BigQuery is Google Cloud's fully managed, serverless data warehouse for running SQL analysis over large datasets.
It can be connected to Agen.co two ways, matching the Official / In-house filter in the connector picker:
- Official — Agen.co connects through Google's own hosted BigQuery MCP server, so your AI agents use the same dataset, table, query, and job tools Google exposes to MCP clients.
- In-house — Agen.co wraps the BigQuery API directly through its own integration layer, using a dedicated OAuth client you register in Google Cloud Console.
Pick Official if the built-in MCP tools cover what your agents need. Fall back to In-house if your agents need to list projects, create or delete datasets and tables, or insert rows into tables.
Prerequisites
Prerequisites
- A Google Cloud project where you can enable APIs, configure the Google Auth Platform, and create OAuth clients.
- Someone who can change IAM on that project, for example an Owner or a Project IAM Admin, to grant the roles below.
- For each user who connects, these IAM roles on every project their agents query: MCP Tool User (
roles/mcp.toolUser) to call the MCP tools, BigQuery Job User (roles/bigquery.jobUser) to run queries, and BigQuery Data Viewer (roles/bigquery.dataViewer) to read data. Grant them in Google Cloud Console under IAM & Admin → IAM → Grant access: enter the user's Google account under New principals, then add each role. Google applies IAM changes after a short delay (the console says it may take a few minutes), so calls made right after granting can still fail with a permission error.
In Google Cloud Console, select your project and enable the BigQuery API. Google turns on the BigQuery MCP server together with the BigQuery API, so there's no separate MCP API to enable.
- Go to Google Auth Platform → Branding. If you see Google Auth Platform not configured yet, click Get Started, enter an app name and a support email, and click Next.
- Under Audience, select Internal. If you can't select it, select External. Finish the wizard and click Create.
- If you selected External, open Audience and, under Test users, click Add users and add every Google account that will connect. Other accounts can't complete sign-in while the app is in testing.
- Open Data Access → Add or Remove Scopes. Under Manually add scopes, paste the scope below, click Add to Table, click Update, then click Save.
| Scope | What it allows |
|---|---|
https://www.googleapis.com/auth/bigquery | View and manage the user's BigQuery data, and run queries and jobs |
- In the Agen.co portal, go to Connectors → My connectors and click Add connector.
- Search for
BigQueryand select it. At the top of the Add BigQuery panel, keep Official selected. - Copy both read-only URLs at the bottom of the panel:
- Callback URL: completes the initial OAuth handshake between Agen.co and your OAuth client.
- Gateway callback URL: used by the Agen.co MCP gateway for per-user authorization at runtime.
Leave this panel open. You return to it after creating the OAuth client.
- In Google Cloud Console, make sure the same project is selected, then go to Google Auth Platform → Clients → Create client. The client must belong to the project where you enabled the BigQuery API, because Google checks API enablement against the project that owns the credential.
- Set Application type to Web application and enter a name (for example,
Agen.co BigQuery MCP). - Under Authorized redirect URIs, click Add URI and add both URLs you copied from Agen.co.
- Click Create, then copy the Client ID and Client Secret. Google shows the secret once, in the OAuth client created dialog, so copy both values straight into your secrets manager and don't leave the dialog open or screenshot it. If you lose the secret, add a new one from the client's detail page.
- Return to the Add BigQuery panel you left open and fill in the fields:
| Field | Required | Description |
|---|---|---|
| Instance Slug | Yes | Namespaces this instance. It prefixes each imported tool as slug__tool, so a second instance of the same connector needs its own slug. Use lowercase kebab-case, for example bigquery. You can change it later from the connector's settings. |
| Client ID | Yes | The Client ID of the OAuth client you created. |
| Client Secret | Yes | The Client Secret of the OAuth client you created. |
- Click Connect. You're redirected to Google to sign in and approve access.
- Back in Agen.co, the panel shows Select the tools to import from BigQuery. with a toggle for each tool, all on by default. Turn off any tool you don't want, then click Add. The connector is created and its tools imported only when you click Add, even if the Google sign-in page reported success.
- After you create a policy for the tools, the first tool call a user makes returns a one-time authorization link instead of data. The user opens it and approves access with their own Google account. This per-user step uses the Gateway callback URL you registered, and each user does it once.
Once connected, BigQuery appears under My connectors with tools spanning:
| Area | What it covers |
|---|---|
| Datasets & tables | Listing the datasets and tables in a project, including BigLake namespaces and tables, and reading their metadata |
| Queries | Running SQL, either read-only or with changes allowed, and reading a query job's results |
| Jobs | Checking a job's status and canceling a running job |
Every tool takes the ID of the Google Cloud project to work in, so agents need to know which project to query. Queries are canceled after three minutes by default, and a result returns at most 3,000 rows. The read-only query tool rejects statements that change data or schema and Python UDFs, and doesn't support Google Drive external tables or graph (GQL) queries.
The execute_sql tool runs any SQL, including statements that modify or delete data. If your agents should only read, turn it off when you import the tools, or leave it out of the policy.
Tool calls fail with a permission error
Tool calls fail with a permission error
If tool calls fail with a permission error, check that the user who authorized the connector has the IAM roles listed in Prerequisites on the project the agent is querying. MCP Tool User is a separate role: the BigQuery roles alone don't let the user call the MCP tools. If you just granted the roles, wait a few minutes and retry. The roles apply per user, so one user's calls can succeed while another's fail.
Enabling the BigQuery connector isn't enough on its own. Tool calls remain denied until you create a policy that grants access to the specific tools you want to expose.
The BigQuery integration allows your application to connect to BigQuery through Frontegg, enabling users to run queries, manage datasets and tables, and stream data — all through a secure OAuth 2.0 connection.
Prerequisites
Prerequisites
- A Google Cloud account with an active project
- Admin or editor permissions on the Google Cloud project
- BigQuery API enabled in your Google Cloud project
Navigate to Google Cloud Console and select your project from the project selector at the top of the page. If you do not have a project yet, create a new one.
Go to APIs & Services → Library and search for BigQuery API. If it is not already enabled, click Enable.
Go to APIs & Services → Credentials. This page lists all your existing API keys, OAuth 2.0 Client IDs, and service accounts. Click Create credentials and select OAuth client ID.
On the Create OAuth client ID page, configure the following:
- Set Application type to Web application.
- Set Name to a descriptive name (e.g.,
Frontegg Integration). - Under Authorized redirect URIs, click Add URI and add the redirect URL shown in the Frontegg portal for this integration — copy it whole, including the path. See How to get your Redirect URL. It has the shape
https://YOUR_MCP_GATEWAY_URL/integration-callback, but take the real one from the portal rather than assembling it. - Click Create.
After creating the OAuth client, a dialog appears with your Client ID and Client Secret. Copy both values and store them securely — the Client Secret will not be shown again after you close this dialog.
The BigQuery integration requires the following OAuth scopes:
| Scope | Description |
|---|---|
https://www.googleapis.com/auth/bigquery | Full access to BigQuery resources |
https://www.googleapis.com/auth/bigquery.readonly | Read-only access to BigQuery data |
https://www.googleapis.com/auth/bigquery.insertdata | Insert data into BigQuery tables |
https://www.googleapis.com/auth/cloud-platform | Full access to Google Cloud Platform resources |
openid | OpenID Connect authentication |
https://www.googleapis.com/auth/userinfo.email | Access to user email address |
https://www.googleapis.com/auth/userinfo.profile | Access to user profile information |
Minimum required scopes
Minimum required scopes
For basic read-only functionality, you need: https://www.googleapis.com/auth/bigquery.readonly, openid, and https://www.googleapis.com/auth/userinfo.email.
Once you have obtained your Client ID and Client Secret from the steps above, enter them in the integration configuration page of the Frontegg portal:
- Open the Frontegg portal and navigate to [Environment] → Integrations → BigQuery.
- Enter the Client ID and Client Secret in the corresponding fields.
- Select the required scopes.
- Click Save.
Keep your credentials secure
Keep your credentials secure
Never share or commit your Client Secret to version control.