Cloud SQL’s disabled MCP query tags create an attribution blind spot

Google said in its September 10 Cloud SQL release notes that it has temporarily disabled sqlcommenter tags for queries run through the Cloud SQL remote MCP server. The release note applies to both MySQL and PostgreSQL query execution, and Google gives no restoration date.

That is a small configuration change with an operationally important boundary: it removes query-level attribution metadata, not the server’s authentication or database authorization.

What operators lose

The documented tagging scheme is unusually useful for agent traffic. When enabled on execute_sql or execute_sql_readonly, sql_commenter_enabled appends four fields to SQL statements: the MCP tool name, the remote server identity, the authenticated database or IAM user, and the identified AI client or agent. Google says those comments are visible with executed queries in Cloud SQL Studio and in database query and audit logs through Logs Explorer.

While tagging is disabled, queries can still appear in those systems, but the SQL text will not carry that four-part MCP attribution envelope. A missing comment therefore cannot be treated as proof that a human—not an agent—issued the statement.

The rest of the control plane remains documented. The remote server uses OAuth 2.0 and IAM, does not accept API keys, and executes SQL with the privileges of an IAM database-authentication user. Google also recommends a separate identity for agents so resource access can be controlled and monitored. The server exposes distinct all-tools, read-only, instance-management and query-execution endpoints, plus separate tools for unrestricted and read-only SQL.

A temporary operating contract

Teams using Cloud SQL’s remote MCP server should make the missing tag an explicit incident condition rather than silently accepting lower-fidelity logs:

1. Keep agent identities separate. Do not share one database principal between people and multiple agents; principal-level evidence is now more important.
2. Prefer the read-only endpoint for analytical agents. The endpoint boundary remains available even when SQL comments do not.
3. Correlate three records. Match the MCP client request, the authenticated principal and the database query by time and normalized SQL text.
4. Test for restoration. Run a known read-only query with sql_commenter_enabled=true and verify that all four documented tags reappear before declaring the telemetry path recovered.

The practical lesson is narrow: Cloud SQL has not disabled remote MCP query execution. It has temporarily removed the easiest way to answer a different production question—which agent path produced this SQL? Until the tags return, authorization can still stop an impermissible query, but incident review and per-client attribution need compensating evidence.