Ocient MCP Server

​

Ocient MCP Server and Its Tools

• The server itself defines only the execute_statement tool. The server discovers all other tools by querying the sys.mcp_tools system catalog table, exposes them to MCP clients as standard MCP tools, and executes them using the CALL MCP TOOL SQL statement.
• New user-defined tools become available to MCP clients immediately after you create them, without a server upgrade or restart.
• The Ocient System governs all tools with standard access control privileges.
• Because all tools are remote, no tools are available while the connection to the Ocient System is down. In this case, the server returns a clear connection-failure error as tool output so that the AI agent can report the issue.

​

Prerequisites

• Access to an Ocient System with a database user account.
• The uv Python package manager, which provides the uvx command.
• Network connectivity from the machine that executes the server to the SQL port of the Ocient System.

​

Deployment Models

​

Deploy Locally with Stdio

1. If you set the OCIENT_DSN environment variable, the server connects using the full Data Source Name (DSN) and ignores the SSO environment variables.
2. Otherwise, the server requires the OCIENT_HOSTS and OCIENT_DATABASE environment variables and connects using single sign-on (SSO).

{
  "mcpServers": {
    "ocient": {
      "command": "uvx",
      "args": ["--from", "ocientmcp", "ocientmcp-stdio"],
      "env": {
        "OCIENT_HOSTS": "host1.ocient.com,host2.ocient.com",
        "OCIENT_DATABASE": "mydb"
      }
    }
  }
}

{
  "mcpServers": {
    "ocient": {
      "command": "uvx",
      "args": ["--from", "ocientmcp", "ocientmcp-stdio"],
      "env": {
        "OCIENT_DSN": "ocient://username:password@host:port/database"
      }
    }
  }
}

​

Deploy Remotely with Streamable HTTP

uvx ocientmcp-http --auth-file /var/opt/ocient/mcp/auth.yaml

• If the MCP client supports Streamable HTTP natively, configure the client directly with the server URL and pass the API key as a Bearer token.
• If the MCP client supports only the Stdio transport, configure the ocientmcp-http-proxy entrypoint with the --url option and pass the API key in the OCIENT_MCP_API_KEY environment variable.

{
  "mcpServers": {
    "ocient": {
      "command": "uvx",
      "args": [
        "--from", "ocientmcp",
        "ocientmcp-http-proxy",
        "--url", "http://localhost:8000/mcp"
      ],
      "env": {
        "OCIENT_MCP_API_KEY": "secret_key_abc_123"
      }
    }
  }
}

​

Authentication

​

Stdio Authentication

ocient://username:password@host:port/database

​

Streamable HTTP Authentication

• A DSN connection string.
• An object with a dsn key for SSO access and a token_source key with the path of the JSON file for the SSO token. Only machine-to-machine SSO is supported for the Streamable HTTP transport, and the Google identity provider is supported for SSO access.

# /var/opt/ocient/mcp/auth.yaml

# DSN access
secret_key_abc_123: ocient://user1:pass1@host:port/db1
secret_key_abc_456: ocient://user2:pass2@host:port/db2

# SSO access
secret_key_sso_123:
  dsn: ocient://user:password@host:port/database?handshake=sso&identityprovider=google_sso
  token_source: /path/to/token_source.json

• The authentication file must have 600 file permissions because the file contains plain-text DSNs. The server validates the file permissions at startup.
• API keys are Bearer tokens over HTTP. Use TLS for production deployments. The server logs a warning if it executes over HTTP without TLS.

​

Connection Behavior

• For the Stdio transport, a single DSN or SSO configuration maps to one persistent connection. The server opens the connection on the first tool invocation and reuses it for all subsequent calls.
• For the Streamable HTTP transport, each API key maps to one set of connection credentials, and each connected client has its own logical connection and session. Because multiple connections can be open concurrently, idle connections have a 30-minute time-to-live, after which the server closes them. The server reconnects automatically on the next tool invocation.
• If the Ocient connection goes down during a session, the server returns a connection-failure error as tool output instead of a transport-level failure, so that the AI agent can inform you of the issue.

​

Tool Reference

​

Static Tools

​

Dynamic Tool Discovery

​

System Tools

​

User-Defined MCP Tools

CREATE MCP TOOL my_schema.my_tool(schema VARCHAR)
    DESCRIPTION 'This tool lists user-defined tables within a schema.'
    TOOLSET 'System Information'
    AS BEGIN TOOL
        RETURN SELECT * FROM information_schema.tables
        WHERE table_schema NOT IN ('sys', 'information_schema')
        AND table_type = 'BASE TABLE'
        AND (@schema IS NULL OR table_schema = @schema);
    END TOOL;

• Tools support the SQL language for their definitions.
• Every tool has a toolset, which groups related tools.
• The ALTER statement is not supported for MCP tools. To change a tool, use the CREATE OR REPLACE MCP TOOL SQL statement.
• The tool object supports the CREATE, VIEW, DROP, and EXECUTE privileges.
• The CALL MCP TOOL SQL statement executes the SQL definition of the tool with the privileges of the caller. There is no privilege escalation.

​

Usage Considerations

• The system scopes all tool results to the privileges of the connected database user. For shared or agent-driven deployments, create a dedicated database user with the minimum privileges the agent requires, and revoke the EXECUTE privilege on any system tools you do not want the agent to use. For details, see Data Control Language (DCL) Statement Reference.
• SQL statements that AI agents submit through the MCP server execute like any other SQL statement and participate in workload management. You can use service classes to control the priority of agent-driven queries. For details, see Workload Management and Service Classes.
• AI agents can request large result sets. Where possible, define user-defined MCP tools that aggregate or limit results instead of exposing broad queries, and include LIMIT clauses in exploratory queries.
• Agent-driven queries appear in the sys.queries and sys.completed_queries system catalog tables like any other query. For details, see System Catalog.

​

Limitations

• A single server instance connects to one Ocient System. Multi-system routing is not supported.
• With the Stdio transport, connecting to a different database requires a server restart.
• The legacy HTTP with SSE transport is not supported.
• User-defined MCP tools support SQL definitions only.
• MCP tools do not support the ALTER statement.
• Only machine-to-machine SSO is supported for the Streamable HTTP transport.
• No tools are available while the connection to the Ocient System is down.

​

Related Links