> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rippit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BigQuery MCP server

> Let the Rippit agent explore datasets and run SQL against your BigQuery data.

Connecting BigQuery lets the agent join what customers said to what your business data records: revenue, plan, usage, churn, product events.

## What the agent gets

* **Dataset and table discovery**: list the datasets and tables in a Google Cloud project and read their schemas and metadata.
* **Read-only SQL** with `execute_sql_readonly`, which rejects DML, DDL, and other statements that change data.
* **Job status and results** for queries the agent has run.
* **Writable SQL** with `execute_sql`, only if you enable it.

Every tool takes a Google Cloud project ID, and the agent has no tool to list your projects. Name the project in your question, or in the agent's instructions, so it knows where to look.

Google limits each query to three minutes of processing and 3,000 rows of results. Ask for aggregates rather than raw rows when the data is large.

## Setup

Google does not let Rippit register itself as an OAuth client, so an admin creates an OAuth client in your Google Cloud project once and pastes its credentials into Rippit.

**1. Check the BigQuery API is enabled**

The BigQuery MCP server is on whenever the BigQuery API is enabled in the project. New projects have it enabled already. If yours does not, enable `bigquery.googleapis.com` under **APIs & Services**.

**2. Grant IAM roles**

The person who will authorize the connection needs these roles on the project the agent will query:

| Role | Why |
| - | - |
| MCP Tool User (`roles/mcp.toolUser`) | Call tools on Google Cloud MCP servers |
| BigQuery Job User (`roles/bigquery.jobUser`) | Run queries |
| BigQuery Data Viewer (`roles/bigquery.dataViewer`) | Read table data |

Grant Data Viewer on specific datasets instead of the whole project to narrow what the agent can read.

**3. Create an OAuth client**

In the Google Cloud console, open **Google Auth Platform → Clients → Create client** and choose **Web application**. Under **Authorized redirect URIs**, add the redirect URI Rippit shows in the connect dialog, copied exactly rather than typed.

If the consent screen isn't set up yet, choose the **Internal** user type. Internal apps can be used only by accounts in your Google Workspace organization and don't need Google's app verification.

**4. Connect in Rippit**

Paste the client's **client ID** and **client secret** into Rippit, then authorize. Google asks you to approve access to BigQuery.

## Identity and scope

The connection acts as the Google account that authorized it, so every query runs under that account's IAM roles and is billed to the project the agent queries. A dataset the account cannot read is a dataset the agent cannot read.

An organization-wide connection shares that identity with everyone in your Rippit organization. The clean approach is to authorize with a dedicated Google account whose roles grant exactly the reporting access the agent should have, rather than an analyst's personal account.

## Tools

You choose which tools the agent can use under **Tool permissions** on the server's page, one at a time or a whole group at once. See [Setting one up](https://docs.rippit.com/agentic-chat/overview.md#setting-one-up).

| Tool | Access | What it does |
| - | - | - |
| `list_dataset_ids` | Read | List the datasets in a project |
| `get_dataset_info` | Read | Metadata for a dataset |
| `list_table_ids` | Read | List the tables in a dataset |
| `get_table_info` | Read | A table's schema and metadata |
| `execute_sql_readonly` | Read | Run a read-only SQL query and return the results |
| `get_query_results` | Read | Fetch the results of a query job |
| `get_job` | Read | Status and details of a query job |
| `execute_sql` | Write | Run any SQL query, including statements that change or delete data |
| `cancel_job` | Write | Cancel a running job |

The read tools are enabled by default. `execute_sql` and `cancel_job` stay off until you enable them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.