802 Databases servers
- GitHub stars
- 2
- more than 60% of 602 Databases servers
- Downloads a week
- 266
- more than 75% of 328 Databases servers with a package
Release history: 2 versions in the registry since 2026-09-12, latest 2026-09-29, typically one every 17 days.
Install Clickhouse in Claude Code, Cursor or VS Code
Runs npx -y @dockndevai/mcp-clickhouse on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mcp-clickhouse -- npx -y @dockndevai/mcp-clickhouse
What the publisher says
From the Clickhouse repository's README, as published. We do not edit it. Read it on GitHub
mcp-clickhouse
A Model Context Protocol server for ClickHouse. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) explore schemas, run analytical queries, and manage the database — with behaviour controlled entirely by flags.
The security model is statement-aware: every SQL statement is classified as read, write, or destructive, and gated against the current access mode. Read-only mode additionally runs queries under ClickHouse's own readonly=1 setting.
Features
- Exploration & monitoring — databases, tables, columns, SHOW CREATE, table stats (parts/rows/bytes), running queries, server metrics, cluster topology.
- Read queries — a query tool that only accepts read statements, capped at CLICKHOUSEMAXROWS.
- Management — an execute tool for INSERT/CREATE/ALTER (read-write) and DROP/TRUNCATE/DELETE (admin), each gated by classification.
- Access modes — read-only → read-write → admin, layered so a mode never exposes statements above its level.
- Security flags — database allowlist, protected databases, destructive gating, row cap, dry-run, and JSON audit logging (see below).
Security model
Statement classification lives in src/sql.ts and is fail-safe: ALTER … DELETE/UPDATE counts as destructive, and anything unparseable is treated as destructive.
Tools
Read (read-only+): listdatabases, listtables, describetable, showcreatetable, tablestats, runningqueries, servermetrics, cluster_info, query
Write/Admin (read-write+): execute — runs a single statement after classifying it; writes need read-write mode, destructive statements need admin mode + CLICKHOUSEALLOWDELETE.
Quickstart — add to your agent
Published on npm as @dockndevai/mcp-clickhouse. No clone or build needed — your MCP client runs it on demand with npx. Start in read-only mode; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.
Claude Code (CLI)
claude mcp add clickhouse -e CLICKHOUSE_URL="http://localhost:8123" -e CLICKHOUSE_USER="default" -e CLICKHOUSE_MODE="read-only" -- npx -y @dockndevai/mcp-clickhouseShortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Clickhouse: common questions
- Is Clickhouse MCP server safe?
- Mostly: it is graded B (80/100). Read the Clickhouse safety report
- How do I install Clickhouse?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Clickhouse need an API key?
- Yes. The registry entry asks for
CLICKHOUSE_PASSWORD. - Is Clickhouse maintained?
- The last commit was 32 days ago (2026-10-02). The latest release is v0.3.0.
- What can I use instead of Clickhouse?
- Servers from other publishers that do the same job: DBHub MCP server, Motherduck MCP server and Keboola MCP server.
- How does Clickhouse compare with other Databases MCP servers?
- safety score 80/100 (higher than 50% of 802 Databases servers); github stars 2 (more than 60% of 602 Databases servers); downloads a week 266 (more than 75% of 328 Databases servers with a package). Full comparison.
Alternatives to Clickhouse
Same job from other publishers: the closest match first, then the best rated.
- DBHubToken-efficient database MCP server for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLitenot reviewedWidely usedA
- MotherduckSQL analytics and data engineering for AI Assistants and IDEsnot reviewedEstablishedA
KeboolaConnect your AI assistants to Keboola and expose your data, transformations, SQL queries, ...not reviewedEstablishedA- GeoLensRead-only access to a self-hosted GeoLens spatial catalog: datasets, features, maps, sandboxed SQL.not reviewedEstablishedB
FaucetSQL database to MCP tools and REST API: PostgreSQL, MySQL, SQL Server, Oracle, SQLite, Snowflake.not reviewedEstablishedA
