Skip to main content
Glama
govern-agents

sql-sop-mcp

by govern-agents
OverviewSchemaRelated ServersScoreDiscussions
Python
Local
IMPORTANT

This repository has moved into the Governed Agent Stack monorepo.

Active development is now at packages/sql-sop-mcp/. This repo is archived and read-only. Its full commit history is preserved here; new work, issues and releases happen in the monorepo.

sql-sop-mcp

PyPI Downloads

PyPI Python CI pre-commit.ci License

Model Context Protocol server that wires sql-sop into any MCP-aware LLM client. Lets Claude Desktop, Cursor, ChatGPT desktop, Continue, and similar tools call sql-sop's linter as a callable tool from inside a chat.

The point: when an LLM generates SQL for you, it can lint that SQL itself before suggesting it. Or you can say "lint this query", paste the SQL, and the model uses the tool rather than guessing.

What it exposes

Two tools, both stdio-transport:

Tool

What it does

lint_sql(sql, severity?, disable?)

Run sql-sop against a SQL string. Returns {passed, summary, findings[]}. Each finding has rule_id, severity, line, message, suggestion.

list_rules()

Return the full rule catalogue (43 rules in sql-sop v0.7.0; 48 with --contract enabled).

Backed by sql-sop, a fast rule-based SQL linter with 38 SQL rules (including 5 T-SQL specific ones) and 5 Python source rules for SQL injection on cursor.execute() / sqlalchemy.text(). As of v0.7.0 it also offers an opt-in Contracts pack (5 schema-aware rules) for projects that maintain a YAML data contract. There's a browser playground if you want to feel out the rules before wiring this up.

Related MCP server: MCP Spectral

Install

pip install sql-sop-mcp

Or with pipx if you want the CLI on PATH without polluting your project's venv:

pipx install sql-sop-mcp

Wire it into your LLM client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "sql-sop": {
      "command": "sql-sop-mcp"
    }
  }
}

Restart Claude Desktop. New chats will see two tools: lint_sql and list_rules.

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "sql-sop": {
      "command": "sql-sop-mcp"
    }
  }
}

Continue (VS Code / JetBrains plugin)

Add to ~/.continue/config.json:

{
  "mcpServers": [
    {
      "name": "sql-sop",
      "command": "sql-sop-mcp"
    }
  ]
}

Generic stdio-MCP client

Anything that speaks MCP over stdio will work. Run sql-sop-mcp as a subprocess and talk to it on stdin/stdout.

What a typical interaction looks like

You: "Write me a query to remove inactive users older than a year and lint it before suggesting."

The model calls lint_sql against its draft, gets back something like:

{
  "passed": false,
  "summary": "1 error, 1 warning in 1 statement",
  "findings": [
    {
      "rule_id": "E001",
      "severity": "error",
      "line": 1,
      "message": "DELETE without WHERE clause -- this will delete all rows",
      "suggestion": "Add a WHERE clause to limit affected rows"
    },
    {
      "rule_id": "W003",
      "severity": "warning",
      "line": 1,
      "message": "Function on column in WHERE -- kills index usage",
      "suggestion": "Move the function to the value side: WHERE date >= '2024-01-01'"
    }
  ]
}

It then revises the query and lints again before showing it to you.

When to use disable

If the model is sure a rule is a false positive in context (e.g. a one-off admin script where SELECT * is genuinely fine), it can pass disable: ["W001"]. Treat this as the model's reasoning surface. Read the suggested rationale, not just the final SQL.

Roadmap (open to PRs)

  • lint_file(path): lint a file the LLM has access to via filesystem MCP

  • explain_rule(rule_id): return the rule's full documentation, examples of pass/fail SQL

  • lint_python_file(path): wrap the Python-source scanner so the LLM can audit .py files for cursor.execute(f"...") SQL injection

  • suggest_index(sql, schema): emit candidate covering-index DDL based on the query

Related

  • sql-sop: the linter this server wraps. CLI, pre-commit hook, GitHub Action, browser playground

  • pr-sop: sister tool for PR governance

  • Model Context Protocol: the spec

  • FastMCP: the Python framework this server is built on

License

MIT. See LICENSE.

Available Tools

2 tools
lint_sqlA

Lint a SQL string with sql-sop. Catches dangerous patterns (DELETE/UPDATE without WHERE, SQL injection via string concat, DROP COLUMN, ADD NOT NULL without DEFAULT), SARGability mistakes (function on indexed column, leading-wildcard LIKE, OR across columns), 5 T-SQL specific rules (NOLOCK, xp_cmdshell, deprecated outer join, etc.), and 5 Python source rules for sqlalchemy.text() / cursor.execute() injection. 38 rules in total. Returns one JSON object listing every finding plus a human-readable summary.

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYesThe SQL string to lint. Can be one or many statements.
disableNoRule IDs to skip for this call, e.g. ['W001', 'T001']. Useful when the LLM knows a specific finding is a false positive in context.
severityNoMinimum severity to report. 'error' returns only blocking issues; 'warning' returns everything (default).warning

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses what the tool catches (38 rules across categories) and the return format (one JSON object with findings and summary). It implicitly indicates it is non-destructive (linting), though it could be more explicit about being read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph that is efficient and front-loaded with the main action. It packs substantial information without wasted words, though it could benefit from slightly better structure for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (38 rules, multiple categories) and the existence of an output schema, the description covers the return type (JSON with findings and summary) adequately. It does not mention error handling, but overall it is sufficiently complete for the agent to use the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter is already described in the input schema. The description adds context about the tool's capabilities (rule categories) but does not provide additional parameter-specific details beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lints a SQL string with sql-sop, lists specific categories of patterns it catches (dangerous, SARGability, T-SQL, Python), and distinguishes from sibling list_rules by being the actual linting tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool (to catch dangerous patterns, performance issues, etc.) but does not explicitly state when not to use it or provide alternative scenarios beyond the sibling. However, the usage context is clear and adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_rulesA

List every rule sql-sop ships with. Useful for explaining a finding's full description, picking which rules to disable for a project, or for an LLM to discover what it can use lint_sql to catch.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It correctly implies a read-only operation (listing rules) with no side effects, but doesn't elaborate on potential limitations or performance characteristics. Since the tool has no parameters and is simple, the description is minimally adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loading the core action and following with specific use cases. No redundant words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (no parameters, no nested objects) and has an output schema. The description fully explains the purpose and appropriate contexts, leaving no obvious gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description appropriately omits any parameter details as none exist, and schema coverage is 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List every rule sql-sop ships with.' It specifies the verb (list) and resource (rules), and distinguishes from the sibling tool lint_sql by mentioning discovery for linting. No ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: explaining findings, picking rules to disable, or discovering what lint_sql can catch. It does not explicitly state when not to use it, but the guidance is clear and contextualizes the tool relative to its sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.2
    • First observedlint_sql
    • First observedlist_rules
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0
Disambiguation5/5

The two tools serve entirely different functions: lint_sql performs analysis, while list_rules provides reference information. There is no overlap or ambiguity.

Naming Consistency5/5

Both tool names follow a consistent verb_noun pattern (lint_sql, list_rules) with lowercase and underscores, making them predictable.

Tool Count5/5

With exactly 2 tools, the server is tightly scoped for SQL linting: one core analysis tool and one supporting rule listing tool. This is appropriate for the domain.

Completeness4/5

The server covers the primary linting action and rule discovery, but lacks a tool to configure or disable specific rules, which may be needed for practical use. Minor gap.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • MCP Spectral

    mark-sivill
    A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that wraps Spectral to lint OpenAPI specifications, enabling LLMs to validate and fix API definitions.
    1
    MIT

  • sqldb-mcp-server

    akrym1582
    A
    license
    A
    quality
    A
    maintenance
    A read-only MCP server that exposes SQL database access to LLMs, supporting multiple database types, compact columnar results, pagination, and file export.
    6
    18
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/govern-agents/sql-sop-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server