MaxCompute MCP Server (MCMCP) implements the Model Context Protocol (MCP) to wrap MaxCompute’s underlying metadata, compute, and storage services into a unified capability layer that AI Agents can understand and invoke directly. Using MCMCP, AI Agents can perform large-scale data analytics, multimodal data transformation, and intelligent operations and maintenance (O&M) without additional tooling.
Function Overview
Agents invoke structured tools provided by MCMCP using the standard MCP protocol—no extra SDK or driver is required. MCMCP covers the full data operation workflow, from metadata browsing and SQL analysis to table management.
Core capabilities
Catalog metadata browsing and search: Browse projects, schemas, tables, fields, and partitions hierarchically. Supports natural language search.
Table management and metadata maintenance: Create tables (with options for lifecycle, primary key, and partial column updates), insert small amounts of data, and update table comments, tags, or column descriptions.
Identity and permission checks: View current account identity and SHOW GRANTS permission details.
Multiple authentication methods: AccessKey/SecretKey (AK/SK), Security Token Service (STS), Credentials URI, ECS RAM Role, and the default Alibaba Cloud credential chain.
Read-only SQL analysis: Cost estimation, asynchronous execution, instance status queries, and result retrieval. Enforced as read-only on the server side.
Architecture overview

MCMCP uses a layered architecture, from top to bottom:
User Agent ecosystem: Supports multiple Agent clients including OpenClaw, DataWorks Agent, Qwen Code, QoderWork, and MaxAgent.
MaxCompute Skills collection: A universal skill package for Agents, containing semantic packs, common commands, development templates, and usage limits. Extends Agent capabilities via MaxCompute OpenAPI, InfraAgent, and CatalogAI.
MCMCP service: Wraps MaxCompute OpenAPI, StorageAPI, and CatalogAPI into structured tools directly callable by Agents.
MaxCompute core capabilities:
Metadata:
Catalog / Schema / Table / Partition. Features include authorization, auditing, data discovery, data exporting, masking, row-level permissions, and data sharing.
Compute Engines:
MaxCompute SQL, MaxFrame, MC Spark. Compute types include heterogeneous CU/GU, AI functions, and models.
Storage:
Table (Append / PK Delta Table); data types include BLOB, JSON, ARRAY, MAP, STRUCT. Features include automatic storage tiering, multi-replica, multi-AZ disaster recovery, recycle bin/Time Travel, data snapshots, and storage encryption.
Prerequisites
Python
Version 3.10 or later.
We recommend using the uv package management tool to install dependencies and run the service.
Alibaba Cloud credentials
AK/SK, STS, Credentials URI, ECS RAM Role, or the default Alibaba Cloud credential chain.
MaxCompute
Project: You must have access to at least one MaxCompute project. Confirm your default project name—it is used to create the ODPS client, submit SQL, check permissions, and serve as the default context when project parameters are omitted.
Confirm your endpoint, for example:
https://service.cn-hangzhou.maxcompute.aliyun.com/api.
Confirm your root account UID (also known as namespaceId).
Important notes
Do not commit
config.json, AK/SK, STS tokens, Credentials URIs, query result files, or coverage outputs.In production environments, prefer dynamic credential sources such as
ALIBABA_CLOUD_CREDENTIALS_URIor RAM Roles.Grant the identity used for MCP the least privilege access. Do not use high-permission root account AKs directly.
execute_sqlenforces read-only protection, butcreate_table,insert_values, andupdate_tablemodify resources or metadata.output_urionly allows writing to local files on the server. Use a dedicated secure directory and avoid sensitive system paths.For high-cost, large-result, or cross-project queries, estimate costs first and verify that project, schema, and table references are correct.
If you encounter issues, contact the MaxCompute team or open an issue in the GitHub repository.
Download and install
Download MCMCP
GitHub Repo: https://github.com/aliyun/alibabacloud-maxcompute-mcp-server
Compatible with MCP clients such as Claude Code, OpenCode, Qoder, and Cursor.
Install from source
In your terminal, run:
git clone https://github.com/aliyun/alibabacloud-maxcompute-mcp-server.git cd alibabacloud-maxcompute-mcp-server uv syncVerify the CLI entry point:
uv run alibabacloud-maxcompute-mcp-server --helpCopy the configuration template:
cp config.example.json config.jsonWarningconfig.json contains sensitive information (such as AK/SK). Keep it local only—do not commit it to Git.
After editing
config.json, start the service once from the command line to confirm there are no configuration errors:uv run alibabacloud-maxcompute-mcp-server --config config.json
The default transport method is stdio. After successful startup, the server waits for communication from the MCP client via standard input and output.
Configure MaxCompute connection
MCMCP supports two configuration sources:
Configuration file: Specify using
--config /path/to/config.jsonor the environment variableMAXCOMPUTE_CATALOG_CONFIG.Environment variables: These can override the configuration file or be used without any config file.
Using a configuration file
config.json contains sensitive information (such as AK/SK). Keep it local only—do not commit it to Git.
Example config.json:
{
"maxcompute": {
"maxcompute_endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
"defaultProject": "<DEFAULT_PROJECT_NAME>",
"namespaceId": "<ALIBABACLOUD_ACCOUNT_UID>",
"accessKeyId": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
"accessKeySecret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
}
}Using environment variables
export MAXCOMPUTE_ENDPOINT="https://service.cn-hangzhou.maxcompute.aliyun.com/api"
export MAXCOMPUTE_DEFAULT_PROJECT="<DEFAULT_PROJECT_NAME>"
export MAXCOMPUTE_NAMESPACE_ID="<ALIBABACLOUD_ACCOUNT_UID>"
# Method 1: AK/SK
export ALIBABA_CLOUD_ACCESS_KEY_ID="<ALIBABA_CLOUD_ACCESS_KEY_ID>"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
# Method 2: STS
export ALIBABA_CLOUD_ACCESS_KEY_ID="<STS_ACCESS_KEY_ID>"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="<STS_ACCESS_KEY_SECRET>"
export ALIBABA_CLOUD_SECURITY_TOKEN="<STS_TOKEN>"
# Method 3: Credentials URI (recommended for production or platform-managed environments)
export ALIBABA_CLOUD_CREDENTIALS_URI="http://localhost:8765/credentials"Credential resolution rules:
If AK/SK is set in environment variables or the config file, MCMCP uses those static credentials.
If no static AK/SK is set, MCMCP uses the default Alibaba Cloud Credentials SDK credential chain.
The default credentials chain can use
ALIBABA_CLOUD_CREDENTIALS_URI, the local Alibaba Cloud configuration, or ECS RAM.RAM Role, OIDC, and other sources.
For automatic STS token refresh, prefer Credentials URI, RAM Role, or other dynamic credential sources.
Configure your MCP client
Qoder / Cursor / Claude Code / generic stdio clients
Common client configuration locations
Client
Config location
Cursor
~/.cursor/mcp.jsonClaude Code
.mcp.jsonin your project rootOther MCP clients
Refer to your client’s MCP server configuration documentation
Configuration methods
Using a config file
{ "mcpServers": { "alibabacloud-maxcompute-mcp-server": { "command": "uv", "args": ["--directory", "/absolute/path/to/alibabacloud-maxcompute-mcp-server", "run", "alibabacloud-maxcompute-mcp-server"], "env": {"MAXCOMPUTE_CATALOG_CONFIG": "/absolute/path/to/config.json"} } } }Using only environment variables
{ "mcpServers": { "alibabacloud-maxcompute-mcp-server": { "command": "uv", "args": ["--directory", "/absolute/path/to/alibabacloud-maxcompute-mcp-server", "run", "alibabacloud-maxcompute-mcp-server"], "env": { "MAXCOMPUTE_ENDPOINT": "https://service.cn-hangzhou.maxcompute.aliyun.com/api", "MAXCOMPUTE_DEFAULT_PROJECT": "<DEFAULT_PROJECT_NAME>", "MAXCOMPUTE_NAMESPACE_ID": "<ALIBABACLOUD_ACCOUNT_UID>", "ALIBABA_CLOUD_ACCESS_KEY_ID": "<AK_ID>", "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<AK_SECRET>" } } } }
DataWorks personal instance + Claude Code
DataWorks personal instances typically inject ALIBABA_CLOUD_CREDENTIALS_URI. In this environment, config.json only needs endpoint, default project, and optionally namespaceId:
{
"maxcompute": {
"maxcompute_endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
"defaultProject": "<DEFAULT_PROJECT_NAME>",
"namespaceId": "<ALIBABACLOUD_ACCOUNT_UID>"
}
}Example .mcp.json:
{
"mcpServers": {
"alibabacloud-maxcompute-mcp-server": {
"command": "uv",
"args": [
"--directory",
"/absolute/path/to/alibabacloud-maxcompute-mcp-server",
"run",
"alibabacloud-maxcompute-mcp-server"
],
"env": {
"MAXCOMPUTE_CATALOG_CONFIG": "/absolute/path/to/alibabacloud-maxcompute-mcp-server/config.json",
"ALIBABA_CLOUD_CREDENTIALS_URI": "<VALUE_FROM_DATAWORKS_ENV>"
}
}
}
}
You can view the injected credentials URI inside the instance with:
echo "$ALIBABA_CLOUD_CREDENTIALS_URI"
Streamable HTTP mode
Use stdio by default. For remote or multi-process access, start in HTTP mode:
uv run alibabacloud-maxcompute-mcp-server \
--config /absolute/path/to/config.json \
--transport http \
--host 127.0.0.1 \
--port 8000
Set the MCP client address to:
http://127.0.0.1:8000/mcp
Verify connection
After configuration, restart your MCP client and enter the following in a conversation:
Show my MaxCompute identity information without querying detailed permissionsThe Agent should call check_access and return a response like:
{
"success": true,
"data": {
"identity": {
"accessKeyId": "LTAI***xYzW",
"defaultProject": "my_project",
"endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
"displayName": "user@example.com"
}
}
}
To also verify permission queries, use:
Show my MaxCompute permissions in the my_project projectMCP tools reference
Category | Tool | Description |
Catalog metadata |
| List projects accessible to the current account. |
| Get project details, including whether schemas are enabled. | |
| List schemas in a project. | |
| Get schema details. | |
| List tables, views, and foreign tables. Returns namingModel to distinguish two-layer vs. three-layer models. | |
| Get field info, partition keys, table comments, tags, lifecycle, sqlTableRef, and more. | |
| Get partition list, data volume, and time metrics for partitioned tables. | |
Metadata search |
| Search tables, resources, and schemas under the configured |
SQL and instances |
| Estimate SQL cost without executing it. |
| Execute read-only SQL. Returns instanceId asynchronously by default. | |
| Query instance status, progress, LogView, and resource consumption. | |
| Retrieve results from completed instances. Supports writing full results to a file via | |
Identity and permissions |
| Check current identity and permissions in the target project. |
Table management |
| Create a table with support for partitions, lifecycle, primary key, storage tier, and more. |
| Insert small amounts of data using | |
Table metadata maintenance |
| Update table comments, tags, lifecycle, column comments, nullability, and add new columns. |
Key constraints
execute_sqlonly allows read-only SQL. The server enforces this by injectingodps.sql.read.only=true.create_table,insert_values, andupdate_tablemodify resources or metadata. Grant access carefully.Before writing SQL queries, call
get_table_schemaand use the returnedsqlTableRefto generate table references.list_tablesreturns anamingModelthat affects the SQL table name format: the three-layer model usesschema.tableorproject.schema.table, and the two-layer model usestableorproject.table.search_meta_datarequiresnamespaceIdto be configured, and the query syntax typically requirestype=TABLE,type=RESOURCEortype=SCHEMA.
Common scenarios
Browse projects and tables
Example:
List MaxCompute projects I can access, then show schemas in my_project
Show fields, partition keys, and table comments for user_info in my_project's default schemaRun SQL queries securely
Estimate cost before execution:
First show the structure of the orders table, then estimate the cost of this SQL:
SELECT COUNT(*) FROM orders WHERE dt='2026-05-01'Run a read-only query:
Run this read-only query in my_project:
SELECT * FROM default.orders WHERE dt='2026-05-01' LIMIT 100For large queries, use asynchronous execution:
Run this query asynchronously. After returning the instanceId, poll its status and read the first 100 rows when doneExport large results
Inline results are capped by row limits. For full results, use output_uri:
Run this query synchronously and write the full result to file:///tmp/maxcompute-result/orders.jsonl;
Only show me a preview and the final outputPath in the responseoutput_uri writes to the local file system of the MCP server—not your client machine.
Check identity and permissions
Show the MaxCompute identity used by MCP and list my permissions in my_projectSearch metadata
Search the Catalog for tables with names containing 'orders', limited to my_projectMaintain business metadata
First read the current schema of default.orders, then update the table comment to 'Order fact table'
and change the buyer_id column comment to 'Buyer ID'update_table supports these changes:
Table comment:
descriptionTags:
labelsLifecycle:
expiration.days,expiration.partitionDaysColumn comments:
columns.setCommentsChange top-level columns from non-nullable to nullable:
columns.setNullableAdd new columns:
columns.add
MaxCompute does not support deleting columns, changing column types, reordering columns, inserting columns in the middle, changing nullable columns to non-nullable, or modifying nullability of nested columns via this tool.
Create tables and insert small data sets
Create a test table demo_user in my_project.default
with fields id BIGINT, name STRING, and dt STRING as a partition key, with a 7-day lifecycleInsert two test rows into demo_user with dt partition value 2026-05-18These operations modify MaxCompute resources. Grant permissions only for test or controlled projects.
Troubleshooting
MCP client does not show tools
Check the following:
Is
commandset touv? Doesargsinclude--directorypointing to the absolute path of the repo?If the client cannot find
uv, replacecommandwith the absolute path returned bywhich uv.Have you run
uv syncin the repo?Does
MAXCOMPUTE_CATALOG_CONFIGpoint to the correctconfig.json?Did you restart Cursor, Claude Code, or your MCP client?
Does manually running
uv run alibabacloud-maxcompute-mcp-server --helpin the repo directory succeed?
Authentication or connection failures
Check the following:
Does
MAXCOMPUTE_ENDPOINTormaxcompute_endpointmatch your project’s region?Are your AK/SK or STS token valid and not expired?
If using a credentials service, can
ALIBABA_CLOUD_CREDENTIALS_URIbe accessed from the MCP server machine?Has the current identity been granted access to the target project?
First verify your identity with
check_access, then troubleshoot specific tools.
search_meta_data returns an error
Common causes:
namespaceIdorMAXCOMPUTE_NAMESPACE_IDis not configured.The query lacks
type=TABLE,type=RESOURCE, ortype=SCHEMA.The query uses incompatible project and region conditions.
SQL table name resolution fails
First call get_table_schema and have the Agent use the returned sqlTableRef.
Three-layer model tables commonly use
schema.tableorproject.schema.table;Two-layer model tables commonly use
tableorproject.table.
SQL execution times out or results are truncated
We recommend asynchronous execution by default. After obtaining the
instanceId, useget_instance_statusandget_instanceto retrieve the results.For synchronous execution, set a
timeout. If it times out, you can still use the returnedinstanceIdto continue querying.For large results, use
output_uri=file:///path/to/result.jsonlto write to a local file on the server.Before execution, call
cost_sql, then usemaxCUto limit resource consumption.
Information Schema semantic skill guide
Information_Schema is a system-level Ops semantic skill built on MaxCompute tenant-level INFORMATION_SCHEMA metadata views. It gives data teams comprehensive capabilities for project auditing, usage analysis, and operational observability by turning complex low-level metadata into natural-language-queryable metrics and entities.
Skill Repo: https://skills.aliyun.com/skills/alibabacloud-odps-information-schema
Scenarios
Storage pressure diagnosis
Capability: Identify top storage-consuming tables, detect partition bloat risks, and spot data freshness issues.
Prompt example: "Analyze the top 10 tables by storage usage in my tenant" or "Check which tables have partition bloat risks."
Cost pressure diagnosis
Capability: Break down job costs by owner, project, or type; track CU-hour consumption and identify high-resource jobs.
Prompt example: "What were the most expensive jobs in the last week?" or "Rank users by resource consumption."
Job failure surge analysis
Capability: Monitor failure rate trends and drill down by type, owner, or project to find root causes.
Prompt example: "List failed jobs in the last 24 hours" or "Show failure rates by job type."
Permission exposure audit
Capability: Audit table-level grants, identify high-risk admin accounts, and detect over-granting.
Prompt example: "Which users have admin permissions?" or "Count tables granted to each user."
Hot table monitoring
Capability: Identify frequently accessed tables and automatically detect "zombie tables" based on last access time.
Prompt example: "Which tables are accessed most often?" or "Find zombie tables not accessed in the last 90 days."
Metadata governance gap analysis
Capability: Measure table and column comment coverage to find metadata gaps and stale data.
Prompt example: "What is the column comment coverage rate?" or "List tables without table comments."
Job performance analysis
Capability: Analyze average and P99 job durations to spot long-tail slow jobs and abnormal queuing.
Prompt example: "Show the slowest P99 jobs" or "What was the average job duration last week?"
Data tunnel audit
Capability: Track Tunnel upload/download volumes, trace public network download IPs, and detect abnormal transfers.
Prompt example: "Show Tunnel data volume in the last 24 hours" or "Audit public network download source IPs."
User role audit
Capability: Map user-role relationships, review admin role assignments, and identify inactive high-privilege accounts.
Prompt example: "List all admin and super_administrator users" or "Show user role assignments."
Partition lifecycle analysis
Capability: Monitor partition growth trends, verify lifecycle policy enforcement, and check expired partition cleanup.
Prompt example: "Which tables have more than 500 partitions?" or "Find partitioned tables without lifecycle enabled."
Quota resource monitoring
Capability: Monitor real-time CPU/memory quota usage and alert on bottlenecks or imbalanced allocations.
Prompt example: "Show CPU usage for all Quotas" or "Which Quotas exceed their usage threshold?"