Skip to main content

Set up the Oracle Database MCP server

The Oracle Database MCP server lets AI agents run SQL and PL/SQL, describe tables, explain query plans, and check database health on an Oracle Database you run. Mintive hosts Oracle's Database MCP Toolkit on managed infrastructure and connects to your database with one database user shared by everyone on the connector. This guide covers creating that user, installing the server from the Mintive MCP store, and letting the server reach your database, either by allowlisting Mintive's egress IP or through a private network when the database sits behind a VPC.

Prerequisites​

  • A Mintive admin account
  • An Oracle Database whose listener Mintive can reach, either over the internet with Mintive's egress IP allowlisted, or through a private network
  • The database's host, port and service name

Create a database user for the connector​

The server connects with a single user, so every member of your team runs queries as that user. Create a dedicated user rather than reusing a personal or application account, and grant it only what your team needs. For read-only access, CREATE SESSION plus SELECT on the relevant tables or views is enough; the write, table and transaction tools need the corresponding privileges.

CREATE USER mcp_user IDENTIFIED BY "<password>";
GRANT CREATE SESSION TO mcp_user;
GRANT SELECT ON <schema>.<table> TO mcp_user;

Add Oracle Database to Mintive​

  1. In Mintive, go to MCP store > Manage store.
  2. Find Oracle Database in the Catalog tab and click to install it.
  3. In the setup dialog, enter:
    • JDBC URL (DB_URL): the thin JDBC URL of your database, jdbc:oracle:thin:@<host>:<port>/<service_name>.
    • Database user (DB_USER): the user you created.
    • Database password (DB_PASSWORD): its password.
  4. Click Save.

Add Mintive's egress IP to your network​

Mintive runs the server on managed infrastructure with a stable outbound IP. If your database only accepts connections from known addresses, add that IP before the server can connect. If the database has no listener Mintive can reach, skip this section and connect through a private network instead.

  1. In Mintive, open the Oracle Database server's settings page.
  2. Click the Hosted Connector tab.
  3. Copy the Dedicated Egress IP address shown there.
  4. Allow inbound traffic from that IP to the listener port (1521 by default) in the security group, network security list or firewall in front of the database.

Connect to a database behind a VPC​

Use this path when Mintive can't reach your database directly, for example when it only has a private IP inside a VPC. The server reaches it through a Mintive private network: a replica running inside your network forwards the server's connections to the listener, so you don't need a public listener or an egress IP allowlist.

Set up a private network with a Ready replica that can reach the database before you start.

Add a route to the database listener​

  1. In the private network's details, click Add route.
  2. Set Target host to the database host's internal DNS name or IP address, as the replica resolves it, and Port to the listener port (1521 by default).
  3. Enable Hosted connectors and leave Originate TLS to the target off.
  4. Click Add route, wait for the route to show Ready, then copy its route ID. It looks like pnrte_01M23G0PA5BXPSZEA303EGE9NT.

Add one route for each address the server connects to. A connection string with a failover address list needs a route per address. On Oracle RAC, add a route for the SCAN address and one for each node's virtual IP, because the SCAN listener redirects every new connection to a node's listener and the server has to reach that node too. Use the node addresses your listeners register (your DBA can confirm them from LOCAL_LISTENER).

Connect the server through the route​

  1. Install Oracle Database as described in Add Oracle Database to Mintive. Set JDBC URL to the connection string your applications use inside the network, either the short form jdbc:oracle:thin:@<host>:<port>/<service_name> or a TNS descriptor jdbc:oracle:thin:@(DESCRIPTION=...). TNS aliases such as jdbc:oracle:thin:@EBSPROD aren't supported.
  2. Open the Oracle Database server's settings page and click the Hosted Connector tab.
  3. Under Private Network, select your network in Move to another network and click Move connector.
  4. On the Environment variables tab, add one of these variables, then click Save:
VariableUse it whenValue
DB_PRIVATE_NETWORK_ROUTE_IDThe JDBC URL names a single addressThe route ID, for example pnrte_01M23G0PA5BXPSZEA303EGE9NT
DB_PRIVATE_NETWORK_ROUTESThe JDBC URL names several addresses, or the database runs on RACEach address and its route ID as host:port=route ID, separated by commas, for example ebs-scan.internal:1521=pnrte_...,ebs-node1-vip.internal:1521=pnrte_...,ebs-node2-vip.internal:1521=pnrte_...

The server sends its database connections through the matching routes and keeps the hostnames from your JDBC URL, including when a RAC SCAN listener redirects it to a node. It refuses connections to any address without a route and logs no Private Network route for <host>:<port>, so a missing RAC node shows up in the server's logs. If a route isn't available to the connector, the server doesn't start, and its logs name the missing route.

Security considerations​

  • The database user is shared by everyone who uses the connector, so its privileges are the ceiling for every agent. Audit on the database side records this user, not the individual Mintive member.
  • The server exposes Oracle's full default tool set, including tools that write data, create and drop tables, and run transactions. Restrict what the user can do in the database, and use tool customization to hide tools your team should not call.
  • Mintive's Dedicated Egress IP is stable: add it once and it does not change.

Next steps​