Connecting to the database is only the first layer · The real barrier in this class is metric definitions, and nobody can sell you those
2026-09-23 · BigCat
This class installs fastest and fails most quietly: the SQL runs, the chart renders, the number is wrong, and nothing turns red. So this issue gives you ten installable entries first, then a review checklist built specifically for silent failure.
When a writing skill goes wrong you can see it. When a data skill goes wrong you see a nicely formatted number. Failure in this class is silent: wrong column, wrong definition, one missing filter, and the query still returns a row. Worse, the thing that would save you is not in any marketplace: only you know what your company calls an active user. This issue names ten real, installable entries (some from the official plugin marketplace, some from GitHub, some from the official skills repo), gives the table and the commands first, and saves the selection criteria for the second half.
// 01
The list first: ten entries, install commands below
Claim: read the second column across. Half of these are one-click installs from the official plugin marketplace; the other half are MCP servers you have to configure yourself. The first half saves time, the second half is the only one that pins down definitions.
Entry Source What it takes off your plate When not to install
──────────────────────────────────────────────────────────────────────────────────────────────────────────
(1) duckdb-skills Official · DuckDB Foundation SQL over any local data file Your data lives only in a cloud warehouse
(2) bigquery-data-analytics Official · Google LLC Q&A over BigQuery datasets You do not use BigQuery
(3) clickhouse + 28 rules Official · ClickHouse Read-only SQL on CH Cloud Self-hosted CH: use mcp-clickhouse
(4) MCP Toolbox for Databases googleapis/genai-toolbox Definitions as tools, not open SQL You only need one ad-hoc query
(5) Postgres MCP Pro crystaldba/postgres-mcp Index tuning · EXPLAIN · health You do not run Postgres
(6) DBHub bytebase/dbhub One gateway, six engines, guards One engine with an official plugin
(7) mcp-server-motherduck motherduckdb Local / S3 / cloud under one SQL You do not intend to write SQL
(8) mcp-server-chart antvis 26+ chart types from one sentence Data may not leave your network
(9) xlsx, inside document-skills anthropics/skills Results as .xlsx that is not broken You want charts, not sheets
(10) jupyter-mcp-server datalayer Code that runs in a real notebook You have no notebook workflow
──────────────────────────────────────────────────────────────────────────────────────────────────────────
(1)(2)(3) are one-click; (4)(5)(6)(7) are the connection layer, pick one per engine; (8)(9) are output; (10) is a runtime.
How to install (commands copied from each project's own page)
# (1)(2)(3) the official marketplace is added on first interactive start; add it by hand if not
/plugin marketplace add anthropics/claude-plugins-official
/plugin install duckdb-skills@claude-plugins-official
/plugin install bigquery-data-analytics@claude-plugins-official
/plugin install clickhouse@claude-plugins-official
/plugin install clickhouse-best-practices@claude-plugins-official
# (4) binary / brew / npm; the real configuration lives in tools.yaml
brew install mcp-toolbox
npx -y @toolbox-sdk/server --prebuilt=postgres --stdio # prebuilt tools, to try it out
./toolbox --config "tools.yaml"# the real use: your own tools# (5) on a production database, always pass restricted
pipx install postgres-mcp
postgres-mcp --access-mode=restricted
# (6) one gateway for Postgres/MySQL/SQL Server/MariaDB/Oracle/SQLite
npx @bytebase/dbhub@latest --transport http --port 8080 \
--dsn "postgres://user:password@localhost:5432/dbname?sslmode=disable"# (7) no token means pure local DuckDB; drop --read-write to stay read-only
uvx mcp-server-motherduck --db-path :memory: --read-write --allow-switch-databases
# (8) uses its public rendering service by default; self-host and point VIS_REQUEST_SERVER at it
npx -y @antv/mcp-server-chart
# (9) the official document suite: xlsx / docx / pptx / pdf together
/plugin marketplace add anthropics/skills
/plugin install document-skills@anthropic-agent-skills
# (10) start JupyterLab first, then attach the MCP server
uvx jupyter-mcp-server@latest
# do this right after installing
/skill-doctor # context cost and invocation count per skill
One by one, in plain words
(1) duckdb-skills (official marketplace, authored by DuckDB Foundation): the catalog describes it as read any data file, attach and query DuckDB databases, search DuckDB/DuckLake docs, search past session logs, and install/update DuckDB extensions. This is the lowest-barrier entry in the whole list — a folder of CSV or Parquet files is enough, no service to connect. When not to install: your data lives only in a cloud warehouse and there is not a single local file.
(2) bigquery-data-analytics and looker (official marketplace, both authored by Google LLC): one talks to BigQuery datasets, the other talks to Looker in LookML. The second deserves separate attention: LookML is a written-down, executable definition layer. If you already run Looker, you have solved half of the hardest problem in this class.
(3) clickhouse (official marketplace, authored by ClickHouse): browse organizations, services, databases and schemas, run read-only SQL, and inspect backups and billing. The same vendor ships clickhouse-best-practices — 28 best practice rules for schema design, query optimization and ingestion, prioritized by impact. It connects to nothing; it only changes how the model writes. Self-hosted ClickHouse goes through ClickHouse/mcp-clickhouse (877 stars per its GitHub repo page, 2026-09, Apache-2.0; CLICKHOUSE_ALLOW_WRITE_ACCESS=false by default).
(4) MCP Toolbox for Databases (16.5k stars per its GitHub repo page, 2026-09, Apache-2.0): the most-starred entry here, and the only one that attacks the definition problem head-on. Its own README makes the argument: compared with generic SQL access, custom tools give you restricted access, structured queries and semantic search, with safety coming from predefined logic rather than direct queries. You define how monthly actives are computed as a parameterized tool in tools.yaml, and the model can only call it — it cannot invent a second version. Coverage includes AlloyDB, BigQuery, Cloud SQL, Spanner, Postgres, MySQL, SQL Server, Oracle, MongoDB, Redis, ClickHouse, Snowflake and Trino. When not to install: for a one-off question, writing the YAML costs more than the answer is worth.
(5) Postgres MCP Pro (3.3k stars per its GitHub repo page, 2026-09, MIT): more than a SQL pipe — it brings the DBA toolkit over: health checks for index health, buffer cache, vacuum status and replication lag; industrial-strength algorithms to find missing indexes; EXPLAIN with hypothetical index simulation, so you can price an index without creating it. The two access modes are stated plainly: unrestricted for a dev box, restricted for production, meaning read-only transactions with an execution time limit. On production there is no second option.
(6) DBHub (3.6k stars per its GitHub repo page, 2026-09, MIT): one gateway across Postgres, MySQL, SQL Server, MariaDB, Oracle and SQLite. The tool surface is restrained — execute_sql and search_objects, with explain_sql and health_check opt-in — plus custom parameterized SQL tools, a lighter version of what (4) does. The README states the guardrails as read-only mode, row limiting and query timeout. Honest disclosure: its options site was blocked by the egress policy this issue, so the exact flag names are not copied here — read its Command-Line Options page before you install.
(7) mcp-server-motherduck (523 stars per its GitHub repo page, 2026-09, MIT): local files, in-memory databases, data on S3 and MotherDuck in the cloud, all under one SQL dialect; with no token it stays entirely local. The difference from (1) is that (1) is a set of skills (instruction layer) and this is an MCP server (tool layer). Install both and they fight over the same job, so pick one.
(8) mcp-server-chart (4.4k stars per its GitHub repo page, 2026-09, MIT): 26+ chart types, including sankey, funnel, violin, fishbone, mind map and network diagrams. Two boundaries you must know: by default it calls the free rendering service it provides, which means your data leaves your network — self-host and point VIS_REQUEST_SERVER at your own instance if that matters; and the map charts depend on AMap, so they only work inside China.
(9) the official xlsx skill (bundled in the document-skills plugin): the output-layer entry most worth installing, because it writes not-breaking-the-file into hard rules — use real formulas rather than hardcoding a value Python computed; after writing formulas, run scripts/recalc.py, which drives LibreOffice to actually evaluate them, and do not deliver unless errors_found is zero; XLOOKUP, FILTER and UNIQUE are banned because LibreOffice cannot evaluate them, so use INDEX/MATCH. The one rule most worth stealing for your own standards: every assumption and hardcoded number must carry a cell comment saying where it came from.
(10) jupyter-mcp-server (1.3k stars per its GitHub repo page, 2026-09, BSD-3-Clause): lets the model create cells, execute them and read outputs in a real notebook instead of imagining code in chat. The cost is setup: JupyterLab, the collaboration extension, and a fair number of version constraints. When not to install: no notebook workflow, in which case duckdb plus Bash is enough.
Two more, as warnings only · runekaagaard/mcp-alchemy (420 stars per its repo page, 2026-09, MPL-2.0) reaches anything SQLAlchemy can reach, but its docs state no read-only switch — keep it off production. And the official reference serversno longer include postgres or sqlite (what remains: everything, fetch, filesystem, git, memory, sequentialthinking, time). Any tutorial still telling you to install those two is stale. One box stays empty this issue: on anomaly detection, the skill repos that turned up were either at zero stars and zero forks or were just a few statistical methods rewritten as prompts, so none qualified to be named — better an empty box than filler.
// 02
Why these ten do not compare: four layers, and nobody sells the bottom one
Claim: the connection layer decides what it can reach, the execution layer decides whether it can actually compute, the output layer decides whether you can send it to anyone — and the definition layer, which decides whether the number is right, has no off-the-shelf product at all.
Output (8) mcp-server-chart · (9) xlsx -> charts and sheets you can send
^
Execution (1) duckdb-skills · (7) motherduck · (10) jupyter -> the number gets computed
^
Connection (2)(3)(4)(5)(6) -> the bytes come out of your database
^
Definition --- nobody sells you this --- -> what "active user" actually means
The usual install covers only the middle two layers: connected, charting, and giving a different answer to the same metric question every time. That is not the model being dumb — it is a database with thousands of columns whose definitions nobody ever wrote down. The enterprise text-to-SQL benchmark Spider 2.0 (ICLR 2025 Oral) quantified it: per its repo README, on the paper's numbers (2024-11), the strongest LLMs of the time solved only 6.0% of Spider 2.0 tasks, versus 86.6% on Spider 1.0 and 57.4% on BIRD. The three numbers together are the point — it is not that models cannot write SQL; it is that in a real enterprise database, question-to-SQL has no single correct answer. (Leaderboard scores in 2026 are well above that figure; the benchmark's own site was blocked by the egress policy this issue, so only the paper's number and its date are quoted.)
So selection order in this class is the reverse of every other class: decide where the definitions live, then pick tools. Three workable paths, all named above: tools.yaml in (4), where a metric becomes a parameterized tool the model can call but not rewrite; the custom parameterized SQL tools in (6), the lighter version of the same idea; and the official looker plugin if you already have LookML, which is itself an executable definition layer. If none of the three is available, fall back to the crudest option: write your handful of metric definitions, canonical tables and forbidden tables straight into CLAUDE.md, and let the rule from (9) leave a trail — assumptions must be written as cell comments.
(8) and (9) sit in their own layer because they only govern how it looks and whether the file survives — they say nothing about whether the number is right. A sankey diagram will render a wrong definition very professionally.
How it breaks: someone installs (5) and (6), both pointed at the same Postgres. The same question then takes different execution paths with different row caps on different runs, and you conclude the data changed. One entry point per database. That is a hard rule.
// 03
Three-minute review: six questions the README already answers
Claim: in this class you read switches, not stars. If any one of these six has no answer, do not point it at production.
Is it read-only by default? The best answers here are (5), whose --access-mode=restricted gives read-only transactions with an execution time limit, and mcp-clickhouse, where CLICKHOUSE_ALLOW_WRITE_ACCESS is false by default. In (7) write access is something you add with --read-write. mcp-alchemy leaves this box empty.
Is there a row cap and a query timeout? Without them, one SELECT * fills your context window and your connection pool at the same time. (6) states both guardrails.
How does the schema enter context? Dumped in full at startup, or fetched on demand (search_objects in (6), schema browsing in (3))? On a database with thousands of columns, the first option burns money every turn.
Can you see the SQL? It must show you the statement it actually ran. A data tool that hides its SQL is a contract with the terms removed.
Does the data leave this machine? (8) goes through a public rendering service by default; (1), (5), (6), (7) and (10) all run locally. This question alone decides whether the tool may touch production data.
Can definitions be pinned down? Only (4), (6) and looker have anything real here. Everything else relies on the model improvising, and improvisation differs run to run.
The line for this section: star counts are worth less in this class than in any other. (8) has 4.4k stars and runs no SQL at all; (4) has 16.5k and degrades into an ordinary SQL gateway if you never write tools.yaml. Pick by the layer you are missing, not by rank.
// 04
The honest cost: this is the class you should least install wholesale
Claim: the marginal cost of data tooling is not tokens — it is your trust in a wrong number, and that bill comes due at the quarterly review.
Three bills
Tool slots and context tax: every connection-layer server parks another batch of tool descriptions in every turn. Plenty of people install (4), (5), (6) and (7) when they need exactly one. Run /skill-doctor after installing and see who is collecting rent.
Permissions: grant write access for convenience, and one day a cleanup step runs a DELETE. There is no undo key for that. Read-only is the default, not an option.
Silent errors: the most expensive failure in this class raises nothing. Wrong column, wrong definition, one filter short, and the query still succeeds. (1), (7) and (10) will not catch it, and (8) will draw it as a beautiful chart.
What you can do without installing anything
Export a CSV and hand it to the official xlsx skill. No database connection means no permission risk, and its formula-verification loop still applies.
A duckdb CLI plus Bash is an execution layer. What (1) adds is convenience and doc search, not capability.
Write the definitions before you buy the tools. Put the five metrics you ask about most into CLAUDE.md, with canonical tables and forbidden tables spelled out. That step is worth more than any server on this list, and it costs nothing.
The permanently empty box: (4) can guarantee the model only calls tools you defined, (5) can tell you which index a query used, (9) can guarantee the formulas evaluate — none of them can tell you whether the definition you wrote is the right one. That step is still human work, and only the human who knows the business can do it.
// THE ONE-PAGE BUYING CARD
Install these three first: (1) /plugin install duckdb-skills@claude-plugins-official — local files become queryable immediately, with zero permission risk. (2) the one that reaches your database, chosen by engine: for Postgres, pipx install postgres-mcp and always pass --access-mode=restricted; for a mixed estate, npx @bytebase/dbhub@latest; if you already live in BigQuery or ClickHouse, install the official bigquery-data-analytics or clickhouse. (3) /plugin install document-skills@anthropic-agent-skills — so results land as an .xlsx whose formulas evaluate and whose assumptions carry comments.
Add as needed: googleapis/genai-toolbox (you want metric definitions pinned into tools and will write tools.yaml) · antvis/mcp-server-chart (you need charts and accept the public renderer, or will self-host VIS_REQUEST_SERVER) · clickhouse-best-practices (you are designing ClickHouse tables) · datalayer/jupyter-mcp-server (you already live in notebooks) · ClickHouse/mcp-clickhouse (self-hosted ClickHouse) · the official looker (you already have LookML).
Explicitly do not: grant write access on production · point two servers at the same database · dump a whole schema into context at once · use something like mcp-alchemy, with no read-only switch, against production · follow an old tutorial into the official reference postgres or sqlite servers that no longer exist · assume that installing all ten solves the definition problem.
// GLOSSARY
metric definition
How a business number is actually computed: which table, which time window, which exclusions. It decides whether the number is right, and it exists only inside your company.
text-to-SQL
Turning a natural-language question into SQL. Enterprise benchmarks like Spider 2.0 show the hard part is not syntax but picking the right columns and definitions out of thousands.
restricted / unrestricted access mode
The two permission levels in Postgres MCP Pro. The former means read-only transactions with an execution time limit, for production; the latter is for a dev box.
tools.yaml
The MCP Toolbox config file: define a metric as a parameterized tool there and the model can call it but cannot write its own version of the SQL.
LookML
Looker's modeling language. Its value is that the definitions are written down and executable — the layer most companies are missing.
hypothetical index
Letting the planner pretend an index exists to see whether the plan improves, without building it. Postgres MCP Pro's index advice rests on this.
recalc check
The closing step of the official xlsx skill: LibreOffice actually evaluates the formulas, and nothing ships unless errors_found is zero.
// FURTHER READING
anthropics/claude-plugins-official — the official plugin catalog; the names and authors of duckdb-skills (DuckDB Foundation), bigquery-data-analytics / looker (Google LLC) and clickhouse / clickhouse-best-practices (ClickHouse) in this issue all come from its marketplace.json (2026-09)
Claude Code · Discover plugins — the official marketplace is added on first interactive start; /plugin install <name>@claude-plugins-official; the details pane shows Context cost and Last updated (2026-09)
googleapis/genai-toolbox — tools.yaml; brew install mcp-toolbox and --prebuilt=postgres --stdio; custom tools as restricted access plus structured queries (16.5k stars per its repo page, 2026-09, Apache-2.0)
crystaldba/postgres-mcp — index tuning, EXPLAIN with hypothetical indexes, database health checks; --access-mode=restricted|unrestricted (3.3k stars per its repo page, 2026-09, MIT)
bytebase/dbhub — six engines; execute_sql / search_objects, with explain_sql and health_check opt-in; custom parameterized SQL tools (3.6k stars per its repo page, 2026-09, MIT)
motherduckdb/mcp-server-motherduck — local files / memory / S3 / MotherDuck; no token means fully local (523 stars per its repo page, 2026-09, MIT)
antvis/mcp-server-chart — 26+ chart types; public rendering service by default, self-host via VIS_REQUEST_SERVER; map charts depend on AMap and work only inside China (4.4k stars per its repo page, 2026-09, MIT)
anthropics/skills · xlsx — formulas not hardcoded values; scripts/recalc.py and errors_found; XLOOKUP/FILTER/UNIQUE banned; assumptions as cell comments
xlang-ai/Spider2 — the enterprise text-to-SQL benchmark (ICLR 2025 Oral); 547 examples each for Spider 2.0-Snow and -Lite, 68 for DBT; the 6.0% vs 86.6% vs 57.4% figures are the paper's (2024-11)
datalayer/jupyter-mcp-server — create and execute cells in a real notebook (1.3k stars per its repo page, 2026-09, BSD-3-Clause)