python from google.adk.agents import LlmAgent class DatabaseAgent(LlmAgent): def init(self): super().init( name="database_analyst", model="gemini-2.5-flash", system_instruction=self._load_prompt(), tools=self._load_mcp_tools() ) def _load_mcp_tools(self): from mcp_toolbox import MCPToolbox toolbox = MCPToolbox.for_database( project_id="my-project", instance="my-instance", database="my-db" ) return toolbox.get_tools() def query(self, question: str) -> str: response = self.generate(question) return response
Persistent Memory
Default ADK sessions are in-memory. Production agents need memory across sessions, and swapping in a database-backed session service is straightforward: python from google.adk.sessions import DatabaseSessionService session_service = DatabaseSessionService( connection_string="postgresql://user:pass@host/db" ) agent = LlmAgent( name="persistent-agent", session_service=session_service ) A community failure case drives this home: one team reported that during a company-wide rollout, every Python script process restart — memory overflow, server reboot, code update — wiped all session data. Five hundred employees lost their agent conversations simultaneously. Do not skip this step.
Google's managed MCP servers are built on standard Cloud identity and observability frameworks. The security model is straightforward: - IAM-based access control, no static API keys - Cloud Audit Logging for every agent-database interaction - Optional CMEK for DataAgent resources - Agent Identity service accounts with scoped permissions A Google Developer Forum user asked a telling question about scoping: "When creating/updating the Data Agent so that every query it runs is automatically scoped (for example: always filter by [specific condition])." The subtext is that raw query access isn't enough — enterprises need row-level or condition-level guardrails. The governance payoff is less glamorous but more important. Because agent-database interactions land in Cloud Audit Logs, there's a clear trail of what the agent accessed and which queries it executed. As one community commenter put it, "This satisfies the governance requirements that often stall AI projects in enterprise environments."
Production Deployment and Scaling
Deployment Options
Three viable paths exist for production: - Cloud Run — serverless deployment for ADK agents - Agent Engine — Google's managed agent runtime - Gemini Enterprise Agent Platform — the full enterprise package All three remove infrastructure management, which Google positions as the scaling advantage: "With no infrastructure management, you can scale your agentic workloads without incurring operational overhead."
What to Monitor
- Query latency
- Token consumption
- Tool call frequency
- Error rates
- Session persistence
Cost Reality Check
A community cost analysis is worth internalizing before you scale: "If a typical data agent flow consumes 20,000 tokens and triggers five tools, and your blended model rate is $5 per million tokens, then one thousand full workflows land near $100 before storage, logging and network egress." That's not a reason to avoid agents. It's a reason to monitor token consumption per workflow from day one.
[SPONSORED]
NEXT-GEN NPU CHIPSETS
Empower your local devices with desktop-class inference capabilities.
The Fleet-Wide Use Case
The Database Observability Agent, announced in August 2026, supports fleet-wide queries across an organization's database estate. Per Google's announcement, "A user could ask which databases consumed the most CPU over a set period and receive a summarised response." For enterprises with hundreds of database instances, this is the difference between an agent that helps one team and an agent that changes how the whole platform team operates.
Troubleshooting from the Trenches
Three issues dominate community discussions.
Issue 1: Permission Errors on Agent Engine
A Stack Overflow report: "My ADK agent works fine locally when running on adk web, but the instance running on Agent Engine always fails to read and write data from firestore. I get an error saying 403 Missing or insufficient permissions." Fix: verify the Agent Engine service account has the correct IAM roles. It won't inherit your local credentials.
Issue 2: Agent Not Calling Tools
GitHub Issue #126: "There is a high chance (around 30%) that no matter what I do, the db_agent is not calling initial_bq_nl2sql tool." Check the YAML skill configuration first. If the tool isn't registered at the skill level, the model can't invoke it. This is frustrating precisely because it's a config problem, not a model problem.
Issue 3: Database Name Inconsistencies
A Google Developer Forum thread traced a persistent failure to "a database name inconsistency across your project files." The environment variables in the MCP server config, the YAML skill definition, and the Python agent code must all reference the same database name. It sounds trivial. It causes hours of debugging.
[SPONSORED]
COMFYUI WORKFLOW OPTIMIZATION
Reduce render times by 40% with our automated edge-silicon pipelines. Download Whitepaper.
A Community-Led Solution Worth Stealing
Agent-to-Agent MCP, an open-source GitHub project, implements an intelligent SQL agent using Google ADK. Agentic RAG with ADK extends the pattern to multi-agent systems that query both structured databases and documents. Both are worth studying as reference architectures — they show how teams are handling the orchestration problem that Google's own Sean Rhee has described as the core of agentic applications: reasoning, planning, and tool use need to happen in a coordinated system.
The Bigger Picture: Where This Fits
The Database Agent API doesn't exist in a vacuum. AWS launched AgentCore. Microsoft has Foundry Agent Service. Both went GA between October 2025 and February 2026. Databricks and Snowflake are pushing their own data platform agents. The competitive field is crowded, but Google's bet is distinctive: treat the database connection layer as a managed, standards-based service rather than a per-application integration. The wider enterprise adoption context is sobering. A 2026 Mayfield CXO Network survey of 266 CIO/CTO/CAIO/CISO/CDOs found that 42% of agentic AI is in production, but 58% still call data readiness/quality their #1 obstacle. Gartner predicts that over 40% of agentic AI projects will be canceled by end of 2027. The technology works. The governance and data quality layers are what kill projects. This is why the boring parts of this tutorial matter. Agent Identity instead of static keys. Audit logging from day one. Schema examination before query generation. These aren't compliance theater — they're the difference between an agent that ships and an agent that gets pulled after the first incident.
Final Thoughts, and a Question
The Database Agent API is Google's most coherent argument yet that AI agents can be trusted with production data. Managed MCP servers eliminate the infrastructure excuse. QueryData addresses the accuracy excuse. Fine-grained IAM and audit logging neutralize the security excuse. The pieces are in place. The open question — for your team, not for Google — is whether your data is ready. The 58% of CIOs who cite data quality as their top barrier aren't going to be saved by better agents. They're going to be saved by better data governance, and then the agents will do the rest. Start with a pilot. Use a non-production database. Enable audit logging from day one. Iterate on your context engineering. Measure token usage and accuracy before you scale. What's the first use case you'd pilot? A customer support query bot, an internal analytics assistant, or something else entirely? The answer says a lot about where your data is ready — and where it's not.