An open way to plug tools into an AI application
The Model Context Protocol introduction says MCP is an open protocol for connecting AI applications to external systems. Those systems can be data sources, tools, or workflows. The same page names clients such as Claude, ChatGPT, Visual Studio Code, and Cursor. A server is the piece you run so one of those clients can call your tools without a private plugin for each client.
The client asks. The server answers with a tool result.
The AI application is the client. It starts the server, or connects to one, and receives a list of tools. The LLM chooses a tool and supplies arguments. The server runs that tool and returns a result. The model then writes the reply the person sees. If the server is a database tool, the result may be rows, or it may be an error. The model does not become the database.
That split is why a definition belongs on this page before any product steps. People search "what is an MCP server" because the name sounds like the model itself. It is the adapter beside the model.
DataTug runs one local database server
DataTug's MCP for database page is that database MCP server, the adapter for a DataTug project. That binary is also the SQL CLI tool, a terminal database client. The CLI command datatug mcp speaks stdio (standard input and output) to a desktop client and talks to a datatug serve daemon you already started. The published tools list projects, schemas, and saved SQL, then run a saved query. They do not include a text-to-SQL tool or a write. When a model writes SQL somewhere else, text to SQL accuracy is the check: read the statement before you trust the number. The setup, including Postgres and SQLite scope, is on that page, taken from the project documentation.
Ways to use DataTug shows the same server as one status among the agent integrations. Query multiple databases at once is a CLI join, not an MCP tool. DataTug vs DataGrip compares that server with JetBrains DataGrip.
Read-only is a choice you still have to make
Giving an AI agent read-only database access is not automatic because a server exists. DataTug's tools omit writes, and native SQL stays off until a policy allows it. The database login should also be unable to write. The ungoverned agent article says what happens when that login is too strong. A planned read-only connection control is labelled on the MCP page. It is not this explainer's promise.
SQL lessons are the place to practise the language a saved query contains. Query Firestore with SQL is a different CLI path, and it rejects SQL.