Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 3
- 4 5
- 3 2
- 2 0
- 1 0
Trust in production
- Trust it - 60%
- With caveats - 30%
- Wouldn't - 10%
90% would recommend this server
How reviewers scored it
- Setup & docs 3.9
- Auth experience 3.4
- Reliability 4.3
- Maintainer responsiveness 4.0
Why it got a B
ClickHouse's own open-source local server (Apache-2.0, PyPI mcp-clickhouse 0.7.0, stdio by default); the hosted ClickHouse Cloud server is a separate listing, clickhouse-mcp. It runs SQL and lists databases and tables on your cluster, and can query local files through the embedded chDB engine. Queries run read-only by default, enforced by ClickHouse itself (readonly=1); CLICKHOUSE_ALLOW_WRITE_ACCESS=true allows inserts and DDL, and DROP, TRUNCATE, DELETE and UPDATE need a second flag, CLICKHOUSE_ALLOW_DROP=true, which the README calls a best-effort accident guard, not a security boundary. HTTP and SSE modes refuse to start without a bearer token or OAuth/OIDC. Biggest deduction: access is one ClickHouse user and password from the environment, so use a dedicated low-privilege user, because the server cannot narrow it further and even read-only mode lets that user cancel its own queries.
How to connect
// claude_desktop_config.json (README; fill in your own ClickHouse host and credentials)
{ "mcpServers": { "mcp-clickhouse": { "command": "uv",
"args": ["run", "--with", "mcp-clickhouse", "--python", "3.12", "mcp-clickhouse"],
"env": { "CLICKHOUSE_HOST": "<clickhouse-host>", "CLICKHOUSE_PORT": "<clickhouse-port>",
"CLICKHOUSE_USER": "<clickhouse-user>", "CLICKHOUSE_PASSWORD": "<clickhouse-password>",
"CLICKHOUSE_ROLE": "<clickhouse-role>", "CLICKHOUSE_SECURE": "true",
"CLICKHOUSE_VERIFY": "true", "CLICKHOUSE_CONNECT_TIMEOUT": "30" } } } }Is ClickHouse Open-Source MCP Server safe?
Is ClickHouse Open-Source MCP Server safe to use?
ClickHouse Open-Source MCP Server grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. It runs locally over stdio, so it acts with your machine's access.
Does ClickHouse Open-Source MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does ClickHouse Open-Source MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Databases & Data Stores
- A Airtable MCP ServerAirtable's own hosted server. List your workspaces and bases, read and search records, and create or update them, using the permissions you already have in Airtable.
- A Airtable MCP Server (community)A community-built Airtable server you run yourself. Lists bases and tables, reads, searches, creates, updates and deletes records, and can change table structure, using a personal access token you scope.
- A Aiven MCP ServerOfficial Aiven server to manage PostgreSQL, Kafka, OpenSearch and application services, run SQL, read Kafka topics and search the Aiven docs, with your Aiven permissions applied.
- A ClickHouse MCP ServerClickHouse's official hosted MCP server for ClickHouse Cloud - read-only SELECT queries, schema browsing, and service, backup, ClickPipes and billing tools, with OAuth or a scoped API key.
- A Databricks Managed MCP ServersDatabricks-hosted MCP servers in each workspace for Genie, SQL, Unity Catalog functions and vector search, signed in with OAuth and limited by Unity Catalog.
Embed this badge
[](https://trustedmcp.io/servers/mcp-clickhouse)<a href="https://trustedmcp.io/servers/mcp-clickhouse"><img src="https://trustedmcp.io/badge/mcp-clickhouse.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Does what it says, no drama
Tried it on a side project first, then rolled it out at work. You create a token and pass it in. Scope it narrowly, that is the main thing. Good choice if you need ClickHouse Open-Source in your agent.
Used for Generating SQL for ad-hoc reports
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Capable but needs guardrails
Good for experimenting, still deciding about production. You can tell it is actively maintained, the rough edges keep getting fixed. Auth is there, but the credential still lives in my local config, so I keep that file locked down. I gave it a database user that can only read the tables it needs. Keep permissions tight and it is a good tool.
Used for Debugging data issues in staging
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Our team uses it every day
Installed it on a Friday, it was part of my workflow by Monday. Setting up the token took longer than the server itself, but the scoping options are decent. Updates land regularly, and nothing broke when I upgraded.
Used for Read-only analytics questions
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Set it up once, forgot about it
Clear tool names, sensible outputs, very few surprises. You create a token and pass it in. Scope it narrowly, that is the main thing. Filed an issue and got a reply within two days. Token setup is the fiddliest part, after that it is smooth. Would recommend without hesitation.
Used for Schema exploration during a migration
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Good defaults, good docs
Our agents call this dozens of times a day. Setting up the token took longer than the server itself, but the scoping options are decent. Easy recommendation.
Used for Read-only analytics questions
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Easy win for our agent setup
Set this up for our team after comparing a few options. Releases come often and the changelog is clear. Used a fine-grained token with short expiry and it works fine with that. Auth is there, but the credential still lives in my local config, so I keep that file locked down. It is in our production agent and I sleep fine.
Used for Checking data quality after imports
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Started with it as an experiment, now it is a fixture. Used a fine-grained token with short expiry and it works fine with that. Auth is there, but the credential still lives in my local config, so I keep that file locked down.
Used for Incident investigation
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 3/5
The ClickHouse Open-Source integration I wanted
I use this almost daily. Setting up the token took longer than the server itself, but the scoping options are decent. Fine in production if you sandbox it.
Used for Answering support questions from the database
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Promising, a bit raw
It does the job, but it took some tweaking. Updates land regularly, and nothing broke when I upgraded. Setting up the token took longer than the server itself, but the scoping options are decent. Local stdio process, easy to start and stop from the client. Not something I would put in production yet.
Used for Prototyping queries before writing code
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Exactly what I needed from ClickHouse Open-Source
Simple to set up in Cursor, simple to reason about. Token setup is the fiddliest part, after that it is smooth. Happy to run it in production.
Used for Incident investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.