Skip to main content
Native BigQuery MCP setup in Sidecar is coming soon. Today, you can register a BigQuery MCP server through Sidecar’s custom connector.

​
Choose a server

Google provides two official options:
The managed BigQuery endpoint requires Google OAuth. Google access tokens normally expire after one hour, while Sidecar’s custom connector stores one static bearer token and does not refresh it. Do not use a temporary gcloud access token for scheduled Agent Console jobs.
For a durable connection today, host MCP Toolbox or another compatible BigQuery MCP server behind an HTTPS endpoint that accepts a stable bearer token. The endpoint must meet the custom endpoint requirements.

​
Prepare the Google Cloud identity

Use a dedicated service account for the hosted MCP server. The server can use Application Default Credentials from that identity instead of storing a service account key. This example creates an identity with project-wide query and read access:
Project-level roles/bigquery.dataViewer can read every dataset in the project. Grant it at the dataset level instead when agents should see only selected datasets. See the official BigQuery IAM roles and MCP Toolbox BigQuery requirements. If you already created the service account and custom role in the Sidecar BigQuery integration guide, you can reuse that identity only when its scope matches the access you want agents to have.

​
Host and secure the endpoint

Follow Google’s Cloud Run deployment guide for MCP Toolbox or deploy the server on your own infrastructure. Use these values as a starting point: MCP Toolbox’s prebuilt BigQuery configuration includes tools that can modify data and Google describes prebuilt configurations as build-time tools. For Agent Console jobs, expose a purpose-built read-only toolset or enforce read-only access with IAM and dataset permissions. Review the BigQuery MCP tool reference before making tools available to agents. Your gateway must validate the bearer value Sidecar sends and forward the request to the MCP server. Do not expose an unauthenticated Toolbox endpoint to the internet.

​
Register the endpoint in Sidecar

  1. In Sidecar, select Integrations → MCP Servers.
  2. Click Add MCP, then select Custom server.
  3. Enter values like these:
  1. Click Add server.
  2. Confirm that the server status is Connected and review the discovered tools.
Continue by granting the server to an agent and selecting it for jobs.

​
Troubleshooting

A pasted Google OAuth access token has expired. Use a hosted endpoint with a durable bearer-authentication layer, or wait for Sidecar’s native BigQuery MCP integration. Replacing the token manually is suitable only for a short test.
Confirm that the URL ends at the Streamable HTTP endpoint, normally /mcp, rather than the Toolbox service root. Verify that your gateway preserves the MCP request and accepts Sidecar’s Authorization header.
Check the IAM roles on the MCP server’s runtime service account and the dataset-level access policies. The identity needs permission to create query jobs in the billing project and read the referenced tables.