SayQL vs MCP Toolbox for Databases
Updated
MCP Toolbox for Databases is Google's open-source MCP server that gives AI agents tools for your databases. It's infrastructure for developers: you define tools in YAML and run the server. SayQL is an app for people and agents, with an MCP server and a self-hosted gateway built in.
Choose MCP Toolbox to build agents across many cloud sources with fixed-SQL tools and sign-in from your identity provider. Choose SayQL for a ready app where people ask in plain English and agents get results at the level you choose, with columns kept from the AI, out of the box.
Checked on 3 November 2026 against each product's own docs, code and pricing; every cell links to its source. Spotted something out of date? Email hello@azenvoc.com and we'll fix it.
Side by side
| SayQL | MCP Toolbox for Databases | |
|---|---|---|
| What it is | Desktop SQL client (macOS, Windows, Linux) with AI, plus an optional self-hosted team server source | An open-source MCP server that connects AI agents and apps to databases, with prebuilt tools and custom tools you define in YAML; published by Google source |
| Status | Maintained; 0.6.0 released 2026-11-03 source | Maintained; 1.15.0 released 23 October 2026 source |
| Licence | App: open source, Apache 2.0. Team server: paid licence source | Open source, Apache 2.0 source |
| Price | App free. Team server $149 a month for up to 10 people, 30-day trial source | Free; no paid tier found source |
| Databases | PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Azure SQL source | 51 integrations, including AlloyDB, BigQuery, Spanner, Cloud SQL, PostgreSQL, MySQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Snowflake, ClickHouse and Neo4j source |
| AI models | Claude, OpenAI, Gemini, OpenRouter, Mistral, Groq, DeepSeek, any OpenAI-compatible API; local models with Ollama or LM Studio source | Any MCP client (Claude Code, Gemini CLI, Cursor and others) or agent framework (LangChain, LlamaIndex, Genkit, ADK); it doesn't run a model itself source |
| Plain English to SQL | Yes: SQL appears in the editor as you type, from your schema and approved notes source | Not itself: the agent writes SQL or calls tools with fixed SQL (BigQuery's conversational analytics tool is the exception) source |
| Multi-step questions | Yes (beta): plans, runs read-only steps, checks its work, cites each query source | Left to the agent or its framework source |
| MCP server for AI agents | Yes: a local MCP server for Claude Code, Cursor and others, and an HTTP gateway on the team server source | Yes: it is an MCP server (stdio or Streamable HTTP) source |
| What the AI sees of your data | Schema by default. Per connection you choose what AI sees of results: nothing, counts and summaries (default), masked rows, or all rows source | What each tool returns goes back to the agent; no built-in summarising or masking (optional post-processing, or Google Cloud Model Armor) source |
| Keep chosen columns from the AI | Yes: columns marked never send are refused in any form and withheld from results source | Not built in: leave the column out of a fixed-SQL tool, or mask with Model Armor on Google Cloud source |
| Read-only for AI | Read-only by default: statements are checked before they run and run in a read-only transaction; AI apps can't change data source | Fixed-SQL tools take only bound parameters; a free-form SQL tool exists for developer use. A read-only setting is documented for Cloud SQL, AlloyDB and BigQuery; otherwise use a read-only database user source |
| Record of AI queries | Yes: a local log of what each AI app ran; on the team server, one log of every query from people and agents, whose rows can't be edited source | OpenTelemetry traces and metrics per tool call, and logs; no dedicated query audit log documented source |
| Per-agent or per-user rules | Block or allow each AI app. Team server: each agent its own key, databases, tables and rows source | Sign-in with Google or OIDC, per-tool auth, and parameters filled from the caller's token (through its SDKs); OAuth 2.1 on the MCP endpoint source |
| Where it runs, where data goes | Runs on your computer; the team server runs on your servers and your data never reaches us source | You run it: local binary, Docker, Cloud Run or Kubernetes. Data goes from the database through it to the agent and its model source |
| Interface | Desktop app source | No end-user app; a built-in web UI for testing tools source |
| Learns about your database | Shared notes about the database that people approve and SayQL keeps true as the schema changes; no training on question–SQL pairs source | No source |
What MCP Toolbox for Databases does better
- Many more sources: 51 integrations, including managed cloud databases such as BigQuery, Spanner, AlloyDB and Snowflake, and NoSQL and graph stores. source
- Tools with fixed SQL: a developer writes the query and the agent only fills in bound parameters. source
- Identity-aware tools: sign-in with Google or OIDC, and parameters filled from the caller's token, so rows are scoped per end user. source
- A central server for many agents and apps, with connection pooling, deployable to Cloud Run, Kubernetes or Docker. source
- Built-in OpenTelemetry, and first-party SDKs for LangChain, LlamaIndex, Genkit and ADK. source
How SayQL handles AI access
- Counts, not rows, by default. For each connection you choose what AI apps see of results: nothing, counts and summaries, masked rows or all rows. See what AI apps may see.
- Columns that never reach the AI. Mark a column never send and any query that could read it is refused, and it's withheld from results. See never-send columns.
- Read-only, enforced. Every statement is checked before it runs and runs in a read-only transaction; AI apps can't change data. See how queries run safely.
- A record of what AI ran. See every query each AI app ran, and block an app in one click. On the team server, one log covers every person and agent. See agent activity.
- Per-agent keys on your own server. The self-hosted team server gives each agent its own key, databases, tables and rows. See SayQL for teams.
Questions
Does MCP Toolbox for Databases send query results to the AI?
What each tool returns goes back to the agent; no built-in summarising or masking (optional post-processing, or Google Cloud Model Armor) source In SayQL: schema by default. Per connection you choose what AI sees of results: nothing, counts and summaries (default), masked rows, or all rows. source
Can MCP Toolbox for Databases keep a column away from the AI?
Not built in: leave the column out of a fixed-SQL tool, or mask with Model Armor on Google Cloud. source In SayQL, yes: columns marked never send are refused in any form and withheld from results. source
Is MCP Toolbox for Databases read-only for AI?
Fixed-SQL tools take only bound parameters; a free-form SQL tool exists for developer use. A read-only setting is documented for Cloud SQL, AlloyDB and BigQuery; otherwise use a read-only database user. source In SayQL: read-only by default: statements are checked before they run and run in a read-only transaction; AI apps can't change data. source
Does MCP Toolbox for Databases have an MCP server for AI agents?
Yes: it is an MCP server (stdio or Streamable HTTP) source In SayQL, yes: a local MCP server for Claude Code, Cursor and others, and an HTTP gateway on the team server. source
Other comparisons
Download SayQL: the app is free and open source.
Something missing or unclear? Ask in Discussions.