MCP server for ClickHouse

MCP server for ClickHouse is an application that provides AI assistants with access to ClickHouse databases via the standard Model Context Protocol (MCP). The server is deployed on a virtual machine in Yandex Cloud and connects to an existing ClickHouse cluster.

Key Features and Benefits

• Yandex AI Studio Integration. The MCP server integrates with AI Studio MCP Servers — connect it to your AI agents in just a few clicks.
• AI Assistant Integration. Enables AI models to execute queries against ClickHouse, analyze data, and retrieve database schema information.
• Bearer Token Authorization. All requests to the MCP server are protected with a Bearer token stored in Yandex Lockbox.
• Secure ClickHouse Connection. The ClickHouse connection password is stored in Yandex Lockbox and retrieved at startup. SSL/TLS support for encrypted connections. Optional CA certificate from Certificate Manager for non-Managed ClickHouse^®.
• Standard MCP Protocol. Uses the open Model Context Protocol for AI model interaction, ensuring compatibility with a wide range of clients.
• HTTP Transport. The MCP server is accessible on port 8000 (HTTP), simplifying integration with various clients and tools.
• Minimal Resources. The application runs on a virtual machine with minimal configuration (2 vCPU, 2 GB RAM), reducing infrastructure costs.

1. Make sure you have a running ClickHouse cluster (Managed Service for ClickHouse or self-hosted).
2. Create a secret in Yandex Lockbox to store the ClickHouse password. The secret must contain a clickhouse_password key with the password value.
3. Create a secret in Yandex Lockbox to store the Bearer token for authorization. The secret must contain a bearer_token key with an arbitrary token value.
4. (Optional) If using non-Managed ClickHouse^® and an additional CA certificate is required, upload a certificate to Yandex Certificate Manager.
5. (Optional) For diagnostics, enable SSH access and specify a username and public SSH key. When SSH is enabled, port 22 is accessible from the internet. After installation, connect with ssh <username>@<vm-public-ip>.
6. Create a service account for deploying the application and assign it the roles compute.editor, iam.serviceAccounts.admin, vpc.admin, and resource-manager.admin on the deployment folder.
7. Assign the installer service account the lockbox.admin role separately on the Bearer token secret and the external service credentials secret. This role is required to read and modify access permissions on the selected secrets; no folder-level Lockbox role is required. This also applies to secrets in another folder. During installation, the application creates a dedicated VM service account and grants it lockbox.payloadViewer only on the selected secrets.
8. The template also grants the VM service account certificate-manager.certificates.downloader on the deployment folder. The installer needs resource-manager.admin to create this IAM binding, even when no custom certificate is selected. If using a certificate, select one from the deployment folder; for a certificate in another folder, grant the VM account access to it separately.
9. In the management console select the Cloud Apps service.
10. In the left panel, select Application Store.
11. Select MCP ClickHouse and click the Use button.
12. Specify:
    • Application name.
    • (Optional) Application description.
    • The service account created earlier.
    • The cloud subnet where the virtual machine will be deployed.
    • Lockbox secret ID containing the Bearer token for authorization.
    • (Optional) Certificate from Certificate Manager for the ClickHouse^® connection.
    • ClickHouse host (FQDN).
    • ClickHouse port (default is 8443; valid range: 1–65535).
    • ClickHouse username (default is default).
    • Lockbox secret ID containing the ClickHouse password.
    • External access to the MCP server (optional; disabled by default, enable for connections through the public IP address).
13. Click the Install button and wait for the application to install.
14. After installation, copy the full URL from Application data, MCP server URL (internal): http://<private-ip>:8000/mcp. The client needs network access to the VM’s internal IP address.
15. Configure your AI client to connect to the MCP server, specifying the Authorization: Bearer <your-token> header.

Connecting the MCP server to Yandex AI Studio

1. In the management console open AI Studio and go to Agent Core → MCP servers.
2. Click Create MCP server and select the required MCP server under MCP servers from Yandex Cloud Marketplace.
3. Specify the server name and select an existing application instance, or create a new one by following the deployment instructions. When deploying a new server, the Save button becomes available only after the MCP server has been fully deployed and started.
4. After you select the application, the MCP server’s Network and Service account settings are filled in automatically.
5. Click Create. After the connection has been verified successfully, select the required tools and click Save. The MCP server will be registered in AI Studio and available for use by AI agents.

• Analyzing data in ClickHouse using an AI assistant.
• Automatic SQL query generation for ClickHouse via natural language.
• Exploring ClickHouse database schema with AI.
• Monitoring and analyzing logs stored in ClickHouse.
• Building reports and visualizations based on ClickHouse data.

Yandex Cloud technical support is available 24/7. The types of requests you can submit and the appropriate response time depend on your pricing plan. You can switch to the paid support plan in the management console. You can learn more about the technical support terms here.