To chart BigQuery data in Claude, ChatGPT or another AI client, connect it here, then create an app on it. Bonnard reads BigQuery through a read-only service account, so your apps query only what you grant.

Requirements

The Admin role in your Bonnard workspace.
Permission in the Google Cloud project to create service accounts and keys, and to grant IAM roles on the project and its datasets.
Service account keys allowed in the project. The iam.disableServiceAccountKeyCreation organization policy blocks them, and organizations created since May 3, 2024 enforce it by default.

1. Create a read-only service account

Bonnard connects as this service account. Agents can query only the tables it can read.

Bash

# A service account for Bonnard
gcloud iam service-accounts create mcp-reader \
  --project=<project_id> --display-name="Bonnard reader"

# Let it read one dataset. Run this once for each dataset apps should query
bq query --use_legacy_sql=false \
  'GRANT `roles/bigquery.dataViewer` ON SCHEMA `<project_id>`.<dataset>
   TO "serviceAccount:mcp-reader@<project_id>.iam.gserviceaccount.com"'

# Let it run queries in the project. This grants no access to data
gcloud projects add-iam-policy-binding <project_id> \
  --member="serviceAccount:mcp-reader@<project_id>.iam.gserviceaccount.com" \
  --role="roles/bigquery.jobUser"

# A JSON key for the connect form
gcloud iam service-accounts keys create mcp-reader-key.json \
  --iam-account=mcp-reader@<project_id>.iam.gserviceaccount.com

Replace <project_id> and <dataset> with your own. Grant datasets you add later the same way.

2. Add the connection

In the console at app.bonnard.ai, select Data, then BigQuery.
Under How should requests route to BigQuery data?, choose how each tenant (the customer a caller belongs to) is routed, from the routing table below.
Enter a Connection name and the service account’s details from the fields table below.
Select Test & connect. Bonnard logs in as the service account and reads the tables it can see.

Routing options
Option	Use it when
No tenancy	Every caller should see the same data.
Dataset per tenant	Each tenant has its own dataset and its own service account.

With Dataset per tenant, upload one customer’s key, pick their dataset under Which dataset is this customer’s?, then confirm the Layout step. You map each customer to their dataset later, on the app that serves them.

BigQuery connection fields
Field	Enter
Connection name	A name for this database in Bonnard, such as `Production`.
Project ID	The ID of the project that holds the datasets from step 1, not its name.
Service account JSON	The key file from step 1. Select Upload key (.json), or paste the file’s contents under or paste JSON.

Connection saved shows the number of tables discovered.

Troubleshooting

bigquery discovery covers at most 100 datasets and this service account can see more: scope its IAM to the datasets you mean to expose. The account reads over 100 datasets. Remove any project-wide role, and grant roles/bigquery.dataViewer on each dataset instead (step 1). Past 2,000 tables, the message names tables instead. The fix is the same.
credentials must be valid JSON. Upload the key file, or paste the whole file.
invalid_grant with Invalid JWT Signature. The key is deleted, disabled or expired. Create a new key (step 1) and upload it.
A table is missing. Grant roles/bigquery.dataViewer on its dataset. After a minute, select Re-introspect on the database’s Tables tab.
Any other error is BigQuery’s own message. Check the field it names, then select Test & connect again.

Charts in your AI client

Create an app on this database, so AI clients such as Claude and ChatGPT can query it and draw charts.