All Products
Search
Document Center

MaxCompute:Set up the local MCMCP Server

Last Updated:Jun 30, 2026

MaxCompute MCP Server (MCMCP) implements the Model Context Protocol (MCP) to wrap MaxCompute’s underlying metadata, compute, and storage services into a unified capability layer that AI Agents can understand and invoke directly. Using MCMCP, AI Agents can perform large-scale data analytics, multimodal data transformation, and intelligent operations and maintenance (O&M) without additional tooling.

Function Overview

Agents invoke structured tools provided by MCMCP using the standard MCP protocol—no extra SDK or driver is required. MCMCP covers the full data operation workflow, from metadata browsing and SQL analysis to table management.

Core capabilities

  • Catalog metadata browsing and search: Browse projects, schemas, tables, fields, and partitions hierarchically. Supports natural language search.

  • Table management and metadata maintenance: Create tables (with options for lifecycle, primary key, and partial column updates), insert small amounts of data, and update table comments, tags, or column descriptions.

  • Identity and permission checks: View current account identity and SHOW GRANTS permission details.

  • Multiple authentication methods: AccessKey/SecretKey (AK/SK), Security Token Service (STS), Credentials URI, ECS RAM Role, and the default Alibaba Cloud credential chain.

  • Read-only SQL analysis: Cost estimation, asynchronous execution, instance status queries, and result retrieval. Enforced as read-only on the server side.

Architecture overview

image

MCMCP uses a layered architecture, from top to bottom:

  • User Agent ecosystem: Supports multiple Agent clients including OpenClaw, DataWorks Agent, Qwen Code, QoderWork, and MaxAgent.

  • MaxCompute Skills collection: A universal skill package for Agents, containing semantic packs, common commands, development templates, and usage limits. Extends Agent capabilities via MaxCompute OpenAPI, InfraAgent, and CatalogAI.

  • MCMCP service: Wraps MaxCompute OpenAPI, StorageAPI, and CatalogAPI into structured tools directly callable by Agents.

  • MaxCompute core capabilities:

    • Metadata:

      Catalog / Schema / Table / Partition. Features include authorization, auditing, data discovery, data exporting, masking, row-level permissions, and data sharing.

    • Compute Engines:

      MaxCompute SQL, MaxFrame, MC Spark. Compute types include heterogeneous CU/GU, AI functions, and models.

    • Storage:

      Table (Append / PK Delta Table); data types include BLOB, JSON, ARRAY, MAP, STRUCT. Features include automatic storage tiering, multi-replica, multi-AZ disaster recovery, recycle bin/Time Travel, data snapshots, and storage encryption.

Prerequisites

  • Python

    • Version 3.10 or later.

    • We recommend using the uv package management tool to install dependencies and run the service.

  • Alibaba Cloud credentials

    AK/SK, STS, Credentials URI, ECS RAM Role, or the default Alibaba Cloud credential chain.

  • MaxCompute

    • Project: You must have access to at least one MaxCompute project. Confirm your default project name—it is used to create the ODPS client, submit SQL, check permissions, and serve as the default context when project parameters are omitted.

    • Confirm your endpoint, for example: https://service.cn-hangzhou.maxcompute.aliyun.com/api.

  • Confirm your root account UID (also known as namespaceId).

Important notes

  • Do not commit config.json, AK/SK, STS tokens, Credentials URIs, query result files, or coverage outputs.

  • In production environments, prefer dynamic credential sources such as ALIBABA_CLOUD_CREDENTIALS_URI or RAM Roles.

  • Grant the identity used for MCP the least privilege access. Do not use high-permission root account AKs directly.

  • execute_sql enforces read-only protection, but create_table, insert_values, and update_table modify resources or metadata.

  • output_uri only allows writing to local files on the server. Use a dedicated secure directory and avoid sensitive system paths.

  • For high-cost, large-result, or cross-project queries, estimate costs first and verify that project, schema, and table references are correct.

If you encounter issues, contact the MaxCompute team or open an issue in the GitHub repository.

Download and install

Download MCMCP

GitHub Repo: https://github.com/aliyun/alibabacloud-maxcompute-mcp-server

Compatible with MCP clients such as Claude Code, OpenCode, Qoder, and Cursor.

Install from source

  1. In your terminal, run:

    git clone https://github.com/aliyun/alibabacloud-maxcompute-mcp-server.git
    cd alibabacloud-maxcompute-mcp-server
    uv sync
  2. Verify the CLI entry point:

    uv run alibabacloud-maxcompute-mcp-server --help
  3. Copy the configuration template:

    cp config.example.json config.json
    Warning

    config.json contains sensitive information (such as AK/SK). Keep it local only—do not commit it to Git.

  4. After editing config.json, start the service once from the command line to confirm there are no configuration errors:

    uv run alibabacloud-maxcompute-mcp-server --config config.json

The default transport method is stdio. After successful startup, the server waits for communication from the MCP client via standard input and output.

Configure MaxCompute connection

MCMCP supports two configuration sources:

  • Configuration file: Specify using --config /path/to/config.json or the environment variable MAXCOMPUTE_CATALOG_CONFIG.

  • Environment variables: These can override the configuration file or be used without any config file.

Using a configuration file

Warning

config.json contains sensitive information (such as AK/SK). Keep it local only—do not commit it to Git.

Example config.json:

{
  "maxcompute": {
    "maxcompute_endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
    "defaultProject": "<DEFAULT_PROJECT_NAME>",
    "namespaceId": "<ALIBABACLOUD_ACCOUNT_UID>",
    "accessKeyId": "<ALIBABA_CLOUD_ACCESS_KEY_ID>",
    "accessKeySecret": "<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
  }
}

Click to view field descriptions

Field

Required

Description

maxcompute_endpoint

Yes

MaxCompute service endpoint. Choose based on your region.

defaultProject

Strongly recommended

Default project name. Without this, SQL execution, permission checks, instance queries, and automatic Catalog endpoint resolution will not work.

namespaceId

Optional

Root account UID. Required only for search_meta_data.

catalogapi_endpoint

Optional

Catalog API address. If not set, MCMCP automatically resolves it from maxcompute_endpoint using the ODPS client, so defaultProject is usually also needed.

protocol

Optional

https or http. Usually inferred from the endpoint and does not need to be set.

accessKeyId / accessKeySecret

Optional

Static AK/SK. Suitable for development and testing. Use dynamic credentials in production.

securityToken

Optional

STS token. Used together with static AK/SK.

Using environment variables

export MAXCOMPUTE_ENDPOINT="https://service.cn-hangzhou.maxcompute.aliyun.com/api"
export MAXCOMPUTE_DEFAULT_PROJECT="<DEFAULT_PROJECT_NAME>"
export MAXCOMPUTE_NAMESPACE_ID="<ALIBABACLOUD_ACCOUNT_UID>"

# Method 1: AK/SK
export ALIBABA_CLOUD_ACCESS_KEY_ID="<ALIBABA_CLOUD_ACCESS_KEY_ID>"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="<ALIBABA_CLOUD_ACCESS_KEY_SECRET>"

# Method 2: STS
export ALIBABA_CLOUD_ACCESS_KEY_ID="<STS_ACCESS_KEY_ID>"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="<STS_ACCESS_KEY_SECRET>"
export ALIBABA_CLOUD_SECURITY_TOKEN="<STS_TOKEN>"

# Method 3: Credentials URI (recommended for production or platform-managed environments)
export ALIBABA_CLOUD_CREDENTIALS_URI="http://localhost:8765/credentials"

Credential resolution rules:

  • If AK/SK is set in environment variables or the config file, MCMCP uses those static credentials.

  • If no static AK/SK is set, MCMCP uses the default Alibaba Cloud Credentials SDK credential chain.

  • The default credentials chain can use ALIBABA_CLOUD_CREDENTIALS_URI, the local Alibaba Cloud configuration, or ECS RAM.

    RAM Role, OIDC, and other sources.

  • For automatic STS token refresh, prefer Credentials URI, RAM Role, or other dynamic credential sources.

Configure your MCP client

Qoder / Cursor / Claude Code / generic stdio clients

  • Common client configuration locations

    Client

    Config location

    Cursor

    ~/.cursor/mcp.json

    Claude Code

    .mcp.json in your project root

    Other MCP clients

    Refer to your client’s MCP server configuration documentation

  • Configuration methods

    Using a config file

    {
      "mcpServers": {
        "alibabacloud-maxcompute-mcp-server": {
          "command": "uv",
          "args": ["--directory", "/absolute/path/to/alibabacloud-maxcompute-mcp-server", "run", "alibabacloud-maxcompute-mcp-server"],
          "env": {"MAXCOMPUTE_CATALOG_CONFIG": "/absolute/path/to/config.json"}
        }
      }
    }

    Using only environment variables

    {
      "mcpServers": {
        "alibabacloud-maxcompute-mcp-server": {
          "command": "uv",
          "args": ["--directory", "/absolute/path/to/alibabacloud-maxcompute-mcp-server", "run", "alibabacloud-maxcompute-mcp-server"],
          "env": {
            "MAXCOMPUTE_ENDPOINT": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
            "MAXCOMPUTE_DEFAULT_PROJECT": "<DEFAULT_PROJECT_NAME>",
            "MAXCOMPUTE_NAMESPACE_ID": "<ALIBABACLOUD_ACCOUNT_UID>",
            "ALIBABA_CLOUD_ACCESS_KEY_ID": "<AK_ID>",
            "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<AK_SECRET>"
          }
        }
      }
    }

DataWorks personal instance + Claude Code

DataWorks personal instances typically inject ALIBABA_CLOUD_CREDENTIALS_URI. In this environment, config.json only needs endpoint, default project, and optionally namespaceId:

{
  "maxcompute": {
    "maxcompute_endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
    "defaultProject": "<DEFAULT_PROJECT_NAME>",
    "namespaceId": "<ALIBABACLOUD_ACCOUNT_UID>"
  }
}

Example .mcp.json:

{
  "mcpServers": {
    "alibabacloud-maxcompute-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/alibabacloud-maxcompute-mcp-server",
        "run",
        "alibabacloud-maxcompute-mcp-server"
      ],
      "env": {
        "MAXCOMPUTE_CATALOG_CONFIG": "/absolute/path/to/alibabacloud-maxcompute-mcp-server/config.json",
        "ALIBABA_CLOUD_CREDENTIALS_URI": "<VALUE_FROM_DATAWORKS_ENV>"
      }
    }
  }
}

You can view the injected credentials URI inside the instance with:

echo "$ALIBABA_CLOUD_CREDENTIALS_URI"

Streamable HTTP mode

Use stdio by default. For remote or multi-process access, start in HTTP mode:

uv run alibabacloud-maxcompute-mcp-server \
  --config /absolute/path/to/config.json \
  --transport http \
  --host 127.0.0.1 \
  --port 8000

Set the MCP client address to:

http://127.0.0.1:8000/mcp

Verify connection

After configuration, restart your MCP client and enter the following in a conversation:

Show my MaxCompute identity information without querying detailed permissions

The Agent should call check_access and return a response like:

{
  "success": true,
  "data": {
    "identity": {
      "accessKeyId": "LTAI***xYzW",
      "defaultProject": "my_project",
      "endpoint": "https://service.cn-hangzhou.maxcompute.aliyun.com/api",
      "displayName": "user@example.com"
    }
  }
}

To also verify permission queries, use:

Show my MaxCompute permissions in the my_project project

MCP tools reference

Category

Tool

Description

Catalog metadata

list_projects

List projects accessible to the current account.

get_project

Get project details, including whether schemas are enabled.

list_schemas

List schemas in a project.

get_schema

Get schema details.

list_tables

List tables, views, and foreign tables. Returns namingModel to distinguish two-layer vs. three-layer models.

get_table_schema

Get field info, partition keys, table comments, tags, lifecycle, sqlTableRef, and more.

get_partition_info

Get partition list, data volume, and time metrics for partitioned tables.

Metadata search

search_meta_data

Search tables, resources, and schemas under the configured namespaceId.

SQL and instances

cost_sql

Estimate SQL cost without executing it.

execute_sql

Execute read-only SQL. Returns instanceId asynchronously by default.

get_instance_status

Query instance status, progress, LogView, and resource consumption.

get_instance

Retrieve results from completed instances. Supports writing full results to a file via output_uri.

Identity and permissions

check_access

Check current identity and permissions in the target project.

Table management

create_table

Create a table with support for partitions, lifecycle, primary key, storage tier, and more.

insert_values

Insert small amounts of data using INSERT INTO ... VALUES.

Table metadata maintenance

update_table

Update table comments, tags, lifecycle, column comments, nullability, and add new columns.

Key constraints

  • execute_sql only allows read-only SQL. The server enforces this by injecting odps.sql.read.only=true.

  • create_table, insert_values, and update_table modify resources or metadata. Grant access carefully.

  • Before writing SQL queries, call get_table_schema and use the returned sqlTableRef to generate table references.

  • list_tables returns a namingModel that affects the SQL table name format: the three-layer model uses

    schema.table or project.schema.table, and the two-layer model uses table or project.table.

  • search_meta_data requires namespaceId to be configured, and the query syntax typically requires type=TABLE,

    type=RESOURCE or type=SCHEMA.

Common scenarios

Browse projects and tables

Example:

List MaxCompute projects I can access, then show schemas in my_project
Show fields, partition keys, and table comments for user_info in my_project's default schema

Run SQL queries securely

Estimate cost before execution:

First show the structure of the orders table, then estimate the cost of this SQL:
SELECT COUNT(*) FROM orders WHERE dt='2026-05-01'

Run a read-only query:

Run this read-only query in my_project:
SELECT * FROM default.orders WHERE dt='2026-05-01' LIMIT 100

For large queries, use asynchronous execution:

Run this query asynchronously. After returning the instanceId, poll its status and read the first 100 rows when done

Export large results

Inline results are capped by row limits. For full results, use output_uri:

Run this query synchronously and write the full result to file:///tmp/maxcompute-result/orders.jsonl;
Only show me a preview and the final outputPath in the response
Note

output_uri writes to the local file system of the MCP server—not your client machine.

Check identity and permissions

Show the MaxCompute identity used by MCP and list my permissions in my_project

Search metadata

Search the Catalog for tables with names containing 'orders', limited to my_project

Maintain business metadata

First read the current schema of default.orders, then update the table comment to 'Order fact table'
and change the buyer_id column comment to 'Buyer ID'

update_table supports these changes:

  • Table comment: description

  • Tags: labels

  • Lifecycle: expiration.days, expiration.partitionDays

  • Column comments: columns.setComments

  • Change top-level columns from non-nullable to nullable: columns.setNullable

  • Add new columns: columns.add

MaxCompute does not support deleting columns, changing column types, reordering columns, inserting columns in the middle, changing nullable columns to non-nullable, or modifying nullability of nested columns via this tool.

Create tables and insert small data sets

Create a test table demo_user in my_project.default
with fields id BIGINT, name STRING, and dt STRING as a partition key, with a 7-day lifecycle
Insert two test rows into demo_user with dt partition value 2026-05-18

These operations modify MaxCompute resources. Grant permissions only for test or controlled projects.

Troubleshooting

MCP client does not show tools

Check the following:

  1. Is command set to uv? Does args include --directory pointing to the absolute path of the repo?

  2. If the client cannot find uv, replace command with the absolute path returned by which uv.

  3. Have you run uv sync in the repo?

  4. Does MAXCOMPUTE_CATALOG_CONFIG point to the correct config.json?

  5. Did you restart Cursor, Claude Code, or your MCP client?

  6. Does manually running uv run alibabacloud-maxcompute-mcp-server --help in the repo directory succeed?

Authentication or connection failures

Check the following:

  1. Does MAXCOMPUTE_ENDPOINT or maxcompute_endpoint match your project’s region?

  2. Are your AK/SK or STS token valid and not expired?

  3. If using a credentials service, can ALIBABA_CLOUD_CREDENTIALS_URI be accessed from the MCP server machine?

  4. Has the current identity been granted access to the target project?

  5. First verify your identity with check_access, then troubleshoot specific tools.

search_meta_data returns an error

Common causes:

  • namespaceId or MAXCOMPUTE_NAMESPACE_ID is not configured.

  • The query lacks type=TABLE, type=RESOURCE, or type=SCHEMA.

  • The query uses incompatible project and region conditions.

SQL table name resolution fails

First call get_table_schema and have the Agent use the returned sqlTableRef.

  • Three-layer model tables commonly use schema.table or project.schema.table;

  • Two-layer model tables commonly use table or project.table.

SQL execution times out or results are truncated

  • We recommend asynchronous execution by default. After obtaining the instanceId, use get_instance_status and

    get_instance to retrieve the results.

  • For synchronous execution, set a timeout. If it times out, you can still use the returned instanceId to continue querying.

  • For large results, use output_uri=file:///path/to/result.jsonl to write to a local file on the server.

  • Before execution, call cost_sql, then use maxCU to limit resource consumption.

Information Schema semantic skill guide

Information_Schema is a system-level Ops semantic skill built on MaxCompute tenant-level INFORMATION_SCHEMA metadata views. It gives data teams comprehensive capabilities for project auditing, usage analysis, and operational observability by turning complex low-level metadata into natural-language-queryable metrics and entities.

Skill Repo: https://skills.aliyun.com/skills/alibabacloud-odps-information-schema

Scenarios

Storage pressure diagnosis

  • Capability: Identify top storage-consuming tables, detect partition bloat risks, and spot data freshness issues.

  • Prompt example: "Analyze the top 10 tables by storage usage in my tenant" or "Check which tables have partition bloat risks."

Cost pressure diagnosis

  • Capability: Break down job costs by owner, project, or type; track CU-hour consumption and identify high-resource jobs.

  • Prompt example: "What were the most expensive jobs in the last week?" or "Rank users by resource consumption."

Job failure surge analysis

  • Capability: Monitor failure rate trends and drill down by type, owner, or project to find root causes.

  • Prompt example: "List failed jobs in the last 24 hours" or "Show failure rates by job type."

Permission exposure audit

  • Capability: Audit table-level grants, identify high-risk admin accounts, and detect over-granting.

  • Prompt example: "Which users have admin permissions?" or "Count tables granted to each user."

Hot table monitoring

  • Capability: Identify frequently accessed tables and automatically detect "zombie tables" based on last access time.

  • Prompt example: "Which tables are accessed most often?" or "Find zombie tables not accessed in the last 90 days."

Metadata governance gap analysis

  • Capability: Measure table and column comment coverage to find metadata gaps and stale data.

  • Prompt example: "What is the column comment coverage rate?" or "List tables without table comments."

Job performance analysis

  • Capability: Analyze average and P99 job durations to spot long-tail slow jobs and abnormal queuing.

  • Prompt example: "Show the slowest P99 jobs" or "What was the average job duration last week?"

Data tunnel audit

  • Capability: Track Tunnel upload/download volumes, trace public network download IPs, and detect abnormal transfers.

  • Prompt example: "Show Tunnel data volume in the last 24 hours" or "Audit public network download source IPs."

User role audit

  • Capability: Map user-role relationships, review admin role assignments, and identify inactive high-privilege accounts.

  • Prompt example: "List all admin and super_administrator users" or "Show user role assignments."

Partition lifecycle analysis

  • Capability: Monitor partition growth trends, verify lifecycle policy enforcement, and check expired partition cleanup.

  • Prompt example: "Which tables have more than 500 partitions?" or "Find partitioned tables without lifecycle enabled."

Quota resource monitoring

  • Capability: Monitor real-time CPU/memory quota usage and alert on bottlenecks or imbalanced allocations.

  • Prompt example: "Show CPU usage for all Quotas" or "Which Quotas exceed their usage threshold?"