This is an MCP server that lets AI assistants securely query and manage multiple MySQL/DM8 databases through SQL tools, plus a web admin interface.
Execute single SQL statements (SELECT, SHOW, DESCRIBE, DML/DDL, ad-hoc queries), including cross-database queries via database.table notation.
Switch between configured databases using an alias parameter or a project folder name.
Get schema metadata: column names, data types, nullability, defaults, and comments for a table or all tables.
Fetch small sample rows from a table to understand its data format.
Manage multiple database connections from a browser admin page, with per-alias SSE endpoints for clients.
Use separate read-only and read-write accounts: reads use the read account; writes use the write account after confirmation.
Classify SQL as read/write/delete; delete operations (DELETE/TRUNCATE/DROP) are disabled by default and must be explicitly enabled.
Confirm write/delete operations via MCP elicitation prompts or a chat-token flow with a 6-second cooldown and one-time 5-minute validity.
Optionally skip confirmation for non-delete write operations.
Audit all write attempts (success, rejected, pending) in the admin page and in logs/audit.log.
Support both MySQL and Dameng DM8 databases side by side on the same server.
Deploy as a static single-file Linux executable with bundled start/stop scripts.
Provides tools for securely exploring and interacting with MySQL databases, including listing tables, reading table contents, executing SQL queries, retrieving schema information, sampling table data, and managing multiple database connections.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MySQL MCP Server What tables are in my database?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) implementation for secure interaction with MySQL databases. This server component establishes communication between AI applications (hosts/clients) and MySQL databases, making database exploration and analysis safer and more structured through a controlled interface.
Note: MySQL MCP Server supports both STDIO (standard input/output) and Streamable HTTP (SSE) transport modes. SSE mode is recommended for remote/self-hosted deployments.
Hosted — Fronteir AI runs the server for you; no local setup required.
Local — Smithery installs and runs the server on your own machine.
Related MCP server: mysql-mcp-server
Lists available MySQL tables as resources
Reads table contents
Executes SQL queries with robust error handling
Multi-database mode (optional MYSQL_DATABASE)
SSE/HTTP transport support (MCP_TRANSPORT=sse)
SSH tunnel support
Complete table schema information
Table data sampling
Secure database access via environment variables
Comprehensive logging
pip install mysql-mcp-serverUse Smithery to automatically install MySQL MCP Server for Claude Desktop:
npx -y @smithery/cli install designcomputer/mysql-mcp-server --client claudeclaude mcp add --transport stdio designcomputer-mysql_mcp_server uvx mysql_mcp_serverautohand mcp add mysql env MYSQL_HOST=localhost MYSQL_PORT=3306 MYSQL_USER=your_username MYSQL_PASSWORD=your_password MYSQL_DATABASE=your_database uvx mysql_mcp_serverAdding --scope project after mcp add keeps the registration in the current workspace. See Autohand Code for current CLI details.
Set the following environment variables:
MYSQL_HOST=localhost # 数据库主机
MYSQL_PORT=3306 # 可选：数据库端口（不指定时默认 3306）
MYSQL_USER=your_username
MYSQL_PASSWORD=your_password
MYSQL_DATABASE=your_database # 可选：留空则进入多数据库模式
# 高级配置
MYSQL_SSL_MODE=DISABLED # DISABLED、REQUIRED、VERIFY_CA、VERIFY_IDENTITY
MYSQL_CONNECT_TIMEOUT=10 # 超时时间（秒）
# 连接行为（可选）
MYSQL_SQL_MODE=TRADITIONAL # 连接所应用的 SQL mode（默认：TRADITIONAL）
# 兼容性（可选）
MYSQL_CHARSET=utf8mb4
MYSQL_COLLATION=utf8mb4_unicode_ci
MYSQL_AUTH_PLUGIN= # 例如旧版 MySQL 使用 mysql_native_password
MYSQL_USE_PURE=false # 强制使用纯 Python 连接器（默认：false）
MYSQL_RAISE_ON_WARNINGS=false # 出现 SQL 警告时抛出异常（默认：false）
# SSE 传输（可选）
MCP_TRANSPORT=stdio # stdio 或 sse
MCP_SSE_HOST=0.0.0.0 # 监听所有网卡（Docker/托管部署需要）
PORT=8000 # HTTP 端口（MCP_SSE_PORT 的回退值）
MCP_SSE_ALLOWED_HOSTS= # 逗号分隔的允许 Host 头（默认：localhost:{port},127.0.0.1:{port}）
# SSH 隧道（可选）
MYSQL_SSH_ENABLE=false # 设为 true 启用
MYSQL_SSH_HOST= # SSH 跳板机
MYSQL_SSH_PORT=22 # SSH 端口
MYSQL_SSH_USER= # SSH 用户名
MYSQL_SSH_KEY_PATH= # SSH 私钥路径
MYSQL_SSH_REMOTE_HOST=localhost # 从跳板机视角看的目标主机
MYSQL_SSH_REMOTE_PORT=3306
MYSQL_LOCAL_PORT=3330.env file loadingThe server automatically loads the .env file via python-dotenv at startup. For local use, simply:
cp .env.example .env # 然后填入你的凭据The file is read from the process working directory (and its parent directories), so it works as expected when you start the server yourself from the project directory.
⚠️ Claude Code / Claude Desktop: these hosts start the server from their own working directories, so they cannot find the
.envin your project, and you will seeMissing required database configuration. Put theMYSQL_*values in theenvblock of your MCP configuration (see "Usage" below) instead of relying on.env.
When MYSQL_DATABASE is not set, the server enters multi-database mode:
list_resources returns all user databases (system databases are filtered out)
Use fully qualified table names in SQL queries, such as mydb.mytable
Note: only single SQL statements are supported; multi-statement queries are not (e.g. USE db; SELECT ...).
Start the server in SSE mode and open the built-in admin page to manage multiple database connections, each configurable with independent read/write accounts:
# Windows PowerShell
$env:MCP_TRANSPORT="sse"; $env:MCP_SSE_PORT="8000"; python -m mysql_mcp_server
# Linux/macOS
MCP_TRANSPORT=sse MCP_SSE_PORT=8000 python -m mysql_mcp_serverAdmin page: http://127.0.0.1:8000/admin/ (loopback only — the admin API and page reject non-loopback clients and unknown Host headers; do not place it behind a reverse proxy).
Each alias can be configured:
Field | Purpose |
Connection (host/port/database) | Connection target. Leaving database empty enables multi-database mode. |
Query user (read_user) | Used for SELECT / SHOW / DESCRIBE / EXPLAIN |
Write user (write_user) | Used for DML/DDL after confirmation |
write_policy |
|
allow_delete | Master switch for DELETE / TRUNCATE / DROP (disabled by default) |
Clients connect by alias: http://127.0.0.1:8000/sse?alias=db1
(the default alias is used when alias is omitted). When config/databases.json has no entries, the original MYSQL_* environment variables still work as a backward-compatible single-database fallback (read and write share the same account in this mode).
Note the difference from Multi-database mode above: that mode exposes multiple schemas on a single connection; aliases manage multiple connections, each with independent accounts and a write policy.
How write operations are confirmed: the server classifies each statement into three levels (read / write / delete). Read operations execute directly with the query account; write and delete operations trigger an MCP elicitation dialog showing the full SQL — accepting executes it with the write account, rejecting aborts. When the client does not support elicitation, the fallback behavior follows the alias's write_policy (see table above). All write attempts are recorded in the admin page's audit list (on disk at logs/audit.log).
execute_sqlExecutes arbitrary standard SQL queries.
Arguments: query (string)
Functionality: supports SELECT, SHOW, DESCRIBE and DML (INSERT, UPDATE, DELETE). DML operations are flagged as destructive.
Limitations: only single statements are supported; multi-statement queries are not.
Cross-database: no matter what MYSQL_DATABASE is set to, any database can be queried using the database.table syntax.
get_schema_infoProvides detailed metadata about the database schema.
Arguments: table_name (optional string)
Output: column names, types, nullability, default values, and comments.
Cross-database: pass database.table to query databases other than MYSQL_DATABASE; bare table names use the configured database.
Identifier rules: names may only contain alphanumerics, underscores, and $ (a single dot is allowed as the database.table separator).
get_table_sampleFetches a representative data sample.
Arguments: table_name (string), limit (optional integer, max 20)
Purpose: quickly understand data format and content without pulling large result sets.
Cross-database: pass database.table to sample databases other than MYSQL_DATABASE; bare table names use the configured database.
Identifier rules: names may only contain alphanumerics, underscores, and $ (a single dot is allowed as the database.table separator).
In addition to tools, the server also provides MCP prompts — guided multi-step workflows that clients can launch on demand. They appear as slash commands in Claude Code (/mcp__<server>__<prompt>); in Claude Desktop they are in the prompts (+) menu.
Prompt | Arguments | Description |
| (none) | Systematically explore the database: discover available tables, inspect table schemas, sample data, and summarize contents. |
|
| Deep-dive analysis of a specified table: get its schema, sample data, and practical query suggestions. Supports |
Example (Claude Code):
/mcp__mysql__explore_database
/mcp__mysql__analyze_table customersBoth prompts orchestrate the existing get_schema_info and get_table_sample tools; explore_database also uses the resource list to enumerate tables.
Add the following to claude_desktop_config.json:
{
"mcpServers": {
"mysql": {
"command": "uv",
"args": [
"--directory",
"path/to/mysql_mcp_server",
"run",
"mysql_mcp_server"
],
"env": {
"MYSQL_HOST": "localhost",
"MYSQL_PORT": "3306",
"MYSQL_USER": "your_username",
"MYSQL_PASSWORD": "your_password",
"MYSQL_DATABASE": "your_database"
}
}
}
}See MCP_USECASES.md for more detailed examples and agent-specific guides.
Add the following to mcp.json:
{
"mcpServers": {
"mysql": {
"type": "stdio",
"command": "uvx",
"args": [
"--from",
"mysql-mcp-server",
"mysql_mcp_server"
],
"env": {
"MYSQL_HOST": "localhost",
"MYSQL_PORT": "3306",
"MYSQL_USER": "your_username",
"MYSQL_PASSWORD": "your_password",
"MYSQL_DATABASE": "your_database"
}
}
}
}Note: uv must be installed first.
MySQL MCP Server is not designed to run standalone or to be launched directly from the Python command line, but you can debug it using MCP Inspector.
MCP Inspector provides a convenient way to test and debug MCP implementations:
# 安装依赖
pip install -r requirements.txt
# 使用 MCP Inspector 调试（不要直接用 Python 运行）MySQL MCP Server is designed to be integrated into AI applications such as Claude Desktop and should not be run directly as a standalone Python program.
# 克隆仓库
git clone https://github.com/designcomputer/mysql_mcp_server.git
cd mysql_mcp_server
# 创建虚拟环境
python -m venv venv
source venv/bin/activate # Windows 上用 `venv\Scripts\activate`
# 安装开发依赖
pip install -r requirements-dev.txt
# 复制示例配置并填入你的凭据
cp .env.example .env
# 编辑 .env，填入 MySQL 连接信息
# 运行测试
pytestIdentifier validation: table and database names passed to get_schema_info and get_table_sample undergo strict whitelist validation (only alphanumerics, underscores, and $ are allowed; one dot is allowed as the database.table separator). All other special characters are rejected to prevent SQL injection.
Encrypted access: full support for SSL/TLS and SSH tunnels to secure remote connections.
Log privacy: passwords and SSH private keys are automatically redacted from server logs.
Least privilege: always use dedicated MySQL users with minimal permissions.
SSE transport has no built-in authentication. The SSE server binds to 0.0.0.0 by default and accepts connections without credentials. If exposed beyond localhost, place it behind a reverse proxy that enforces authentication (nginx, Caddy, Traefik). nginx + HTTP Basic Auth example:
location /sse {
auth_basic "MCP";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_buffering off;
}
location /messages/ {
auth_basic "MCP";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
}Set MCP_SSE_HOST=127.0.0.1 to make the server listen only on the loopback address, making the proxy the only public entry point. Set MCP_SSE_ALLOWED_HOSTS to the public hostname forwarded by the proxy (for example MCP_SSE_ALLOWED_HOSTS=myserver.example.com:443).
See SECURITY.md for a complete guide to secure deployment.
This MCP implementation requires database access to function. To stay secure:
Create a dedicated MySQL user and grant minimal permissions
Never use root credentials or administrator accounts
Restrict database access to necessary operations
Enable logging for auditing
Regularly review database access for security
See the MySQL Security Configuration Guide for detailed instructions, including:
Creating restricted MySQL users
Setting appropriate permissions
Monitoring database access
Security best practices
⚠️ Important: always follow the principle of least privilege when configuring database access.
MIT License - see the LICENSE file for details.
Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push the branch (git push origin feature/amazing-feature)
Open a Pull Request
Execute a SQL statement against the MySQL server. Use for SELECT, DML (INSERT/UPDATE/DELETE), SHOW, DESCRIBE, and ad-hoc queries. Supports cross-database queries using database.table notation. Single statements only — use fully qualified names instead of USE statements. Write/delete statements require user confirmation: depending on the client, either a confirmation prompt appears, or the first call returns a confirm_token — show the SQL to the user, and after explicit consent re-call with the same query plus confirm_token. Use the optional alias parameter to target a different configured database within a single connection.
| Name | Required | Description | Default |
|---|---|---|---|
| alias | No | 数据库别名，或管理页面 /admin 中为该库配置的项目名称（项目文件夹名）。在单个 SSE 连接内通过此参数切换不同库；省略时用连接 URL ?alias 指定的别名或默认别名。建议优先传当前项目文件夹名自动匹配对应数据库。 | |
| query | Yes | The SQL statement to execute. Single statements only. | |
| confirm_token | No | One-time confirmation token returned by a previous write attempt. Pass it with the SAME query after the user explicitly approved the SQL. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations mark this as destructive, and the description substantially expands on this by detailing the confirmation workflow: a prompt appears, or a confirm_token is returned and must be re-sent with the same query after explicit user consent. It also discloses single-statement-only behavior and cross-database support, going well beyond the annotation flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-structured, front-loading the main purpose, then constraints, confirmation flow, and alias behavior. Every clause contributes essential information without redundancy, and its length is justified by the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive SQL tool with no output schema, this description covers all critical operational aspects: statement types, single-statement enforcement, cross-db notation, the confirmation protocol, and alias usage. The only gap is return-format details, but that is standard SQL client behavior and not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all parameters, so the baseline is 3. The description adds meaningful semantics for confirm_token (one-time token from a prior write attempt, pass with the same query after approval) and alias (switch database within a single connection), enriching the raw schema definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as executing SQL statements against a MySQL server and enumerates supported statement types (SELECT, DML, SHOW, DESCRIBE, ad-hoc queries). It is distinct from sibling inspection tools by its general-purpose scope, though it does not explicitly name or contrast them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides direct usage guidance by enumerating applicable statement types and imposing constraints: single statements only, fully qualified names instead of USE statements, and confirmation for writes/deletes. It does not explicitly discuss when to prefer sibling tools like get_schema_info, but the implied distinction is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get column metadata for a table or all tables in the configured database: column names, data types, nullability, default values, and comments. Call this before querying an unfamiliar table. Omit table_name to see all tables at once. Accepts bare table names (uses MYSQL_DATABASE) or database.table for cross-database lookups. Use alias to target a different configured database.
| Name | Required | Description | Default |
|---|---|---|---|
| alias | No | 数据库别名，或管理页面 /admin 中为该库配置的项目名称（项目文件夹名）。在单个 SSE 连接内通过此参数切换不同库；省略时用连接 URL ?alias 指定的别名或默认别名。建议优先传当前项目文件夹名自动匹配对应数据库。 | |
| table_name | No | Optional: bare table name, or database.table for a cross-database lookup. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds behavioral context: it can return metadata for all tables when table_name is omitted, accepts database.table for cross-database lookups, and uses bare names with MYSQL_DATABASE, plus alias switching behavior. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core purpose, then provides usage details in logical order. Every sentence contributes useful information without excessive verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, annotations, and full schema coverage, the description is complete enough for an agent to select and invoke it. It covers scoping, naming, and alias switching. Minor gaps like return format are acceptable since no output schema exists and the tool is a read-only metadata lookup.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents both parameters. The description still adds meaning by explaining the semantic effects of omitting table_name, the database.table format, bare-name resolution via MYSQL_DATABASE, and alias behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves column metadata (names, data types, nullability, defaults, comments) for a table or all tables, with a specific resource and verb. It also distinguishes itself from sibling tools by positioning it as the pre-query metadata lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to call this before querying an unfamiliar table, explains how to list all tables, and notes cross-database usage and alias-based targeting. This provides clear contextual guidance on when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch a small sample of rows from a table to understand its data format and content. Use alongside get_schema_info before writing complex queries. Accepts bare table names (uses MYSQL_DATABASE) or database.table for cross-database lookups. Use alias to target a different configured database.
| Name | Required | Description | Default |
|---|---|---|---|
| alias | No | 数据库别名，或管理页面 /admin 中为该库配置的项目名称（项目文件夹名）。在单个 SSE 连接内通过此参数切换不同库；省略时用连接 URL ?alias 指定的别名或默认别名。建议优先传当前项目文件夹名自动匹配对应数据库。 | |
| limit | No | Number of rows to return (default 5, max 20). | |
| table_name | Yes | Table to sample. Use database.table notation for cross-database queries. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds valuable behavioral context: bare table names use MYSQL_DATABASE, database.table enables cross-database lookups, and alias switches the configured database target. It does not describe return shape or sampling order, but these are less critical given the read-only annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences with no filler: purpose, usage timing, table-name syntax, and alias behavior each get one focused sentence. It is front-loaded with the core action and reads efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only sampler with no output schema, the description covers what the tool does, when to use it, how to name tables, and how to override the database target. An agent has enough information to invoke it correctly without needing to infer anything beyond the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description goes beyond the schema by specifying that bare table names resolve to MYSQL_DATABASE and reinforcing how alias targets a different configured database. The limit parameter needs no extra explanation because the schema already documents default and maximum.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific action and resource: 'Fetch a small sample of rows from a table to understand its data format and content.' It also names a companion tool (get_schema_info) and clearly frames this as an exploration tool, which distinguishes it from execute_sql even without an explicit contrast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: 'Use alongside get_schema_info before writing complex queries,' indicating when this tool is appropriate. It does not explicitly state when to prefer execute_sql instead, but the phrase 'before writing complex queries' implies the alternative, so it falls just short of fully explicit exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.4.4execute_sqlget_schema_infoget_table_sampleEach tool has a clear, distinct role: execute_sql for arbitrary SQL, get_schema_info for metadata, and get_table_sample for row previews. Although execute_sql can also run SHOW/SELECT statements, the specialized helper tools are explicitly framed as complementary, not competing.
All tool names follow a consistent verb_noun pattern in snake_case: execute_sql, get_schema_info, get_table_sample. This makes the action and target of each tool predictable.
Three tools is a compact but appropriate scope for a SQL database server: one general execution path plus two focused inspection helpers. Each tool serves a distinct need without redundancy.
The surface covers the core workflow: inspect schema, preview data, and execute arbitrary SQL for reads and writes. Cross-database behavior and user confirmation are handled, and remaining database-level operations can be reached via execute_sql.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Read-only PostgreSQL, MySQL, SQL Server access via MCP — 24 dialect-aware hosted tools.
Paid remote MCP for governed database query review, SQL simulation, approvals, and audits.
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/qq5032449/mysql_mcp_server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server