Skip to main content
Connecting BigQuery lets the agent join what customers said to what your business data records: revenue, plan, usage, churn, product events.

​
What the agent gets

  • Dataset and table discovery: list the datasets and tables in a Google Cloud project and read their schemas and metadata.
  • Read-only SQL with execute_sql_readonly, which rejects DML, DDL, and other statements that change data.
  • Job status and results for queries the agent has run.
  • Writable SQL with execute_sql, only if you enable it.
Every tool takes a Google Cloud project ID, and the agent has no tool to list your projects. Name the project in your question, or in the agent’s instructions, so it knows where to look. Google limits each query to three minutes of processing and 3,000 rows of results. Ask for aggregates rather than raw rows when the data is large.

​
Setup

Google does not let Rippit register itself as an OAuth client, so an admin creates an OAuth client in your Google Cloud project once and pastes its credentials into Rippit.
1

Check the BigQuery API is enabled

The BigQuery MCP server is on whenever the BigQuery API is enabled in the project. New projects have it enabled already. If yours does not, enable bigquery.googleapis.com under APIs & Services.
2

Grant IAM roles

The person who will authorize the connection needs these roles on the project the agent will query:Grant Data Viewer on specific datasets instead of the whole project to narrow what the agent can read.
3

Create an OAuth client

In the Google Cloud console, open Google Auth Platform → Clients → Create client and choose Web application. Under Authorized redirect URIs, add the redirect URI Rippit shows in the connect dialog, copied exactly rather than typed.If the consent screen isn’t set up yet, choose the Internal user type. Internal apps can be used only by accounts in your Google Workspace organization and don’t need Google’s app verification.
4

Connect in Rippit

Paste the client’s client ID and client secret into Rippit, then authorize. Google asks you to approve access to BigQuery.

​
Identity and scope

The connection acts as the Google account that authorized it, so every query runs under that account’s IAM roles and is billed to the project the agent queries. A dataset the account cannot read is a dataset the agent cannot read. An organization-wide connection shares that identity with everyone in your Rippit organization. The clean approach is to authorize with a dedicated Google account whose roles grant exactly the reporting access the agent should have, rather than an analyst’s personal account.

​
Tools

You choose which tools the agent can use under Tool permissions on the server’s page, one at a time or a whole group at once. See Setting one up. The read tools are enabled by default. execute_sql and cancel_job stay off until you enable them.