Verified

Oracle Database MCP Server

Oracle Database schema introspection and SQL execution via STDIO transport.

Data last scanned today · Reviewed today

4370 tools★ 2JavaMIT

Overview

This Java-based server uses Spring Boot and Spring AI to provide 70 tools for interacting with Oracle Database environments. It enables users to perform schema exploration, analyze performance diagnostics through V$ views, and execute DML operations like INSERT, UPDATE, and DELETE directly from an MCP-compatible assistant. Designed for local use, the server operates exclusively over STDIO without exposing HTTP ports. It leverages Java 26 virtual threads to manage blocking JDBC connections efficiently and relies on environment variables for credential management rather than hardcoded secrets.

Our verdict

With a high-risk security score of 38/100, this project should be approached with caution. The score reflects that the server is community-maintained rather than vendor-backed, and core security concerns such as authentication methods and read-only mode enforcement remain unreviewed by third parties. While the author suggests using a least-privilege Oracle user to mitigate risks, the lack of an independent audit means it is best suited for non-sensitive testing environments only.

Uses zero direct dependencies reducing supply-chain surface area
Implemented with Java 26 virtual threads for performance
Provides 70 specific tools for introspection and diagnostics
Requires only local STDIO transport for connectivity

High-risk security score of 38/100
Community-maintained project lacks official vendor backing
Critical security aspects like authentication remain unreviewed
Low community adoption indicated by 2 GitHub stars

Tools

Tool	Description	Risk
list_schemas	List all Oracle schemas (users) visible to the current connection.	low
list_tables	List tables; optional schema and case-insensitive LIKE name pattern (defaults to %).	low
list_views	List views; optional schema and LIKE name pattern.	low
describe_table	Columns of a table: name, data type, nullability, default value and comment. Call before writing SELECT/INSERT/UPDATE against an unverified table.	low
list_indexes	Indexes on a table with their columns, uniqueness and status.	low
list_constraints	Constraints on a table (PK, FK, unique, check) with columns and references.	low
list_sequences	Sequences with range, increment, last number, cycle flag and cache size (from ALL_SEQUENCES, not DBA_SEQUENCES). Optional schema.	low
get_sequence_info	Metadata for one sequence (range, increment, last number, cache/order flags) from ALL_SEQUENCES. Read-only: does NOT consume NEXTVAL.	low
table_exists	true if a table exists (via ALL_TABLES; views not considered). Use instead of run_query {SELECT 1 FROM ALL_TABLES ...}.	low
list_triggers	Triggers with type, triggering event, target table and status. Optional schema.	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the system prerequisites for running this server?

You need JDK 26, Apache Maven 3.9+, and an Oracle Database version 12c or higher.

›How is the server secured against unauthorized database modifications?

The server uses a least-privilege Oracle user model. Because this user lacks DDL and DCL privileges, Oracle will reject any structural commands such as CREATE, ALTER, DROP, or GRANT with an ORA-01031 error.

›How do I configure the database connection?

Credentials and connection details are provided via environment variables, specifically ORACLE_DB_URL, ORACLE_DB_USERNAME, and ORACLE_DB_PASSWORD. No secrets are stored in the repository.

›Does the server require an exposed web port for communication?

No, the server uses STDIO transport exclusively and does not expose an HTTP or SSE port.

›How do I specify which schema the server accesses?

There is no static schema configuration; the server defaults to the schema associated with your ORACLE_DB_USERNAME. To query other schemas where the user has been granted access, provide the schema name as a tool parameter.

›Can the server execute PL/SQL procedures?

Yes, you can invoke procedures using the call_procedure tool, provided the database user has been granted the necessary EXECUTE privileges on the target object.