Published: 2026-10-17

MCP Tool Calls in a SQL Client: What 24,725 Logged Events Show, and Which SQL Clients Have an MCP Server

Between September 17 and October 16, 2026, 67 of the 887 Jam SQL Studio installations that started the app (7.6%) sent at least one MCP tool-call event, and 68 installations sent them in all. They sent 24,725 events: 82.7% were for query_execute, the tool that runs SQL, and 85.6% were labelled succeeded, 8.4% failed and 6.0% refused. The data counts events, not separate calls; the reason is below.

Which other SQL clients have an MCP server, from each vendor’s own pages as of October 17, 2026: DataGrip and TablePlus for macOS have a built-in MCP server; DBeaver has MCP servers in its paid dbvr CLI and its web products, and documents a desktop one for version 26.3, which its release notes did not list yet; SSMS and VS Code connect to MCP servers without documenting a server for outside agents; Navicat and Beekeeper Studio document neither.

Each event is an entry in the audit trail of the app’s local MCP server, logged for calls from external MCP clients such as coding agents, from the jam-sql command-line tool and from the app’s own AI chat sidebar. Every number below counts these events: which tool was called, where the call came from and how the logged step ended. Jam SQL Studio does not record the SQL, the prompt or the database, so the data shows what was asked of the app, not why. Some of the calls were not made by an autonomous agent at all: the jam-sql CLI can be run by hand, and the chat sidebar answers a person typing in the app.

The 24,725 events by outcome

The events came from Jam SQL Studio 1.4.0 to 1.5.6 on 44 macOS, 20 Windows and 4 Linux installations. The app’s MCP server is off by default in all of these versions, so each of the 68 installations had turned it on.

Why these are events, not calls

Most tool calls log one event. The exception, in every version in this data, is a write sent to query_execute on a connection at Confirm. The app logs a refused event while the approval dialog waits, then a second event with your answer (refused if you deny it or let it time out, succeeded if you approve it, an error if the dialog could not be shown), and after an approval a third event with the result of running the write. The events carry no call ID and no permission level, so they cannot be grouped back into calls.

Each event is also uploaded on its own. Since version 1.5.1 the app drops events of one name that arrive more than 100 times a minute, and an event whose upload fails three times is lost, so the events of one call can arrive incomplete; a retried upload may, rarely, be stored twice. For these reasons the data cannot say how many separate calls the 24,725 events stand for, or how each call ended. The outcome shares in this post are shares of events. The refused label also covers every write that waited at Confirm, including the ones you then approved, so refused events are not a count of refused calls.

Which tools were called

77 different tools appear in the events. Running SQL dominates:

By family, running SQL with query_execute was 82.7% of events on 62 installations; listing and opening connections 10.0% (2,471 events, 56 installations); driving the app’s tabs and editor 3.2% (798 events, 42 installations); the schema tools 2.1% (512 events, 44 installations); notebooks 0.9% (211 events, 5 installations). Dashboards, Schema and Data Compare, MetaInfo and transaction control together stayed under 1%. 23 of the 62 installations with query_execute events sent no schema tool event. Of the 75 schema_get_columns error events, 73 came from one installation on a version before 1.5.0, which records no error category.

Where the calls came from

The MCP server labels each session when a client connects, and every event carries that label. Three sources showed up:

• External MCP clients are anything connected to the local endpoint with the bearer token: coding agents such as Claude Code, Codex or Cursor, Claude Desktop through the @jamsql/mcp stdio bridge, custom agents, and agents started in Jam SQL Studio’s own AI terminal, which use the same endpoint. The data does not say which client it was.
• The jam-sql CLI is what an agent calls when the Jam SQL skill is installed (jam-sql add-skill). People can also run it in a terminal, and the data cannot tell the two apart.
• The AI chat sidebar runs the Claude Code or Codex CLI installed on the machine, inside the Query Editor or a SQL notebook, in answer to a person typing in the app.

30 installations used only external clients, 13 only the sidebar and 12 only the CLI; 13 used more than one source. The source totals add up to more than 68 installations for that reason.

A few installations sent most of the events

The median installation sent about 80 MCP tool-call events in the 30 days, and the middle half sent between about 28 and 346. The busiest one sent 5,248 events, 21.2% of the total, all through the CLI. The five busiest sent 57.2% of all events and the ten busiest 72.9%; 10 installations sent fewer than 10 each. The median installation sent events on 3 different days, 26 installations on 5 days or more, and 16 on a single day. Events dropped at weekends: 1,037 per weekday on average against 238 per Saturday or Sunday.

Because of that concentration, we checked the outcome shares without the busiest installation. They barely move: 84.9% of events were labelled succeeded, 8.4% failed and 6.7% refused, out of 19,477 events. Taken one installation at a time, the median share of events labelled succeeded was 86.2%, and every one of the 68 installations sent at least one.

What “refused” means

An event is labelled refused when Jam SQL Studio stops a call before it reaches the database, or, at Confirm, while a write waits for your answer. A call is stopped when:

• the connection is at Block, the default, and the agent tries to run a query;
• the connection is at Read-only and the query is not a read, or the app cannot verify that it is (two statements in one query are refused at Read-only on version 1.5.6);
• the agent asks for something that is off by default, such as opening a connection itself (Allow AI to connect using saved connections) or reading the results grid (Share query results);
• at Confirm, you press Deny in the approval dialog or do not answer before it times out.

The wait at Confirm, described above, is logged with the same label. The events do not include the permission level, so a call refused at Block and a write waiting for approval at Confirm look the same.

52 of the 68 installations sent at least one refused event. Of the 46 with a refused query_execute event, 44 also sent a query_execute event labelled succeeded after their first refused one, and 2 sent no such event. 1,331 of the 1,344 refused query_execute events had another query_execute event from the same installation within two minutes. That fits a write waiting at Confirm followed by your answer, and it also fits an agent that tries again after a refusal. The events carry nothing that tells the two apart, or that links a later event to the same task, connection or person.

What the error events say

An error event carries an error category that the app works out from the error code or message; the message itself is not sent. The category records what the database or driver reported, not why it happened. 1,881 of the 2,085 error events (90.2%) came from query_execute:

The largest named category is object not found: 474 events on 35 installations, all from query_execute, 22.7% of the error events. The category does not say which object or why. A misspelled name, the wrong database or schema and, on SQL Server and Oracle, an existing object the login has no permission on all produce it: Microsoft lists missing permissions among the causes of error 208, and Oracle says ORA-00942 can mean the application did not have access to the table. Timeouts were spread wide, on 31 installations, while refused and lost connections came from 5 and 7 installations. 16 error events were classified as permission errors; that counts only errors that report missing privileges as such, not the ones that surface as an unknown object. 533 error events carry a message the classifier does not recognize and 335 come from versions without categories, so only 1,217 of the 2,085 (58.4%) have a named category.

Which SQL clients have an MCP server (checked October 17, 2026)

Three different things get called “MCP support” in SQL clients:

• An MCP server lets an outside agent, such as Claude Code, Codex or Cursor, connect to the client and use the database connections saved in it. This is what the numbers above measure.
• An MCP client is the client’s own AI chat connecting to other MCP servers (a ticketing system, documentation, another database tool).
• Tools or extensions give one specific assistant, such as GitHub Copilot in VS Code, access to the database without being an MCP server for others.

Every cell below comes from the vendor’s own documentation, changelog or release notes, read on October 17, 2026; the sources follow the table. We did not install each product to test it. A dash means the vendor does not document it.

DataGrip

JetBrains’ MCP Server page (DataGrip 2026.2 Help) says that starting with version 2025.2 DataGrip comes with an integrated MCP server. The plugin is bundled and enabled, but the server itself is turned on with the Enable MCP Server checkbox in Settings | Tools | MCP Server. DataGrip can configure Junie, VS Code, Claude Code, Codex, Air and GitHub Copilot CLI automatically, and offers SSE, stdio and HTTP stream configurations for other clients. The database tools include execute_sql_query, preview_table_data, list_database_connections, create_database_connection, introspect_schema and cancel_sql_query. Each tool has an Enabled checkbox; the page documents no read-only mode, and says that to guarantee strictly read-only access you should use a database user with read-only privileges. Separately, DataGrip’s AI Assistant connects to MCP servers over STDIO, Streamable HTTP or SSE.

TablePlus

TablePlus documents its MCP server on its own site. “The server runs inside TablePlus on your Mac”, is turned on with Enable MCP Server in Settings > MCP, and serves stdio clients through a bundled tableplus-mcp command and HTTP clients over Streamable HTTP (http://127.0.0.1:51003/mcp by default) with a bearer token; “by default the server only accepts connections from your own Mac.” Its tools are list_connections, list_open_connections, open_connection, disconnect, execute_read_query and execute_query. Each token has the permission Read Only (read-only queries such as SELECT; “Other queries are rejected.”), Read & Write or Full Access, and can be limited to chosen connections or connection groups. “A query can run for up to 300 seconds.” The option Approval needed for unsafe query, on by default, “On connections in Silent Mode, asks you before a client runs a query that changes data or structure”; on connections in the other safe modes TablePlus asks for confirmation or the database password instead.

The TablePlus macOS changelog lists “Introduced and reworked TablePlus MCP” in version 7.1.8 (June 10, 2026), a self-signed SSL fix for MCP in 26.6.0 (June 25, 2026), and in 27.0.2 (October 8, 2026): “Add the TablePlus MCP server to Claude Code, Codex, Cursor, VS Code and more in one click.” The Windows changelog, whose newest entry is 26.10.2 (September 1, 2026), mentions the LLM chat but not MCP, and the MCP page describes the Mac app only. The AI assistant, documented on the LLM plugin page, is a chat for OpenAI, Anthropic, Google AI, OpenRouter, DeepSeek, GitHub Copilot, Codex CLI, Ollama, OpenAI-compatible servers and agents that use the Agent Client Protocol. Per that page, the assistant runs read-only queries such as SELECT directly (TablePlus still asks for confirmation if safe mode is on) and needs your approval for any other query, and safe mode still applies after approval; this describes the assistant, not the MCP server. Its privacy section says the results of the queries it runs, “including data rows, are sent to the provider.” The page does not describe the assistant connecting to other MCP servers.

DBeaver

DBeaver has MCP in several products, all of them paid, and documents one more for a version its release notes do not list yet:

• The 26.0 release post (March 12, 2026): “CloudBeaver Enterprise, CloudBeaver AWS, and DBeaver Team Edition Web all work as MCP servers”, turned on by an administrator for each connection.
• The 26.1 release post (June 10, 2026): external MCP servers in AI Chat in the DBeaver PRO apps, and “dbvr can now run as an MCP server”, where the agent “works within the permissions of the database user it connects as”. The post’s comparison table shows no MCP server in the free dbvr Community.
• The Model Context Protocol Server docs page, marked “Since 26.3” and available in the Lite, Enterprise and Ultimate editions only: a local server over Streamable HTTP on port 8976 that accepts local connections only, turned on in Preferences and then for each connection under Enable MCP access to this connection. The DBeaver Ultimate release notes list 26.2 (September 7, 2026) as the newest release on October 17, and its notes do not mention an MCP server, so this desktop server was documented but not yet in a release listed there. The newest DBeaver Community release on GitHub was 26.2.2 (October 4).
• The AI tools & MCP page: each AI tool has an Allow mode of Ask (confirm every time) or Always allow. The Ultimate release notes for 26.1 (June 8, 2026) list “the ability to add, configure, and use external AI MCP servers and tools.”

DBeaver documents its MCP server and MCP client for the paid editions only; neither is documented for DBeaver Community 26.2.2.

Navicat

The Navicat Premium release notes list each platform separately. The newest entries on October 17 were 18.0.3 for Windows (September 29, 2026, followed by a 17.3.12 maintenance release on October 12), 18.0.3 for macOS (October 15, 2026) and 18.0.2 for Linux (September 28, 2026). The notes list AI Assistant (17.2.2 on Windows and macOS, 17.2.1 on Linux), Ask AI in Query (17.3.0), and in Navicat 18 (September 16, 2026; 18.0.2 on Windows, 18.0.1 on macOS and Linux) Fill with AI and Ask AI in the table designer and data editor. The word MCP appears nowhere in the release notes for any platform, back to 2009, or on the Navicat 18 highlights page, so no MCP server or MCP client is documented in the sources we checked.

Beekeeper Studio

Beekeeper Studio’s documentation and its GitHub release notes up to 6.1.6 (October 7, 2026) do not mention MCP, so no MCP support is documented there. Its AI Shell, included in all paid editions, can run SQL and read the results. It always asks for consent before running SQL, unless you turn on Always allow execution of read-only queries.

SQL Server Management Studio

SSMS is an MCP client. Microsoft’s MCP servers page says GitHub Copilot Agent mode in SSMS 22.7 and later can connect to MCP servers, that Ask mode cannot, and that the tools of a newly added server are disabled until you enable each one. The SSMS 22 release notes for 22.10.2 (September 28, 2026) made Agent mode generally available and “updated the bundled SQL Tools MCP server to version 3.0.17”, adding that “query execution permissions are now determined by the connected SQL account’s permissions.” That bundled server is what Copilot inside SSMS uses; neither page describes connecting another agent to it. The current release is 22.11.0 (October 13, 2026), and SSMS runs only on Windows.

VS Code with the MSSQL extension

Microsoft’s agent mode quickstart describes tools the MSSQL extension contributes to GitHub Copilot agent mode: connect, list_servers, list_databases, list_tables, show_schema, run_query and others. “Every tool call requires your approval before execution”, and the approval can be given for the session, the workspace or always. These are tools for Copilot inside VS Code, not an MCP server other agents connect to. VS Code itself connects to MCP servers, so Copilot can use those alongside the MSSQL tools. Azure Data Studio, the other Microsoft option, was retired on February 28, 2026 and gets no updates.

Jam SQL Studio

Jam SQL Studio’s MCP server is described in AI Integrations & MCP. It listens on 127.0.0.1 (port 14507 unless that port is taken), requires a bearer token, and is off until you turn on Enable MCP server in Settings → AI Integrations. Agents see your saved connections but never a password or connection string. Stdio-only clients such as Claude Desktop use the @jamsql/mcp bridge (npx -y @jamsql/mcp). The permission level is Block by default: the agent can read the schema and put SQL into a query tab, but cannot run it. Read-only allows SELECT, EXPLAIN, SHOW and PRAGMA, judged on the whole SQL text with the connection’s engine rules; Confirm runs reads and asks you in an approval dialog before each write. A connection can override the global level in its connection dialog, under More options → AI access. The AI chat sidebar is not a general MCP client: it runs the Claude Code or Codex CLI on your machine, connected to the app’s own server.

How to connect Claude Code or Cursor to a managed database

An agent reaches a database through an MCP server that holds the connection. If that server is part of your SQL client, the agent uses the connections you already saved there, so a managed database such as Azure SQL Database, Amazon RDS or a hosted PostgreSQL needs nothing extra: if the client can connect to it, the agent can use that connection, within the client’s limits. With Jam SQL Studio:

1. Save and test the connection to the managed database in the app.
2. Turn on Enable MCP server in Settings → AI Integrations, and copy the endpoint and the token.
3. Register it with your agent. For Claude Code:

   claude mcp add --transport http jam-sql http://127.0.0.1:14507/mcp \
     --header "Authorization: Bearer YOUR_TOKEN_HERE" \
     --scope user

   Cursor and other MCP clients take the same endpoint and token. In the app’s AI terminal, once the server is on, the configuration files for Claude Code, Cursor, OpenCode and VS Code are written into the workspace folder for you.
4. Set the connection’s AI access to Read-only, then ask for a first query.

The endpoint is local, but the SQL still runs against the remote database, and the rows a tool returns go wherever your AI client sends its context. The full walkthrough for Claude Code, Claude Desktop and Codex is in Connect AI agents to your database with MCP.

What the numbers suggest for permission settings

The clients in the table answer “what may an agent run without asking?” in different ways. VS Code’s MSSQL tools ask before every call, DBeaver PRO asks per tool unless you allow it, TablePlus sets a permission on each MCP token and asks before changes on Silent Mode connections, Beekeeper Studio asks before every query with an option to let reads through, DataGrip’s documentation and SSMS’s release notes point to the database login’s own permissions, and Jam SQL Studio judges the SQL against a level you set per connection. The usage data points to five practical choices:

1. The level that matters is the one on running SQL. 82.7% of the events were for query_execute, on 62 of the 68 installations, against 2.1% for the schema tools. At Block, an agent can read the schema and write SQL into a tab for you to run, but cannot run the query itself. Read-only is the level that lets an agent query on its own. On version 1.5.6 it also refuses a query with more than one statement; the next release runs such a batch when every statement in it is a read.
2. Set it per connection, and back it with a read-only login on production. Read-only in Jam SQL Studio checks the SQL text, so a write hidden inside a function, view or trigger that the query calls is invisible to it. A database login without write privileges is the only control that does not depend on the client: JetBrains recommends one for DataGrip’s MCP server, and Copilot in SSMS runs queries with the connected account’s permissions.
3. Expect refusals, and read the message. 52 of 68 installations sent at least one refused event. When a level or a switched-off setting refuses a call, the message the agent gets names the setting that would allow it, so the agent can pass that on to you instead of reporting a bare failure.
4. Give the agent the schema, and keep the timeout. The commonest named error category was object not found (474 events on 35 installations): a table, column or function the database did not know, or one the login could not see. Timeouts followed (195 on 31). The schema tools work at every level, including Block, so an agent can look names up before it queries. The 30-second timeout cancels a query that runs longer. The 1,000-row limit applies to each result set after the query has run, so it limits what the agent receives, not the work the database does. Both are ceilings in Settings → AI Integrations: an agent can ask for less, not more.
5. Use Confirm for writes on development databases. Each write opens an approval dialog that names the connection, the database and the kind of statement, and shows the SQL as a one-line preview, cut off after 500 characters. Deny has the focus, and no answer within 60 seconds means denied. Leave Allow AI to connect using saved connections off unless you want the agent to open connections by itself; that switch is behind the 45 refused connections_connect events on 9 installations.

Method and limits

• Source and window. Jam SQL Studio’s anonymous in-app usage events from September 17 to October 16, 2026: 30 full UTC days, queried on October 17. The MCP server sends one mcp:tool_call event per entry in its audit trail, with the tool name, the source, the outcome label and, for errors, an error category, plus the app version and operating system. There is no call ID.
• What is not collected. No SQL text, no prompts, no table, column, schema or database names, no connection details and no error messages. The privacy policy describes the telemetry. We publish aggregates only.
• Opt-out. Usage analytics can be turned off in Settings → Privacy. Installations that did so are not in any of these numbers, and they may use MCP more or less than the rest.
• Installations, not people. Each installation sends an anonymous identifier derived from a hashed device fingerprint. One person on two machines counts twice. The 887 are installations that started the app at least once in the window, and the 7.6% is the 67 MCP installations among them. The 68th MCP installation has no recorded start event in the window. Anonymous data cannot tell a customer’s installation from one used by the Jam SQL Studio team, so ours are not excluded.
• What one event is. Most tool calls make one audit entry. In versions 1.4.0 to 1.5.6 the one exception is a write to query_execute at Confirm, which makes two or three, the first labelled refused (see why these are events, not calls). An agent that retries makes a new call, and each one counts. Reads of MCP resources (635 events on 8 installations) are a separate event and not included.
• Some events were not sent. Since version 1.5.1 the app drops an event name once 100 events of that name have arrived within a rolling 60 seconds, counting the dropped ones, and sends a start and an end marker instead. Two installations hit that limit for mcp:tool_call 11 times; the markers’ size buckets add up to at least 2,411 events that were not sent. Events still queued when the app quits, or whose upload fails three times, are lost too.
• Versions. Events came from 1.4.0 to 1.5.6. Error categories exist from 1.5.0; 335 error events from older versions have none.
• Who is in the sample. These are Jam SQL Studio users who turned on its MCP server. The numbers describe this app and its permission model, not DataGrip, TablePlus or DBeaver users.
• Vendor table. Each product’s entry comes from the vendor pages linked in its section, read on October 17, 2026. Vendors ship often; check the linked pages before relying on a cell.

Quick Answers

Q: How many people use MCP with a SQL client?

A: In Jam SQL Studio's anonymous usage data for September 17 to October 16, 2026, 67 of the 887 installations that started the app (7.6%) sent at least one MCP tool-call event, and 68 installations sent them in all. Together they sent 24,725 events: 82.7% were for query_execute, the tool that runs SQL, and 85.6% were labelled succeeded, 8.4% failed and 6.0% refused. These are events, not separate calls: a write at the Confirm level logs two or three events, and events carry no call ID, so the number of calls cannot be recovered from them. Five installations sent 57% of the events.

Q: Does TablePlus have an MCP server?

A: On macOS, yes. TablePlus documents a built-in MCP server that runs inside the Mac app and is turned on in Settings > MCP; the macOS changelog first lists it in version 7.1.8 (June 10, 2026), and 27.0.2 (October 8, 2026) adds one-click setup in Claude Code, Codex, Cursor, VS Code and other clients. Each client's token is Read Only, Read & Write or Full Access and can be limited to chosen connections, a query can run for up to 300 seconds, and on Silent Mode connections a query that changes data or structure needs your approval, an option that is on by default. The Windows changelog, up to 26.10.2 (September 1, 2026), does not mention MCP.

Q: Does DataGrip have an MCP server?

A: Yes. Since version 2025.2 DataGrip includes an MCP server that you turn on in Settings | Tools | MCP Server. It can configure Claude Code, Codex, VS Code, Junie and GitHub Copilot CLI for you, and its tools include execute_sql_query, list_database_connections and introspect_schema. Each tool can be switched off, but the MCP server page documents no read-only switch: for strictly read-only access JetBrains recommends a database user with read-only privileges. DataGrip's AI Assistant is also an MCP client.

Q: Does Navicat have an MCP server?

A: Not in the sources we checked on October 17, 2026. The Navicat Premium release notes for Windows (up to 18.0.3, September 29, 2026, and 17.3.12, October 12, 2026), macOS (18.0.3, October 15, 2026) and Linux (18.0.2, September 28, 2026), and the Navicat 18 highlights page, list AI features such as AI Assistant, Ask AI and Fill with AI, and do not mention MCP. Neither an MCP server nor an MCP client is documented there.

Q: Does Beekeeper Studio support MCP?

A: Not according to its own pages on October 17, 2026: neither its documentation nor its GitHub release notes up to 6.1.6 (October 7, 2026) mention MCP. Its AI Shell, included in the paid editions, can run SQL itself; it asks before each query unless you turn on the setting that always allows read-only queries.

Q: How do I connect Claude Code or Cursor to a managed database?

A: Through an MCP server that holds the database connection, for example one built into your SQL client. In Jam SQL Studio, save and test the connection to the managed database, turn on Enable MCP server in Settings → AI Integrations, and register the endpoint (http://127.0.0.1:14507/mcp unless that port was taken) and its bearer token in Claude Code or in Cursor's MCP configuration. The agent then works through the saved connection and never receives the password. Set the connection's AI access to Read-only before you ask for the first query.

Q: Should an AI agent get read-only or write access to a database?

A: Start with read-only and widen it per connection. The usage data does not show what the SQL did, but 82.7% of the MCP tool-call events were for query_execute, and the commonest named error categories were object not found (a name the database did not know or the login could not see) and timeouts. Set Read-only on the connections an agent should query, use a read-only database login on production because a check of the SQL text cannot see a write inside a function or trigger, and use Confirm, which asks you before each write, on development databases.

Summary

In 30 days, 7.6% of the Jam SQL Studio installations that started the app sent MCP tool-call events, and 82.7% of the 24,725 events were for query_execute, the tool that runs SQL. 85.6% of the events were labelled succeeded, 8.4% failed and 6.0% refused. A write at Confirm logs up to three events and the events carry no call ID, so they cannot be turned into a count of calls or of how calls ended. The largest named error categories were object not found, timeouts and connection problems. Five installations sent more than half of the events. Among other SQL clients on October 17, 2026, DataGrip and TablePlus for macOS have a built-in MCP server; DBeaver has MCP servers in its paid dbvr CLI and web products and documents a desktop one for version 26.3, which its release notes did not list yet; SSMS and VS Code are MCP clients whose database tools serve their own Copilot; and Navicat and Beekeeper Studio document no MCP support. Whichever client you use, a database login without write privileges is the one limit that does not depend on the client.