Oracle MCP Server: Setup, Tools & Real Limits
Oracle now offers three first-party MCP routes to its database, but the right choice depends on whether you value local speed, centralized control, or remote access.
An Oracle MCP server lets an MCP-compatible AI client inspect Oracle schemas and execute SQL or PL/SQL under a real database identity. Oracle now ships first-party options, not just community experiments. For most developers, start with SQLcl locally; for production, prefer OCI Database Tools or ORDS with centralized identity, narrow tools, and a read-only database account.
Table of contents
- What Oracle MCP actually is
- What exists today
- How to set up Oracle MCP
- Tools you get
- Permissions and blast radius
- Real limits
- When not to use it
What Oracle MCP actually is
Oracle MCP is a protocol adapter between an AI client and Oracle Database, not a database-trained model. An agent can discover saved connections, inspect schema metadata, generate a query, execute it, and summarize returned rows. The model proposes SQL; Oracle executes it with the connected user's privileges.
You can ask which tables contain customer data, request the structure of ORDERS, compare counts, or invoke a PL/SQL block. Oracle's SQLcl MCP documentation confirms support for SQL, PL/SQL, and SQLcl commands. Compare broader integrations among the best MCP servers.
MCP does not validate business intent. A valid update can alter the wrong rows, and a plausible join can produce a false answer. I would use Oracle MCP for exploration, constrained reporting, and reviewed development work—not autonomous production administration.
What exists today
There are three first-party Oracle Database MCP deployments. SQLcl is the local route, OCI Database Tools is the managed cloud route, and ORDS 26.2 exposes a remote /mcp endpoint for enterprises already operating ORDS. This is no longer a “community server only” category.
| Option | Transport and location | Best fit | Main trade-off |
|---|---|---|---|
| SQLcl MCP Server | Local stdio process | Development, DBA investigation, prototypes | Simple, but credentials and process lifecycle live on the workstation |
| OCI Database Tools MCP Server | Managed Streamable HTTP in OCI | Centralized cloud access and approved reports | Better governance, but requires OCI IAM, Vault, a Database Tools connection, and service setup |
| ORDS MCP | Remote HTTPS at /mcp | Existing ORDS estates and identity-provider integration | Central endpoint, but administrators must enable and secure connection pools and schemas |
Oracle's MCP overview describes all three models. Database Tools supports built-in SQL, custom parameterized SQL or PL/SQL, and curated reports; its official overview targets Oracle Database 19c and Oracle AI Database 26ai cloud services. ORDS can list authorized databases, inspect schemas, and execute SQL, per the ORDS Developer's Guide.
My choice: SQLcl for one developer against non-production; Database Tools for an OCI organization; ORDS when it is already the approved gateway. Avoid adding a community database bridge unless a missing feature justifies its review and patching burden. See the official server collection for other vendor-maintained choices.
How to set up Oracle MCP
The quickest verified setup uses SQLcl 25.2 or later, Java 17 or 21, an Oracle Database, and a saved SQLcl connection with its password stored. The client launches SQLcl with -mcp; OAuth is not involved in this local stdio path.
- Install SQLcl and a supported Java runtime.
- Create a dedicated, least-privilege database user.
- Save a named SQLcl connection with its password. Never paste a production password into the client configuration.
- Point the client at the absolute SQLcl executable path.
- Restart the client and verify the six tools before allowing calls.
Oracle documents the connection store and prerequisites in the SQLcl User's Guide. This is the exact shape Oracle publishes for Claude Desktop; replace the placeholder path:
{
"mcpServers": {
"sqlcl": {
"command": "PATH/bin/sql",
"args": ["-mcp"]
}
}
}
For the correct file location, use client documentation or the MCP Directory config generator; clients do not all store the same JSON. SQL Developer for VS Code can register SQLcl automatically for GitHub Copilot.
For Database Tools, create the connection, Vault key, IAM identity domain, MCP server, role assignments, and a toolset. Clients use the server URL with OAuth 2.0 or a Personal Access Token. Oracle's connection guide says roles are carried in the token; a valid token without the required role is insufficient. Prefer OAuth and short-lived access over copied PATs.
Tools you get
SQLcl exposes six documented tools, and the small surface helps you audit what the agent may call. These names come from Oracle's current guide, not a third-party wrapper.
| Tool name | What it does | Risk note |
|---|---|---|
list-connections | Lists saved Oracle Database connections | Can reveal environment and connection names |
connect | Opens one named saved connection | The selected account defines the blast radius |
disconnect | Ends the active database connection | Low risk, but confirm later calls reconnect where expected |
run-sql | Executes SQL queries and PL/SQL blocks | Can read or change data if the account permits it |
run-sqlcl | Executes SQLcl commands and extensions | Broader than SQL; keep SQLcl restriction defaults |
schema-information | Describes the connected schema | Metadata may disclose sensitive object design |
The list appears in Oracle's SQLcl User's Guide. Database Tools instead assembles toolsets. Its report tools include dbtools_list_reports, dbtools_execute_report, dbtools_get_report_sql, and dbtools_get_tool_request; see Oracle's toolset documentation. For MCP concepts beyond tools, see capabilities.
Permissions and blast radius
Start read-only, use a dedicated integration account, and assume every visible table may reach the model provider. Database grants—not prompts, dialogs, or descriptions—are the dependable enforcement layer. A careless write can change business rows, execute side-effecting PL/SQL, lock tables, or commit a bad migration.
For SQLcl, keep the default MCP restriction level. Oracle says default level 4 blocks host commands, scripts, and other sensitive operations; lowering it expands run-sqlcl. The restriction-level documentation shows that -R 0 allows all commands. I would not use that setting for an agent.
Use a sanitized replica, grant SELECT only on approved views, omit broad catalog and package privileges, and require confirmation for every mutation. Oracle logs SQLcl MCP activity in DBTOOLS$MCP_LOG and identifies sessions through database metadata, according to its launch guidance. Client chat history is not a database audit trail.
Real limits
The binding constraint is usually context, not Oracle's SQL engine. Thousands of returned rows consume model context, increase latency and cost, and make summaries less reliable. Filter and aggregate in SQL, select named columns, and begin with a small row limit.
There is no universal Oracle MCP calls-per-minute figure across SQLcl, Database Tools, and ORDS. SQLcl is local; remote limits also depend on identity, database, network, tenancy, and service controls. Oracle publishes resource ceilings—not a blanket request rate—including 10 Database Tools MCP servers and 250 toolsets per paid-account region, in its service limits. Measure your workload and handle throttling and expired tokens.
The API cannot rescue bad SQL, infer undocumented business definitions reliably, bypass grants, or make a multi-step plan atomic. The six SQLcl tools lack dedicated backup, IAM, or cloud-resource operations. A model can attempt related commands only if exposed and permitted, which is why broad accounts are dangerous. MCP standardizes tool exchange; the MCP architecture does not make calls safe transactions.
When not to use it
Do not use Oracle MCP when deterministic code, an approved report, or Oracle's native AI features solve the task with fewer moving parts. For a scheduled export, migration, or fixed integration, a parameterized script or REST endpoint is easier to test, version, retry, and audit.
Use Database Tools custom SQL/report toolsets when users need a narrow natural-language interface but should not generate arbitrary SQL. Use AI Vector Search or Select AI when the goal is database-native retrieval or natural-language SQL inside Oracle. Oracle documents Select AI in the Autonomous AI Database guide.
My line is simple: MCP earns its place when an interactive agent must choose among several governed database actions. If the operation is known, write the script. If data cannot leave the database boundary, keep the model and retrieval path inside the approved Oracle architecture. You give up conversational flexibility for reproducibility, smaller exposure, and clearer failures.