How do I use mcp-mssql-secure?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-mssql-secure Show me the schema of the Orders table" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mcp-mssql-secure

by pugltd

Overview Schema Related Servers Score Discussions

JavaScript

Remote

MCP MSSQL Secure

A Model Context Protocol server for Microsoft SQL Server and Azure SQL Database with permission-based access modes. Choose how much database power the AI gets at install time.

Access modes

Mode	`MSSQL_ACCESS_MODE`	Tools	SQL allowed
Read-only	`readonly` (default)	`query`, schema introspection	`SELECT`, `WITH`, `EXPLAIN`, `TABLE`, `VALUES`
Read + DML	`dml`	above + `execute`	DML: `INSERT`, `UPDATE`, `DELETE`, `MERGE`
Full access	`full`	above + `execute` (DDL)	DML + DDL: `CREATE`, `ALTER`, `DROP`, `TRUNCATE`, etc.

Defense in depth:

Application-level SQL classification (blocks multi-statement queries, GO batch separators, and disallowed statement types)
Connection lock via MSSQL_LOCK_CONNECTION so credentials cannot be swapped at runtime when using env config
Database user permissions as the final authority (SQL Server has no session-level read-only SET equivalent to PostgreSQL)

Pair each mode with a SQL Server login/user that has matching grants. The server enforces intent; the database user is the final authority.

Related MCP server: sql-mcp

Installation

From npm

npm install mcp-mssql-secure

Or run directly:

npx mcp-mssql-secure --access-mode readonly

From source

git clone https://github.com/pugltd/mcp-mssql-secure.git
cd mcp-mssql-secure
npm install
npm run build

Point Cursor at node /absolute/path/to/mcp-mssql-secure/build/index.js.

Configuration

All modes use the same connection environment variables. Set the access level with --access-mode (CLI) or MSSQL_ACCESS_MODE (env). The CLI flag wins if both are set.

Variable / flag	Required	Default	Description
`--access-mode`	no	`readonly`	`readonly`, `dml`, or `full` (overrides env)
`MSSQL_ACCESS_MODE`	no	`readonly`	Same as `--access-mode`
`MSSQL_HOST`	yes	—	Database host
`MSSQL_PORT`	no	`1433`	Database port
`MSSQL_USER`	yes	—	SQL authentication login
`MSSQL_PASSWORD`	yes	—	Password
`MSSQL_DATABASE`	yes	—	Database name
`MSSQL_ENCRYPT`	no	`true`	Enable TLS (recommended for Azure SQL)
`MSSQL_TRUST_SERVER_CERTIFICATE`	no	`false`	Trust self-signed certs (on-prem dev)
`MSSQL_LOCK_CONNECTION`	no	`true` when env config is set	Disables `connect_db` at runtime

# CLI examples
npx mcp-mssql-secure --access-mode readonly
npx mcp-mssql-secure --access-mode=dml
node build/index.js --help

Azure SQL vs on-prem

Azure SQL Database (defaults work out of the box):

{
  "env": {
    "MSSQL_HOST": "your-server.database.windows.net",
    "MSSQL_PORT": "1433",
    "MSSQL_USER": "mcp_readonly",
    "MSSQL_PASSWORD": "your_password",
    "MSSQL_DATABASE": "your_database",
    "MSSQL_ENCRYPT": "true",
    "MSSQL_TRUST_SERVER_CERTIFICATE": "false"
  }
}

On-prem with self-signed certificate (dev/local):

{
  "env": {
    "MSSQL_HOST": "localhost",
    "MSSQL_PORT": "1433",
    "MSSQL_USER": "mcp_readonly",
    "MSSQL_PASSWORD": "your_password",
    "MSSQL_DATABASE": "your_database",
    "MSSQL_ENCRYPT": "true",
    "MSSQL_TRUST_SERVER_CERTIFICATE": "true"
  }
}

1. Read-only (recommended default)

Use for exploring schemas and running analytics without write risk.

{
  "mcpServers": {
    "mssql-readonly": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "mcp-mssql-secure", "--access-mode", "readonly"],
      "env": {
        "MSSQL_HOST": "localhost",
        "MSSQL_PORT": "1433",
        "MSSQL_USER": "mcp_readonly",
        "MSSQL_PASSWORD": "your_password",
        "MSSQL_DATABASE": "your_database",
        "MSSQL_LOCK_CONNECTION": "true"
      }
    }
  }
}

2. Read + DML

Use when the AI may insert, update, or delete rows but must not change schema.

{
  "mcpServers": {
    "mssql-dml": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "mcp-mssql-secure", "--access-mode", "dml"],
      "env": {
        "MSSQL_HOST": "localhost",
        "MSSQL_PORT": "1433",
        "MSSQL_USER": "mcp_dml",
        "MSSQL_PASSWORD": "your_password",
        "MSSQL_DATABASE": "your_database",
        "MSSQL_LOCK_CONNECTION": "true"
      }
    }
  }
}

3. Full access (DDL)

Use only when schema changes are required. Prefer a dedicated low-privilege admin user, not sysadmin.

{
  "mcpServers": {
    "mssql-full": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "mcp-mssql-secure", "--access-mode", "full"],
      "env": {
        "MSSQL_HOST": "localhost",
        "MSSQL_PORT": "1433",
        "MSSQL_USER": "mcp_admin",
        "MSSQL_PASSWORD": "your_password",
        "MSSQL_DATABASE": "your_database",
        "MSSQL_LOCK_CONNECTION": "true"
      }
    }
  }
}

You can register multiple MCP entries (e.g. mssql-readonly and mssql-dml) and enable only the one you need per project.

Available tools

`query`

Read-only T-SQL. Supports @p1, @p2 placeholders and MySQL-style ? aliases.

use_mcp_tool({
  server_name: "mssql-readonly",
  tool_name: "query",
  arguments: {
    sql: "SELECT * FROM users WHERE id = @p1",
    params: [1]
  }
});

`execute` (dml and full modes only)

Mutating T-SQL. In dml mode: INSERT, UPDATE, DELETE, MERGE only. In full mode: DML and DDL.

use_mcp_tool({
  server_name: "mssql-dml",
  tool_name: "execute",
  arguments: {
    sql: "UPDATE users SET active = @p1 WHERE id = @p2",
    params: [true, 1]
  }
});

Returns { "rowsAffected": [N] }.

`list_schemas`, `list_tables`, `describe_table`

Schema introspection (all modes). Default schema is dbo.

`list_programmable_objects`, `describe_programmable_object`

Read-only introspection for stored procedures, functions, views, and triggers (all modes). Does not execute objects — EXEC remains blocked.

list_programmable_objects — discover objects in a schema:

Param	Default	Values
`schema`	`dbo`	Schema name
`object_type`	`all`	`procedure`, `function`, `view`, `trigger`, `all`

Returns object names and types. Triggers include parent_schema and parent_object.

describe_programmable_object — full T-SQL definition and metadata:

Param	Required	Default
`name`	yes	—
`schema`	no	`dbo`
`object_type`	no	auto-detect

Returns definition, parameters (procedures/functions), parent_object (triggers), and timestamps. If definition is null, a definition_note explains that the object may be encrypted or the user lacks VIEW DEFINITION permission.

use_mcp_tool({
  server_name: "mssql-readonly",
  tool_name: "describe_programmable_object",
  arguments: {
    schema: "dbo",
    name: "usp_GetOrders",
    object_type: "procedure"
  }
});

`connect_db`

Optional runtime connection when MSSQL_LOCK_CONNECTION=false and env vars are not set. Disabled by default when using env-based config.

SQL Server role examples

Read-only user:

CREATE LOGIN mcp_readonly WITH PASSWORD = '...';
CREATE USER mcp_readonly FOR LOGIN mcp_readonly;
ALTER ROLE db_datareader ADD MEMBER mcp_readonly;
GRANT VIEW DEFINITION TO mcp_readonly;
-- or schema-scoped:
-- GRANT VIEW DEFINITION ON SCHEMA::dbo TO mcp_readonly;

VIEW DEFINITION is required to read stored procedure, function, view, and trigger source via describe_programmable_object. Without it, listing still works but definitions may be null.

DML user (add write role, no DDL):

CREATE LOGIN mcp_dml WITH PASSWORD = '...';
CREATE USER mcp_dml FOR LOGIN mcp_dml;
ALTER ROLE db_datareader ADD MEMBER mcp_dml;
ALTER ROLE db_datawriter ADD MEMBER mcp_dml;

Admin user (migrations / DDL): grant db_ddladmin or schema-scoped ALTER permissions. Avoid sysadmin.

CREATE LOGIN mcp_admin WITH PASSWORD = '...';
CREATE USER mcp_admin FOR LOGIN mcp_admin;
ALTER ROLE db_datareader ADD MEMBER mcp_admin;
ALTER ROLE db_datawriter ADD MEMBER mcp_admin;
ALTER ROLE db_ddladmin ADD MEMBER mcp_admin;

Security

Parameterized queries for user-supplied values
Single-statement enforcement (no ;-chained batches or GO separators)
Statement-type validation per access mode
Blocks EXEC, DBCC, BACKUP, RESTORE, BULK, OPENROWSET, and other dangerous T-SQL (use describe_programmable_object to read procedure/function definitions instead)
Runtime connect_db disabled when connection is env-locked
Credentials via environment variables (not chat arguments)

Limitations: validation is keyword-based, not a full T-SQL parser. Edge cases like WITH ... INSERT or SELECT INTO may be misclassified. Use least-privilege DB users and non-production databases when possible.

Unlike PostgreSQL, SQL Server has no equivalent of SET default_transaction_read_only = on. Read-only mode relies on application validation and database user permissions.

Error handling

The server returns clear errors for:

Invalid or disallowed SQL for the current access mode
Multiple statements or GO batch separators in one request
Connection failures
Missing or mismatched parameters
Disabled tools (execute in readonly, connect_db when locked)

License

MIT

Sibling project: mcp-postgres-secure — same security model for PostgreSQL.

Available Tools

7 tools

connect_dbD

Disabled when MSSQL_LOCK_CONNECTION=true (use environment variables instead)

ParametersJSON Schema

Name	Required	Description
`host`	Yes	Database host
`port`	No	Database port (default: 1433)
`user`	Yes	Database user
`encrypt`	No	Enable TLS encryption (default: true)
`database`	Yes	Database name
`password`	Yes	Database password
`trustServerCertificate`	No	Trust self-signed server certificate (default: false)

TDQS

D1.4/5.0

Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry full behavioral transparency. It only mentions a lock condition and does not disclose what the tool does, what happens upon connection, or any side effects. This is a severe gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, but it is under-specified rather than concise. It omits essential purpose and usage information, so the brevity is not effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters, no output schema, and no annotations, the description should explain behavioral context and parameters. It only provides a disabled condition, leaving the agent without enough information to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 7 parameters have descriptions in the schema. The tool description adds no parameter information, but the schema already provides the baseline meaning, earning a 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description does not state what the tool does. It only says 'Disabled when MSSQL_LOCK_CONNECTION=true' which is a conditional state, not a purpose. No verb or resource is mentioned, so the agent cannot infer that this tool connects to a database.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool or how it relates to sibling tools like query or list_tables. The only hint is to use environment variables when disabled, but that is a configuration fallback, not a usage guideline for the tool itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_programmable_objectA

Get full T-SQL definition and parameters for a stored procedure, function, view, or trigger (read-only; does not execute)

ParametersJSON Schema

Name	Required	Description
`name`	Yes	Object name
`schema`	No	Schema name (default: dbo)
`object_type`	No	Optional filter: procedure, function, view, or trigger (auto-detected if omitted)

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of exposing behavior. It explicitly discloses that the operation is read-only and does not execute, which are critical safety-related behavioral traits. It does not mention error behavior or required permissions, but the core non-destructive nature is clearly stated, and the claim that it returns 'full definition and parameters' conveys the primary output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action and resource, then adds the read-only caveat. Every phrase earns its place—no redundant words, and it avoids restating the tool name or schema details. Excellent conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description must convey what the tool returns, and 'full T-SQL definition and parameters' does that adequately. It also includes the object types and the read-only behavior. The only minor gap is not specifying the return format (e.g., plain text vs. structured JSON), but given the simple parameter set and clear focus, the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for all three parameters, including defaults and optional behavior (auto-detection for object_type). The description text adds the list of supported object types but does not elaborate on parameter syntax or relationships beyond the schema. Since schema coverage is 100%, the baseline of 3 is appropriate; the description adds minimal extra semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Get full T-SQL definition and parameters') and the target resource ('stored procedure, function, view, or trigger'). This distinguishes it from sibling tools like list_programmable_objects (which lists objects) and describe_table (which describes table structure), making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly distinguishes when to use this tool by noting it is read-only and does not execute, which sets it apart from query. It also lists the applicable object types, giving clear context. However, it does not explicitly name alternatives or state 'use this when you need the definition, not to run it,' so the guidance is clear but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_tableC

Get table structure

ParametersJSON Schema

Name	Required	Description	Default
`table`	Yes	Table name
`schema`	No	Schema name (default: dbo)

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. 'Get table structure' implies a read-only operation but does not specify what 'structure' includes (columns, types, constraints, indexes), nor any potential error behavior or access requirements. This is a significant gap for a schema-inspection tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no unnecessary words. It is efficient for the purpose, though it could include more behavioral detail without being overly verbose. The brevity is acceptable but not exceptional.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is too incomplete. It fails to explain what 'structure' entails or how the result relates to sibling tools. For a tool that likely returns detailed schema information, this minimal description leaves the agent under-informed about expected output and capabilities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for both parameters (table and schema), including a default for schema. The description adds no extra meaning beyond the schema, so the baseline of 3 is appropriate. It does not explain parameter formatting or relationships beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Get table structure' uses a specific verb and resource, clearly indicating the tool retrieves schema information for a table. It distinguishes reasonably from siblings like 'query' (data) and 'list_tables' (names only), though it doesn't explicitly contrast with 'describe_programmable_object'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. It does not mention prerequisites (e.g., connect_db first), nor does it contrast with list_tables or describe_programmable_object. Users must infer usage from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_programmable_objectsA

List stored procedures, functions, views, and triggers (read-only metadata)

ParametersJSON Schema

Name	Required	Description	Default
`schema`	No	Schema name (default: dbo)
`object_type`	No	Filter by object type: procedure, function, view, trigger, or all (default: all)

TDQS

A3.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the read-only and metadata nature, which gives a basic safety signal. However, it does not mention potential result set size, whether it returns names only or full definitions, or any behavior regarding missing schemas or filters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of eight words, front-loaded with the key verb and object. Every word earns its place, and there is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with only two optional parameters and no output schema. The description covers the core purpose but does not describe return value shape or any behavioral constraints beyond 'metadata'. For a listing tool, this is adequate but leaves room for more detail about what the result actually contains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the schema already explains both parameters (schema with default dbo, object_type with allowed values). The description adds no extra meaning about parameters, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists stored procedures, functions, views, and triggers, with an explicit read-only metadata qualifier. It distinguishes itself from sibling tools like list_tables (which lists tables) and describe_programmable_object (which targets a single object).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage context is implied by the description—agents can infer it is for enumerating programmable objects—but there is no explicit guidance about when to use this tool versus alternatives, nor any exclusionary conditions. No mention of list_tables or describe_programmable_object as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_schemasA

List all schemas in the database

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. The verb 'List' indicates a read-only operation, but the description does not disclose permissions, return format, or any potential side effects. It is minimally adequate but lacks extra behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no filler. Every word earns its place, and it is front-loaded with the action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is largely complete. It clearly states the tool lists all schemas in the database, which is sufficient for an agent to understand the tool's scope, though it does not mention details like whether system schemas are included.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters, the schema already fully covers parameter semantics. The baseline of 4 applies, and the description adds no unnecessary parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('all schemas in the database'), making the tool's purpose clear. It also implicitly distinguishes from siblings like list_tables (tables vs schemas) and describe_programmable_object.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no guidance on when to use this tool versus alternatives such as list_tables or describe_table. It only states what the tool does, leaving the agent to infer usage context without explicit comparisons or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesC

List tables in the database

ParametersJSON Schema

Name	Required	Description	Default
`schema`	No	Schema name (default: dbo)

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the basic function but does not reveal important details like schema filtering behavior, whether system tables are included, or the output format. This is a significant gap for a tool that could interact with various database states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that directly states the purpose without wasted words. It is front-loaded and efficiently communicates the tool's core function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite being a simple tool, the description lacks completeness given the absence of an output schema and annotations. It does not explain what is returned (e.g., table names only, metadata), how the schema parameter affects results, or any behavior beyond the bare listing. This is insufficient for an agent to predict the tool's direct response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional parameter 'schema' is already fully documented in the input schema (100% coverage), including its default value 'dbo'. The description adds no additional meaning beyond the schema, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'List tables in the database.' This is a specific verb+resource combination that distinguishes it from siblings like list_schemas or describe_table, though it does not explicitly differentiate edge cases (e.g., list_programmable_objects).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. It does not mention exclusion criteria, prerequisites, or relationships to sibling tools such as describe_table or query, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryA

Execute a read-only SQL query (SELECT, WITH, EXPLAIN, TABLE, VALUES)

ParametersJSON Schema

Name	Required	Description	Default
`sql`	Yes	Read-only SQL query (use @p1, @p2, etc. or ? for parameters)
`params`	No	Query parameters (optional)

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the read-only nature and allowed SQL commands, which is valuable safety information. However, it does not mention return format, error behavior, or permission requirements, preventing a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the verb 'Execute', and every word adds value. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with full schema coverage and no output schema, the description covers the essential behavioral constraints (read-only, allowed statements) but omits any mention of the result shape or pagination. This is a minor gap given the tool's low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already describes the sql parameter as a read-only query with placeholder syntax. The description adds no new parameter semantics beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes a read-only SQL query and enumerates supported statement types (SELECT, WITH, EXPLAIN, TABLE, VALUES), making its purpose specific and distinct from siblings that list/describe database metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for running SQL queries but does not explicitly state when to prefer it over sibling tools or exclude non-read-only statements. It lacks explicit comparative guidance, though the read-only constraint gives some direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

7 tool updatesv0.2.0Aug 3, 2026
- First observedconnect_db
- First observeddescribe_programmable_object
- First observeddescribe_table
- First observedlist_programmable_objects
- First observedlist_schemas
- First observedlist_tables
- First observedquery

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

B3.3/5.0

Disambiguation5/5

Each tool serves a distinct purpose: query for ad-hoc read-only SQL, list_tables and list_schemas for enumeration, describe_table for table structure, and programmable-object tools for stored procedures/functions/views/triggers. No overlapping boundaries that would confuse an agent.

Naming Consistency5/5

Tool names follow a clear verb_noun pattern: list_* for enumeration, describe_* for metadata, and query/connect_db as simple verbs. Consistent snake_case throughout.

Tool Count5/5

Seven tools is a well-scoped size for a read-only database exploration server, covering querying, listing, and describing without unnecessary bloat or missing essentials.

Completeness5/5

The surface fully covers read-only database exploration: execute queries, discover tables/schemas/programmable objects, and inspect their definitions. No obvious dead ends for typical inspection workflows.

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Google Big Query A
com.googleapis.bigquery
The BigQuery remote MCP server is a fully managed service that uses the Model Context Protocol to connect AI applications and LLMs to BigQuery data sources. It provides secure, standardized tools for AI agents to list datasets and tables, retrieve schemas, generate and execute SQL queries through natural language, and analyze data—enabling direct access to enterprise analytics data without requiring manual SQL coding.
Databases Cloud Platforms Search
63
Studex MCP ServerOAuth
io.github.itshivams
Model Context Protocol server for Studex tools, notifications, and profile integrations
Developer Tools
1
mcp COAuth
com.wix
A Model Context Protocol server for Wix AI tools
Developer Tools Content Management Systems App Automation
216
thoughtsOAuth
ai.thoughtbox.api
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Cloud Storage Finance
2

Related MCP Servers

MSSQL MCP Server
Databases Developer Tools
knight0zh
A
license
B
quality
D
maintenance
A Model Context Protocol server that enables executing SQL queries and managing connections with Microsoft SQL Server databases.
Updated a year ago (2025-03-10 01:46 UTC)
1
3,338
6
MIT
sql-mcp
Databases Developer Tools
NakiriYuuzu
A
license
Not graded
quality
C
maintenance
A Model Context Protocol server for interacting with MSSQL and PostgreSQL databases, offering tools for schema exploration and SQL execution. It features configurable query modes for safety and supports advanced authentication methods like Windows Auth and SSL.
Updated 4 months ago (2026-04-23 00:25 UTC)
17
MIT
MSSQL MCP Reader
Databases Developer Tools
ConnorBritain
A
license
A
quality
C
maintenance
Read-only Model Context Protocol server for Microsoft SQL Server, enabling safe schema discovery, profiling, and querying with zero risk of data modification.
Updated a month ago (2026-08-04 21:36 UTC)
14
839
8
MIT
MSSQL MCP Server
Databases RAG Systems
mortada7-11
F
license
Not graded
quality
D
maintenance
A Model Context Protocol server that exposes SQL Server metadata and read-only query execution as a structured HTTP API, with safety validation and allowlist policy enforcement.
Updated 4 months ago (2026-05-21 09:31 UTC)
1
-

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/pugltd/mcp-mssql-secure'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

MCP MSSQL Secure

Access modes

Installation

From npm

From source

Configuration

Azure SQL vs on-prem

1. Read-only (recommended default)

2. Read + DML

3. Full access (DDL)

Available tools

query

execute (dml and full modes only)

list_schemas, list_tables, describe_table

list_programmable_objects, describe_programmable_object

connect_db

SQL Server role examples

Security

Error handling

License

Related

Available Tools

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

`query`

`execute` (dml and full modes only)

`list_schemas`, `list_tables`, `describe_table`

`list_programmable_objects`, `describe_programmable_object`

`connect_db`