Oracle Analytics and AI

User_8L6P0

Hi everyone,

I'm evaluating the Oracle Analytics Cloud MCP Server and have a question regarding security and data exposure.

My concern is understanding exactly what information is exposed to an external AI client (Claude Desktop or ChatGPT) when it connects to OAC through the MCP Server.

For example:

• Does the AI only receive the final query results returned by Oracle Analytics?
• Or can it also discover metadata such as subject areas, semantic models, measures, columns, descriptions, and other business definitions?
• Is it possible for the AI to retrieve raw row-level data if the user has permission, or is access limited to aggregated query results?
• What are the recommended best practices for organizations that want to use MCP while ensuring sensitive business data remains protected?

I'm trying to understand the security model and what information is actually shared with the AI versus what remains inside Oracle Analytics.

Thank you!

Gianni Ceresa

Hi,

Welcome to the Oracle Analytics and AI community and forum.

First of all you should always reference the official documentation as that's the best place where to find details:

https://docs.oracle.com/en/cloud/paas/analytics-cloud/acsdv/available-oracle-analytics-cloud-mcp-tools-preview.html

https://docs.oracle.com/en/cloud/paas/analytics-cloud/acsdv/oracle-analytics-cloud-mcp-server-developers-reference-preview.html

As you can see there are a number of tools available in the OAC MCP server. Originally it started with 3: discover, describe, execute. Now there are more that are being added.

The LLM will access anything the query you requested returns. OAC doesn't only run aggregated queries. It mostly run aggregated queries because that's the whole point of the analytical platform, but you can run a query that doesn't aggregate anything. The tool takes a LSQL query as input, your choice what the query is.

If you want, the LLM can write the query (thanks to a resource that provides the LSQL grammar), and then call the tool to execute it.

Your prompt or the LLM are in charge of writing the query, the tool will execute it and send back whatever the result is to the LLM.

There is a tool that discover metadata to match your prompt, it can access subject areas and datasets. But it doesn't go beyond the "presentation layer" (no access to the logical and physical layer of your semantic model for example).

The security model is always enforced, the MCP server doesn't have more powers than what the user can do.

The best practices are to follow the good practices you are supposed to follow anyway, even without AI. The MCP server just apply the security model of your environment: what the user can do manually in the interface will be available via the MCP server. If a user can access some data via the web interface, the same will happen via MCP. If a user is denied access to a dataset or subject area in the web interface, the same will happen via MCP.

Just think at the MCP server as a different way to use what OAC provides, with the same privileges across any interface or way to access the tool.