mcpField
S
SQL MCP Server

SQL MCP Server

Local
github.comDatabases0Updated 1w ago
RepositoryVisit website

About SQL MCP Server

SQL MCP Server is a governed SQL access gateway for untrusted AI agents, aimed at teams connecting agents to PostgreSQL, MySQL, or OceanBase. It uses controlled entities and a relational-algebra IR rather than arbitrary SQL, with separate, opt-in SQL access for trusted operators.

Key features

  1. 01Controlled database tools
  2. 02PostgreSQL, MySQL, OceanBase
  3. 03RBAC and field-level access
  4. 04Row policies and masking
  5. 05Query cost and result limits
  6. 06Auditing and telemetry hooks

Use cases

  1. 01Give agents governed database access
  2. 02Restrict access by tenant and row
  3. 03Limit costly database queries
  4. 04Audit database operations

MCP support

Provides controlled database access tools to MCP clients. It rejects arbitrary SQL in the governed interface; a separate execute_sql path is disabled by default and limited to explicitly authorized users.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "nethinwei-sql": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "DATABASE_DSN",
        "ghcr.io/nethinwei/sql-mcp-server:0.1.21"
      ],
      "env": {
        "DATABASE_DSN": "<DATABASE_DSN>"
      }
    }
  }
}
Run commanddocker run -i --rm -e DATABASE_DSN ghcr.io/nethinwei/sql-mcp-server:0.1.21
Environment variables to set
DATABASE_DSNSecretDatabase DSN referenced by ${DATABASE_DSN} in config.yaml

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/nethinwei/sql-mcp-server:0.1.21

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

SQL MCP Server

The governed SQL gateway for untrusted AI agents.

面向不可信 AI Agent 的受控 SQL 数据访问网关。通过显式 Entity、关系代数 IR 和 参数化 codegen 访问 PostgreSQL、MySQL 与 OceanBase，受治理面不接受任意 SQL，不提供 DDL。可信操作者另有独立的 SQL 逃生通道 execute_sql：默认关闭，只对被显式授予 sql:execute@<数据源> 的用户可见，走单独声明的连接，受硬上限与写入失败即拒绝的 审计约束（见安全模型）。

核心差异

  • 确定性执行：Agent 只能组合受控工具和白名单 IR；
  • 字段与行治理：RBAC、字段 ACL、row policy 和 mask 统一强制；
  • 成本可控：EXPLAIN 预筛、结果上限、超时和 session/tenant 预算；
  • 默认拒绝：安全能力无法证明时 fail closed；
  • 可审计：配置热重载、异步审计和 OpenTelemetry hook。

运行时安全行为以安全模型为准；Provider 验证边界与证据层级 以兼容矩阵为准；威胁、控制与剩余风险见 威胁模型。所有对外声明的证据汇总见 架构、安全边界与证据索引。不以本页摘要为准。

五分钟体验

只需 Docker 与 Docker Compose：

docker compose -f examples/quickstart/compose.yaml up -d --wait
curl -fsS http://127.0.0.1:8080/healthz

完整的 MCP Inspector 调用、tenant 隔离、mask 和拒绝场景见 五分钟快速体验。

安装与接入

源码构建要求 Go 1.26.10+ 和一个已验证数据库版本：

git clone https://github.com/nethinwei/sql-mcp-server.git
cd sql-mcp-server
make build

按角色阅读

首次体验与集成
部署与安全
开发与维护
版本与规划

许可

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.