MCP Toolbox for Databases: setup and secure agent access

Stephanie Wong and Kurtis Van Gent explain how MCP Toolbox for Databases connects an AI agent to data through developer-defined tools. The discussion focuses on confused deputy attacks: an agent with broad permissions can follow untrusted input and expose information the user should not receive.

Van Gent describes Toolbox as open source and self-hosted. He says users can run a binary or container locally, compile the source, or deploy it to Cloud Run. It supports standard IO, and the deployment discussion covers Docker Compose and Kubernetes. He also says running Toolbox does not give Google access to the connected database. The airline demo uses Gemini through Vertex AI, so it is not an example of an entirely local model stack.

The Cymbal Air demo searches flights and asks for human approval before booking. A prompt changes the assistant's conversational understanding of the passenger's identity, but the booking still uses the signed-in user's details. Van Gent explains how bound parameters keep application values outside the model's control, while authenticated parameters derive identity from an OAuth token on the server.

The Q&A covers connection pooling, telemetry and generating skills for progressive tool discovery. Toolbox has no built-in agent and cannot write queries itself. Its execution tools can accept SQL from an external model; developers can also define reviewed SQL templates or stored procedures.