{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T02:40:06.177Z", "record_id": "VXI-EXT-TOOL-TRUST-BIGQUERY-01-v1", "record_kind": "external_reference", "title": "BigQuery MCP: Read-only queries still need data and spending authority", "system": "BigQuery MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does selecting a read-only BigQuery MCP tool eliminate cost and permission concerns?", "near_questions": [ "Can BigQuery MCP modify data?", "How does execute_sql_readonly differ from execute_sql?", "Does listing public tools grant dataset access?", "Can a read-only query still cost money?", "Which identity authorises the query?", "Can result limits hide additional rows?", "Are Google Drive external tables supported?", "Which SQL forms are excluded from read-only execution?", "How should a buyer constrain query spend?", "What dataset content reaches the agent?", "When should an agent refuse a query mutation?", "Can I save the BigQuery data-and-cost review?" ], "supported_claims": [ { "claim": "The documented read-only SQL tool excludes specified mutation and execution forms, while a separate execute_sql tool can modify data. IAM still controls calls, and queries remain subject to time and result limits. Read-only execution can consume billable query resources; a tool list or truncated result does not establish authorised access or complete coverage.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The documented read-only SQL tool excludes specified mutation and execution forms, while a separate execute_sql tool can modify data. IAM still controls calls, and queries remain subject to time and result limits. Read-only execution can consume billable query resources; a tool list or truncated result does not establish authorised access or complete coverage.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITGUARDIAN-01-v1", "VXI-EXT-TOOL-TRUST-AZURE-DEVOPS-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "BigQuery MCP read-only and SQL capabilities", "source_url": "https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-TOOL-TRUST-BIGQUERY-01-v1", "candidate_record_sha256": "41565675f016f9ceb237f107172594d8f03fcf1460457962915975a8814c8879", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The documented read-only SQL tool excludes specified mutation and execution forms, while a separate execute_sql tool can modify data. IAM still controls calls, and queries remain subject to time and result limits. Read-only execution can consume billable query resources; a tool list or truncated result does not establish authorised access or complete coverage.", "required_buyer_context": "Dataset scope, OAuth identity, tool choice, billing model, query limits and spending authority.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "BigQuery MCP", "variant": "Google hosted BigQuery MCP tools" }, "review_status": "documentation_review_only", "checked_on": "2026-10-16", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Google publishes the hosted BigQuery MCP service.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Discover datasets and run supported SQL operations.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Permitted metadata and query result rows.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "execute_sql is the documented mutating tool; the read-only variant has explicit exclusions.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "OAuth-backed IAM access is required for tool calls; tool discovery alone is not authorisation.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "IAM permissions and tool-specific restrictions determine executable operations.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Query results leave BigQuery for the agent client; the buyer must approve that disclosure.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Limits, unsupported external sources and query cost can affect completion or scope.", "source_ids": [ "bigquery-mcp", "bigquery-cost" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Caller grants, billing mode, dataset sensitivity and query limits are unverified.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Require data and spending authority; reject mutations outside scope and do not infer completeness from a limited result.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "bigquery-mcp", "url": "https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp", "final_url": "https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp?hl=it", "title": "BigQuery MCP read-only and SQL capabilities", "checked_on": "2026-10-16", "sha256": "2550de4a21283e96798bcce6e2e2358998c4374c81199fe448f8060b057553a2", "bytes": 344404 }, { "source_id": "bigquery-cost", "url": "https://docs.cloud.google.com/bigquery/docs/best-practices-costs", "final_url": "https://docs.cloud.google.com/bigquery/docs/best-practices-costs", "title": "BigQuery query cost controls", "checked_on": "2026-10-16", "sha256": "06001fa2119a7d7da4ff29f66de7ce91efa4e2622b9a562b7f4b4b7d5d5a7282", "bytes": 410679 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Retain the separate data-access, mutation and query-cost boundaries for an agent workflow.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "IAM grants, tool restrictions, supported sources and billing controls." }, "change_history": [ { "version": 1, "date": "2026-10-16", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#bigquery-mcp-query-writes-and-billing", "machine_readable_record": "/varexis-index/records/bigquery-mcp-query-writes-and-billing.json" }