Skip to main content

​
Overview

The BigQuery tool connects your agents to Google’s official BigQuery MCP server. Agents can list datasets and tables, read their metadata, run SQL queries, and manage query jobs, within the BigQuery permissions of the connected Google account.
This tool is separate from the BigQuery connection, which connects BigQuery as a data source through a service account.

​
Available tools

Google cancels queries that run longer than three minutes and returns at most 3,000 rows per query.

​
Admin: Setup in Google Cloud

You need a Google Cloud project with the BigQuery API enabled. Enabling the BigQuery API also enables the BigQuery MCP server.
  1. Configure the project’s OAuth consent screen. Choose Internal for a Google Workspace organization. If you choose External and keep the app unpublished, add every member who will connect as a test user.
  2. On the consent screen’s Data Access page, add the BigQuery scope:
  3. Go to APIs & Services > Credentials, click Create credentials > OAuth client ID, and choose Web application.
  4. Under Authorized redirect URIs, add the two redirect URIs for your Dust region: US workspaces:
    EU workspaces:
  5. Click Create and download the client’s JSON file. It contains the client ID, client secret, token uri, and auth uri you enter in Dust.
Each member who connects needs these IAM roles on the projects they query:
  • MCP Tool User (roles/mcp.toolUser)
  • BigQuery Job User (roles/bigquery.jobUser)
  • BigQuery Data Viewer (roles/bigquery.dataViewer)

​
Admin: Setup in Dust

  1. Go to Spaces > Tools > Add Tools and select BigQuery.
  2. Enter the client ID and client secret from the JSON file. Dust discovers Google’s authorization and token endpoints and requests the https://www.googleapis.com/auth/bigquery scope, so you don’t fill in anything else.
  3. Choose the credentials type:
    • Personal: each member signs in with their own Google account on first use, and queries run with that member’s BigQuery permissions.
    • Workspace: one admin signs in, and everyone with access to the tool shares that connection.
  4. Complete the Google sign-in.
Dust reaches the BigQuery MCP server through its static egress IP, so you can allow it if your organization restricts BigQuery access by IP address.

​
Usage

Add the tool to an agent from the Agent Builder (Add Tool > BigQuery). With personal credentials, members click Connect the first time an agent uses the tool, then Retry.

​
Troubleshooting