--- title: "MCP Tool Calls in a SQL Client: What 24,725 Logged Events Show, and Which SQL Clients Have an MCP Server" description: "24,725 MCP tool-call events in one SQL client by tool and outcome, and which SQL clients have an MCP server: DataGrip, TablePlus, DBeaver, Navicat, SSMS." url: "https://jamsql.com/blog/2026-10-17-mcp-tool-calls-sql-clients/" html_url: "https://jamsql.com/blog/2026-10-17-mcp-tool-calls-sql-clients/" generated: "2026-10-25T01:35:22.644Z" --- Published: 2026-10-17 # MCP Tool Calls in a SQL Client: What 24,725 Logged Events Show, and Which SQL Clients Have an MCP Server Between September 17 and October 16, 2026, 67 of the 887 Jam SQL Studio installations that started the app (7.6%) sent at least one MCP tool-call event, and 68 installations sent them in all. They sent 24,725 events: 82.7% were for `query_execute`, the tool that runs SQL, and 85.6% were labelled succeeded, 8.4% failed and 6.0% refused. The data counts events, not separate calls; [the reason](#events-and-calls) is below. [Which other SQL clients have an MCP server](#mcp-sql-clients), from each vendor’s own pages as of October 17, 2026: DataGrip and TablePlus for macOS have a built-in MCP server; DBeaver has MCP servers in its paid `dbvr` CLI and its web products, and documents a desktop one for version 26.3, which its release notes did not list yet; SSMS and VS Code connect to MCP servers without documenting a server for outside agents; Navicat and Beekeeper Studio document neither. Each event is an entry in the audit trail of the app’s local MCP server, logged for calls from external MCP clients such as coding agents, from the `jam-sql` command-line tool and from the app’s own AI chat sidebar. Every number below counts these events: which tool was called, where the call came from and how the logged step ended. Jam SQL Studio does not record the SQL, the prompt or the database, so the data shows what was asked of the app, not why. Some of the calls were not made by an autonomous agent at all: the `jam-sql` CLI can be run by hand, and the chat sidebar answers a person typing in the app. ## The 24,725 events by outcome Outcome label Events Share Installations with at least one Succeeded 21,160 85.6% 68 of 68 Failed (database or tool error) 2,085 8.4% 55 of 68 Refused (a permission check, or a write waiting at Confirm) 1,480 6.0% 52 of 68 **All events** **24,725** **100%** **68** The events came from Jam SQL Studio 1.4.0 to 1.5.6 on 44 macOS, 20 Windows and 4 Linux installations. The app’s MCP server is off by default in all of these versions, so each of the 68 installations had turned it on. ### Why these are events, not calls Most tool calls log one event. The exception, in every version in this data, is a write sent to `query_execute` on a connection at Confirm. The app logs a refused event while the approval dialog waits, then a second event with your answer (refused if you deny it or let it time out, succeeded if you approve it, an error if the dialog could not be shown), and after an approval a third event with the result of running the write. The events carry no call ID and no permission level, so they cannot be grouped back into calls. Each event is also uploaded on its own. Since version 1.5.1 the app drops events of one name that arrive more than 100 times a minute, and an event whose upload fails three times is lost, so the events of one call can arrive incomplete; a retried upload may, rarely, be stored twice. For these reasons the data cannot say how many separate calls the 24,725 events stand for, or how each call ended. The outcome shares in this post are shares of events. The refused label also covers every write that waited at Confirm, including the ones you then approved, so refused events are not a count of refused calls. ### Which tools were called 77 different tools appear in the events. Running SQL dominates: Tool What it does Events Share Installations Succeeded Failed Refused `query_execute` Runs SQL on a saved connection and returns the rows 20,448 82.7% 62 17,223 1,881 1,344 `connections_list` Lists saved connections, without passwords 1,275 5.2% 56 1,275 0 0 `connections_connect` Opens a saved connection 1,163 4.7% 40 1,042 76 45 `schema_get_columns` Columns of a table 366 1.5% 36 291 75 0 `ui_set_editor_text` Puts SQL into a query tab 232 0.9% 23 231 1 0 `ui_open_tab` Opens a query, table or notebook tab 228 0.9% 27 228 0 0 `ui_execute_query` Runs the SQL in a query tab 95 0.4% 15 83 0 12 `ui_list_tabs` Lists the open tabs 84 0.3% 16 81 0 3 `ui_close_tab` Closes a tab 69 0.3% 11 69 0 0 `query_get_results` Reads the results grid of a tab 56 0.2% 12 22 0 34 `schema_list_tables` Lists the tables of a database 50 0.2% 29 46 4 0 66 other tools Notebooks, dashboards, exports, compare, execution plans, transactions and more 659 2.7% 33 569 48 42 By family, running SQL with `query_execute` was 82.7% of events on 62 installations; listing and opening connections 10.0% (2,471 events, 56 installations); driving the app’s tabs and editor 3.2% (798 events, 42 installations); the schema tools 2.1% (512 events, 44 installations); notebooks 0.9% (211 events, 5 installations). Dashboards, Schema and Data Compare, MetaInfo and transaction control together stayed under 1%. 23 of the 62 installations with `query_execute` events sent no schema tool event. Of the 75 `schema_get_columns` error events, 73 came from one installation on a version before 1.5.0, which records no error category. ### Where the calls came from The MCP server labels each session when a client connects, and every event carries that label. Three sources showed up: Source Installations Events Share of events Succeeded Failed Refused External MCP clients 42 13,677 55.3% 81.6% 9.9% 8.5% `jam-sql` CLI 23 10,261 41.5% 90.3% 7.0% 2.7% AI chat sidebar in the app 18 787 3.2% 92.5% 2.8% 4.7% - **External MCP clients** are anything connected to the local endpoint with the bearer token: coding agents such as Claude Code, Codex or Cursor, Claude Desktop through the `@jamsql/mcp` stdio bridge, custom agents, and agents started in Jam SQL Studio’s own AI terminal, which use the same endpoint. The data does not say which client it was. - **The `jam-sql` CLI** is what an agent calls when the Jam SQL skill is installed (`jam-sql add-skill`). People can also run it in a terminal, and the data cannot tell the two apart. - **The AI chat sidebar** runs the Claude Code or Codex CLI installed on the machine, inside the Query Editor or a SQL notebook, in answer to a person typing in the app. 30 installations used only external clients, 13 only the sidebar and 12 only the CLI; 13 used more than one source. The source totals add up to more than 68 installations for that reason. ### A few installations sent most of the events The median installation sent about 80 MCP tool-call events in the 30 days, and the middle half sent between about 28 and 346. The busiest one sent 5,248 events, 21.2% of the total, all through the CLI. The five busiest sent 57.2% of all events and the ten busiest 72.9%; 10 installations sent fewer than 10 each. The median installation sent events on 3 different days, 26 installations on 5 days or more, and 16 on a single day. Events dropped at weekends: 1,037 per weekday on average against 238 per Saturday or Sunday. Because of that concentration, we checked the outcome shares without the busiest installation. They barely move: 84.9% of events were labelled succeeded, 8.4% failed and 6.7% refused, out of 19,477 events. Taken one installation at a time, the median share of events labelled succeeded was 86.2%, and every one of the 68 installations sent at least one. ### What “refused” means An event is labelled refused when Jam SQL Studio stops a call before it reaches the database, or, at Confirm, while a write waits for your answer. A call is stopped when: - the connection is at **Block**, the default, and the agent tries to run a query; - the connection is at **Read-only** and the query is not a read, or the app cannot verify that it is (two statements in one query are refused at Read-only on version 1.5.6); - the agent asks for something that is off by default, such as opening a connection itself (*Allow AI to connect using saved connections*) or reading the results grid (*Share query results*); - at **Confirm**, you press Deny in the approval dialog or do not answer before it times out. The wait at Confirm, described [above](#events-and-calls), is logged with the same label. The events do not include the permission level, so a call refused at Block and a write waiting for approval at Confirm look the same. Refused tool Refused events Installations Usual reason `query_execute` 1,344 46 The permission level: Block, Read-only, or a write waiting or denied at Confirm `connections_connect` 45 9 *Allow AI to connect using saved connections* is off `query_get_results` 34 7 *Share query results* is off `ui_execute_query` 12 9 The permission level, judged on the tab’s SQL `query_get_messages` 12 8 *Share query results* is off `connections_add` 11 5 Adding connections is set to Block, or you denied it Other tools 22 6   52 of the 68 installations sent at least one refused event. Of the 46 with a refused `query_execute` event, 44 also sent a `query_execute` event labelled succeeded after their first refused one, and 2 sent no such event. 1,331 of the 1,344 refused `query_execute` events had another `query_execute` event from the same installation within two minutes. That fits a write waiting at Confirm followed by your answer, and it also fits an agent that tries again after a refusal. The events carry nothing that tells the two apart, or that links a later event to the same task, connection or person. ### What the error events say An error event carries an error category that the app works out from the error code or message; the message itself is not sent. The category records what the database or driver reported, not why it happened. 1,881 of the 2,085 error events (90.2%) came from `query_execute`: Error category Meaning Error events Installations Object not found The database reported a table, view, column, procedure or function as unknown (SQL Server 207/208, PostgreSQL 42P01/42703, MySQL 1146/1054, ORA-00942/00904, SQLite *no such table*) 474 35 Timeout A query or connection ran out of time 195 31 Connection refused The database server refused the connection 183 5 Connection lost The connection dropped 120 7 Syntax error The database could not parse the SQL 96 14 Host not found DNS could not resolve the server name 45 5 Login failed The database rejected the credentials 18 6 Unknown connection ID The agent passed a connection ID the app does not have 18 5 Permission The database reported missing privileges 16 14 Unknown An error message the classifier does not recognize 533 34 No category Sent by versions before 1.5.0 335 21 Other categories Type conversion, the app window not answering in time, firewall, TLS and others 52   The largest named category is object not found: 474 events on 35 installations, all from `query_execute`, 22.7% of the error events. The category does not say which object or why. A misspelled name, the wrong database or schema and, on SQL Server and Oracle, an existing object the login has no permission on all produce it: Microsoft lists missing permissions among the causes of [error 208](https://learn.microsoft.com/en-us/sql/relational-databases/errors-events/mssqlserver-208-database-engine-error?view=sql-server-ver17), and Oracle says [ORA-00942](https://docs.oracle.com/en/error-help/db/ora-00942/) can mean the application did not have access to the table. Timeouts were spread wide, on 31 installations, while refused and lost connections came from 5 and 7 installations. 16 error events were classified as permission errors; that counts only errors that report missing privileges as such, not the ones that surface as an unknown object. 533 error events carry a message the classifier does not recognize and 335 come from versions without categories, so only 1,217 of the 2,085 (58.4%) have a named category. ## Which SQL clients have an MCP server (checked October 17, 2026) Three different things get called “MCP support” in SQL clients: - **An MCP server** lets an outside agent, such as Claude Code, Codex or Cursor, connect to the client and use the database connections saved in it. This is what the numbers above measure. - **An MCP client** is the client’s own AI chat connecting to other MCP servers (a ticketing system, documentation, another database tool). - **Tools or extensions** give one specific assistant, such as GitHub Copilot in VS Code, access to the database without being an MCP server for others. Every cell below comes from the vendor’s own documentation, changelog or release notes, read on October 17, 2026; the sources follow the table. We did not install each product to test it. A dash means the vendor does not document it. Tool (version checked) MCP server for outside agents Its AI chat as an MCP client What limits an agent’s SQL [DataGrip](#datagrip) 2026.2 Yes, built in since 2025.2; turned on in Settings | Tools | MCP Server Yes, AI Assistant Each tool can be switched off; for read-only access JetBrains recommends a read-only database user [TablePlus](#tableplus) for macOS 27.0.2 Yes, built in; turned on in Settings > MCP (in the changelog since 7.1.8, June 2026) — (AI assistant) Each token is Read Only, Read & Write or Full Access and can be limited to chosen connections; queries run up to 300 seconds; on Silent Mode connections, changes to data or structure need your approval (on by default) [TablePlus](#tableplus) for Windows 26.10.2 — — (LLM chat) — [DBeaver](#dbeaver) PRO (Lite, Enterprise, Ultimate) 26.2 The paid `dbvr` CLI since 26.1; CloudBeaver Enterprise, CloudBeaver AWS and Team Edition Web since 26.0. A local desktop server is documented “since 26.3”, a version the release notes did not list on October 17 Yes, since 26.1 Each AI tool set to Ask or Always allow; through `dbvr`, the database user’s permissions [DBeaver](#dbeaver) Community 26.2.2 — — — [Navicat Premium](#navicat) 18.0.3 (Windows, macOS), 18.0.2 (Linux) — — (AI Assistant, Ask AI) — [Beekeeper Studio](#beekeeper-studio) 6.1.6 — — (AI Shell) AI Shell asks before each query; read-only queries can be always allowed [SSMS](#ssms) 22.11.0 (Windows only) — (Copilot uses a bundled SQL Tools MCP server inside SSMS) Yes, Copilot Agent mode, SSMS 22.7 and later The connected SQL account’s permissions; tools of an added MCP server start disabled [VS Code + MSSQL extension](#vs-code-mssql) No; the extension adds tools such as `run_query` to GitHub Copilot agent mode Yes, through VS Code’s MCP support Every tool call needs your approval, which can be given for the session, the workspace or always Azure Data Studio 1.52.0 — (retired February 28, 2026) — — [Jam SQL Studio](#jam-sql-studio) 1.5.6 Yes, local HTTP endpoint with a bearer token, off until you turn it on; `@jamsql/mcp` bridge for stdio clients No; the chat sidebar runs your Claude Code or Codex CLI against the app’s own server Block (default), Read-only or Confirm, globally or per connection; by default up to 1,000 returned rows per result set and a 30-second timeout per call ### DataGrip JetBrains’ [MCP Server](https://www.jetbrains.com/help/datagrip/mcp-server.html) page (DataGrip 2026.2 Help) says that starting with version 2025.2 DataGrip comes with an integrated MCP server. The plugin is bundled and enabled, but the server itself is turned on with the *Enable MCP Server* checkbox in Settings | Tools | MCP Server. DataGrip can configure Junie, VS Code, Claude Code, Codex, Air and GitHub Copilot CLI automatically, and offers SSE, stdio and HTTP stream configurations for other clients. The database tools include `execute_sql_query`, `preview_table_data`, `list_database_connections`, `create_database_connection`, `introspect_schema` and `cancel_sql_query`. Each tool has an Enabled checkbox; the page documents no read-only mode, and says that to guarantee strictly read-only access you should use a database user with read-only privileges. Separately, DataGrip’s [AI Assistant connects to MCP servers](https://www.jetbrains.com/help/ai-assistant/mcp.html) over STDIO, Streamable HTTP or SSE. ### TablePlus TablePlus documents its [MCP server](https://tableplus.com/docs/preferences/mcp) on its own site. “The server runs inside TablePlus on your Mac”, is turned on with *Enable MCP Server* in Settings > MCP, and serves stdio clients through a bundled `tableplus-mcp` command and HTTP clients over Streamable HTTP (`http://127.0.0.1:51003/mcp` by default) with a bearer token; “by default the server only accepts connections from your own Mac.” Its tools are `list_connections`, `list_open_connections`, `open_connection`, `disconnect`, `execute_read_query` and `execute_query`. Each token has the permission Read Only (read-only queries such as `SELECT`; “Other queries are rejected.”), Read & Write or Full Access, and can be limited to chosen connections or connection groups. “A query can run for up to 300 seconds.” The option *Approval needed for unsafe query*, on by default, “On connections in Silent Mode, asks you before a client runs a query that changes data or structure”; on connections in the other safe modes TablePlus asks for confirmation or the database password instead. The [TablePlus macOS changelog](https://tableplus.com/osx/changelog) lists “Introduced and reworked TablePlus MCP” in version 7.1.8 (June 10, 2026), a self-signed SSL fix for MCP in 26.6.0 (June 25, 2026), and in 27.0.2 (October 8, 2026): “Add the TablePlus MCP server to Claude Code, Codex, Cursor, VS Code and more in one click.” The [Windows changelog](https://tableplus.com/win/changelog), whose newest entry is 26.10.2 (September 1, 2026), mentions the LLM chat but not MCP, and the MCP page describes the Mac app only. The AI assistant, documented on the [LLM plugin](https://tableplus.com/docs/llm-plugin) page, is a chat for OpenAI, Anthropic, Google AI, OpenRouter, DeepSeek, GitHub Copilot, Codex CLI, Ollama, OpenAI-compatible servers and agents that use the Agent Client Protocol. Per that page, the assistant runs read-only queries such as `SELECT` directly (TablePlus still asks for confirmation if safe mode is on) and needs your approval for any other query, and safe mode still applies after approval; this describes the assistant, not the MCP server. Its privacy section says the results of the queries it runs, “including data rows, are sent to the provider.” The page does not describe the assistant connecting to other MCP servers. ### DBeaver DBeaver has MCP in several products, all of them paid, and documents one more for a version its release notes do not list yet: - The [26.0 release post](https://dbeaver.com/2026/03/12/dbeaver-26-0/) (March 12, 2026): “CloudBeaver Enterprise, CloudBeaver AWS, and DBeaver Team Edition Web all work as MCP servers”, turned on by an administrator for each connection. - The [26.1 release post](https://dbeaver.com/2026/06/10/dbeaver-26-1/) (June 10, 2026): external MCP servers in AI Chat in the DBeaver PRO apps, and “dbvr can now run as an MCP server”, where the agent “works within the permissions of the database user it connects as”. The post’s comparison table shows no MCP server in the free dbvr Community. - The [Model Context Protocol Server](https://dbeaver.com/docs/dbeaver/Model-Context-Protocol-Server/) docs page, marked “Since 26.3” and available in the Lite, Enterprise and Ultimate editions only: a local server over Streamable HTTP on port 8976 that accepts local connections only, turned on in Preferences and then for each connection under *Enable MCP access to this connection*. The [DBeaver Ultimate release notes](https://dbeaver.com/dbeaver-ultimate-release-notes/) list 26.2 (September 7, 2026) as the newest release on October 17, and its notes do not mention an MCP server, so this desktop server was documented but not yet in a release listed there. The newest DBeaver Community release on [GitHub](https://github.com/dbeaver/dbeaver/releases) was 26.2.2 (October 4). - The [AI tools & MCP](https://dbeaver.com/docs/dbeaver/AI-Tools-and-MCP/) page: each AI tool has an Allow mode of *Ask* (confirm every time) or *Always allow*. The Ultimate release notes for 26.1 (June 8, 2026) list “the ability to add, configure, and use external AI MCP servers and tools.” DBeaver documents its MCP server and MCP client for the paid editions only; neither is documented for DBeaver Community 26.2.2. ### Navicat The [Navicat Premium release notes](https://www.navicat.com/en/products/navicat-premium-release-note) list each platform separately. The newest entries on October 17 were 18.0.3 for Windows (September 29, 2026, followed by a 17.3.12 maintenance release on October 12), 18.0.3 for macOS (October 15, 2026) and 18.0.2 for Linux (September 28, 2026). The notes list AI Assistant (17.2.2 on Windows and macOS, 17.2.1 on Linux), Ask AI in Query (17.3.0), and in Navicat 18 (September 16, 2026; 18.0.2 on Windows, 18.0.1 on macOS and Linux) Fill with AI and Ask AI in the table designer and data editor. The word MCP appears nowhere in the release notes for any platform, back to 2009, or on the [Navicat 18 highlights](https://www.navicat.com/en/navicat-18-highlights) page, so no MCP server or MCP client is documented in the sources we checked. ### Beekeeper Studio Beekeeper Studio’s [documentation](https://docs.beekeeperstudio.io/) and its [GitHub release notes](https://github.com/beekeeper-studio/beekeeper-studio/releases) up to 6.1.6 (October 7, 2026) do not mention MCP, so no MCP support is documented there. Its [AI Shell](https://docs.beekeeperstudio.io/user_guide/sql-ai-shell/), included in all paid editions, can run SQL and read the results. It always asks for consent before running SQL, unless you turn on *Always allow execution of read-only queries*. ### SQL Server Management Studio SSMS is an MCP client. Microsoft’s [MCP servers](https://learn.microsoft.com/en-us/ssms/github-copilot/mcp-servers) page says GitHub Copilot Agent mode in SSMS 22.7 and later can connect to MCP servers, that Ask mode cannot, and that the tools of a newly added server are disabled until you enable each one. The [SSMS 22 release notes](https://learn.microsoft.com/en-us/ssms/release-notes-22) for 22.10.2 (September 28, 2026) made Agent mode generally available and “updated the bundled SQL Tools MCP server to version 3.0.17”, adding that “query execution permissions are now determined by the connected SQL account’s permissions.” That bundled server is what Copilot inside SSMS uses; neither page describes connecting another agent to it. The current release is 22.11.0 (October 13, 2026), and SSMS runs only on Windows. ### VS Code with the MSSQL extension Microsoft’s [agent mode quickstart](https://learn.microsoft.com/en-us/sql/tools/visual-studio-code-extensions/github-copilot/agent-mode) describes tools the MSSQL extension contributes to GitHub Copilot agent mode: `connect`, `list_servers`, `list_databases`, `list_tables`, `show_schema`, `run_query` and others. “Every tool call requires your approval before execution”, and the approval can be given for the session, the workspace or always. These are tools for Copilot inside VS Code, not an MCP server other agents connect to. VS Code itself [connects to MCP servers](https://code.visualstudio.com/docs/copilot/chat/mcp-servers), so Copilot can use those alongside the MSSQL tools. Azure Data Studio, the other Microsoft option, was [retired on February 28, 2026](https://learn.microsoft.com/en-us/sql/tools/whats-happening-azure-data-studio) and gets no updates. ### Jam SQL Studio Jam SQL Studio’s MCP server is described in [AI Integrations & MCP](/docs/ai-integrations-mcp/). It listens on `127.0.0.1` (port 14507 unless that port is taken), requires a bearer token, and is off until you turn on *Enable MCP server* in Settings → AI Integrations. Agents see your saved connections but never a password or connection string. Stdio-only clients such as Claude Desktop use the `@jamsql/mcp` bridge (`npx -y @jamsql/mcp`). The permission level is Block by default: the agent can read the schema and put SQL into a query tab, but cannot run it. Read-only allows `SELECT`, `EXPLAIN`, `SHOW` and `PRAGMA`, judged on the whole SQL text with the connection’s engine rules; Confirm runs reads and asks you in an approval dialog before each write. A connection can override the global level in its connection dialog, under More options → AI access. The AI chat sidebar is not a general MCP client: it runs the Claude Code or Codex CLI on your machine, connected to the app’s own server. ## How to connect Claude Code or Cursor to a managed database An agent reaches a database through an MCP server that holds the connection. If that server is part of your SQL client, the agent uses the connections you already saved there, so a managed database such as Azure SQL Database, Amazon RDS or a hosted PostgreSQL needs nothing extra: if the client can connect to it, the agent can use that connection, within the client’s limits. With Jam SQL Studio: 1. Save and test the connection to the managed database in the app. 2. Turn on *Enable MCP server* in Settings → AI Integrations, and copy the endpoint and the token. 3. Register it with your agent. For Claude Code: ``` claude mcp add --transport http jam-sql http://127.0.0.1:14507/mcp \ --header "Authorization: Bearer YOUR_TOKEN_HERE" \ --scope user ``` Cursor and other MCP clients take the same endpoint and token. In the app’s AI terminal, once the server is on, the configuration files for Claude Code, Cursor, OpenCode and VS Code are written into the workspace folder for you. 4. Set the connection’s AI access to Read-only, then ask for a first query. The endpoint is local, but the SQL still runs against the remote database, and the rows a tool returns go wherever your AI client sends its context. The full walkthrough for Claude Code, Claude Desktop and Codex is in [Connect AI agents to your database with MCP](/blog/connect-ai-agents-database-mcp/). ## What the numbers suggest for permission settings The clients in the table answer “what may an agent run without asking?” in different ways. VS Code’s MSSQL tools ask before every call, DBeaver PRO asks per tool unless you allow it, TablePlus sets a permission on each MCP token and asks before changes on Silent Mode connections, Beekeeper Studio asks before every query with an option to let reads through, DataGrip’s documentation and SSMS’s release notes point to the database login’s own permissions, and Jam SQL Studio judges the SQL against a level you set per connection. The usage data points to five practical choices: 1. **The level that matters is the one on running SQL.** 82.7% of the events were for `query_execute`, on 62 of the 68 installations, against 2.1% for the schema tools. At Block, an agent can read the schema and write SQL into a tab for you to run, but cannot run the query itself. Read-only is the level that lets an agent query on its own. On version 1.5.6 it also refuses a query with more than one statement; the next release runs such a batch when every statement in it is a read. 2. **Set it per connection, and back it with a read-only login on production.** Read-only in Jam SQL Studio checks the SQL text, so a write hidden inside a function, view or trigger that the query calls is invisible to it. A database login without write privileges is the only control that does not depend on the client: JetBrains recommends one for DataGrip’s MCP server, and Copilot in SSMS runs queries with the connected account’s permissions. 3. **Expect refusals, and read the message.** 52 of 68 installations sent at least one refused event. When a level or a switched-off setting refuses a call, the message the agent gets names the setting that would allow it, so the agent can pass that on to you instead of reporting a bare failure. 4. **Give the agent the schema, and keep the timeout.** The commonest named error category was object not found (474 events on 35 installations): a table, column or function the database did not know, or one the login could not see. Timeouts followed (195 on 31). The schema tools work at every level, including Block, so an agent can look names up before it queries. The 30-second timeout cancels a query that runs longer. The 1,000-row limit applies to each result set after the query has run, so it limits what the agent receives, not the work the database does. Both are ceilings in Settings → AI Integrations: an agent can ask for less, not more. 5. **Use Confirm for writes on development databases.** Each write opens an approval dialog that names the connection, the database and the kind of statement, and shows the SQL as a one-line preview, cut off after 500 characters. Deny has the focus, and no answer within 60 seconds means denied. Leave *Allow AI to connect using saved connections* off unless you want the agent to open connections by itself; that switch is behind the 45 refused `connections_connect` events on 9 installations. ## Method and limits - **Source and window.** Jam SQL Studio’s anonymous in-app usage events from September 17 to October 16, 2026: 30 full UTC days, queried on October 17. The MCP server sends one `mcp:tool_call` event per entry in its audit trail, with the tool name, the source, the outcome label and, for errors, an error category, plus the app version and operating system. There is no call ID. - **What is not collected.** No SQL text, no prompts, no table, column, schema or database names, no connection details and no error messages. The [privacy policy](/legal/privacy-policy/) describes the telemetry. We publish aggregates only. - **Opt-out.** Usage analytics can be turned off in Settings → Privacy. Installations that did so are not in any of these numbers, and they may use MCP more or less than the rest. - **Installations, not people.** Each installation sends an anonymous identifier derived from a hashed device fingerprint. One person on two machines counts twice. The 887 are installations that started the app at least once in the window, and the 7.6% is the 67 MCP installations among them. The 68th MCP installation has no recorded start event in the window. Anonymous data cannot tell a customer’s installation from one used by the Jam SQL Studio team, so ours are not excluded. - **What one event is.** Most tool calls make one audit entry. In versions 1.4.0 to 1.5.6 the one exception is a write to `query_execute` at Confirm, which makes two or three, the first labelled refused (see [why these are events, not calls](#events-and-calls)). An agent that retries makes a new call, and each one counts. Reads of MCP resources (635 events on 8 installations) are a separate event and not included. - **Some events were not sent.** Since version 1.5.1 the app drops an event name once 100 events of that name have arrived within a rolling 60 seconds, counting the dropped ones, and sends a start and an end marker instead. Two installations hit that limit for `mcp:tool_call` 11 times; the markers’ size buckets add up to at least 2,411 events that were not sent. Events still queued when the app quits, or whose upload fails three times, are lost too. - **Versions.** Events came from 1.4.0 to 1.5.6. Error categories exist from 1.5.0; 335 error events from older versions have none. - **Who is in the sample.** These are Jam SQL Studio users who turned on its MCP server. The numbers describe this app and its permission model, not DataGrip, TablePlus or DBeaver users. - **Vendor table.** Each product’s entry comes from the vendor pages linked in its section, read on October 17, 2026. Vendors ship often; check the linked pages before relying on a cell. ## Quick Answers ### Q: How many people use MCP with a SQL client? A: In Jam SQL Studio's anonymous usage data for September 17 to October 16, 2026, 67 of the 887 installations that started the app (7.6%) sent at least one MCP tool-call event, and 68 installations sent them in all. Together they sent 24,725 events: 82.7% were for query\_execute, the tool that runs SQL, and 85.6% were labelled succeeded, 8.4% failed and 6.0% refused. These are events, not separate calls: a write at the Confirm level logs two or three events, and events carry no call ID, so the number of calls cannot be recovered from them. Five installations sent 57% of the events. ### Q: Does TablePlus have an MCP server? A: On macOS, yes. TablePlus documents a built-in MCP server that runs inside the Mac app and is turned on in Settings > MCP; the macOS changelog first lists it in version 7.1.8 (June 10, 2026), and 27.0.2 (October 8, 2026) adds one-click setup in Claude Code, Codex, Cursor, VS Code and other clients. Each client's token is Read Only, Read & Write or Full Access and can be limited to chosen connections, a query can run for up to 300 seconds, and on Silent Mode connections a query that changes data or structure needs your approval, an option that is on by default. The Windows changelog, up to 26.10.2 (September 1, 2026), does not mention MCP. ### Q: Does DataGrip have an MCP server? A: Yes. Since version 2025.2 DataGrip includes an MCP server that you turn on in Settings | Tools | MCP Server. It can configure Claude Code, Codex, VS Code, Junie and GitHub Copilot CLI for you, and its tools include execute\_sql\_query, list\_database\_connections and introspect\_schema. Each tool can be switched off, but the MCP server page documents no read-only switch: for strictly read-only access JetBrains recommends a database user with read-only privileges. DataGrip's AI Assistant is also an MCP client. ### Q: Does Navicat have an MCP server? A: Not in the sources we checked on October 17, 2026. The Navicat Premium release notes for Windows (up to 18.0.3, September 29, 2026, and 17.3.12, October 12, 2026), macOS (18.0.3, October 15, 2026) and Linux (18.0.2, September 28, 2026), and the Navicat 18 highlights page, list AI features such as AI Assistant, Ask AI and Fill with AI, and do not mention MCP. Neither an MCP server nor an MCP client is documented there. ### Q: Does Beekeeper Studio support MCP? A: Not according to its own pages on October 17, 2026: neither its documentation nor its GitHub release notes up to 6.1.6 (October 7, 2026) mention MCP. Its AI Shell, included in the paid editions, can run SQL itself; it asks before each query unless you turn on the setting that always allows read-only queries. ### Q: How do I connect Claude Code or Cursor to a managed database? A: Through an MCP server that holds the database connection, for example one built into your SQL client. In Jam SQL Studio, save and test the connection to the managed database, turn on Enable MCP server in Settings → AI Integrations, and register the endpoint (http://127.0.0.1:14507/mcp unless that port was taken) and its bearer token in Claude Code or in Cursor's MCP configuration. The agent then works through the saved connection and never receives the password. Set the connection's AI access to Read-only before you ask for the first query. ### Q: Should an AI agent get read-only or write access to a database? A: Start with read-only and widen it per connection. The usage data does not show what the SQL did, but 82.7% of the MCP tool-call events were for query\_execute, and the commonest named error categories were object not found (a name the database did not know or the login could not see) and timeouts. Set Read-only on the connections an agent should query, use a read-only database login on production because a check of the SQL text cannot see a write inside a function or trigger, and use Confirm, which asks you before each write, on development databases. ## Summary In 30 days, 7.6% of the Jam SQL Studio installations that started the app sent MCP tool-call events, and 82.7% of the 24,725 events were for `query_execute`, the tool that runs SQL. 85.6% of the events were labelled succeeded, 8.4% failed and 6.0% refused. A write at Confirm logs up to three events and the events carry no call ID, so they cannot be turned into a count of calls or of how calls ended. The largest named error categories were object not found, timeouts and connection problems. Five installations sent more than half of the events. Among other SQL clients on October 17, 2026, DataGrip and TablePlus for macOS have a built-in MCP server; DBeaver has MCP servers in its paid `dbvr` CLI and web products and documents a desktop one for version 26.3, which its release notes did not list yet; SSMS and VS Code are MCP clients whose database tools serve their own Copilot; and Navicat and Beekeeper Studio document no MCP support. Whichever client you use, a database login without write privileges is the one limit that does not depend on the client. ### Related - [AI Integrations & MCP](/docs/ai-integrations-mcp/) - [Connect AI Agents with MCP](/blog/connect-ai-agents-database-mcp/) - [Why a SQL IDE Needs an MCP Server](/blog/why-sql-ide-needs-mcp-server/) - [Best AI SQL Clients](/alternatives/best-sql-ide-ai/) - [Prevent Accidental Production Queries](/blog/prevent-accidental-production-queries/) - [DataGrip Alternative](/alternatives/datagrip/) - [TablePlus Alternative](/alternatives/tableplus/) - [DBeaver Alternative](/alternatives/dbeaver/) ## A Local MCP Server With Limits per Connection Jam SQL Studio's MCP server stays off until you turn it on in Settings → AI Integrations, and it starts at Block. Each connection can override the level: in the connection dialog, More options → AI access offers Block, Read-only or Confirm. [Download Jam SQL Studio Free](/#download) [Permission levels](/docs/ai-integrations-mcp/#permission-levels) Free for personal use • No account required • Mac, Windows, Linux ![Jam SQL Studio Settings on the AI Integrations page, with the Enable MCP server switch turned off and the endpoint shown as Not running](/images/quick-tour/ph-ai-integrations.png)