Skip to main content

Set up the Looker Toolbox MCP server

Looker Toolbox is a hosted MintMCP connector, built on Google's MCP Toolbox, that gives agents a curated set of Looker tools against one Looker instance: querying explores, running Looks and dashboards, editing LookML, and checking instance health. You pick exactly which tools the connector exposes by declaring them in a configuration value, so a read-only analytics connector and a LookML developer connector can run side by side from the same image.

Prerequisites​

  • A MintMCP admin account
  • A Looker instance (Looker Original or Looker Google Cloud Core) reachable from MintMCP's runtime
  • Admin access to that Looker instance, to create a service account and API credentials

Create a service account and API credentials​

Every user of this connector acts in Looker as one shared identity, so create a dedicated user with only the permissions your tools need rather than reusing an admin account. Looker permissions are the real boundary here: a user that can only access_data and see_looks cannot edit LookML or create dashboards, whatever tools you declare.

For Looker Original​

  1. Go to Admin → Users and create a user for the connector (for example mintmcp-toolbox), then assign it a role with only the model sets and permissions the tools need.
  2. Open the user, scroll to API 4.0 Keys and click Edit Keys → New API 4.0 Key.
  3. Copy the Client ID and Client Secret, because the secret is shown only once.

For Looker Google Cloud Core​

  1. Have a Looker admin enable API credential management on the Users page.
  2. Sign in as the service account user, open the Account page → API 4.0 Keys → Generate New Key.
  3. Copy the Client ID and Client Secret.
CredentialWhere to find itEnvironment variable
Looker instance URLYour browser's address bar (no trailing slash)LOOKER_BASE_URL
Client IDAdmin → Users → Edit → API 4.0 KeysLOOKER_CLIENT_ID
Client SecretShown once at key creationLOOKER_CLIENT_SECRET

Looker instances that serve the API on port 19999 need the port in the URL, e.g. https://looker.example.com:19999.

Allow MintMCP to reach Looker​

Most Looker instances are reachable from the public internet, so this step usually needs nothing. If yours sits behind an IP allowlist (Looker Original with an allowlist, or a private network in front of Looker Core), allow the connector's dedicated egress IP: open the Looker Toolbox connector page under MCP store > Manage store in MintMCP and copy the Egress IP shown there.

Define the tools​

The connector exposes only the tools you declare in the TOOLBOX_TOOLS environment variable. You define tools, not data sources, because every tool runs against the Looker instance you configure at install time and the connector wires that connection in for you, so you never set a source. Each tool has a kind and an optional description, and you can group tools into named toolsets.

Every Looker tool is ready-made: declare the kind and a description, and the tool exposes its own input parameters automatically (e.g. looker-query accepts a model, explore, fields, filters and limit). There is no custom-statement tool for Looker; looker-query is the general query entry point.

{
  "tools": {
    "get_models": { "kind": "looker-get-models", "description": "List LookML models." },
    "get_explores": { "kind": "looker-get-explores", "description": "List explores in a model." },
    "get_dimensions": { "kind": "looker-get-dimensions", "description": "List dimensions in an explore." },
    "get_measures": { "kind": "looker-get-measures", "description": "List measures in an explore." },
    "query": { "kind": "looker-query", "description": "Run a query against an explore and return rows." },
    "query_url": { "kind": "looker-query-url", "description": "Build a shareable explore URL for a query." },
    "get_dashboards": { "kind": "looker-get-dashboards", "description": "Search saved dashboards." },
    "run_dashboard": { "kind": "looker-run-dashboard", "description": "Run every tile in a dashboard." }
  },
  "toolsets": {
    "explore": ["get_models", "get_explores", "get_dimensions", "get_measures", "query", "query_url"],
    "dashboards": ["get_dashboards", "run_dashboard"]
  }
}

Available tools​

Pick a category to see what each tool does, then expand Copy as JSON for a ready-to-paste config. The first two categories cover what most teams want, while the LookML, git and health categories change or audit the instance and need a service account with developer or admin permissions.

KindPurpose
looker-get-modelsList LookML models
looker-get-exploresList explores in a model
looker-get-dimensionsList dimensions in an explore
looker-get-measuresList measures in an explore
looker-get-filtersList filter-only fields in an explore
looker-get-parametersList parameters in an explore
looker-queryRun an inline query against an explore and return the rows
looker-query-sqlReturn the SQL Looker would run for a query, without running it
looker-query-urlBuild a shareable explore URL for a query
Copy as JSON
{
  "tools": {
    "get_models": { "kind": "looker-get-models", "description": "List LookML models." },
    "get_explores": { "kind": "looker-get-explores", "description": "List explores in a model." },
    "get_dimensions": { "kind": "looker-get-dimensions", "description": "List dimensions in an explore." },
    "get_measures": { "kind": "looker-get-measures", "description": "List measures in an explore." },
    "get_filters": { "kind": "looker-get-filters", "description": "List filter-only fields in an explore." },
    "get_parameters": { "kind": "looker-get-parameters", "description": "List parameters in an explore." },
    "query": { "kind": "looker-query", "description": "Run a query against an explore and return rows." },
    "query_sql": { "kind": "looker-query-sql", "description": "Show the SQL Looker would run for a query." },
    "query_url": { "kind": "looker-query-url", "description": "Build a shareable explore URL for a query." }
  },
  "toolsets": { "explore": ["get_models", "get_explores", "get_dimensions", "get_measures", "get_filters", "get_parameters", "query", "query_sql", "query_url"] }
}

Add Looker Toolbox to MintMCP​

  1. In MintMCP, go to MCP store and open the Recommended servers tab.
  2. Select Looker Toolbox to open its configuration panel.
  3. Fill in the connection fields with the values from Create a service account and API credentials:
FieldValueRequired
Looker URLInstance URL, no trailing slashYes
Client IDAPI 4.0 client ID of the service accountYes
Client secretAPI 4.0 client secret, stored as a secretYes
Verify TLS certificatetrue (default), or false for a self-signed certificateNo
Google Cloud projectOnly for the Conversational Analytics toolsNo
Google Cloud locationOnly for the Conversational Analytics tools (default: us)No
  1. Paste your tool definitions from Define the tools into Tool Definitions.
  2. Click Install.

The connector authenticates to Looker and loads your tools on startup, and shows as active once Looker accepts the credentials. If Looker is unreachable, the credentials are rejected, or the tool definitions are invalid, the connector fails to start and its logs say why.

All fields are global: every user shares the service account, and MintMCP's audit log records which user issued each call. A few tuning variables exist for the rare cases that need them and can be added as extra environment variables: LOOKER_TIMEOUT (API timeout, default 600s) and LOOKER_SHOW_HIDDEN_MODELS, LOOKER_SHOW_HIDDEN_EXPLORES and LOOKER_SHOW_HIDDEN_FIELDS (default true; set to false to keep LookML objects marked hidden out of the listing tools).

Security considerations​

  • Every user acts in Looker as the single configured service account, so its Looker role and model set are the real guardrail. Grant only what the declared tools need, and keep it read-only unless writes are explicitly intended.
  • The connector only ever talks to the Looker instance you configure and only accepts looker-* tool kinds, but it does not restrict what those tools do in Looker. Tools that create content, edit LookML or switch git branches change the instance for everyone, so omit them or leave the service account without the develop permission to prevent writes.
  • Looker's own audit log attributes every action to the service account; use MintMCP's audit log to see which user was behind each call.
  • Keep Verify TLS certificate at true unless the instance uses a self-signed certificate.
  • If your instance supports an IP allowlist, combine it with the dedicated egress IP so only MintMCP can use these credentials from outside your network.

Next steps​