Wren AI MCP server
Connect Claude, ChatGPT, Claude Code or your own agent to one MCP endpoint. Agents hand data questions to Wren AI and get back governed SQL, results and charts from 20+ databases, under each user's permissions.
$ claude mcp add --transport http wrenai \ https://cloud.getwren.ai/api/mcp
✓ signed in, 2 projects exposed
toollist_projects
sales-analytics, finance-core
toolask
{ projectId: "sales-analytics", question: "Net revenue by region last quarter?" }
SELECT region, SUM(net_revenue) AS net_revenue FROM sales_performance WHERE fiscal_quarter = '2026-Q3' GROUP BY region
4 rows. North America leads at $4.2M; APAC is down 6% quarter over quarter.
toolgenerate_chart
Vega chart spec, bar chart by region
Illustrative session on a sample project.
The tool surface
Agents can delegate the whole question, or drive each step themselves. Either way, every call resolves through the same definitions, joins and access rules your team uses in Wren AI.
Discover
Start a session by finding the projects this user can reach and how their data is shaped.
list_projectsLists the projects exposed to MCP that this user is a member of.
get_project_metadataReturns the tables and columns of one project.
Delegate
Treat Wren AI as a sub-agent: it plans the query, runs governed SQL and answers in plain language.
askEnd-to-end question answering from live data.
respond_clarificationReplies when Wren AI asks which metric or period you meant.
generate_summaryTurns query results into a plain-language summary.
Compose
For agents that want control: generate the SQL, review it, run it and chart the result.
generate_sqlTurns a question into SQL against your context layer.
run_sqlExecutes SQL under the signed-in user's permissions.
generate_chartReturns a Vega chart spec for the result.
Every tool except list_projects takes a projectId, so one connection can work across every project the user is allowed to query.
Why it matters
Most database MCP servers hand an agent a schema and a set of credentials. The agent then guesses what the columns mean on every question. Wren AI puts a context layer between the agent and your data, so answers agree no matter which agent asked.
| Dimension | Agent on a database MCP server | Agent on Wren AI MCP |
|---|---|---|
| Business definitions | Inferred from table and column names | Resolved from your context layer, versioned in git |
| Joins | Chosen by the model on each question | Declared once and reused by every agent |
| Sources | One server and one connection per database | 20+ sources through one endpoint |
| Credentials | Database credentials in the agent's config | OAuth with each user's Wren AI account |
| Access | Whatever the connection's role can see | Row- and column-level security per user, enforced on the server |
| Revoking access | Rotate the database password | Switch off a project or the MCP connection, effective immediately |
| Every answer | Rows back from a query | The SQL that ran, results, a chart spec and a summary |
The same context layer also serves Wren AI's own GenBI agent, Slack and embedded analytics, so a definition changed once is used everywhere.
How it works
An admin decides what agents can reach. Everyone else signs in with their own account.
1. Expose
In Settings, an admin turns on MCP for the organization and marks which projects are exposed. Projects stay private until you expose them, and switching one off cuts access immediately.
Settings
Organization
Members
Integrations
MCP
MCP
Choose which projects AI agents can reach.
Enable MCP for this organization
Turning this off cuts every connection immediately.
Users only reach exposed projects they are members of.
2. Connect
Add the endpoint as a custom connector in Claude or ChatGPT, or with one command in Claude Code. Each person signs in with OAuth, so no key or database password is stored in the client.
Add custom connector
Name
WrenAI
Remote MCP server URL
https://cloud.getwren.ai/api/mcp
You will sign in with your Wren AI account. No API key or database password is stored.
3. Call
The agent calls ask for a full answer, or composes generate_sql, run_sql and generate_chart itself. Wren AI resolves the context layer, applies the user's access rules and returns the SQL with every result.
ClaudeWrenAIWhich regions missed target in Q3?
wrenai: list_projects, ask
Two regions missed target: APAC closed at 91% and LATAM at 96%. North America and EMEA beat it.
SELECT region, SUM(net_revenue) / SUM(target) AS attainment FROM sales_performance WHERE fiscal_quarter = '2026-Q3' GROUP BY region
And bookings?
wrenai: ask
Wren AI needs one detail before it answers: gross or net bookings? Your choice goes back through respond_clarification.
One context layer
The MCP server is the same context layer behind every surface Wren AI answers in. An agent you build gets the same numbers your team sees in ChatGPT, Claude and Slack.
MCP server
Any agent or MCP client that supports remote servers with OAuth.
ChatGPT app directory
Ask in the chat your team already works in, and get the SQL and a chart back.
Wren AI in ChatGPT →ClaudeClaude connector, MCP
Turn one prompt into a dashboard where every number links to its SQL.
Claude dashboards →Claude CodeCLI, MCP
Query governed data from the terminal while you build.
Setup guide →SlackSlack app
Answer the question in the thread where it was asked.
Wren AI in Slack →Running the open-source Wren Engine? It includes its own MCP server you can self-host.
FAQ
It is a remote MCP endpoint, https://cloud.getwren.ai/api/mcp, that lets an AI agent hand data questions to Wren AI. The agent calls tools like ask or generate_sql, and Wren AI answers from live data through your context layer, so every caller works from the same business definitions.
Setup is documented for Claude (web and desktop), ChatGPT and Claude Code. The server speaks the open Model Context Protocol over HTTP with OAuth, so your own agents and other MCP clients that support remote servers can use the same endpoint. See the MCP setup guide.
Each person signs in with their own Wren AI account over OAuth. There is no API key to paste into a config file, and database credentials never leave Wren AI. Each connection is bound to one organization, and an admin can switch off a project or the whole MCP connection at any time, which cuts access immediately.
Row- and column-level security is enforced on the server for the user who signed in, and the client cannot override it. Agents only reach projects an admin has exposed to MCP and the user is a member of. Because permissions follow the account, each person should connect with their own account rather than a shared one.
A database MCP server gives an agent a connection and a schema, so the model guesses what columns mean and how tables join on every question. Wren AI gives the agent your context layer instead: metrics, relationships and business rules defined once in MDL and versioned in git. One endpoint covers 20+ data sources, and every answer comes back with the SQL that ran.
Use ask to delegate the whole question: Wren AI plans the query, runs it and answers, and may ask a clarifying question you reply to with respond_clarification. Use generate_sql, run_sql and generate_chart when your agent wants to control each step. Both paths resolve through the same context layer.
The hosted MCP server is available on the Enterprise Cloud plan and above. If you run the open-source Wren Engine, it ships its own MCP server you can host yourself; see the Wren Engine quickstart.
Try it
Expose a project, add one endpoint, and let your agents ask. Or see it on your own data with our team.
