MCP Tools Reference: oracledatabase.googleapis.com

Tool: create_database_connection

Creates a new Database Connection (DatabaseConnection / DBC) resource in a Google Cloud project and location.

A Database Connection (DatabaseConnection / DBC) represents secure connectivity details (credentials, network routing, and connection strings) used to connect to an Oracle Database (such as Autonomous Database, Exadata VM Cluster, or DB System) and execute queries via database_connection_executesql.

Requirements & Prerequisites:

  • Service Account Permissions: The Oracle Database service's Per-Product Per-Project Service Account (P4SA, e.g. service-<PROJECT_NUMBER>@gcp-sa-oracledatabase.iam.gserviceaccount.com) must have the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) on the password secret and optional wallet secret.
  • Network Connectivity: An ODB Network (odb_network) in AVAILABLE state is required for private network connectivity to the database.

Parameters:

  • parent (string, required): The parent resource name. Format: projects/{project}/locations/{location}
  • database_connection_id (string, required): The unique ID for the DatabaseConnection (e.g., my-db-conn).
  • database_connection (object, required):
  • username (string, required): The database username to authenticate with (e.g. SYSTEM, ADMIN, or custom app user).
  • password_secret_version (string, required): Secret Manager resource name containing the database user password. Format: projects/{project}/secrets/{secret_id}/versions/{version_id}
  • connection_string (string, required): Oracle Easy Connect or TNS descriptor (e.g. hostname.domain.com:1521/SERVICE_NAME).
  • display_name (string, optional): A user-friendly display name for the connection.
  • wallet_secret_version (string, optional): Secret Manager resource name containing the base64-encoded Oracle Wallet ZIP file. Required for mTLS / TLS connections (e.g. Autonomous Database). Format: projects/{project}/secrets/{secret_id}/versions/{version_id}
  • odb_network (string, optional): The resource name of the ODB Network for private routing. Format: projects/{project}/locations/{location}/odbNetworks/{odb_network}

The following code sample shows how to use curl to call the create_database_connection MCP tool.

Curl Request 
curl --location 'https://oracledatabase.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "create_database_connection",
    "arguments": {
      // Provide these details according to the MCP tool specification.
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for CreateDatabaseConnection.

CreateDatabaseConnectionRequest

JSON representation 
{
  "parent": string,
  "databaseConnection": {
    object (DatabaseConnection)
  },
  "databaseConnectionId": string
}
Fields
parent

string

Required. The resource name of the project to create the DatabaseConnection in. Format: projects/{project}/locations/{location}
databaseConnection

object (DatabaseConnection)

Required. The DatabaseConnection to create.
databaseConnectionId

string

Required. The ID to use for the DatabaseConnection that is being created.

DatabaseConnection

JSON representation 
{
  "name": string,
  "displayName": string,
  "username": string,
  "passwordSecretVersion": string,
  "connectionString": string,

  // Union field wallet_source can be only one of the following:
  "walletSecretVersion": string
  // End of list of possible types for union field wallet_source.

  // Union field network_configuration can be only one of the following:
  "odbNetwork": string
  // End of list of possible types for union field network_configuration.
}
Fields
name

string

Identifier. The resource name of the DatabaseConnection. Format: projects/{project}/locations/{location}/databaseConnections/{database_connection}
displayName

string

Optional. User-friendly display name for the connection.
username

string

Optional. The default database username to use for connections.
passwordSecretVersion

string

Optional. The resource name of the GCP Secret Manager secret version containing the password for the specified username. Format: projects/{project}/secrets/{secret_id}/versions/{version_id} The service's Per-Product Per-Project Service Account (P4SA) must have the 'secretmanager.secretAccessor' permission on this secret.
connectionString

string

Required. Oracle Easy Connect or TNS connection string. Example: "your-db-host.example.com:1521/YOUR_SERVICE_NAME"
Union field wallet_source. How the Oracle Wallet is supplied for secure TLS/mTLS connections. wallet_source can be only one of the following:
walletSecretVersion

string

Optional. Optional: The resource name of the GCP Secret Manager secret version containing base64 encoded content of the Oracle Wallet ZIP file required for mTLS/TLS connections. Format: projects/{project}/secrets/{secret_id}/versions/{version_id} The service's Per-Product Per-Project Service Account (P4SA) must have the 'secretmanager.secretAccessor' permission on this secret.
Union field network_configuration. Network configuration for reaching the database. network_configuration can be only one of the following:
odbNetwork

string

Optional. For Oracle Database@Google cloud resources. Format: projects/{project}/locations/{location}/odbNetworks/{odbNetwork}

Output Schema

This resource represents a long-running operation that is the result of a network API call.

Operation

JSON representation 
{
  "name": string,
  "metadata": {
    "@type": string,
    field1: ...,
    ...
  },
  "done": boolean,

  // Union field result can be only one of the following:
  "error": {
    object (Status)
  },
  "response": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field result.
}
Fields
name

string

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.
metadata

object

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.
done

boolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.
Union field result. The operation result, which can be either an error or a valid response. If done == false, neither error nor response is set. If done == true, exactly one of error or response can be set. Some services might not provide the result. result can be only one of the following:
error

object (Status)

The error result of the operation in case of failure or cancellation.
response

object

The normal, successful response of the operation. If the original method returns no data on success, such as Delete, the response is google.protobuf.Empty. If the original method is standard Get/Create/Update, the response should be the resource. For other methods, the response should have the type XxxResponse, where Xxx is the original method name. For example, if the original method name is TakeSnapshot(), the inferred response type is TakeSnapshotResponse.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Any

JSON representation 
{
  "typeUrl": string,
  "value": string
}
Fields
typeUrl

string

Identifies the type of the serialized Protobuf message with a URI reference consisting of a prefix ending in a slash and the fully-qualified type name.

Example: type.googleapis.com/google.protobuf.StringValue

This string must contain at least one / character, and the content after the last / must be the fully-qualified name of the type in canonical form, without a leading dot. Do not write a scheme on these URI references so that clients do not attempt to contact them.

The prefix is arbitrary and Protobuf implementations are expected to simply strip off everything up to and including the last / to identify the type. type.googleapis.com/ is a common default prefix that some legacy implementations require. This prefix does not indicate the origin of the type, and URIs containing it are not expected to respond to any requests.

All type URL strings must be legal URI references with the additional restriction (for the text format) that the content of the reference must consist only of alphanumeric characters, percent-encoded escapes, and characters in the following set (not including the outer backticks): /-.~_!$&()*+,;=. Despite our allowing percent encodings, implementations should not unescape them to prevent confusion with existing parsers. For example, type.googleapis.com%2FFoo should be rejected.

In the original design of Any, the possibility of launching a type resolution service at these type URLs was considered but Protobuf never implemented one and considers contacting these URLs to be problematic and a potential security issue. Do not attempt to contact type URLs.
value

string (bytes format)

Holds a Protobuf serialization of the type described by type_url.

A base64-encoded string.

Status

JSON representation 
{
  "code": integer,
  "message": string,
  "details": [
    {
      "@type": string,
      field1: ...,
      ...
    }
  ]
}
Fields
code

integer

The status code, which should be an enum value of google.rpc.Code.
message

string

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
details[]

object

A list of messages that carry the error details. There is a common set of message types for APIs to use.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Tool Annotations

Tool annotations are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.

Along with the title string, the following boolean hints are defined as follows:

  • readOnlyHint: If true, the tool doesn't modify its environment. Default: false.
  • destructiveHint: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
  • idempotentHint: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
  • openWorldHint: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌