Slides and Q&A from our AI/MCP Webinar

Beyond the Hype: Practical AI for Your Oracle Database with MCP with Jeff & Kris, 02 September 2026

Yesterday we spent an hour or so sharing the latest and greatest from our MCP Servers and practical tips from using AI with our Oracle AI Database. The actual description is …

The video

The Slides

If you’re wondering about the recording, it will be up on YouTube shortly, and I’ll udpate this post ASAP. In the meantime…

Q&A

The response was amazing! We had nearly 700 live attendees, and they brought the questions! We had 150 questions during the zoom, of which I think we addressed directly or otherwise..maybe 10%.

So here is a condensed list of those questions, anonymized, and grouped or re-worded to cover 3 questions on the same topic or concept.

1. Architecture: SQLcl vs. ORDS vs. OCI-Managed MCP

1. Is OCI’s MCP support accessed via Developer Tools → MCP?

   Yes, under the Developer Tools → MCP.



2. When do you decide to build a custom MCP tool vs. just exposing a plain REST API?

   Great question! And in fact you can use existing REST APIs to build a custom MCP Server and expose those as tools, but you need to worry about all the security features we’ve already taken care of…so beware that path.

   If you’re using a REST API, that means you need a set of REST credentials and access to the REST API Server, and you’re on a REST HTTP workflow – which is similar to but DIFFERENT than MCP. Sorry, but I would say it depends applies here.

3. Is the OCI/ORDS (HTTP) MCP server stateless and multi-user, while SQLcl (STDIO) is single-user/stateful?

   The HTTP ones (ORDS and OCI) are stateless for multi-user. Confirmed directly: HTTPS is multi-user, STDIO is single-user — correct.

4. Is ORDS moving toward standalone-only deployment, or will it continue to support WebLogic/Tomcat?

   It’s been standalone as the primary for quite some time. For ADB-S we use it in standalone doing billions of calls per week.

   Short answer: no, staying STANDALONE model for time being.

5. In the GitHub repo, do files prefixed oci-* only apply to databases hosted in OCI?

   Those are actually MCP Servers for OCI Services, like COMPUTE or STORAGE. If it’s for a OCI Database Service feature, then yes, for OCI hosted databases.

2. Authentication, Authorization & Security

6. Can we use OAuth2 against our existing IdP (e.g., Azure Entra) instead of username/password?

   The ORDS MCP specifically only allows an Open-ID (OAuth2) flow, which can be set up against Azure Entra, Oracle IDCS, and others.

   OCI DBTools MCP can also auth via your Azure Entra users, via OCI IAM and Federation

7. If IDCS/SSO uses one identity provider (e.g., ForgeRock/Okta) and the database (ATP/ADW) uses another (e.g., Entra), does that work?

   It depends, and not sure that makes sense. The end user via their client/agent will authenticate first to Okta. After that the MCP Server will grab a database connection and authenticate via Entra – but is the Okta and Entra user not the same user? Why have both? Easier to pick one. Happy to chat further with more details, email me!

8. Does the OCI-managed MCP server come pre-integrated with Identity Domains, and does it support Centrally Managed Users?

   If your OCI administrator has already federated those users into your domain, you’re good to go.

9. Can OCI MCP servers work against a database protected by Deep Data Security / Data Safe?

   Yes. In OCI, go to Developer → MCP — that works with Deep Data Security out of the box.

10. How is data retention handled — can we guarantee the LLM doesn’t learn from or retain the data it sees (“zero data retention”)?

    This depends on the LLM. Most have something (probably costs more) called zero data retention, meaning they’re not allowed to do that. That’d be up to your LLM provider — or use a local LLM, or a non-frontier model on an OCI GPU or similar.

11. Is there a simple, reliable way to enforce strict read-only mode so the LLM/agent can never modify a production database?

    yes, create a database user account that only can do query things like READ or SELET privs on the appropriate tables. That user will be used for any MCP Server database connection.

12. Is there a recommended baseline read-only role to start with (e.g., a standard “MCP read-only” role)?

    That’s the recommended approach: start small, start read-only, then creep up permissions as the use case demands.

    But a ‘read only role’ provided by the database or our MCP Servers? No, that’s for you to create/manage.

13. How do you restrict different users/audiences to different privilege levels (some select-only, some admin)?

    Connections would be locked down to a required role/group membership in the identity management system. If you have the right one, you get access to the appropriate database users that will be doing the work.F For one approach, see Jeff’s previous blog post on ORDS with Keycloak.

14. Today mcp.role/mcp.scope authorize at the whole database-pool level — any plan for finer-grained, object-level (table/view) authorization?

    Not really currently, but you’ll soon be able to scope access to specific tools, so access is limited by the scope plus the MCP tool. Separately, Deep Data Security work brings identity into the database itself, which could also be used to limit access.

15. Can OCI application roles be mapped to something more granular than “run this entire tool” (e.g., below sql_run)?

    Yes, forgo the built-in tools that inclue run-sql, and instead deploy custom MCP tools in OCI, and gate those to the app role.

16. Can auto-approval be enabled at the individual tool level — useful when the DB user only has select-only grants?

    The MCP config allows for that, and most agents support that – but that’s your decision/choice. PROCEED CAREFULLY.

17. As a DBA, how do you control/prevent MCP-LLM database access before an institutional policy exists?

    I would reject any incoming connectoin from an agent via our MCP Servers. One way to do that would be an Trigger that kills sessions. Data Vault would probably offer something more elegant.

18. How is quantum-safe cryptography handled for MCP request/response traffic?

    Once the JDBC Thin Driver supports this, you’ll just be good to go. Details here.

    /li>

19. If the LLM gives a wrong answer, can a DBA trace the full chain — natural-language question → MCP tool → generated SQL → DB result → final answer?

    Audit trails would enable this, yes. And in ORDS MCP we use ECIDs to make tracking database queries to webserver requests even easier to correlate.

3. Licensing & Cost

20. Is this a licensed/paid product, or is it free to use?

    There’s always a license, but there’s no cost for these MCP servers. (Confirmed again separately: yes, free.)

21. Who bears the cost of the underlying LLM calls?

    If the LLM writes a bad/expensive SQL Query, and the database runs it and uses up a resource that costs money, then the user who asked the question is responsible for that. We recommend looking at Oracle’s Resource Manager, you could create a consumer group for AI tools, that limits CPU and Memory allocation for these calls

22. How do you minimize token usage, and what does token usage cost?

    Great question, and way too big to handle here. Agent memory, AI Skills, better prompts, Schema Annotations could all help with this.

23. Is there a limit on the size of the output returned to the LLM?

    You’re asking the wrong question. You want to keep the output to a minimum to conserve tokens, let the DATABASE do the heavy lifting and processing, and send the aggregates back to the LLM vs the raw data.B But when it comes to limits, there’s always a limit, but sometimes that’s defined by physics vs our APIs. Have a go and see for yourself!

4. Platform & Version Support

24. What MCP spec version do you support — 2025 or 2026 — and what’s the timeline for the newer spec?

    We’re basically current at time of shipping, since we use the official MCP SDK from the foundation and update to the most current version every release.

25. What’s the minimum ORDS / SQL Developer version that includes the MCP server?

    You’ll want the latest VS Code Extension 26.2. There’s no reason to use an older copy, but we’ve been including this since last July so version 25.2 or 3 probably.

26. Does this work with Oracle Database 19c (on-prem, via SQLcl / MCP CLI)?

    Yes. (Confirmed multiple times, including for on-prem 19c specifically.)

27. Does the OCI-managed MCP support Autonomous JSON Database (AJD)?

    Yes!

28. Is the OCI-managed MCP server available on ExaCC as well as Exadata Dedicated (ExaD)?

    Yes – all databases running in OCI are available, assuming network connectivity is available, which may require a private endpoint.

29. Does Exadata Cloud@Customer have its own built-in AI capabilities?

    Like it’s own MCP Server? No, but you can use the ones discussed today just fine!

30. Is OCI-managed MCP / the Developer Tools option available in FedRAMP / Gov Cloud regions, and do the same security rules apply to federal clients?

    Not in the gov regions yet. The Developer Tools option specifically: not yet, we’re working on it.

5. Setup, Installation & Client Integration

31. (Same as question 1 above — Developer Tools → MCP.)

32. Does SQLcl require VS Code, or can it run fully standalone?

    No — you can get just SQLcl standalone.

33. What’s the curl command to download the latest version of SQLcl?

    Depends on the OS, but you’ll just curl this ZIP, e.g. curl –O https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-latest.zip

34. When upgrading SQLcl (e.g., from 25.4.2.0), does unzipping the new version over the old install preserve existing saved connections?

    Personally, I’d unzip to a new folder — overwriting can be odd if files aren’t present in the newer version.

    The connections are defined outside the program, under the OS user data.

35. Can SQLcl/MCP be installed fully on-premises — and if so, are there still data-sharing concerns when the LLM itself is cloud-hosted?

    Yes. Yes, the data will be going out to the LLM to be analyzed – check with your LLM provider for details.

36. Where can I find documentation for setting up the ORDS-based MCP server?

    In the ORDS Docs.

37. How do I add a remote MCP server to Claude Code or the Copilot CLI?

    In Claude Code just use slash mcp, and in Copilot CLI, just ask it and it will talk you through it.

38. Can I connect to the database using the Codex app (as opposed to the Codex VS Code extension)?

    Yes, we do that here all the time, now the desktop ChatGPT app.

39. Does this need its own dedicated private endpoint, or can an existing Database Management private endpoint be reused?

    The Endpoint needs to be defined in the Database Tools Service for our MCP Server to use it, but yes that can be re-used for other DB Tools Services features.

40. For OCI-managed MCP against Exadata hosted elsewhere (e.g., Azure), is connectivity public-only, or can it go private via Foundry agents?

    It runs in OCI. It can talk to an oracle database in Oracle at Azure. We are already registerd in the Azure Foundry. Not sure what you mean about ‘going private.’

41. Can someone provide 1:1 setup help for SQLcl MCP with VS Code, an Oracle 26ai ADB, and an Azure OpenAI endpoint?

    Nope. But we have forums, and Oracle Support to help you. And we probably have blog posts that show how.

6. Capabilities & Custom Tools

42. Can we define our own custom tools in PL/SQL for the database MCP server, in OCI and/or ORDS?

    Yes — you can make “custom tools,” which is a name/description/variable setup to execute a specific SQL or PL/SQL statement. Registering the same custom tool to both ORDS and OCI-hosted MCP servers: not in the current release, but it’s coming soon.

    I have an example for OCI custom tools here.

43. Can Skills be used to run specific packages/procedures with custom variables/workflows against specific tables?

    Yes!

44. Are there tools/skills for DBA-style operations, e.g., pulling AWR reports?

    Kind of — the sqlcl-command tool means any command in SQLcl can be called, for example AWR reports.

45. What are the benefits of connecting SQLcl to an AWR Warehouse (AWRWH)?

    Your agent can diagnose performance problems by talking to the warehouse vs putting extra load on the slow production system. Plus, it’s safer.

46. Can I connect to and query multiple databases at once through MCP?

    Not today. Multiple connections = multiple requests, the agent munges the results together for analysis – unless you start talking DB_LINKs, ew.

47. Can MCP connect to Oracle Object Storage to import a CSV and create a table from it?

    Yes, there is an MCP Server for OCI Object store. And our MCP Server for database would let you generate the dbms_cloud/external table DDL and execute it on the database

48. Is there a way to expose database schema metadata through MCP?

    Yes, we have a built-in tool for that, schema-information.

49. Is there guidance on which MCP tools to use for DML vs. DDL operations?

    No, they all go through run-sql, unless you build a custom tool.

50. Any plans for MCP tools to assist with database patching and pre-checks?

    Not today, although we are working with those teams to get the Skills up to date. MCP Server. SQLcl can already run autoupgrade 🙂

51. Could an MCP tool directly execute an operation like “create a standby database with DB_UNIQUE_NAME=X”?

    Yes.

52. Beyond chatbot-style Q&A, what other use cases does this unlock?

    See the slides (slide 6) below!

53. Is CSV output supported (instead of JSON) for ORDS REST API / MCP responses, given LLM token-size limits?

    We already do this, query results are shared via CSV, inside the JSON object.

7. Known Issues / Troubleshooting

54. The schema-information tool appears to use LISTAGG without an overflow clause and throws ORA-01489: result of string concatenation is too long — is this a known issue?

    Yes, and I thought we fixed it. We’ll take another stab, but in the meantime, i would instruct your agent to call the tool with a FILTER to limit the scope of the request. You wouldnt want ALL that data most likely, it would overwhelm your LLM/token window.

55. Can MCP tools be tested/invoked directly from Postman?

    Great question for Postman team. There are several MCP Clients builf for testing out there. Wouldn’t be surprised if Postman added support for MCP.

8. LLM / Model Questions

56. Which LLM/model are you using in the demos?

    We mostly use OpenAI’s GPT-5.6 models.

57. I don’t want the LLM doing reasoning or decision-making — only language-related tasks. Is there an alternative approach for that?

    Sure – build your own agent/harness and you can tell the LLM exactly what it needs to do and not do.

9. Integration with Other Oracle Applications

58. Has MCP been built into Oracle apps like EBS, ERP, Fusion, or the Public Safety suite?

    On Fusion specifically: probably via an MCP server — there are MCP servers that can operate against the OpenAPI spec Fusion publishes. Our MCP server can connect to the Fusion data warehouse but doesn’t call REST APIs directly.

    For EBS, you can simply use the database mcp server and connect to the EBS instance.

59. Is there an “agent factory”-style capability planned for Oracle Health/EHR customers (build your own agents/MCPs/skills)?

    Sorry, we’re not privy to the Health side, but I would assume that is being discussed already.

60. Is PeopleTools 8.63’s MCP support acting as a client or a server for developers writing PeopleCode, and where does the LLM live in that setup?

    Sorry, you need to ask the Peoplesoft team

61. When will Skills be available for PeopleSoft?

    See above answer.

62. Is there a plan to support CIMD, or is pre-registration the only option for now?

    At the moment, ORDS MCP already supports dynamic client registration. We’re keepign close eye on the MCP specs and will adopt the major new features as they become standard. So, yes.

63. Can OCI ADB MCP be used together with Fusion AI Agent Studio?

    IF that agent studio is able to talk and work with a database, then sure?

64. For an Exadata RAC + Data Guard configuration, what’s the recommended connection architecture so MCP handles instance failover/switchover without manual reconfiguration?

    This is an ords https issue, see our ORDS reference architecture and best practices guides for that, it’s actually pretty straightforward and definitely possible today.

10. Access, Trials & Training

65. How can I get access to try this myself?

    You can get started here: oracle.com/mcp

66. Can freesql.com be used with a personal account, or is it business/enterprise only?

    Yes — it’s intended for personal users too, you don’t need a business or enterprise account.

67. How long will the free SQL practice environment remain available?

    For as long as you keep using it. We nuke accounts after 90 days of non-use, but you can always create a new account.

68. Is there a “Developer Day”-style database plus free online server available to test these features?

    FreeSQL.com, yes

69. Do you offer training specifically on implementing AI on top of reporting?

    Our R&D team does not…

70. Feedback: hands-on labs (like the prior OracleOpenAIWorld lab), with a provided DB/MCP/LLM sandbox and API keys, would help drive adoption — any plans along these lines?

    Yes, we will have those at AI World this year!

71. Is a special license needed to connect to Oracle’s GitHub repo, and how do you connect / build reports from it?

    Normal Github access rules here, nothing special.