Beyond the Hype: Practical AI for Your Oracle Database with MCP

AI agents are showing up everywhere in the data stack, but are they giving you the right answers, at a reasonable cost, without a PhD in prompt engineering to set them up? Join Jeff Smith and SVP Kris Rice for an hour on all things Model Context Protocol (MCP) for Oracle AI Database.

We’ll cover what’s new with MCP for Oracle AI Database, then dig into the practical stuff: how to get correct results, keep token spend under control, and make the whole experience easy enough for your whole team - not just the AI power users. We’ll also break down context engineering essentials like AI Skills and database schema enrichment, and show how Trusted Reports (available through our MCP Servers) make natural language–to-SQL dramatically more reliable for business users asking questions of their data.

This session is LLM- and agent-agnostic, so the concepts apply no matter what model or agent framework you’re using.

Who should pay attention: DBAs and DevOps engineers, application developers, and business analysts who want faster, safer, more trustworthy answers from their data, no AI expertise required.

What we’ll cover:

Latest updates on MCP for Oracle AI Database
Getting accurate results from AI + your database
Managing token budget and cost
Context engineering: AI Skills and schema enrichment
Trusted Reports for reliable, business-friendly NL2SQL
Whether you’re building agents, administering the database they run against, or just want better answers from a chat box, this session has something for you.

Transcript

1. Kris Rice Jeff Smith
2. Join the database team with special guest OpenAI for a hackathon at Oracle AI World See what you can build with our world-class database and MCP servers with ChatGPT!
4. Oracle DB MCP Server MCP Server MCP Client MCP Server MCP Server LLM MCP Server
5. Resource • Resources • Tools • Prompts Prompt Tool
6. DevOps / DBA Business Support • Diagnose performance problems • Analyze AWR, • Trace Files, • Explain Plans • Suggest/Implement indexing schemes • Debug, fix, test PL/SQL errors • Explain the latency we’re seeing between our Data Guard primary and standby instances. • NL2SQL • How many accounts did we open last quarter, by region, by zipcode? • Correlate overdraft fees with accounts being closed. • Where should we invest in more local branches? • NL2Data • Instead of generating SQL, your LLM chooses from curated SQL Reports! Generative AI • • • • • • Generate data model … test data … full stack applications … low-code APEX apps … REST APIs … security policy, hide EMPLOYEE data for anyone outside my direct management chain.
7. • SQLcl • Oracle REST Data Services • OCI Managed MCP Service 3
8. • Least privilege principle • Segregated environments • Do not trust, always verify
10. Database Availability • any edition, including FREE • any version (19c, 21c, 26ai) • any deployment (on-premises, Cloud, containers, etc.) Technology stack • included with database • existing, proven product • runs locally, STDIO • JSON-RPC communication SQLcl: Release 26.2.2 Production on Wed Sept 2 13:05:35 2026 Copyright (c) 1982, 2026, Oracle. All rights reserved Connected to: Oracle Database 26ai Free Release 23.26.3.0 - Develop, Learn, and Run for Free SQL> cm list . ├── Cloud │ └── Autonomous Reporting └── Local ├── EMS └── ERP SQL> viins ¦ 1:0 ¦ OE¦ ERP
11. • SQLcl sits on user’s local machine • Agent < - > SQLcl STDIO, JSON RPC • Agent invokes LLM for planning, generating code • Agent makes Tool request • SQLcl takes tool request, executes, returns token-optimized results
12. • list-connections Retrieves list of named, stored connections available for MCP • connect Establishes requested by name, connection • run-sql Runs SQL command, SQL script, or PL/SQL block • run-sqlcl Runs SQLcl command (load, ddl, info, datapump, etc.) • schema-information Retrieves metadata and annotations to assist with NL2SQL • disconnect Ends database session, closes connection.
13. • Agent/LLM does not work with database, everything goes though SQLcl • Passwords never shared with the agent, locally encrypted (.SSO) • SQLcl can be configured to • Restrict allowed commands, prevent access to local OS • Use a separate list of connections from normal SQLcl runtime • SQLcl creates db conn/session with: • Program (SQLcl-MCP) • Module (LLM) • Action (MCP Tool)
14. • Install SQL Developer extension • Create at least one connection • Start your AI chat! • Optionally – invoke via Command Palette Generates JSON for SQLcl MCP you can add to your local Agent config file
15. Connections SQL> conn -save mcp_demo -savepwd jeff/xyzabc@localhost1521/freepdb1
16. • MCP SQLcl MCP • Agent Codex Extension for VS Code • LLM 5.6 Luna Extra High • Database FreeSQL.com hosted 26ai
17. SQLcl MCP Best fit Ideal workflow Transport Connection model Devs, dbas, power users – people already working directly with your databases Local database exploration, dev, or troubleshooting STDIO locally managed connections, stateful Access model DB credentials avail to the local OS user Tools List connections, connect, run-sql, runsqlcl, schema-information, disconnect Operational model Database reach Lightweight local setup Oracle databases with a network path from the local machine
19. Copyright © 2026, Oracle and/or its affiliates
20. fully managed, Serverless SQL Reports Enterprise Security • • • OCI IAM auth via OAuth2 Federate Azure Entra ID, Okta, etc Application roles control exactly who can run what Easy to Deploy • • • Enable via OCI Console. Powered via DBTools Connection Pay only for the database resources you consume. One MCP for all Cloud Services • • • • Autonomous AI Database Base Database Exadata Cloud Service Oracle AI Database on AWS, Azure, and Google Cloud
21. What it is Why it matters for security • A managed, secure link between OCI and your Oracle AI Database • The database user tied to the connection is the ultimate security backstop • Stores credentials, wallet, and endpoint centrally — not on each user's machine • Oracle AI Database security rules apply in full — roles, object grants, VPD, all of it • One connection can back multiple MCP Servers • The MCP layer inherits those controls automatically — no duplication needed • Defined once by an administrator, consumed by everyone • A read-only database user means read-only AI access. Full stop. OCI controls who can reach the MCP layer – Oracle AI Database controls what they can see
22. You can deploy any one or combination of these tools. Built-in SQL tools Reporting tools Custom Tools Ad-hoc, NL2SQL focused, allows an Agent to execute any Oracle SQL or PL/SQL code it has generated. Curated, parameterized queries published as governed, callable tools. Predefined, parameterized SQL or PL/SQL scripts to implement your database operations. • report_list • report_sql • report_execute • your_tool_name • sql_run • request_status • schema_information Available reports controlled by authenticated user’s Group membership. Want your Agent to be able to cancel any query, reset a password, or run your favorite script? Build your own tool!
23. No new credential silos — OCI Identity Management handles it all Authentication Authorization • • • • User access determined by Group membership/policies Users authenticate via OAuth2 via OCI IAM Federate Azure Entra ID, Okta, or Active Directory No separate MCP credentials to manage or rotate SSO experience: users sign in once grant OBO access for their clients clients retrieve access tokens as necessary IAM Group 🔒DBTools Connections 🔒MCP Servers 🔒Toolsets & Reports
24. MCP Server propagates the OAuth2/user’s information to the Database (V$SESSION, Session Contexts) Administrator asks question, routed to report Biz Analyst asks same question, via same report 1. Database MCP Tool invoked a. MCP server creates conn, w/USERENV & CLIENTCONTEXT populated b. Includes OAUTH info, including user & client details 2. Database security policy defined for schema and appropriate tables 3. Database automatically filters out sensitive or unauthorized data
25. Managers can SELECT all columns except SSN, can only UPDATE SALARY for their direct reports. Now available! • • • minVer Oracle AI Database 23.26.3 Uses OCI IAM auth tokens Deep Data Security Integration Use Case Docs
26. You no longer need to worry about the Agent/LLM generating the correct SQL, only to pick the right report! OCI SQL Reports, accessible via MCP Tools 1. Reports are OCI Resources • • • Trusted, validated SQL Named, documented (when to use, what questions are answered) Parameterized – variables permit questions like, last X days 2. Report access via role 3. Agent invokes reports 4. Consistent SQL Your organization already has many of these reports, now they can be utilized via AI.
27. • MCP OCI Database Tools • Agent Claude Desktop • LLM 5.6 Luna Extra High • Database OCI Base VM 26ai
28. OCI Managed MCP Best fit Ideal workflow Transport Business users, analysts, support teams, shared AI agents, developers Governed natural language access to approved databases, validated reports, and SQL tools Streaming HTTPS Connection model OCI Database Tools Connections, passwords in OCI Vaults / stateless Access model OAuth 2.0, OCI identity, federated users, IAM groups, MCP roles Tools run-sql, schema-information,list reports, run reports, custom Operational model Oracle Managed Cloud service Database reach Any Oracle AI Database in OCI, Oracle @ AWS, Azure, GCP
30. • FREE • 📢 /mcp endpoint available, minVer 26.2
31. • • • • • No database install required Connections are direct, not proxy (e.g. ORDS_PUBLIC_USER for REST APIS) Bring your own Identity Provider (JWT) Fully OAuth compliant to MCP Spec • Supports dynamic client registration! Stateless
32. What is database_list ? Included Tools • database_list • run_sql • schema_information • ORDS maintains connection pools, serving either REST or MCP • MCP pools are retrieved along with descriptions • Agents discover what databases are available, name included on subsequent tool requests Coming Soon • Reports (list-reports, run-report) • Custom Tools • Deep Data Security
33. ORDS acts as an OAuth-protected resource server for /mcp — auth and audit extend all the way into the database OAuth-Protected Resource Enterprise IDP Integration • ORDS validates JWTs • • Bearer token required for all /mcp calls • Unauthenticated calls receive 401 + discovery hint • • RFC 9728 protectedresource metadata at /.well-known/… Supports any IdP that issues standard JWTs Dynamic Client Registration reduces admin overhead End-to-End Audit Trail • JWT identity propagated to CLIENTCONTEXT • Calls written to DBTOOLS$MCP_LOG • REQUEST_ECID links DB evidence back to ORDS logs 📢 One ORDS instance can serve multiple MCP database connection pools. ORDS can be clustered, front-ended with a load balancer, supports Data Guard for high availability and failover.
34. Every connection resolves through two configurable layers — a global default, refined per connection pool. 🔒 LAYER 1 — GLOBAL APPLICATION SET TING Applies to every connection pool, unless overridden below. jwt.profile.role.claim.name set? 👥 LAYER 2 — POOL-LEVEL OVERRIDE Set a tighter requirement for specific connection pool — three equivalent ways to express it: YES → use named role claim CUSTOM SCOPE NO → fall back to scopes mcp.scope=pools:sales Active Directory Example AD group SALES_DBA → AD FS / Entra ID issues role claim → mcp.role=POOL.SALES → pool access granted Scope minted specifically for this pool GLOBAL SCOPE mcp.scope=urn:oracle:dbtools; ords.mcpserver:all Accept the broad, server-wide scope REQUIRED ROLE mcp.role=POOL.SALES Match a named role claim instead No new infrastructure — reuses the customer's existing AD group-to-role mapping and audit trail!
35. End-user identity travels from the MCP token through ORDS into the database — no identity is lost behind the pool OAUTH_PRINCIPAL OAUTH_CLIENT_NAME User principal from the JWT Name of the MCP client application OAUTH_SUB REQUEST_ECID JWT subject (sub) claim — unique user identifier Execution Context ID — links ORDS logs to database audit OAUTH_ISSUER OAUTH_APP_ROLES JWT issuer (iss) — which IdP issued the token Roles from the JWT (role mode) OAUTH_MODE OAUTH_APP_SCOPES scope or role — which authorization model is active Scopes from the JWT (scope mode) Agent with Keycloak Auth info is available in the database session
36. • MCP ORDS • Agent Claude Code • LLM Sonnet 5 • Database On Premises 26ai EE
37. ORDS Best fit Ideal workflow Transport Connection model Access model Tools Operational model Database reach Devs, dbas, power users Governed natural language access to approved databases, and SQL tools Streaming HTTPS Local ORDS, direct user connection pools / stateless OAuth 2.0, JWT with scopes or roles from your identity provider List databases, run-sql, schemainformation Customer managed mid-tier On-premises
39. ORACLE DATABASE + MCP
40. ORACLE DATABASE + MCP The promise is real. The steering wheel is still yours. the Pilot. I’m not a passenger on this magical plane ride my “ Be Agent is taking me on. I’m in charge. Vibe coding is not “turn off your brain.” It is “move faster because you are actively directing the work.” Copyright © 2026, Oracle and/or its affiliates
41. ORACLE DATABASE + MCP Live demo vibe coding is hard, but if you want that… Copyright © 2026, Oracle and/or its affiliates
42. GIVE THE AGENT ORACLE CONTEXT Load Oracle skills first. LLMs have seen a lot of Postgres and MySQL. They will happily generate something that looks like SQL… and is wrong for Oracle. Skills are your “Oracle-aware starting point.” Copyright © 2026, Oracle and/or its affiliates Before the first task • Load Oracle AI skills • State the target Oracle version • Name the framework/tooling • Ask for Oracle syntax and APIs
43. GIVE THE AGENT ORACLE CONTEXT
44. GIVE THE AGENT ORACLE CONTEXT
45. AGENTS SHOULD THINK BEFORE THEY ACT Plan first. Debate it. Amend it. Only then, GO. 01 02 03 Ask Review Execute State outcome, constraints, and what “done” means. Challenge the plan: objects, blast radius, rollback, tests. Approve bounded steps — not an unlimited adventure. A good plan is a contract you can negotiate before it becomes a transaction. Copyright © 2026, Oracle and/or its affiliates
46. PROMPT LIKE A DOMAIN EXPERT Specificity buys you useful output. Vagueness buys you… vibes. Weak ask Strong ask “Build me an app for sales.” “Create a local ORDS app for account managers to review open orders. Use these APIs, roles, and acceptance tests. Do not deploy.” Outcome: an impressive-looking guess. Outcome: a bounded proposal you can judge. Copyright © 2026, Oracle and/or its affiliates
47. PROMPT LIKE A DOMAIN EXPERT Example: here’s a prompt I used to build ORDS REST APIs Connect to my Raptor database, and for my Spotify data, construct an ORDS REST API, GET Handler, that returns a collection of artists with a summary of the total number of tracks and total overall time spent listening You will need to generate some SQL to provide for the GET handler definition in the ORDS PL/SQL API. Implement the ORDS REST API using the ORDS.CREATE_SERVICE plsql program. The module base path should be 'claude-apis' and the template should be called 'spotify-summary’ Here is a simple example begin ORDS.create_service( p_module_name => 'day_zero', p_base_path => 'day0', p_pattern => 'greeting/', p_method => 'GET', p_source_type => 'json/item', p_source => 'select ''Hello!'' from dual', p_status => 'PUBLISHED', p_module_comments => 'see if we can create a module', p_template_comments => 'see if we can create a template', p_handler_comments => 'see if we can say Hello!'); end; Copyright © 2026, Oracle and/or its affiliates
48. PROMPT LIKE A DOMAIN EXPERT Example: I didn’t like the SQL it used, so I fixed it select /* LLM in use is claude-opus-4-120250805 */ artistname, count(distinct trackname) as total_tracks, count(*) as total_plays, sum(msplayed) as total_ms_played, round( sum(msplayed) / 1000 / 60, 2 ) as total_minutes, round( sum(msplayed) / 1000 / 60 / 60, 2 ) as total_hours from spotify_streaming where artistname is not null group by artistname order by total_ms_played desc Copyright © 2026, Oracle and/or its affiliates
49. PROMPT LIKE A PRODUCT MANAGER Example: I didn’t like the SQL it used, so I fixed it I noticed you are summing the milliseconds and dividing it out multiple times to get the hours, minutes, and seconds played We're connected to a 23ai database, this is much easier now, we can simply SUM the PLAYING_TIME column, which is an interval, which will return the time spent represented as Days, Hours, Minutes, and Seconds, and even fractions of a second up to 6 digits of precision let's refactor our REST API to do that instead we can keep the interval type we do not need to drop and recreate the handler, we can simply define the handler again, and it will overwrite or replace the existing api SQL Copyright © 2026, Oracle and/or its affiliates
50. TREAT MCP APPROVALS LIKE A CHANGE REVIEW Never auto-approve database tool calls. Tool approval is the moment to ask: Good approval behavior 01 What exact connection/account? 02 Read, write, DDL, or OS access? 03 What is the object and scope? 04 Can I explain the SQL/PLSQL? 05 What proves success — and what undoes it? Copyright © 2026, Oracle and/or its affiliates ✓ Review the call ✓ Reject surprises ✓ Reduce scope ✓ Ask for dry-run output ✓ Keep credentials & privilege boundaries intact
51. SANDBOX BEFORE PRODUCTION Build a safe place to be wrong. Local Docker sandbox Purpose-built “vibe” account Fast prototypes Disposable test data Repeatable setup No production surprises Least privilege No DBA role Only the schemas, objects, packages, and operations required Auditable connection identity Keep “can the agent do this?” separate from “should it be allowed to do this here?” Copyright © 2026, Oracle and/or its affiliates
52. DOMAIN KNOWLEDGE IS STILL THE QUALITY GATE If you can’t judge it, you probably can’t keep it. because the code compiles, we don’t ship it. Just because the chart “ Just has pretty colors, doesn’t mean we present it to the CEO. A very sensible rule for both apps and databases Research the business domain. Understand the data. Be able to spot the “looks right” answer that is wrong. Copyright © 2026, Oracle and/or its affiliates
53. GIVE IT A MAP, NOT A FLASHLIGHT Use schema-information. Be stubborn. Preferred path The common detour schema-information → structured metadata → focused SQL → fewer round trips dictionary query dictionary query more probing sample rows “just to see” Prompt it explicitly: “Use schema-information for metadata. Do not run dictionary queries unless I ask.” Copyright © 2026, Oracle and/or its affiliates
54. ANNOTATIONS ARE PROMPT ENGINEERING THAT EVERYONE CAN REUSE Teach the database what its own objects mean. Old schema reality: • cryptic names • missing comments • unclear relationships • business meaning trapped in people’s heads AI Schema Enrichment Group objects. Annotate tables, views, columns, and APIs. Put the “what this really means” context beside the data. One bit of homework; every human and agent benefits. Copyright © 2026, Oracle and/or its affiliates
55. ASK FOR A SUMMARY, THEN TURN IT INTO A SKILL Turn a good run into institutional memory. After a successful task, ask the agent to capture: Real-world example Trigger When should this skill be used? Procedure What does it inspect, decide, and execute? Guardrails What can go wrong and how is it verified? Copyright © 2026, Oracle and/or its affiliates ETL / CSV load skill The agent learned how to inspect data, choose settings, load it, check row counts, then improve the skill across runs.
56. ASK FOR A SUMMARY, THEN TURN IT INTO A SKILL Turn a good run into institutional memory. Copyright © 2026, Oracle and/or its affiliates
57. REQUIRE PROOF “It generated code” is not the finish line. Every code-generation request should also ask for: My favorite prompt add-on ✓ A test script / harness ✓ Happy-path test data ✓ Negative & edge-case coverage ✓ Expected results ✓ Cleanup / rollback steps Copyright © 2026, Oracle and/or its affiliates “Generate the tests that prove this works — and show me the expected output before executing anything.”
58. REQUIRE PROOF “The SQL is faster” is not the finish line. Every SQL-tuning request should also ask for: My favorite prompt add-on ✓ A test script / harness ✓ Happy-path test data ✓ Negative & edge-case coverage ✓ Expected results ✓ Cleanup / rollback steps Copyright © 2026, Oracle and/or its affiliates “Run some load tests before we implement this new index, and then again afterwards. Compare.
59. PUT THIS NEXT TO YOUR AGENT The “before you approve” checklist. □ Oracle skills loaded? □ schema-information used? □ Plan reviewed and agreed? □ Scope and SQL understood? □ Dedicated low-privilege account? □ Tests + expected output ready? □ Sandbox / Docker where possible? □ Good work summarized as a skill? High expectations. Thoughtful prompts. Verify everything. Copyright © 2026, Oracle and/or its affiliates
60. 3. Today’s agents & LLMs are amazing problem solvers – think BIG & TOMORROW.
61. Explore the MCP LiveLab Step-by-Step tutorials for getting started, including prompts to guide you on your Agentic AI development experience with the Oracle AI Database. Download SQLcl Try FreeSQL.com