# How to connect Google BigQuery to Hermes Agent (no API keys) > Connect Google BigQuery to Hermes with ClawLink in one click — 63 tools your AI agent can call from chat via hosted OAuth. No API keys, no manual setup. Web version: https://claw-link.dev/hermes/google-bigquery Most guides for giving Hermes Agent Google BigQuery access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Google BigQuery setup: pair once in the browser and your always-on Hermes agent can act on Google BigQuery for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself. **Start here — paste this into Hermes to set up ClawLink:** > Set up ClawLink for Hermes and tell me when it's ready. > 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable` > 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait. > 3. I'll approve it in my browser, then reply "approved". > 4. When I say approved, finish setup: `hermes clawlink finish` > 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready. ## Setup It takes three steps to connect Hermes to Google BigQuery. 1. **Install ClawLink** — add the plugin to Hermes Agent once. 2. **Connect Google BigQuery** — one-click OAuth in the ClawLink dashboard. 3. **Use it from chat** — ask Hermes Agent in plain English. **Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead: ```bash npx -y @useclawlink/cli login # sign in via browser — no API key to paste npx -y @useclawlink/cli connect google-bigquery # connect Google BigQuery (browser OAuth) npx -y @useclawlink/cli actions google-bigquery # list available actions npx -y @useclawlink/cli run google-bigquery --input '' # execute (add --confirm for writes) ``` ### Install by command The prompt above walks Hermes through this. By hand, it is four commands and a browser approval: ```bash hermes plugins install ClawLink-HQ/hermes-plugin --enable hermes clawlink begin # prints an approval link — open it and approve hermes clawlink finish # after approving in the browser hermes clawlink test ``` Then connect Google BigQuery in the [ClawLink dashboard](https://claw-link.dev/dashboard) — a one-click OAuth approval, no API keys. Verify the connection by asking Hermes: > List my BigQuery datasets with googlebigquery_list_datasets, then show me the schema of \.\ with googlebigquery_get_table_schema. Do not run a query yet — I want to see the columns first. ### Using a different agent? The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI: ```bash npx -y @useclawlink/cli login ``` `login` opens the same browser approval and stores a credential locally. Once Google BigQuery is connected in the dashboard, that agent calls the same 63 Google BigQuery tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent). ## Google BigQuery MCP for Hermes Looking for a Google BigQuery MCP server for Hermes Agent? ClawLink connects Google BigQuery to Hermes Agent and exposes 63 Google BigQuery tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Google BigQuery integration](https://claw-link.dev/openclaw/google-bigquery) works the same way. Hermes Agent is the MCP-native runtime from Nous Research, and this page is about giving it BigQuery tools it can call from chat. The whole setup is three steps: install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, pair once with `hermes clawlink begin`, approve in the browser, `hermes clawlink finish`, and then connect BigQuery in the ClawLink dashboard. That last step is the one summaries tend to drop, and without it the agent is paired but has no BigQuery to call. There is no service-account JSON key to download, no `GOOGLE_APPLICATION_CREDENTIALS` to export, and nothing about BigQuery in a config file. ## What the Hermes Agent Google BigQuery integration can do 63 Google BigQuery tools are ready for Hermes Agent once the account is connected. The 30 below are the ones people reach for most; your agent can call all 63. ### 30 of 63 Google BigQuery tools for Hermes | Tool | What it does | |---|---| | **Cancel job** `googlebigquery_cancel_job` | Tool to cancel a running BigQuery job. This call returns immediately, and you need to poll for the job status to see if the cancel completed successfully. | | **Create capacity commitment** `googlebigquery_create_capacity_commitment` | Tool to create a new capacity commitment resource in BigQuery Reservation. Use when you need to purchase compute capacity (slots) with a committed period of usage for BigQuery jobs. | | **Create connection** `googlebigquery_create_connection` | Tool to create a new BigQuery connection to external data sources using the BigQuery Connection API. | | **Create data exchange** `googlebigquery_create_data_exchange` | Tool to create a new Analytics Hub data exchange for sharing BigQuery datasets. Use when you need to set up a container for data sharing with descriptive information and listings. | | **Create dataexchanges listings** `googlebigquery_create_dataexchanges_listings` | Tool to create a new listing in a BigQuery Analytics Hub data exchange. Use when you need to share a BigQuery dataset with specific subscribers or make it available for discovery. | | **Create dataset** `googlebigquery_create_dataset` | Tool to create a new BigQuery dataset with explicit location, labels, and description using the BigQuery Datasets API. | | **Create listing** `googlebigquery_create_listing` | Tool to create a new listing in a data exchange using Analytics Hub API. Use when publishing a BigQuery dataset to make it available for subscription by other users or organizations. | | **Create locations datapolicies** `googlebigquery_create_locations_datapolicies` | Tool to create a new data policy under a project with specified location using the v2beta1 BigQuery Data Policy API. | | **Create query template** `googlebigquery_create_query_template` | Tool to create a new query template in a BigQuery Analytics Hub Data Clean Room (DCR) data exchange. Use when you need to define predefined and approved queries for data clean room use cases. | | **Create reservation** `googlebigquery_create_reservation` | Tool to create a new BigQuery reservation resource to guarantee compute capacity (slots) for query and pipeline jobs. | | **Create reservation assignment** `googlebigquery_create_reservation_assignment` | Tool to create a BigQuery reservation assignment that allows a project, folder, or organization to submit jobs using slots from a specified reservation. | | **Create routine** `googlebigquery_create_routine` | Tool to create a new user-defined routine (function or procedure) in a BigQuery dataset. | | **Get bigquery model** `googlebigquery_get_bigquery_model` | Retrieve a specific BigQuery ML model resource by model ID | | **Get connection iam policy** `googlebigquery_get_connection_iam_policy` | Get the IAM access control policy for a BigQuery connection resource | | **Get dataset** `googlebigquery_get_dataset` | Retrieve BigQuery dataset metadata including location via the datasets.get API | | **Get job** `googlebigquery_get_job` | Retrieve information about a specific BigQuery job | | **Get query results** `googlebigquery_get_query_results` | Get the results of a BigQuery query job via RPC | | **Get routine** `googlebigquery_get_routine` | Retrieve a BigQuery routine (user-defined function or stored procedure) by its ID | | **Get routine iam policy** `googlebigquery_get_routine_iam_policy` | Retrieve the IAM access control policy for a BigQuery routine resource | | **Get service account** `googlebigquery_get_service_account` | Get the service account for a project used for interactions with Google Cloud KMS | | **Get table iam policy** `googlebigquery_get_table_iam_policy` | Retrieve the IAM access control policy for a BigQuery table resource | | **Get table schema** `googlebigquery_get_table_schema` | Fetch a BigQuery table's schema and metadata without querying row data | | **List analytics hub listings** `googlebigquery_list_analytics_hub_listings` | List all listings in a given Analytics Hub data exchange | | **List big query connections** `googlebigquery_list_big_query_connections` | List BigQuery connections in a given project and location | | **List capacity commitments** `googlebigquery_list_capacity_commitments` | List all capacity commitments for the admin project | | **List dataexchanges listings** `googlebigquery_list_dataexchanges_listings` | List all listings in a given Analytics Hub data exchange using the v1beta1 API | | **List datasets** `googlebigquery_list_datasets` | List datasets in a specific BigQuery project, including dataset locations | | **List jobs** `googlebigquery_list_jobs` | List all jobs that you started in a BigQuery project | | **List locations** `googlebigquery_list_locations` | List information about supported locations for BigQuery Data Transfer Service | | **List locations connections** `googlebigquery_list_locations_connections` | List BigQuery connections in a given project and location using the v1beta1 API | ## Example prompts **Explore before querying** > List my BigQuery datasets with googlebigquery_list_datasets, then show me the schema of \.\
with googlebigquery_get_table_schema. Do not run a query yet — I want to see the columns first. **Run a cost-aware query** > Query \.\
for the last 7 days, filtering on the partition column and selecting only \. Show me the SQL before you run it, and tell me roughly how much data it will scan. **Check a long-running job** > List recent BigQuery jobs with googlebigquery_list_jobs, find the one still running, and use googlebigquery_get_job to tell me its state and bytes processed. Cancel it with googlebigquery_cancel_job only if I say so. **Fetch results from a completed job** > Use googlebigquery_get_query_results for job \ and give me the rows as a table, with the numbers formatted readably. ## How the BigQuery tools behave Details that decide whether a BigQuery prompt is cheap and correct rather than expensive and wrong. - **Queries are billed by bytes scanned.** Filtering on the partition column and naming columns instead of using star is the difference between a trivial query and an expensive one. Say so in the prompt; the agent will not infer it. - **`googlebigquery_get_table_schema` is the cheap first step.** Reading a schema costs nothing compared with discovering the columns by querying, and it stops the agent guessing field names. - **Jobs are asynchronous, and there are tools for each stage.** `googlebigquery_list_jobs`, `googlebigquery_get_job`, `googlebigquery_get_query_results`, and `googlebigquery_cancel_job` cover start, inspect, fetch, and stop. - **Location matters for datasets and jobs.** BigQuery resources are regional, and a job issued against the wrong location fails rather than falling back. `googlebigquery_list_locations` is there for exactly this. - **The administrative tools are real writes.** Reservations, capacity commitments, and connections change billing and infrastructure, not just data. They inherit the connected account's IAM, so restrict at the account level if the agent should not reach them. ## ClawLink vs. building it yourself The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google BigQuery working from chat. | | Manual | ClawLink | |---|---|---| | **Connection flow** | Register a Google BigQuery app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect Google BigQuery through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. | | **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Google BigQuery. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. | | **Agent usability** | You still need to expose the right Google BigQuery actions to the runtime in a format your agent can reliably use. | 63 tools for Google BigQuery are already exposed through ClawLink, so the agent can read and act from chat immediately. | ## ClawLink vs. Composio Composio also exposes Google BigQuery to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Google BigQuery in the browser, and the 63 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison. ### Hermes paired but still can't use Google BigQuery Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`. ### Connection succeeds but no tools appear Reconnect Google BigQuery from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded. ### "Tool schema not loaded yet" error when calling Google BigQuery tools Google BigQuery tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Google BigQuery call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again. ### Google BigQuery returns 403 or "permission denied" on one action while others work Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs. ### BigQuery returns "Quota exceeded" or "Exceeded rate limits" BigQuery enforces several separate quotas and the message usually names which one, so read it before retrying. Concurrent interactive queries, query bytes scanned per day, and table update operations per day are the ones agents meet most often, and they behave differently: a concurrency limit clears in seconds, whereas a daily bytes-scanned cap does not clear until the quota window rolls over. Retrying immediately makes the first case worse and does nothing for the second. The durable fix is query shape rather than pacing — filter on the partition column, select named columns instead of star, and have the agent check a table's schema with googlebigquery_get_table_schema before writing a query against it rather than exploring with repeated full scans. Ask the agent to diagnose it: ```text Quote the exact quota name from the error. Then show me the query you ran and tell me which columns and partitions it touched. Do not re-run it yet. ``` ### BigQuery returns 403 "Access Denied" or "User does not have permission to query table" BigQuery permissions are layered, and the layer that fails tells you what to fix. Project-level access controls whether jobs can run at all; dataset-level and table-level access control what those jobs can read. So an account that can run a query but not read one table produces exactly this error while everything else works, and the fix is granting access to that dataset in Google Cloud rather than reconnecting. Check the connected identity first — if several Google accounts have access to the project, the one you connected may not be the one you were thinking of. The other cause, invisible to search results but real here, is a placeholder: a project or dataset id copied from documentation fails as a permission error rather than a not-found. Ask the agent to diagnose it: ```text Run googlebigquery_list_datasets and tell me which project and datasets this connection can actually see, and which Google account it is acting as. Do not retry the failed query yet. ``` ### "Tool schema not loaded yet" on the first BigQuery call in a session Schemas load on demand rather than shipping with the plugin, so the very first BigQuery call in a fresh session can arrive before the catalog does. Wait a moment and retry and it normally resolves. If every call fails in a brand-new chat, the connection itself needs attention — reconnect from the dashboard. This is a different failure from the one most search results describe, which is a local MCP server missing from a client config file; there is no local server here and no file to edit. ### OAuth finished in the browser but the account is still missing Try reconnecting Google BigQuery and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete. ### Is there a Hermes Agent Google BigQuery integration? Yes. ClawLink is the fastest way to connect Hermes to Google BigQuery: link your Google BigQuery account once in the browser and Hermes Agent can call the Google BigQuery API through 63 ready-made tools — no custom code or token handling. ### How do I connect Google BigQuery to Hermes with ClawLink? Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Google BigQuery in the dashboard and Hermes can use it from the next message — no config files or API keys to manage. ### How long does it take to connect Google BigQuery to Hermes Agent? About two minutes. Sign in, click Connect next to Google BigQuery in the dashboard, authenticate, and Hermes Agent can use it from the next chat message. ### Why use ClawLink instead of wiring Google BigQuery up myself? The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google BigQuery working from chat. ### Do I need a service account key file? No, and avoiding it is the main practical gain. The standard BigQuery setup has you create a service account in Google Cloud, download a JSON key, and put it somewhere the agent can read — a long-lived credential in a file, which is the thing security reviews object to and the thing that gets committed by accident. ClawLink connects through Google's OAuth consent screen instead, so the credential lives on the ClawLink server and the agent acts with the access your Google account already has in that project. ### Whose BigQuery costs does the agent spend? Yours, and this is worth understanding before you let an agent write queries. BigQuery bills on-demand queries by the volume of data scanned, not by how long they take or how many rows come back, so a `SELECT *` against a large partitioned table can cost real money in seconds while looking like a harmless question. The habits that matter are the usual BigQuery ones: select only the columns you need, always filter on the partition column, and ask for a dry run or a limit when exploring. An agent will happily write the expensive version if nobody tells it not to. ### Can the agent write to my datasets or only read? Both, and the toolset is broader than reporting: alongside queries and schema reads there are tools to create datasets, routines, connections, reservations, capacity commitments, and data-exchange listings. That breadth is useful and it is also the reason to think about which Google account you connect. The agent inherits that account's IAM permissions exactly, so if it should not be able to create reservations, connect an account that cannot. IAM is the real control surface here, not the prompt. ### Is it safe to connect BigQuery to an AI agent? The connection is Google's own OAuth flow, so you approve it on Google's screen, no key file exists on your machine, and revoking from the ClawLink dashboard stops further calls. Two risks are worth planning for beyond the mechanism. The first is cost rather than access, since a badly shaped query is expensive rather than dangerous — the mitigations above are the answer. The second is that query results are data the model then reasons over, so if a table contains text written by other people, treat it as untrusted input and keep a human in the loop before the agent acts on what it read. ### Hermes paired but still can't use Google BigQuery Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`. ## Related - [Hermes Google Classroom integration](https://claw-link.dev/hermes/google-classroom) — Manage classes, coursework, and students - [Hermes Google Calendar integration](https://claw-link.dev/hermes/google-calendar) — Create and manage calendar events - [Google Sheets](https://claw-link.dev/hermes/google-sheets) — Read and write spreadsheet data