Verified

SQL MCP Server

Query and browse MySQL, PostgreSQL, SQL Server, and SQLite database schemas directly.

Data last scanned today · Reviewed today

43 1 dangerous tool6 tools★ 9TypeScriptMIT

Overview

This server provides AI models with direct access to database schemas and content. By bypassing the need for models to guess schema structures based on code files, it enables more precise queries across common relational database engines. It features an auto-detection mechanism for database types based on the connection URI provided. Users can maintain security by utilizing environment variables for connection strings or project-root configuration files, keeping credentials out of shell command history and configuration files.

Our verdict

This tool holds a security score of 33/100, resulting in a high-risk classification. The project is currently community-maintained rather than vendor-backed and has not yet undergone independent editorial review. Users should exercise caution regarding the authentication methods, which are not currently audited, and ensure the read-only configuration is strictly enforced in their environment before use.

Supports MySQL, PostgreSQL, SQL Server, and SQLite engines
Minimal supply chain surface with only six direct dependencies
Supports credential-free installation via local configuration files
Provides built-in read-only mode by default

High-risk security profile with a score of 33/100
Lacks verification through third-party editorial review
Single-contributor bus-factor risk

Setup

Claude Desktop

{
  "mcpServers": {
    "sql-mcp": {
      "args": [
        "-y",
        "@salmanulfaris/sql-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
list_tables	List all tables and views in the database	low
describe_table	Full schema for one table: columns, types, indexes, FK	low
get_schema	Full database schema dump	low
get_sample_data	Sample N rows from a table	low
query	Execute any SQL statement	high
analyze_query	Show execution plan + detect performance issues (full scans, missing indexes, filesort, etc.)	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Which databases are supported by this server?

The server supports MySQL, PostgreSQL, SQL Server, and SQLite.

›Is the server configured for read-only access by default?

Yes, the server is read-only by default and requires explicit opt-in using the --allow-write or ALLOW_WRITE flags to perform write operations.

›How can I manage database credentials securely across different projects?

You can use a .sql-mcp file in the project root or the DB_URL environment variable instead of hardcoding credentials in your MCP configuration files. It is recommended to add .sql-mcp to your .gitignore to avoid committing sensitive connection details.

›What is the priority order for database configuration if multiple methods are used?

The command line --db flag takes highest priority, followed by the .sql-mcp file, and finally the DB_URL environment variable.

›Do I need special configuration for SQL Server TLS connections?

You should pass the --ssl flag to enforce encrypted, certificate-validated connections, which is required for Azure SQL. Alternatively, you can use URI query parameters like encrypt=true and trustServerCertificate=true.