BigQuery MCP — Protected Mode for PHI/PII Guardrails

Practical Notes

• Quant: Protected Mode supports a config.json to prevent specific columns from ever being returned to the LLM context.
• Quant: always start with small limits and a bytes-billed cap before you let agents explore large datasets.

Rollout pattern

• Start in a dev project with sanitized datasets and verify query limits and output formatting.
• Introduce Protected Mode configs before any production data touches the agent.
• Add a separate “analysis allowed” allowlist of datasets and keep everything else blocked by default.

Watchouts

BigQuery IAM controls who can run queries, not what ends up in the LLM conversation. Use Protected Mode (or a view-based approach) to prevent sensitive columns from being returned.

FAQ

Q: Is it only for Claude Desktop? A: The README calls out Claude Desktop as the currently supported interface; treat it as the reference client setup.

Q: What is the safest default? A: Simple Mode with small limits, then Protected Mode with prevented fields for regulated data.

Q: How should I authenticate in production? A: Use a service account key file (or a workload identity pattern) and keep permissions narrowly scoped.