Best AI Agent Skills for SQL and Data Warehouses (2026)

An agent that can read your warehouse schema is worth more than one that writes SQL from memory. The second guesses at column names. The first joins two tables correctly on the first attempt because it looked.

That gap is what agent skills and MCP servers close for data work. You stop pasting DDL into a chat window and start letting the agent query the catalog itself.

Below are the skills and servers worth installing if your day involves SQL and a warehouse, with install commands taken from each project's repo, plus what each one gets wrong. Security notes are at the bottom and you should read them before you connect anything to production.

The stack at a glance

Query access is the foundation, and dbhub is the least painful version

Most people start by installing a database MCP per engine and end up with four connectors that behave differently. dbhub collapses that: one server, Postgres and MySQL and SQL Server and more behind it, MIT licensed, 3,299 stars, community-reviewed.

claude mcp add dbhub -- npx -y bytebase/dbhub

The design choice that matters is token efficiency. Schema introspection can blow through a context window fast on a warehouse with 400 tables, and dbhub is built to return compact catalog responses rather than dumping every column definition. That's the difference between an agent that can reason about your model and one that runs out of room before it starts.

If you're on Postgres specifically, Supabase MCP is the official option at 2,854 stars and audited security status:

claude mcp add supabase -- npx -y @supabase/mcp-server

And Neon is worth a look for a reason that has nothing to do with AI: database branching. Spin a branch off production, let the agent run destructive experiments on it, throw the branch away. It removes most of the risk from the rest of this article.

claude mcp add neon -- npx -y @neondatabase/mcp-server-neon

pg-aiguide from Timescale is the odd one out and my favourite of the group. It doesn't connect to your data, it feeds the agent Postgres documentation and idiom so the SQL it writes looks like something a Postgres person would write, rather than generic ANSI that happens to run.

claude mcp add pg-aiguide -- npx -y timescale/pg-aiguide

dbt is where the workflow changes

Everything above makes the agent better at queries. dbt MCP makes it better at your project, which is a different thing.

claude mcp add dbt-mcp -- npx -y dbt-labs/dbt-mcp

It's maintained by dbt Labs, Apache-2.0, 595 stars. With it the agent can trace lineage, look at model definitions, and run dbt commands rather than reasoning about your DAG from filenames. The task it's good at: you change a column in a staging model and ask what breaks downstream. It reads the graph instead of grepping.

It's marked community tier and unreviewed in our directory despite the vendor maintaining it, which is a good reminder that trust tier reflects independent review, not who owns the repo. Read the code before you point it at a production dbt Cloud token.

Analytics engines: ClickHouse and DuckDB

ClickHouse Analytics is verified, Apache-2.0, 843 stars:

claude mcp add clickhouse -- npx -y @clickhouse/mcp-server

Use it when the questions are aggregate and the tables are enormous. An agent iterating on a query against a billion-row events table is a different experience from doing it by hand, because the feedback loop is seconds and the agent doesn't get bored on the fourth rewrite.

For everything local, MotherDuck's server covers DuckDB and MotherDuck, MIT, 505 stars:

claude mcp add mcp-server-motherduck -- npx -y motherduckdb/mcp-server-motherduck

There's also a lighter community DuckDB server at 177 stars. DuckDB plus an agent is the fastest way I know to interrogate a directory of parquet files nobody documented. No warehouse, no credentials, no ticket.

It's also the safest place to start. Nothing you do against a local parquet file can page anyone at 3am, which makes it the right sandbox for learning where agent-assisted analysis helps and where it confidently invents a join key that doesn't exist.

Notebooks, spreadsheets, and charts

Jupyter MCP connects the agent to a running kernel. It executes cells and reads output rather than writing notebook JSON blind, which is the failure mode of every earlier attempt at this. BSD-3-Clause, 1,239 stars.

claude mcp add jupyter-mcp-server -- npx -y datalayer/jupyter-mcp-server

The XLSX skill is Anthropic's own, audited, MIT:

claude skill add anthropics/skills/xlsx

Nobody's data engineering diagram includes a spreadsheet and every real pipeline has one at the edge of it. This handles reading and writing them properly, including formulas. There's also excel-mcp-server at 4,093 stars if you need a server rather than a skill, and a small CSV summarizer skill for quick profiling of an unfamiliar file.

For output, mcp-server-chart from AntV covers 25+ chart types, MIT, 4,292 stars:

claude mcp add mcp-server-chart -- npx -y antvis/mcp-server-chart

Read the security section before you install any of this

A warehouse connection is the worst possible place to be relaxed about agent permissions, because the blast radius is your company's data.

Four rules I'd treat as non-negotiable:

• Connect with a read-only role. Not your role. A dedicated one, granted SELECT on the schemas the agent needs and nothing else. Every server above works fine read-only, and the ones that need writes should get a second, separately-scoped connection you enable deliberately.
• Never point an unreviewed server at production first. Of the servers here, dbt MCP, MotherDuck and the community DuckDB server are all marked unreviewed. That's not an accusation, it means nobody independent has audited them. Run them against a branch or a copy for a week.
• Watch what leaves the machine. An MCP server that queries your warehouse sees rows. Check whether the project phones home, and check it again after you update it. The audit you did at v1.2 says nothing about v1.6.
• Pin versions. npx -y pulls latest by default. For anything touching production data, pin the version and update on purpose.

The uncomfortable version of this: an agent skill has roughly the access of a junior engineer with your credentials and no judgement about what's sensitive. Scope it accordingly.

A starter stack

If you're setting this up today and want three things rather than ten: dbhub for query access, dbt MCP if you run dbt, and DuckDB for local file work. That combination covers most daily warehouse work and costs nothing.

Add pg-aiguide if you're Postgres-heavy, because the quality jump in generated SQL is larger than the star count suggests.

This is the query-and-warehouse side of the job. For building the pipelines that fill those tables, see agent skills for data pipelines and ETL; for the operational side, agent skills for database administrators. Also useful: skills for Excel and spreadsheets and how to optimize SQL queries with Claude skills. Our full list for data scientists covers the modelling side.

FAQ

What's the difference between an MCP server and an agent skill here?

An MCP server is a running process that exposes tools: querying a database, executing a notebook cell. A skill is instructions and scripts the agent loads to do something better. Most of this list is servers, because data work is mostly about reaching live systems. pg-aiguide is the interesting hybrid: it serves knowledge, not data.

Can I use these outside Claude Code?

The MCP servers, yes. MCP is an open protocol and Cursor, Windsurf, Zed and others support it. The claude skill add items are Claude-specific.

Will this replace dbt or Airflow?

No, and be suspicious of anything claiming otherwise. These tools help you write and debug queries and transformations faster. Orchestration, scheduling and retries are still the framework's job.

Which one should a solo analyst install first?

DuckDB via the MotherDuck server. It needs no infrastructure, works on files you already have, and shows you within an hour whether agent-assisted analysis fits how you work.

How do I check a skill is safe before installing?

Open the repo, read what the server executes, check the issue tracker for anything security-shaped, and confirm the licence. Then run it read-only against non-production for a week. Trust tier in a directory, ours included, is a starting filter, not a substitute for looking.