For Database Tools Model Context Protocol Servers

The Database Tools MCP Server policies depend on the following:

• the MCP Server runtime identity
• the Database Tools Connection runtime identity
• the database authentication method
• the policy scope (Resource or Compartment)

The following diagram shows how the Database Tools MCP Server uses the configured runtime identity to access OCI resources. Depending on the runtime identity configuration, OCI resource access is performed either using the authenticated user identity (On-Behalf-Of token) or the MCP Server resource principal. The diagram also shows the OCI services commonly accessed by the MCP Server, including IAM, Database Tools connections, Vault secrets, Object Storage, runtime work requests, and Oracle Database.

Required IAM Permissions

IAM policies use the following syntax:

Allow <subject> to <verb> <resource-type> in <location> where <conditions>

IAM policies define which users, groups, or resource principals can access MCP Server resources and related OCI services.The following table lists the IAM permissions required for the Database Tools MCP Server.

Runtime Identity Models

The required policies depend on the runtime identity configuration.

MCP Server Runtime Identity

Determines which identity the MCP Server uses when accessing resources.

• Authenticated_Principal: Requests run using the logged-in user identity.
• Resource_Principal: Requests run using the MCP Server identity.

Connection Runtime Identity

Determines which identity is used for database access.

• Authenticated_Principal: Database access uses the user identity.
• Resource_Principal: Database access uses the Database Tools Connection resource identity.

Authentication Types

• Token: Uses IAM token-based authentication.
• Password: Uses database username and password authentication.

Policy Scope

Policies can be applied at either the resource level or compartment level.

• Resource: Restricts access to a specific resource.
• Compartment: Allows access to all matching resources in the compartment.

Policy Configurations

Choose the configuration that matches your deployment model.

Option 1

• MCP Server runtime identity: AUTHENTICATED_PRINCIPAL
• Connection runtime identity: AUTHENTICATED_PRINCIPAL
• Authentication type: TOKEN

Resource-Scope Policy Statements

allow any-user to use database-tools-db-connect-obo in tenancy
where request.principal.id = '<mcp-server-ocid>'

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name> where target.resource.id = '<mcp-server-ocid>'

allow group '<domain_name>/<group_name>' to use database-connections
in compartment <compartment_name> where target.database.id = '<database-ocid>'

allow group '<domain_name>/<group_name>' to use database-tools-connections
in compartment <compartment_name> where target.resource.id = '<connection-ocid>'

Optional: Required only when secrets or key stores are used.

allow group '<domain_name>/<group_name>' to read secret-bundles in compartment <compartment_name> 
where target.secret.id = '<secret-ocid>'

Compartment-Scope Policy Statements

allow any-user to use database-tools-db-connect-obo in tenancy
where all {request.principal.type = 'databasetoolsmcpserver', 
request.principal.compartment.id = '<compartment-ocid>'}

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use database-connections
in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use database-tools-connections
in compartment <compartment_name>

Optional: Required only when secrets or key stores are used.

allow group '<domain_name>/<group_name>' to read secret-bundles 
in compartment <compartment_name>

Option 2

Resource-Scope Policy Statements

allow group 'domain_name'/'group_name' to use database-tools-mcp-servers-invocation
in compartment <compartment_name> where target.resource.id = '<mcp-server-ocid>'

allow group 'domain_name'/'group_name' to use database-tools-connections in 
compartment <compartment_name> where target.resource.id = '<connection-ocid>'

allow group 'domain_name'/'group_name' to read secret-bundles in 
compartment <compartment_name> where any { 
target.secret.id = '<secret-ocid-1>', 
target.secret.id = '<secret-ocid-2>' }

Compartment-Scope Policy Statements

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use database-tools-connections
in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to read secret-bundles 
in compartment <compartment_name>

Option 3

• MCP Server runtime identity: AUTHENTICATED_PRINCIPAL
• Connection runtime identity: RESOURCE_PRINCIPAL
• Authentication type: TOKEN

Resource-Scope Policy Statements

allow any-user to use database-tools-db-connect-obo in tenancy
where request.principal.id = '<mcp-server-ocid>'

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name> where target.resource.id = '<mcp-server-ocid>'

allow group '<domain_name>/<group_name>' to use database-connections
in compartment <compartment_name> where target.database.id = '<database-ocid>'

allow group '<domain_name>/<group_name>' to use database-tools-connections
in compartment <compartment_name> where target.resource.id = '<connection-ocid>'

allow group '<domain_name>/<group_name>' to use database-tools-runtime-work-requests
in compartment <compartment_name>
where target.resource.created-by-principal-id = request.principal.id

allow any-user to read secret-bundles
in compartment <compartment_name> where all {
  request.principal.id = '<connection-ocid>',
  target.secret.id = '<secret-ocid>'}

allow any-user to use buckets in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.bucket.name = '<bucket-name>'}

allow any-user to manage objects in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.bucket.name = '<bucket-name>'}

Compartment-Scope Policy Statements

allow any-user to use database-tools-db-connect-obo in tenancy 
where request.principal.id = '<mcp-server-ocid>'

allow group '<domain_name>/<group_name>' to use 
database-tools-mcp-servers-invocation in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use 
database-connections in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use 
database-tools-connections in compartment <compartment_name>

allow group '<domain_name>/<group_name>' to use 
database-tools-runtime-work-requests in compartment <compartment_name>

allow any-user to read secret-bundles in compartment <compartment_name> 
where request.principal.id = '<connection-ocid>'

allow any-user to use buckets in compartment <compartment_name> 
where request.principal.id = '<connection-ocid>'

allow any-user to manage objects in compartment <compartment_name> 
where request.principal.id = '<connection-ocid>'

Option 4

• MCP Server runtime identity: RESOURCE_PRINCIPAL
• Connection runtime identity: RESOURCE_PRINCIPAL
• Authentication type: PASSWORD

Resource-Scope Policy Statements

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name> where target.resource.id = '<mcp-server-ocid>'

allow any-user to use database-tools-connections
in compartment <compartment_name>
where all {
  request.principal.id = '<mcp-server-ocid>',
  target.resource.id = '<connection-ocid>'
}

allow any-user to use database-tools-runtime-work-requests
in compartment <compartment_name>
where all {
  request.principal.id = '<mcp-server-ocid>',
  target.resource.created-by-principal-id = request.principal.id
}

allow any-user to read secret-bundles
in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.secret.id = '<secret-ocid-1>'
}

allow any-user to read secret-bundles
in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.secret.id = '<secret-ocid-2>'
}

allow any-user to use buckets
in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.bucket.name = '<bucket-name>'
}

allow any-user to manage objects
in compartment <compartment_name>
where all {
  request.principal.id = '<connection-ocid>',
  target.bucket.name = '<bucket-name>'
}

Compartment-Scope Policy Statements

allow group '<domain_name>/<group_name>' to use database-tools-mcp-servers-invocation
in compartment <compartment_name>

allow any-user to use database-tools-connections
in compartment <compartment_name>
where request.principal.id = '<mcp-server-ocid>'

allow any-user to use database-tools-runtime-work-requests
in compartment <compartment_name>
where request.principal.id = '<mcp-server-ocid>'

allow any-user to read secret-bundles
in compartment <compartment_name>
where request.principal.id = '<connection-ocid>'

allow any-user to use buckets
in compartment <compartment_name>
where request.principal.id = '<connection-ocid>'

allow any-user to manage objects
in compartment <compartment_name>
where request.principal.id = '<connection-ocid>'

Service Specific Variables

Use these service-specific variables in IAM policy conditions to restrict access to specific resources, for example, a particular Vault secret or Object Storage bucket.

This section describes the IAM policies and identity domain roles that are required for administrators to manage Database Tools MCP Servers, Toolsets and Connections.

Default Domain

To manage MCP Servers, a user must belong to an IAM group in the Default Identity Domain that is granted the policies listed below.

Replace <group_name> and <compartment> with your values.

Identity Domain

For a user in a specific identity domain, the following table lists the required policy statements.

Identity Domain Roles

To manage MCP Clients of MCP Servers a, user in an Identity Domain requires the Application Administrator or the Identity Domain Administrator role.

See Assigning Users to Roles for information about assigning users to administrator roles.