Skip to main content

MCP Servers for Data and Analytics: Official Servers to Try

Short answer

The major warehouses, BI tools, product analytics platforms and payment providers publish their own MCP servers. Most of them are hosted by the vendor, and Tableau, dbt and PayPal also offer servers you run on your own machine. Read-only options vary. Snowflake and BigQuery have a documented read-only mode, and Stripe lets you limit a key to the permissions a client needs. Payments servers can move money, so connect those to a sandbox or with read-only access first.

Tested withVendor documentation, checked 2026-10-20Checked 20 Oct 2026

By Tony LewisHow we test these guides

How to read this list​

Each entry links to the vendor's own documentation, which is what we checked on 2026-10-20. "Remote" means the server runs on the vendor's side and you connect with a URL. "Local" means your AI app starts a program on your computer. Read-only means the vendor documents a way to turn writes off. Where the docs don't describe one, the entry says so.

Warehouses and BI​

Snowflake​

Snowflake's managed MCP server is remote. You create an MCP server object inside Snowflake with CREATE MCP SERVER, and the client connects to a URL in the form https://<account_url>/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}. It can expose Cortex Agents, Cortex Analyst, Cortex Search and SQL execution as tools.

  • Sign-in: Snowflake OAuth by default, with External OAuth as an option. Snowflake recommends OAuth over hardcoded tokens.
  • Read-only: Yes. The SQL execution tool has a read_only option, which allows only SELECT queries and defaults to true.
  • Risk: The server can see what the role it runs as can see. Grant an access role only to the users who need it, and don't grant it to PUBLIC.
  • Source: Snowflake-managed MCP server

BigQuery​

Google's BigQuery MCP server is remote, at https://bigquery.googleapis.com/mcp. It uses OAuth 2.0 with IAM, so any Google Cloud identity with the right roles can connect.

  • Sign-in: OAuth 2.0 with IAM roles on the datasets you want the server to reach.
  • Read-only: Yes. The execute_sql_readonly tool allows only read operations. It refuses DML, DDL and Python UDFs, and it caps results at 3,000 rows.
  • Risk: Give the identity only the IAM roles it needs, and only on the datasets it should query.
  • Source: Use the BigQuery MCP server

Databricks​

Databricks publishes managed MCP servers in the system.ai schema. The Databricks SQL server is at https://<workspace-hostname>/api/2.0/mcp/sql and uses the sql OAuth scope. A workspace admin has to turn on Managed MCP Servers on the workspace Previews page first, and each server's page shows its release status.

  • Sign-in: OAuth with the sql scope.
  • Read-only: Not documented on the page I checked. Databricks says you can control who invokes these MCPs through Unity Catalog.
  • Risk: Queries run with the signed-in user's permissions, so the access you give the user is the access the agent gets.
  • Source: Databricks-provided MCPs

Tableau​

Tableau's MCP server has two options. The hosted server at https://mcp.tableau.com uses OAuth 2.1, so each user signs in with their own Tableau Cloud identity and existing permissions apply. The self-hosted option runs @tableau/mcp-server with npx on your computer and reads SERVER, SITE_NAME, PAT_NAME and PAT_VALUE from its environment.

  • Sign-in: OAuth 2.1 for the hosted server. A personal access token for the local one.
  • Read-only: Not documented in the README I checked.
  • Risk: A personal access token acts as the account that created it. Keep it out of shared config files.
  • Source: tableau/tableau-mcp

dbt​

dbt Labs publishes a dbt MCP server in two forms. The self-hosted server runs locally with uvx dbt-mcp. The remote server uses an HTTP connection to the dbt platform. Both work with OAuth or a token, depending on your setup.

  • Sign-in: OAuth or a token, depending on the form you use.
  • Read-only: The self-hosted server can disable specific tools. The dbt docs point to the environment variables reference for the settings.
  • Risk: execute_sql runs SQL on dbt Platform infrastructure, so give the token only the access you're comfortable with.
  • Source: dbt-labs/dbt-mcp and About the dbt MCP server

Product analytics​

Mixpanel​

Mixpanel's hosted server is at https://mcp.mixpanel.com/mcp for US projects. EU and India projects use mcp-eu.mixpanel.com and mcp-in.mixpanel.com. Mixpanel says the server supports OAuth for interactive use, and service accounts for scripts and automation. Service accounts are in beta.

  • Sign-in: OAuth through your Mixpanel login, or a service account credential header (beta).
  • Read-only: Not documented. The tool list includes feature flag and experiment tools, so check which ones you're exposing before you connect.
  • Risk: Service accounts are non-human users. Give one only the project access the automation needs.
  • Source: Mixpanel MCP Server

PostHog​

PostHog's hosted server is at https://mcp.posthog.com/mcp. You sign in with your PostHog login, and PostHog routes you to the US or EU region from your account.

  • Sign-in: OAuth through PostHog.
  • Read-only: Not documented on the page I checked.
  • Risk: PostHog's own examples include changing issue status and creating assignment rules, so the server can make changes, not only read analytics.
  • Source: PostHog MCP server

Payments and finance data​

These servers touch money or financial records, so start with a sandbox or a read-only key.

Stripe​

Stripe's remote server is at https://mcp.stripe.com. The OAuth sign-in asks for access per account and per environment, live or sandbox, and you can revoke a session at any time. For autonomous clients that can't use OAuth, Stripe uses agent API keys, passed as a bearer token.

  • Sign-in: OAuth, or an agent API key in the Authorization header.
  • Read-only: I didn't find a single read-only switch. Limit the access instead: give an agent API key only the permissions it needs, and choose the permissions in the OAuth consent screen.
  • Risk: stripe_api_write covers every POST, PATCH, PUT and DELETE call, so an agent with that tool can change payment objects. Stripe says it will stop accepting full-access secret keys and restricted keys without the Agent tag starting in December 2026, and asks you to migrate by November 30, 2026.
  • Source: Stripe MCP server

PayPal​

PayPal's official server is on GitHub, at paypal/paypal-mcp-server. It runs locally with npx -y @paypal/mcp, and it reads a PAYPAL_ACCESS_TOKEN and PAYPAL_ENVIRONMENT setting. Set PAYPAL_ENVIRONMENT to SANDBOX while you test. The README's examples use --tools=all.

  • Sign-in: An access token from PayPal's OAuth token endpoint, with the client credentials grant. The token belongs to your app, not to a person.
  • Read-only: Not documented. The README doesn't describe a read-only mode.
  • Risk: The tool list includes pay_order, create_refund and dispute tools such as accept_dispute_claim. Use the sandbox until you've reviewed what the agent can do.
  • Source: paypal/paypal-mcp-server

Plaid​

Plaid's Dashboard MCP server is remote, at https://api.dashboard.plaid.com/mcp/, and uses Streamable HTTP. It provides production diagnostics and analytics, such as tools for debugging Items, reviewing Link conversion data and checking usage.

  • Sign-in: An OAuth token with the mcp:dashboard scope, from the client credentials grant against Plaid's token endpoint.
  • Read-only: I didn't find a read-only setting in the docs.
  • Risk: The token gives the client access to production diagnostics. Keep the client secret out of shared config, and rotate it if it leaks.
  • Source: Plaid Dashboard MCP server

Search the MCPBundles directory​

The MCPBundles directory lists MCP servers, and you can search it by service name. To look for a warehouse server, try www.mcpbundles.com/?q=snowflake. MCPBundles isn't affiliated with the listed services unless a listing says so, so check the publisher before you connect. Use the directory to find a server, and use the vendor's docs above to check what it can do. Browsing the catalog covers the directory view, and setting up credentials explains how your sign-in is stored. Before you connect a server to production data, read MCP security best practices.

FAQ​

Which data warehouse servers have a read-only mode?

Snowflake and BigQuery document one. Snowflake's SQL execution tool has a read_only option that defaults to true, and BigQuery has an execute_sql_readonly tool that refuses writes.

Is it safe to connect Stripe to an AI client?

It can be, if you limit what it can do. Use OAuth with only the permissions the client needs, or an agent API key with narrow permissions, and test in sandbox mode first. The write tool can change payment objects.

Which of these servers run on my computer?

Tableau and dbt have local options, and PayPal runs locally through npx. The other servers on this page are hosted by their vendors, and you connect to them with a URL.

Do I need a separate server for each analytics tool?

Usually yes. Each vendor publishes its own server with its own sign-in, so you connect each one you use. The directory lets you search for them in one place.