# execute_sql_readonly Execute any valid read only SQL statement on a Cloud SQL instance. To support the execute_sql_readonly tool, a Cloud SQL instance must meet the following requirements: * The value of data_api_access must be set to ALLOW_DATA_API. * For a MySQL instance, the database flag cloudsql_iam_authentication must be set to on. For a PostgreSQL instance, the database flag cloudsql.iam_authentication must be set to on. * An IAM user account or IAM service account (CLOUD_IAM_USER or CLOUD_IAM_SERVICE_ACCOUNT) is required to call the execute_sql_readonly tool. The tool executes the SQL statements using the privileges of the database user logged with IAM database authentication. After you use the create_instance tool to create an instance, you can use the create_user tool to create an IAM user account for the user currently logged in to the project. The execute_sql_readonly tool has the following limitations: * If a SQL statement returns a response larger than 10 MB, then the response will be truncated. * The tool has a default timeout of 30 seconds. If a query runs longer than 30 seconds, then the tool returns a DEADLINE_EXCEEDED error. If you receive errors similar to "IAM authentication is not enabled for the instance", then you can use the get_instance tool to check the value of the IAM database authentication flag for the instance. If you receive errors like "The instance doesn't allow using executeSql to access this instance", then you can use get_instance tool to check the data_api_access setting. When you receive authentication errors: 1. Check if the currently logged-in user account exists as an IAM user on the instance using the list_users tool. 2. If the IAM user account doesn't exist, then use the create_user tool to create the IAM user account for the logged-in user. 3. If the currently logged in user doesn't have the proper database user roles, then you can use update_user tool to grant database roles to the user. For example, cloudsqlsuperuser role can provide an IAM user with many required permissions. 4. Check if the currently logged in user has the correct IAM permissions assigned for the project. You can use gcloud projects get-iam-policy [PROJECT_ID] command to check if the user has the proper IAM roles or permissions assigned for the project. * The user must have cloudsql.instance.login permission to do automatic IAM database authentication. * The user must have cloudsql.instances.executeSql permission to execute SQL statements using the execute_sql_readonly tool or executeSql API. * Common IAM roles that contain the required permissions: Cloud SQL Instance User (roles/cloudsql.instanceUser) or Cloud SQL Admin (roles/cloudsql.admin) When receiving an ExecuteSqlResponse, always check the message and status fields within the response body. A successful HTTP status code doesn't guarantee full success of all SQL statements. The message and status fields will indicate if there were any partial errors or warnings during SQL statement execution. Agent View of the PolicyLayer registry record for `execute_sql_readonly`. HTML page: https://policylayer.com/tools/com-googleapis-sqladmin-mcp/execute-sql-readonly ## Facts - Tool: `execute_sql_readonly` - Server: Mcp (`https://sqladmin.googleapis.com/mcp`) — https://policylayer.com/tools/com-googleapis-sqladmin-mcp.md - Homepage: https://github.com/https://sqladmin.googleapis.com/mcp - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server rate-limited: no - Parameters: 7 (3 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `user` | string | no | Optional. The name of an existing database user to connect to the database. This field is used together with the `password_secret_version` field. When not both | | `project` | string | yes | Required. Project ID of the project that contains the instance. | | `database` | string | no | Optional. Name of the database on which the statement will be executed. For Postgres it's required, for MySQL it's optional. For Postgres, if your query is not | | `instance` | string | yes | Required. Database instance ID. This does not include the project ID. | | `sqlStatement` | string | yes | Required. SQL statements to run on the database. It can be a single statement or a sequence of statements separated by semicolons. | | `sqlCommenterEnabled` | boolean | no | Optional. If set to true, enables sqlcommenter-style tagging. Automatically collects and populates mcp.server, mcp.tool, mcp.client, and user.identity. See http | | `passwordSecretVersion` | string | no | Optional. The resource name of the Secret Manager secret holding the password for the user to log into the database. The secret should be created using the regi | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "execute_sql_readonly", "arguments": { "project": "", "instance": "", "sqlStatement": "" } } } ``` ## Why execute_sql_readonly is rated High execute_sql_readonly triggers real processes with real consequences. An agent gone sideways doesn't fire it once. It starts dozens of builds, sends mass notifications, or burns through compute before anyone looks up. Risk signals: Admin/system-level operation ## Use case AI agents invoke execute_sql_readonly to trigger actions in Mcp. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp: ```json { "version": "1", "default": "deny", "tools": { "execute_sql_readonly": { "limits": [ { "counter": "execute_sql_readonly_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Mcp (14) - `execute_sql` — Execute — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/execute-sql.md - `postgres_upgrade_precheck` — Execute — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/postgres-upgrade-precheck.md - `get_instance` — Read — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/get-instance.md - `get_operation` — Read — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/get-operation.md - `list_instances` — Read — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/list-instances.md - `list_users` — Read — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/list-users.md - `clone_instance` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/clone-instance.md - `create_backup` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/create-backup.md - `create_instance` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/create-instance.md - `create_user` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/create-user.md - `import_data` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/import-data.md - `restore_backup` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/restore-backup.md - `update_instance` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/update-instance.md - `update_user` — Write — https://policylayer.com/tools/com-googleapis-sqladmin-mcp/update-user.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-googleapis-sqladmin-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-googleapis-sqladmin-mcp