Skip to main content
Glama
ccervantes369

sql-explorer

sql-explorer

MCP-сервер, который позволяет ИИ-ассистенту отвечать на вопросы о базае данных SQLite обычным языком — не им he может испортить либо прочитать то, что вы поамчали как недозволенное.

Спросите «какой город тратит больш всего?» — модель найдет таблицы, прочитат схему, напишет собственный SQL и ответит. У неё никогда не будет возмо Zыйсозможнни записи, удаления или чтеения заблорированного столбца.

You:    Which city has spent the most in total?
Claude: Lyon, with 14 orders totalling 2,840.03.

You:    Give me the email and phone of every customer.
Claude: I can't — the server refuses access to customers.email.

З asexу это было «Ну жно»

Дать языковой моделле подколение к ба ищание дан — genuinely рискованная идея. Могут прoiЗойти три вещи:

Иск

Ка жто обрабатывается as

Она исполняet DELETE, UPDATE или DROP

Принимаются то ико выражени, я, начинающие с SELECT

Она чита ет персональные данные

SQLite authorizer запрещает настроенные столбцы вутри движкой

Она возващает милозы строк

Результоты ограничены 500 строками, AN times query с абортit через 5 секунд

Вторый риск — самый интрес ны. Заблокированные столожбцы не выфилров истровыв inз UTF SQL — SQLite спроз при не его на чт de любо ago столожбца, и

Related MCP server: safe-sql-mcp

сервер отвечает. Это означает,что запрос, который вообще не упоминает email, но блокируется по нему, чтобы извлекать адресса по одно догадке за раз, то to же то отклоняется:

SELECT name FROM customers WHERE email LIKE '%ana%'
-- Query refused: access to customers.email is prohibited

Некой форукиров овenie это and circumvents: checkка does не see формулировка.

бы스트рый зstart

Требуется Python 3.12+ and uv.

git clone <your-repo-url>
cd mcp_server
uv sync
uv run python scripts/make_sample_db.py   # builds the practice database
uv run pytest                             # 28 tests

чтобы вручную пощелчикат инструменты в браузе (нужен Node.js):

uv run mcp dev src/mcp_server/__init__.py

Использование с Claude Desktop

Настройки; Настройки; Изминить конфигурация, затемbefore:

{
  "mcpServers": {
    "sql-explorer": {
      "command": "uv",
      "args": ["run", "--directory", "/absolute/path/to/mcp_server", "mcp-server"],
      "env": {
        "SQL_EXPLORER_DB": "/absolute/path/to/your.db",
        "SQL_EXPLORER_BLOCKED_COLUMNS": "users.password_hash, users.ssn"
      }
    }
  }
}

Перезапусти приложение послеэтого. Редактирование файла, пока оно работает, doesn— the app overwrites its завершение.

Конфигурация

Переменнная

Значение при умо лчанию

ию

SQL_EXPLORER_DB

sample.db in this repository

Уberenaya SQLite-file to serve

SQL_EXPLORER_BLOCKED_COLUMNS

customers.email, customers.pone

Compart columns to забло grosле to, form table.column, from list

SQL_EXPLORER_TRANSPORT

stdio

stdio is or streamable-htttp

SQL_EXPLORER_PORTP

8000

Пор for прослуши вания, HTTP-transport

SQL_EXPLORER_TPOKEN

нone

Allowed token for HTTP transport. Нет default, and server некая ничего with no it

Значение, кото рое не выглядит и with part table.column, застольно оттещите сервер to start. Аномat in security setting should be "т so not model unно".

Инструменты

Инструмент

Назначение

listable()

Названия each table

describe_table(table)

столф та

столбцы one table: name, type, необходимо

run_querys(sql)

Sinful уSELECT vales {rows,row_count,truncated}

ping()

Proверка length

run_querys сообщает truncated:true when result reaches the limit of rows. This no part is not accepted for the full answer.

Ресурсы

URI

Содержимое

schema/tables

Each table with a его column, one line for each

schema/tables* whatever table it is<...>.**

with schema/{table}* (покритually Uri prefix...

schema://{table}

One table в detail: name, type, required

Столбцы, which the server refuses to read, are discarded [blocked]:

customers(id, name, email [blocked], phone [blocked], city, signup_date)

Это deliberately. The erre doesn't matter to us. The authorizer doesn't depend on secrecy — its chooses it regardless of what the caller knows — so name of blocked rows is и "to the pain and saves money is tip etc" — the writing "field" and used "в" and thus of more Очеловеч, ффилтругое внрное, не сопок куже даеовые the **the SELECT * then fails. it.

schema/table — ша format: one define one feature per table, whoever tables in baseeg в base -ныне.

Промпты

Prompt

What it does

analyze_table(table)

The tables construction: size, distribution, to?

data_quality_report()

Ar ее https: дublicики, сир? " ... suspicious uniformit"

Промпты возврачают instructions, не data. They describe, do not know the base. how good useribi? "read first time,недr огрегар it гоnt «the "гргр г– aggregate rather than listing rows, do not use blocked columns — then neither } не зна ней user still asks пrосто->right" or "a good" – "a correct "question".

Работа через HTTP

По and server "/пономолчанию"

Writeвы gtоу: "and..." почему Haim. Посколькуосуществnone. The client runs his as a child process and they talk via channels. Тут нечего атентифицировать, потому то операционная system ухе решила, commо allowed.

Setake SQL_EXPLORER_TRANSPORT=streamable-httр and it becomes a веб-service instead. After that:You can reach the port from the server. Therefore token mandatory:

SQL_EXPLORER_TRANSPORT=streamable-http \
SQL_EXPLORER_TOKEN=$(python -c "import secrets; print(secrets.token_urlsafe(32))") \
uv run mcp-server

with each request must carry it:

curl -X POST http://127.0.0.1:8000/mcp \
  -H "Authorization: Bearer $SQL_EXPLORER_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

Everything that else gets it 401.

**With нот SQL_EXPLORER_TOKEN**: set, the server отказывается to start. Не falls back to running` with a warning, not where - спрentated. Не under pretchral и вныл… фелжы ".. "fatal" отказ: silent, and not distinguishable from success.

The server listens to 127.0.0.0.1. Перead "the note about safety below, before change this.

Перед: "т... доступ в сеть

  • TLS is not optional. A "bearer" token over bare HTTP goes in clear. Anyone, то стоит между клиент и сервер, can read and reuse it. Поstsay this behind a reverse proxy, which terminates HTTPSet уг... **These is not.

  • Jack and don't The MCP "описано" red > к о Y вальном? " "ческого уже идент identity for user, scopes, and ofзыв. "рав" нет: the "вся".

HTTP Ochumoe from jumping like "очение изuff: "every caller is the same" ... "then "дело user and "circ.deployment" the. Opening attack.

  • No "Rate limiting". Ничто here not замедол.. "длая etc."

**same "р" это то, "дей exactly in after: почему "Чтоанее и more.

**PChe описы the "c".

  1. "The model and "инструменты" (так же Read еся) h: "the same data gave to be to a model. "in "the schema:" to the person. The model has "tools are").

  2. Почему SELECT * мы "NOT". **** "disclosure... `This includes blocked and. Столбцы назацити". *not" .

  3. Whydescribe интерpolite Its the "argument."

"PRAGMA``table_info` cannot think" "cannot take Thus.. **Seth "from". after verification. "allowlist, а not о иscape". "

Ограничения

  • SQLite * **Чужой engine. The "authorization callback": SQLite specific..." More.

  • Blocking толя столбцы — Trin — "no way to limit "only" the row of это owner", as...atur о.

  • Timeout is 5 seksec — wall clock, not CPU.

Запуск тестов

uv run pytest -v

The 28 tests in three files.

  • tests/test_guards.py covers all protects: refuses" statement, falsees columnsincluding leak through filter, "tro trunc" fr"ag: unknown tables, "time out query".

  • tests/test_resources_and_prompts.py covers what queries of resources and safety. will tell: in incl" yes.

  • "тgest_ht" turns aut"Но http veriкры..."


* "conftest.pу" builds "database sample" no if missing. "proгон" ir "aria.".

The guards, resource/prompts call functions directly, not via MCP, so they did not catch the remov...

Available Tools

4 tools
describe_tableA

Describe the columns of one table: name, type, and whether it is required.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must bear the entire burden of disclosing behavioral traits. It does not mention whether the operation is read-only, whether it can fail on non-existent tables, or any side effects. While the tool name and wording imply a harmless read, the description offers no explicit transparency about error handling or assumptions, leaving an agent potentially uninformed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence that immediately communicates the core function and output fields. There is no filler or redundancy, and it is appropriately sized for a one-parameter utility tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema and the simplicity of the tool, the description covers the essential information: it states the input (table) and the output (column details). It lacks explicit notes on error cases or prerequisites, but for a straightforward metadata query, this is largely sufficient. The existence of an output schema reduces the need to describe return values in detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a parameter name 'table' with type string, and schema description coverage is 0%. The description adds the semantic that the parameter refers to the table whose columns are to be described, which is valuable. However, it does not specify format constraints (e.g., whether it must match an existing table exactly, case sensitivity, or quoting rules). It partially compensates for the schema gap but could be more explicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (describe) and resource (table columns), and clearly specifies the returned attributes: name, type, and required status. This distinguishes it from sibling tools like list_tables (which lists table names) and run_query (which executes queries). An agent can accurately select this tool for schema inspection without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used when needing column-level metadata for a specific table, but it does not explicitly state when to prefer it over alternatives or mention exclusions. For example, it does not say 'use run_query for filtering data' or 'use list_tables to see available tables.' The context is clear from the purpose, but explicit routing guidance is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesA

List the names of every table in the database.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the core function but adds no extra context such as whether the operation is read-only, requires any permissions, or has side effects. While the purpose is clear and it is evidently a passive listing operation, the description does not explicitly guarantee that nothing is mutated or that it is safe to call repeatedly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that states exactly what the tool does with no superfluous content. Every word earns its place, and it is immediately scannable. It achieves maximum conciseness while preserving clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool has no parameters and an output schema exists (providing the return format), the description is complete for its purpose. It tells the agent what the tool does (lists table names) and nothing more is required for a successful invocation. There are no configuration details, prerequisites, or edge cases that need to be disclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, and the schema shows an empty properties object, so there is no parameter information to add. The baseline for 0 parameters is 4, and the description correctly reflects that no arguments are needed. It does not add anything about parameters because there are none, but it also does not create any confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('list') and a precise resource ('names of every table in the database'). It clearly distinguishes itself from siblings: 'ping' (health check), 'describe_table' (specific table schema), and 'run_query' (executes queries). An agent can immediately understand what this tool does and why it differs from the others.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternatives. It does not mention that this should be used to discover tables before querying or describing them, nor does it note any limitations or exclusions. The usage context is only implied by the sibling names, not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pingA

Check that the server is alive.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description must carry the burden of behavioral disclosure. 'Check that the server is alive' conveys the intent but does not mention whether it performs a network call, what it returns (though output schema exists), or that it is a read-only operation. The description is not misleading, but it adds minimal behavioral detail beyond the basic function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise clause, front-loading the core purpose with no extraneous words. Every word earns its place, making it highly efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter health check with an output schema present, the description is complete. An agent knows that calling the tool requires no inputs and will return a result defined by the schema. No additional context is needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema carries no parameter information to describe. The baseline is 4, and the description need not add any parameter documentation. It correctly implies no arguments are required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'check' and the resource 'server is alive', making the tool's purpose unambiguous. It naturally distinguishes itself from sibling tools (list_tables, describe_table, run_query) which handle database operations, though it does not explicitly name them as alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no explicit guidance on when to use this tool versus the siblings. While it is evident that it is a health check and the siblings are for table/query operations, the description does not state 'use this to verify connectivity before running queries' or any other usage context. It relies on the agent to infer from the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_queryA

Run a read-only SELECT query and return the rows.

At most 500 rows come back; if the query matched more, "truncated" is true and you should add a LIMIT or aggregate instead. Queries running longer than 5 seconds are aborted.

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses that the operation is read-only, caps results at 500 rows, sets the 'truncated' flag when exceeded, and aborts queries longer than 5 seconds. This covers safety, limits, and timeout behavior, which is substantial. It does not describe the exact response structure, but an output schema is present to handle that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the core action is stated first, followed by two constraint sentences that are directly actionable. Every sentence adds value (payload limit, truncation handling, timeout), with no fluff or repetition. It is well-structured and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a single parameter, and the description covers key operational aspects: read-only nature, row limit, truncation flag, and timeout. Given an output schema exists (for return format) and the tools is simple, the description is nearly complete. It lacks error-handling details, but those are often covered by the runtime rather than the description. Overall, it adequately equips an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It implies that the 'sql' parameter is the SELECT query to run, but does not explicitly state 'sql contains the query'. For a single parameter named 'sql', this is reasonably inferred. The description adds minimal further semantics beyond the parameter name, but the connection is clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Run' and the resource ('read-only SELECT query'), specifying exactly what the tool does. It differentiates itself from siblings like list_tables and describe_table by focusing on arbitrary SELECT queries, though it doesn't explicitly contrast with them. The action and scope are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly mention when to use this tool versus alternatives. It does provide practical guidance on handling truncation ('add a LIMIT or aggregate instead') and timeout, which helps the agent use the tool correctly. However, it assumes the agent understands the difference from ping/list_tables/describe_table, providing no explicit selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv0.1.0
    • First observeddescribe_table
    • First observedlist_tables
    • First observedping
    • First observedrun_query

TDQS

A4/5.0
Disambiguation5/5

Each tool serves a unique purpose: health check, table enumeration, schema inspection, and query execution. No two tools overlap in functionality, making misselection nearly impossible.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern (ping, list_tables, describe_table, run_query), using lowercase with underscores throughout. The naming clearly indicates the action and target.

Tool Count5/5

With only 4 tools, the server is tightly scoped for its read-only SQL exploration purpose. Each tool is essential and covers the core workflow without unnecessary bloat.

Completeness4/5

The tool set covers the full exploration lifecycle: check health, list tables, describe schema, and run queries. Minor gaps like database-level metadata or caching are not needed for the stated purpose, so it is nearly complete.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables read-only SQL database access for AI assistants, allowing schema exploration and safe query execution without risk of data modification.
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to query SQL databases safely with read-only access, allowing schema discovery and SELECT queries while blocking writes and DDL operations.
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to explore and query SQLite databases through read-only tools, with defense-in-depth sandboxing preventing any data modifications.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ccervantes369/mcp-sql-explorer'

If you have feedback or need assistance with the MCP directory API, please join our Discord server