MCP Servers in ATX AnalyticsTable | BigQuery, PostgreSQL, Jira, Confluence

MCP serversRegister an MCP server once; use its tools from Ask Greg, the REST API and Settings — read-only by default. ATX AnalyticsTable is a Model Context Protocol (MCP) client. An administrator registers MCP servers once: Google BigQuery and PostgreSQL through Google's MCP Toolbox for Databases, Jira and Confluence through Atlassian's Rovo MCP server or the self-hosted mcp-atlassian, and any other MCP server as needed. Their tools then become available to Ask Greg, for data analysis, when the data policy allows it; to the public REST API (/api/v1/mcp/…), for scripts and integrations; and to Settings → MCP servers, to test a server and inspect its tools.

Transports and protocol

Protocol revisions: 2025-11-25, 2025-06-18 (requested), 2025-03-26 and 2024-11-05. A server that only speaks the legacy HTTP+SSE transport can be reached through the mcp-remote bridge as a stdio server.

Requests a server sends to the client are answered: ping gets a reply, and sampling, roots and elicitation get "method not found". The client never hands control to a server.

stdio — A server started on this machine (npx, uvx, a binary) — Newline-delimited JSON-RPC on stdin/stdout. stderr becomes a short diagnostic tail with secrets redacted. On Windows, .cmd shims are started through the shell, and arguments with shell metacharacters are refused rather than escaped.
http ("streamable HTTP") — A remote or hosted server (Atlassian Rovo MCP, your own gateway) — POST per message. Answers may be JSON or an SSE stream. The Mcp-Session-Id and MCP-Protocol-Version headers are handled. Goes through the installation's egress guard and proxy.

Templates

Any MCP server can be added today without a dedicated template, from the Custom templates. GET /api/v1/mcp/templates returns the ready-made definitions, each with its parameters: name, where it goes (env, secret, header), whether it is required, default, example and meaning. Every parameter of every template is listed on the documentation page MCP parameters and settings.

Google BigQuery (MCP Toolbox) — stdio: npx -y @toolbox-sdk/server --prebuilt bigquery --stdio — BIGQUERY_PROJECT (required); GOOGLE_APPLICATION_CREDENTIALS = the path of a service-account key file (or empty for Application Default Credentials); BIGQUERY_LOCATION; optional BIGQUERY_MAX_QUERY_RESULT_ROWS, BIGQUERY_MAXIMUM_BYTES_BILLED, BIGQUERY_WRITE_MODE=blocked — list_dataset_ids, list_table_ids, get_dataset_info, get_table_info, search_catalog, execute_sql (read-only checked)
PostgreSQL (MCP Toolbox) — stdio: npx -y @toolbox-sdk/server --prebuilt postgres --stdio — POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DATABASE, POSTGRES_USER, optional POSTGRES_QUERY_PARAMS; secret POSTGRES_PASSWORD — list_tables, execute_sql (read-only checked)
Jira Cloud (Atlassian Rovo MCP) — http: https://mcp.atlassian.com/v2/mcp — secret Authorization: Basic <base64 email:api_token> (personal) or Bearer <api key> (service account) — Jira, search and fetch tools; write tools refused
Confluence Cloud (Atlassian Rovo MCP) — same server — same credential — Confluence, search and fetch tools; write tools refused
Jira Server / Data Center — stdio: uvx mcp-atlassian with READ_ONLY_MODE=true — JIRA_URL; secret JIRA_PERSONAL_TOKEN; optional JIRA_PROJECTS_FILTER, JIRA_SSL_VERIFY — jira_* read tools
Confluence Server / Data Center — stdio: uvx mcp-atlassian with READ_ONLY_MODE=true — CONFLUENCE_URL; secret CONFLUENCE_PERSONAL_TOKEN; optional CONFLUENCE_SPACES_FILTER, CONFLUENCE_SSL_VERIFY — confluence_* read tools
Custom (stdio / HTTP) — either — everything — everything that passes the read-only rule; Ask Greg access off until you review the tools
Atlassian Cloud: an organisation admin must enable API-token authentication for the Rovo MCP server.
Toolbox templates: Node.js must be installed (or download the toolbox binary and point the command at it).
Data Center templates: install uv.

Setting up BigQuery with a service account

The Environment box holds one KEY=value per line; each line becomes an environment variable of the MCP Toolbox process, and KEY= with nothing after it means not set. It is stored as plain text, so a password goes under Secret names (vault) and a key file is referenced by its path — never pasted. Saving a private key into the Environment box is refused, and Test checks the parameters before it starts anything.

BIGQUERY_PROJECT left empty or the JSON pasted into GOOGLE_APPLICATION_CREDENTIALS are the two mistakes that stop the server from starting. Both are reported by Test in plain words.

Google Cloud Console → IAM → Service accounts: create an account (e.g. atx-reader). Grant BigQuery Data Viewer on the datasets and BigQuery Job User on the project — nothing that can write.
Keys → Add key → JSON. Store the downloaded file where only the account that runs ATX AnalyticsTable can read it, e.g. C:\Keys\atx-bigquery-sa.json.
Settings → Set / Restore → MCP servers & API → Add from template → Google BigQuery (MCP Toolbox). Fill in the Environment box as below; the form shows a Parameters table explaining every line.
Test (the first run downloads MCP Toolbox through npx; expect about nine tools), Save, then Tools: six are allowed and execute_sql is checked read-only.
For Ask Greg: keep Available to Ask Greg on and turn on Let the agent use MCP servers in Ask Greg → Governance → Data policy.
BIGQUERY_PROJECT — yes — Project the tools run in and bill to; the project_id in the key file.
GOOGLE_APPLICATION_CREDENTIALS — no — Path of the key file on the machine running ATX AnalyticsTable. Empty = Application Default Credentials (gcloud auth application-default login).
BIGQUERY_LOCATION — no — Where jobs run: EU, US or a region such as europe-west3.
BIGQUERY_MAX_QUERY_RESULT_ROWS — no — Most rows one execute_sql returns (default 50).
BIGQUERY_MAXIMUM_BYTES_BILLED — no — Cost cap per query in bytes; a larger scan is refused without running (empty or 0 = no cap).
BIGQUERY_WRITE_MODE — no — blocked makes MCP Toolbox itself allow SELECT only — the template sets it.
BIGQUERY_IMPERSONATE_SERVICE_ACCOUNT — no — Run as another service account (needs Service Account Token Creator on it).

Security model

Every rule below is enforced in code at call time, whoever is calling. The Settings screen only mirrors it.

Administrators configure — Creating, changing, deleting, testing and resetting a server needs admin: a stdio server is a command line this machine runs, and an HTTP server is a place it sends data. Calling a tool needs analyst. Listing needs viewer.
Secrets in the vault — Passwords and Authorization headers are named in secretKeys and sealed in the same encrypted vault as connection passwords. They are never in the server list file, never returned over HTTP, never logged, and never in the audit trail. Stderr and error text are redacted. A credential-looking header that is not marked secret is refused.
Process isolation — A stdio server gets an allow-listed environment (PATH, temp, proxy, CA bundle, …) plus its own variables, and not the backend's environment. In particular it never gets ANALYTICS_API_TOKEN. NODE_OPTIONS and ANALYTICS_*KEY cannot be configured. Child processes are killed with their tree on exit.
Read-only by default — Each tool is classified read, sql or write from its name (create/update/delete/add/transition/…), its schema, and its destructiveHint. A readOnlyHint is believed only when the name agrees, because annotations are untrusted hints under the MCP specification. On a read-only server, write tools are refused. An execute/run tool whose SQL argument is not named is treated as write.
SQL guard — For sql tools, the arguments named in sqlArgs must be one SELECT/WITH. Side-effect functions (pg_read_file, dblink, xp_*, …) are refused before the call is sent. Use a database role with SELECT only as well: this guard is a second line of defence.
Allow-list and pattern — allowedTools and toolPattern narrow what a server offers, for example the Jira tools of the Atlassian server.
Egress — HTTP servers use the installation's egress guard and proxy. Private and intranet addresses need allowPrivateNetwork, and plain http is accepted only for loopback or with that opt-in. A URL may not contain user:password.
Machine policy — ANALYTICS_MCP=0 turns MCP off. ANALYTICS_MCP_STDIO=0 allows HTTP servers only (the usual choice for a shared server). ANALYTICS_MCP_ALLOWED_COMMANDS=npx,uvx,toolbox limits which executables may be started. ANALYTICS_MCP_MAX_RESULT_KB caps the result size (default 256). ANALYTICS_MCP_SERVERS_FILE delivers servers by policy; those are shown as managed and cannot be changed in the UI. These switches can only narrow.
Audit — mcp.server.create/update/delete/test/reset and mcp.tool.call record the server, tool, outcome, duration, the caller (via: api / agent / settings), and the SHA-256 of the arguments. Arguments and results are never recorded.
Licence read-only mode — Testing a server and calling a tool count as reads. Saving a server is a write.

Resilience

Health is shown in GET /api/mcp/status, GET /api/v1/health, and on /metrics as analytics_mcp_calls_total{server,outcome}, analytics_mcp_call_duration_seconds, analytics_mcp_circuit_open and analytics_mcp_calls_in_flight. Reset (admin) closes a circuit and reconnects after you fix a configuration.

Per-call deadline — 30 s (template-specific; max 300 s) — The call is aborted, and the server is sent notifications/cancelled
Connect deadline — 60 s — Covers the first npx -y download
Circuit breaker — 5 consecutive failures → open 30 s → one trial call — A dead dependency costs one fast 503 unavailable (Retry-After), not a full timeout per call. Caller mistakes (refused SQL, bad arguments, a tool reporting an error) do not count.
Bulkhead — maxConcurrent per server (default 4), 16 queued — Excess calls get 503 immediately, so one slow server cannot hold every request
Reconnect — once, for idempotent work — A crashed process or an expired HTTP session is reconnected transparently for listing and read tools. A write is never re-sent.
Tool cache — 5 minutes — ?refresh=true bypasses it
Idle shutdown — 10 minutes — Unused stdio servers are stopped
Result cap — 256 KB — Longer text is cut and flagged truncated

Ask Greg and MCP

Off by default. Ask Greg uses MCP only when both of these hold:

AI_ALLOW_MCP=0 turns it off for a fleet. No value turns it on. When it is on:

Example questions

More on the assistant in the Ask Greg chapter of the handbook.

the data policy's "Let the agent use MCP servers" (allowMcp) is on (Ask Greg → Data policy), and
the server's "Available to Ask Greg" (allowAgent) is on.
the context pack lists the opted-in servers from this machine's registry, never from the request;
two tools are offered: list_mcp_tools (a server's allowed tools with their argument schemas) and call_mcp_tool. When the switch is off they are not described to the model, and they refuse if called anyway;
the scope rules swap the "cannot reach the network or call another service" clause for an accurate one and add an MCP section. The audit fingerprint gains +mcp;
every result goes through the egress gate. Results that look like rows go through the same level reduction, column masking and PII detectors as other data. Text is withheld entirely at schema-only, cut to 4 000 / 12 000 / 24 000 characters at aggregates / samples / full, and masked;
pseudonym tokens in the model's arguments are unmasked locally before the call, so a search for <<PERSON_1a2b>> finds the real person;
a ticket or page that contains instructions is treated as content. The scope rules say so explicitly.
"Compare the revenue in our project with the BigQuery finance.revenue_daily table for October."
"Which Jira issues in project FIN are still open for the Q3 close, and which of them touch the accounts in the outlier sheet?"
"Summarise the Confluence page 'Revenue recognition policy' and check whether our refunds column follows it."

The REST surface

The public v1 endpoints are read and call only; configuration uses the application's own /api/mcp/… routes, which are not part of the versioned v1 contract.

secrets semantics on PUT: a key with a value replaces the stored one, a key with "" removes it, and a key that is absent keeps what is stored. That way an edit form can save without retyping a password it never shows. expectedUpdatedAt gives optimistic concurrency between two administrators.

GET — /api/mcp/templates · /api/v1/mcp/templates — viewer
GET — /api/mcp/status — viewer
GET — /api/mcp/servers · /api/v1/mcp/servers — viewer
GET — /api/mcp/servers/:id — viewer
PUT — /api/mcp/servers/:id (body: { server, secrets?, expectedUpdatedAt? }) — admin
DELETE — /api/mcp/servers/:id — admin
POST — /api/mcp/servers/:id/test · /api/mcp/test (unsaved form) — admin
POST — /api/mcp/servers/:id/reset — admin
GET — /api/mcp/servers/:id/tools · /api/v1/mcp/servers/:id/tools — viewer
POST — /api/mcp/servers/:id/tools/:tool/call · /api/v1/…/call (body: { arguments }) — analyst

Troubleshooting

could not start "npx" — Node.js is not on the PATH of the account the backend runs as, or the command is not in ANALYTICS_MCP_ALLOWED_COMMANDS
the MCP server process exited … server said: … — Read the stderr tail in the Test result. Usually a missing variable or a wrong password.
MCP server answered HTTP 401 — check the credential — The Atlassian API-token method is not enabled, or the header format is wrong (Basic vs Bearer)
it is a private address and this server only reaches public hosts — Turn on Allow private network for an intranet server
… is failing; calls are paused for N s — The circuit is open. Fix the cause, then press Reset.
A tool is listed but cannot be called — The refusal names the reason: allow-list, pattern, or read-only
Fewer Jira tools than expected with an API token — Atlassian documents that some tools need OAuth scopes that API tokens cannot have