⚡ Match Highlights: blogs/connecting ai assistants and agents to oracle ai database with mcp

Key Takeaways

Model Context Protocol (MCP) is an open standard for exposing tools and context to AI clients in a discoverable, typed way.
Oracle offers multiple MCP paths to Oracle AI Database 26ai: SQLcl (local stdio), OCI Database Tools (managed HTTPS), Autonomous AI Database built-in MCP, and Oracle REST Data Services (ORDS) streaming HTTPS.
Local SQLcl MCP is the fastest developer starting path: saved connections, named tools, restrict levels (a SQLcl setting that limits which SQL operations the session may perform, starting restrictive/read-oriented and widening only deliberately), and a clear database-side evidence trail.
MCP tools are listed and schema-described; the model chooses among them instead of inventing free-form SQL strings.
The agent harness still owns validation, authorization policy, logging, and stop conditions, MCP is the contract, not the full control plane.

Introduction

Before MCP, every new AI client usually needed a custom database adapter. Credentials leaked into prompts, tool surfaces were ad-hoc, and audit trails were incomplete.

MCP changes the shape of the problem. One server can serve many clients. Tools are advertised with names, descriptions, and input schemas. The model discovers what is available and calls it with structured arguments.

Oracle provides several ways to put an MCP surface in front of Oracle AI Database 26ai. This article maps those options, then walks through a concrete local path with SQLcl MCP so you can connect a client, run a read-only query, and leave an evidence trail a DBA can verify.

1. What MCP Is (in Agent Terms)

MCP is a client–server protocol for listing tools, calling tools, and returning structured results. A client (Claude Desktop, Cline, a custom agent runtime, and similar) connects to a server, asks for the tool catalog, and invokes tools by name with typed arguments.

For agents this matters because:

Capabilities are discoverable at connection time.
Arguments are schema-checked.
Results come back as structured observations that feed the next reasoning step.

In the language of Article 8, tool calling is the request the model makes. MCP is one standard way to publish the tool surface. The agent harness still decides whether a call proceeds, under what policy, and how it is logged and stopped.

2. Oracle’s MCP Options at a Glance

Option	Best for	Transport	Auth / identity model	Typical tools
SQLCl MCP	Local dev, DBA, prototyping	stdio	Saved SQLCl connections	list-connections, connect, run-sql, run-sqlcl, schema-information
OCI Database Tools MCP	Shared / enterprise agents in OCI	Streaming HTTPS	OCI IAM	run-sql, reports, custom toolsets
Autonomous AI Database MCP	Per-database managed endpoint	HTTPS	Database identity + registered Select AI Agent tools	Built-in and custom Select AI Agent tools
ORDS MCP	Existing ORDS estates	Streaming HTTPS	JWT / OAuth as configured	list-databases, run-sql, schema-information (as exposed)

These paths are complementary. SQLcl is ideal for a developer laptop. Managed OCI and Autonomous AI Database MCP suit shared agents and business users. ORDS fits teams that already operate REST Data Services mid-tiers. Choose based on where the agent runs and who owns identity.

3. Safe Local Start with SQLcl MCP

Prerequisites

SQLcl 25.2.0 or newer with MCP support
Java 17 or 21 (per current SQLcl docs)
A non-production Oracle Database
A least-privilege, preferably read-only database user
A named connection saved with password persistence for non-interactive use
Permission to query V$SESSION (or a DBA-provided equivalent) for evidence

1. Save a named connection

C++

sql /nolog
conn demo_ro@//host:1521/service -save demo_ro -savepwd

Enter the password interactively. The connection is stored (commonly under ~/.dbtools) so MCP can connect by name without embedding secrets in tool calls. Use a sandbox-only account and follow your organization’s secrets policy.

2. Start the MCP server

C++

sql -mcp

In MCP mode the server defaults to a restrictive level (commonly level 4). Keep the default until you have a reason to widen it with -R.

3. Point your MCP client at SQLcl

Representative configuration (field names and file locations vary by client):

4. Discover, connect, tag, and query

Representative tool sequence (adapt argument names to your client and SQLcl version):

C++

{ "tool": "list-connections", "arguments": {} }

C++

{ "tool": "connect", "arguments": { "name": "demo_ro" } }

C++

{
  "tool": "run-sql",
  "arguments": {
    "sql": "BEGIN DBMS_APPLICATION_INFO.SET_MODULE('sqlcl-mcp','schema-discovery'); END;"
  }
}

C++

{
  "tool": "run-sql",
  "arguments": {
    "sql": "SELECT table_name FROM user_tables ORDER BY table_name FETCH FIRST 5 ROWS ONLY"
  }
}

C++

{ "tool": "disconnect", "arguments": {} }

5. Prove what happened

C++

SELECT module, action, username, machine
FROM v$session
WHERE module = 'sqlcl-mcp';

SQLcl MCP also records request history in DBTOOLS$MCP_LOG where available. Access and retention vary by environment; confirm with your DBA.

After an MCP tool call completes, the developer or DBA should be able to confirm:

Session tagging – The session carries a recognizable client identifier or module name set by the MCP server (as shown in the DBMS_APPLICATION_INFO.SET_MODULE example above).
Active session view – Query V$SESSION (or GV$SESSION) to see the connected session, program, and module.
SQL that actually ran – Check V$SQL / V$SQLAREA or the unified audit trail for the exact statement executed.
Restrict level effect – Confirm that only allowed operations succeeded (read-only statements pass; restricted statements are rejected).
Audit / log entry – Verify an audit record or server log entry exists for the tool invocation (SQLcl also records history in DBTOOLS$MCP_LOG where available).

These five checks turn “database-side evidence” into a concrete, repeatable verification step.

4. What the Model Actually Sees

When the client connects, it can request the tool catalog. The model receives names, descriptions, and input schemas—not a free-form SQL sandbox and not a password.

Discovery changes behavior. The model can reason about missing capabilities instead of inventing calls that do not exist. That is the practical difference between a typed MCP surface and pasting connection strings or raw SQL into a prompt.

5. Managed and In-Database Paths

OCI Database Tools MCP

Managed servers in OCI that expose toolsets over streaming HTTPS. Identity is OCI IAM. Useful for shared agents, validated SQL reports, and databases reachable through Database Tools Connections (including multicloud Oracle AI Database deployments).

Autonomous AI Database MCP

A managed, per-database HTTPS endpoint. You enable the feature, register Select AI Agent tools (built-in or custom via DBMS_CLOUD_AI_AGENT), and point MCP clients at the database-scoped URL. Tools run under database identity and existing network, VPD, and audit controls.

ORDS MCP

A streaming HTTPS /mcp endpoint on Oracle REST Data Services. Fits estates that already use ORDS; authentication follows your configured JWT/OAuth model.

Prefer managed paths when agents are shared, when business users need governed natural-language access, or when you want centralized policy instead of per-laptop servers. Keep local SQLcl for prototyping and DBA workflows.

6. MCP + Select AI + Agent Memory

A natural composition for production agents:

Expose Select AI (Article 10) as an NL2SQL tool behind MCP so the model asks questions in natural language under a scoped AI profile.
Expose agent memory read/write tools the same way.
Register custom PL/SQL or Select AI Agent tools where the platform allows.

The harness (Article 8) still validates the call, applies authorization policy, logs the event, and enforces stop conditions. MCP publishes the surface; it does not replace the control plane. Trajectories that flow through MCP tools belong in the evals layer (Article 9).

7. Production Guardrails Checklist

Least-privilege database user or IAM roles
Explicit tool allowlists / toolsets
No secrets in prompts or tool arguments (saved connections / vault / IAM only)
Session tagging and database audit
Restrict levels or report-only modes for broader audiences
Eval coverage for MCP tool trajectories
Multi-tenant isolation patterns (Article 12)

8. Common Pitfalls

Using a highly privileged saved connection “just for the demo”
Exposing unrestricted run-sql without object or statement guardrails
Treating MCP as a substitute for application authorization
Skipping evidence checks (“we think it ran”)
Running a local MCP server with a broad restrict level in a shared environment

Most Asked Questions

Do I need MCP if I already use the Python Select AI SDK?

No. The SDK talks to Select AI directly. MCP is useful when the caller is an external AI client or agent that expects a standard tool protocol.

Can MCP work with on-premises Oracle Database?

SQLcl MCP works against any network-reachable Oracle Database (including on-premises). Managed OCI and Autonomous AI Database MCP target cloud and Autonomous deployments.

Where do credentials live?

In saved SQLcl connections, OCI Vault / IAM, or database identity—never in prompts or tool arguments.

Is SQLcl MCP enough for production agents?

It is excellent for local and DBA workflows. Shared production agents usually move to managed OCI or Autonomous AI Database MCP for identity, scaling, and operational consistency.

How does this relate to the agent harness?

MCP is the tool-access contract. The harness still validates, authorizes, logs, and stops every call.

What clients are commonly used?

Claude Desktop, VS Code with Cline, OCI AI Agent, and custom MCP-compatible agent runtimes. Exact configuration varies by client version.

Resources

Latest Release

Conclusion

MCP gives AI clients a standard door into Oracle AI Database. Good operations still depend on narrow tools, strong identity, saved or vaulted credentials, and a harness that treats every call as a governed event with evidence you can query later.

Once tools and data paths exist, the remaining production question is isolation under multi-tenant load, the subject of the final article in this series.

Try Yourself: Install SQLcl, create a saved connection with a least-privilege user, enable MCP, and connect Claude Desktop or Cline. Run a read-only tool call and verify the evidence trail in the database. You can exercise the same pattern against Oracle AI Database Free / FreeSQL today.

Connecting AI Assistants and Agents to Oracle AI Database with MCP