DuckDB / MotherDuck Local MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow DuckDB or MotherDuck compatibility and data-access scope as releases change

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Local DuckDB and MotherDuck analytics with explicit read-only/read-write modes.

What we know

Local/self-hosted SQL MCP for DuckDB files, in-memory DBs, S3 and MotherDuck, with catalog browsing and optional database switching.

Maintenance / activity evidence

Observed Aug 19, 2026 (UTC)Bump version to 1.0.8

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read-only default; --read-write enables mutation. SaaS mode can restrict local access. Writes: SQL writes when --read-write; Database switching/creation when enabled.
MotherDuck/token as applicable.
Sensitive access: Database contents, Local files accessible to DuckDB, Cloud tokens

Default read-only helps, but official docs explicitly say it is insufficient as a security boundary for untrusted remote users.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

524 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

Which local and hosted database operations are documented for MCP?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Default read-only helps, but official docs explicitly say it is insufficient as a security boundary for untrusted remote users.
Read-only default; --read-write enables mutation. SaaS mode can restrict local access.
MotherDuck/token as applicable.
Local files, S3 or MotherDuck data are queried; self-hosted server can access filesystem within DuckDB capabilities.
Reviewed write actions: SQL writes when --read-write; Database switching/creation when enabled
Sensitive access: Database contents, Local files accessible to DuckDB, Cloud tokens
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Read-only mode is default but official docs warn it is not a complete sandbox for untrusted callers.
Read-write must be enabled explicitly.
MotherDuck read-only requires a read-scaling token.

Original activity observations

2026-08-19T17:01:45Z: Bump version to 1.0.8

Technical identity

github.com/motherduckdb/mcp-server-motherduck

Exact implementation source: https://github.com/motherduckdb/mcp-server-motherduck ↗
Reviewed resource type: MCP Server
Repository identity: motherduckdb/mcp-server-motherduck
Package identity: pypi:mcp-server-motherduck
Service endpoint: http://localhost:8000/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
motherduckdb/mcp-server-motherduck
Recorded repository material and project history.
Evidence source ↗
motherduck.com/docs/sql-reference/mcp/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

claude-desktop

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Read-write mode can mutate databases; default to an isolated test database or read-only.
Publisher JSON configuration for JSON-based MCP clients; not Codex config.toml. Publisher-supported parameters assembled into a machine-readable JSON example; placeholders are user-specific and no real credentials are included. Treat as reviewed composed example rather than a verbatim executable test. Replace the supplied credential/path placeholders privately; use the named host's configuration schema.
MCP100 client-scope note: this Claude Code example applies only to that client and the exact registered entry. Other client configuration keys and registrations are separate.
MCP100 client-scope note: this Codex example applies only to that client and the exact registered entry. Other client configuration keys and registrations are separate.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.

Install / connect
MCP100 setup guide
Publisher local example: `claude mcp add --scope user duckdb --transport stdio -- uvx mcp-server-motherduck --db-path :memory: --read-write --allow-switch-databases`. Remote MotherDuck option uses a separate hosted connection; do not confuse the two.
`claude mcp add --scope user duckdb --transport stdio -- uvx mcp-server-motherduck --db-path :memory: --read-write --allow-switch-databases` (publisher example).
claude mcp add --scope user duckdb --transport stdio -- uvx mcp-server-motherduck --db-path :memory: --read-write --allow-switch-databases
Configure / authenticate
MCP100 setup guide
MotherDuck local DuckDB mode can run with uvx without tokens; cloud MotherDuck requires motherduck_token. Use read-only DB config by default; publisher quickstarts show read-write flags, which should not be auto-applied as a safe baseline.
Advanced configuration · claude desktop json · MCP100 composed guide
claude desktop json · MCP100 composed guide
{ "mcpServers": { "DuckDB (read-only)": { "args": [ "mcp-server-motherduck", "--db-path", "/absolute/path/to/your.duckdb" ], "command": "uvx" } } }
Check connection
Publisher instructions
Read-only SQL SELECT 1 from an explicit local test database only.
codex mcp list
Remove / uninstall / revoke
MCP100 setup guide
For Claude Code registration named duckdb; keep local .duckdb files and hosted MotherDuck database.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove duckdb

Official Documentation & Sources

What it does

Local/self-hosted SQL MCP for DuckDB files, in-memory DBs, S3 and MotherDuck, with catalog browsing and optional database switching.

Capability: Data & Databases
Resource type: MCP Server
Best fit: Local DuckDB and MotherDuck analytics with explicit read-only/read-write modes.

Representative uses

Run SQL analytics
Browse databases/tables/columns
Switch database connections when enabled
Use managed MotherDuck remote MCP as an alternative

Limitations

Read-only mode is default but official docs warn it is not a complete sandbox for untrusted callers.
Read-write must be enabled explicitly.
MotherDuck read-only requires a read-scaling token.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: MotherDuck/token as applicable.
Permissions: Read-only default; --read-write enables mutation. SaaS mode can restrict local access.
Data handling: Local files, S3 or MotherDuck data are queried; self-hosted server can access filesystem within DuckDB capabilities.
Cost: freemium
Risk and cautions: Default read-only helps, but official docs explicitly say it is insufficient as a security boundary for untrusted remote users.

Access scope and cautions

Write actions: SQL writes when --read-write Database switching/creation when enabled
Sensitive access: Database contents Local files accessible to DuckDB Cloud tokens
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Run SQL analytics; Browse databases/tables/columns; Switch database connections when enabled; Use managed MotherDuck remote MCP as an alternative.

What setup and authentication are documented?

Recorded installation/entrypoint step: uvx mcp-server-motherduck. Recorded endpoint: http://localhost:8000/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: motherduck_token/MOTHERDUCK_TOKEN optional; AWS_* optional. No configuration values are supplied here. Prerequisites: uv. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: MotherDuck token for MotherDuck; local DuckDB can be keyless. A demo or keyless description is not independently verified read-only authority. Check the documented tool permissions rather than inferring authority from that label.

Can it modify data or perform write operations?

Documented write actions include: SQL writes when --read-write; Database switching/creation when enabled. Recorded permission boundary: Read-only default; --read-write enables mutation. SaaS mode can restrict local access.

What data-handling boundary should I consider?

Local files, S3 or MotherDuck data are queried; self-hosted server can access filesystem within DuckDB capabilities. Recorded sensitive-access context: Database contents; Local files accessible to DuckDB; Cloud tokens.

What limitations and risks should I check before use?

Default read-only helps, but official docs explicitly say it is insufficient as a security boundary for untrusted remote users. Read-only mode is default but official docs warn it is not a complete sandbox for untrusted callers. Read-write must be enabled explicitly. MotherDuck read-only requires a read-scaling token. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

MotherDuck is listed as First-party MCP in MCP100’s current evidence.