Jeff Smith from Oracle showed a single MCP server gate for Oracle AI Database on AI Engineer. The demo covered Oracle Database instances that now store vectors alongside relational tables. Access requires a local authenticated session through OAuth 2. Even read-only queries can expose PII without row-level filtering at the database.
Oracle added vectors to support retrieval pipelines with a single SQL interface. Smith said Oracle has added data types for 30 years and now includes graph for GraphRAG. MCP itself is new and the spec added MCP apps in July. Oracle built the MCP server to stay current with updates every three months.
Smith warned that natural language to SQL looks correct but often returns wrong data. Oracle counters that by offering parameterized reports instead of ad hoc generation. The server exposes two tools, list reports and execute reports, to avoid 500 tools for 500 reports. "If you build security only into your tools, what happens when a zealous engineer decides to go pick up another tool and point it at your database, they just go straight in," Smith said.
Smith described token costs from brute-force dictionary scans and shared team memory gaps. Oracle added a schema information tool that returns a compressed JSON dictionary with verbose, slim, and medium modes. A retrieve context tool and a generate annotations tool ingest SharePoint PDFs and docs into the database. Agents can also view report SQL when OAuth 2 scopes permit, to one-shot correct queries.
For production safety Smith recommended interrogating a Data Guard read-only standby instead of production. Oracle allows read-only agent access but still restricts visible rows and columns at the database layer. A custom performance tool with six actions can collect statistics for the cost-based optimizer and emit AWR reports. Smith said he does not trust agents to drop or build indexes without human review.
The daily brief
Get the free daily brief with the day's AI news, new AI startups and funding rounds every morning.
Join 11,995 subscribers.
Oracle enforces deep data security by mapping Azure AD scopes and roles inside Oracle Database. Smith said an HR manager role sees salary data while other roles see stripped results. Filtering happens before results return to Claude, Codex, Gemini, or LangChain clients. That model survives tool swaps because policy lives in Oracle Database, not the MCP client.
Oracle plans MCP apps that embed a database GUI directly in the agent, slated for later this year. Documentation and updates are at oracle.com/mcp. Separately Oracle introduced the OCI Observability MCP Server to bring observability data into AI assistants for troubleshooting. Smith remains in Raleigh and pointed teams to the Oracle booth for samples.
