DBMCP Database MCP Server

Community

Single-binary SQL database MCP server with built-in PII redaction and write-prevention

How to install ↓ Compare GitHub source repository ↗

Category: Database #12 of 58
Stars: ★ 33 Popular
Transport: stdio (local process) · Streamable HTTP
Runtime: Prebuilt binary
Credentials: No credential needed
License: MIT
Last commit: 5 days ago
Tools: 13

67FMRS · C

DBMCP is a well-engineered database MCP server: a single ~7 MB binary covering MySQL/MariaDB, PostgreSQL, and SQLite, read-only by default and backed by AST-level SQL validation, single-statement enforcement, and dangerous-function blocking — a solid security posture. Its standout features are the opt-in 46-type regex PII redaction and fail-closed ONNX NER detection. The tool surface is complete (schema discovery, querying, explain plans, optional writes) with stdio and HTTP transports and cursor pagination. Caveats: redaction is off by default, write mode requires careful risk assessment, and it is a third-party project rather than an official offering from the database vendors.

Strongest · Documentation 17/20 Weakest · Reliability 9/20

Reliability

9/20

Security and permissions

15/20

Maintenance

13/20

Documentation

17/20

Setup experience

13/20

Why each score

Reliability 9/20: The README claims a CI badge, `cargo test --workspace` unit tests, and a Docker-based integration test script (`./tests/run.sh`), plus fairly detailed tool behavior descriptions (listDatabases/listTables/readQuery/writeQuery, pagination via cursor, read-only tool hiding, etc.) that are internally consistent. However, this is a purely static review — no CI run or test suite was actually executed, and no test file contents or CI logs were available to verify these claims, nor could per-backend behavioral differences (e.g., tools unavailable on SQLite) be confirmed beyond the documentation's own assertions. Per the static calibration rule, reliability cannot exceed 12 without verifiable execution evidence, so it is scored 9.
Security and permissions 15/20: Read-only mode is on by default (DB_READ_ONLY=true), and write tools (writeQuery/createDatabase/dropDatabase/dropTable) are only exposed once explicitly disabled; the project claims AST-based SQL validation, single-statement enforcement, dangerous-function detection (LOAD_FILE/INTO OUTFILE/etc.), and identifier validation. HTTP transport defaults to binding on 127.0.0.1 with configurable Origin/Host allowlists; the DB password is marked isSecret and claimed to be excluded from logs; SSL/TLS is supported. This reflects a reasonably least-privilege-oriented design. Deductions: once a user disables read-only mode, irreversible operations like dropDatabase/dropTable are gated only by that single global startup flag, with no per-call confirmation step; the HTTP `/mcp` endpoint relies on Origin/Host allowlists rather than an authentication token, leaving a gap for remote deployments; PII/NER redaction is opt-in and off by default, so the default configuration provides no output redaction. No known CVEs or red-line issues were found in the provided material, so it is scored 15 (solid main safeguards, but missing per-operation confirmation and transport-layer authentication).
Maintenance 13/20: The project is not archived, uses the MIT license, has 30 stars and 9 open issues, and its 0.13.2 version number suggests active pre-1.0 iteration; CI and Release badges in the README imply some continuous integration and release process. However, the provided material gives no way to verify actual commit cadence, issue response times, dependency update frequency, or a dedicated security-disclosure channel (e.g., SECURITY.md), so governance transparency is insufficiently evidenced, yielding a score of 13.
Documentation 17/20: The README is thorough: it covers installation (multiple platform scripts/package managers), quick start (`.mcp.json` examples for both stdio and HTTP transports), layered configuration tables (CLI flag / env var / default), per-tool parameter and pagination/search semantics, a security feature list, test commands, and project structure — well-organized with ample examples. Deductions: there is no dedicated troubleshooting section, and some details (e.g., the specifics of the 46 PII entity types, NER model accuracy/cost trade-offs) are deferred to an external documentation site that could not be verified as part of this review, so it is scored 17.
Setup experience 13/20: One-line install scripts are provided for macOS/Linux/WSL and Windows PowerShell/CMD, along with a Docker image identifier and clear `.mcp.json` examples for both stdio and HTTP transports, giving a concise path into mainstream clients (Claude Desktop/Cursor/Claude Code). However, per the static calibration rule, setup cannot score above 15 without actual execution evidence (e.g., running the install script and completing a real MCP handshake); the trustworthiness and cross-platform consistency of the external install scripts/Docker image also cannot be confirmed statically, so it is scored 13.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessConnects to a database

Best for

Users who need safe, read-only AI access to SQL databases
Teams with data-privacy requirements needing PII redaction
Developers wanting a zero-dependency, single-binary deployment
Environments using multiple database backends

Not for

Users who cannot supply or configure database credentials
Users expecting unrestricted write access without understanding write-mode risks
Users of databases other than MySQL/MariaDB, PostgreSQL, or SQLite

Required permissions

Requires database host, port, username, and password (DB_PASSWORD treated as a secret)
Read-only by default; disabling it lets the AI execute writes, and create/drop databases and tables
SSL/TLS connections require DB_SSL_CA/CERT/KEY certificate paths
Optional NER redaction requires a local ONNX model directory

Risks and side effects

With read-only mode disabled, the AI can modify or delete data directly, including dropDatabase/dropTable
PII redaction is off by default; sensitive data in query results goes to the LLM unredacted unless enabled
Regex redaction is not foolproof, and ML/NER detection depends on model quality; v1 is English-only
HTTP mode may expose database access if allowed-origins/allowed-hosts are misconfigured
EXPLAIN ANALYZE actually executes the query, so beware of side effects and cost

Setup

Before you start

Runtime：Prebuilt binary

DB_BACKEND required Database backend (mysql, mariadb, postgres, sqlite); required.

DB_PASSWORD optionalsecret Database password from your database service; sensitive.

DB_SSL_KEY optionalsecret Path to client key file; sensitive.

Other optional settings (24)

DB_HOST optional Database host, defaults to 127.0.0.1.

DB_PORT optional Database port, backend-dependent default (MySQL 3306, PostgreSQL 5432).

DB_USER optional Database user, backend-dependent default.

DB_NAME optional Database name or SQLite file path.

DB_CHARSET optional Character set, MySQL/MariaDB only.

DB_SSL optional Enable SSL connection, default false.

DB_SSL_CA optional Path to CA certificate file.

DB_SSL_CERT optional Path to client certificate file.

DB_SSL_VERIFY_CERT optional Verify server certificate, default true.

DB_READ_ONLY optional Read-only mode toggle, default true (hides write tools).

DB_MAX_POOL_SIZE optional Maximum connection pool size, default 5.

DB_CONNECTION_TIMEOUT optional Connection timeout in seconds.

DB_QUERY_TIMEOUT optional Query execution timeout in seconds, default 30.

DB_PAGE_SIZE optional Max items per paginated tool response (1-500), default 100.

PII_ENABLE optional Enable PII redaction of query output, default false.

PII_OPERATOR optional PII operator: replace, mask, redact, or hash.

PII_CATEGORIES optional Comma-separated PII categories to detect, e.g. financial,government.

PII_NER_ENABLE optional Enable ML/NER detection (person, location), default false.

PII_NER_MODEL optional Path to NER model directory; required with PII_NER_ENABLE=true.

LOG_LEVEL optional Log level: error, warn, info, debug, trace.

HTTP_HOST optional HTTP bind host, default 127.0.0.1.

HTTP_PORT optional HTTP bind port, default 9001.

HTTP_ALLOWED_ORIGINS optional Allowed CORS origins, comma-separated.

HTTP_ALLOWED_HOSTS optional Allowed Host headers, comma-separated.

macOS/Linux/WSL: run curl -fsSL https://dbmcp.haymon.ai/install.sh | bash; Windows PowerShell: irm https://dbmcp.haymon.ai/install.ps1 | iex; Windows CMD: curl -fsSL https://dbmcp.haymon.ai/install.cmd -o install.cmd && install.cmd && del install.cmd. Also installable via Docker (ghcr.io/haymon-ai/dbmcp), Cargo, and other methods. After installation, add a .mcp. in your project root configuring the dbmcp stdio subcommand with DB_BACKEND, DB_HOST, DB_USER, DB_PASSWORD, DB_NAME, etc. For HTTP mode, start the server yourself (e.g. dbmcp http ...) and point the client at http://127.0.0.1:9001/mcp with "type": "http".

claude_desktop_config.json

{"mcpServers":{"dbmcp":{"command":"dbmcp","args":["stdio"],"env":{"DB_BACKEND":"mysql","DB_HOST":"127.0.0.1","DB_PORT":"3306","DB_USER":"root","DB_PASSWORD":"secret","DB_NAME":"mydb"}}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "dbmcp": {
      "command": "dbmcp",
      "args": [
        "stdio"
      ],
      "env": {
        "DB_BACKEND": "mysql",
        "DB_HOST": "127.0.0.1",
        "DB_PORT": "3306",
        "DB_USER": "root",
        "DB_PASSWORD": "secret",
        "DB_NAME": "mydb"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add dbmcp -e DB_BACKEND=mysql -e DB_HOST=127.0.0.1 -e DB_PORT=3306 -e DB_USER=root -e DB_PASSWORD=secret -e DB_NAME=mydb -- dbmcp stdio

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Check that tools like listTables and readQuery appear in your MCP client's tool list; asking "list the available databases" and getting a result confirms the connection works.

Troubleshooting

Confirm a subcommand (stdio or http) is given; running with no subcommand exits with an error
Check that DB_BACKEND is one of mysql, mariadb, postgres, or sqlite
Verify database host, port (3306 for MySQL, 5432 for PostgreSQL), and credentials
If write tools are missing, check whether DB_READ_ONLY is still the default true
For HTTP failures, check host/port (default 127.0.0.1:9001) and allowed-origins/allowed-hosts settings
When enabling NER, ensure the model directory contains config., tokenizer., model.onnx; unloadable models abort startup
Debug stdio mode with npx @modelcontextprotocol/inspector, or test the HTTP endpoint with curl

Things to try

Once connected, you can ask your AI assistant things like:

List the databases available on my MySQL server
Show me the tables in the mydb database
Run a read-only query: SELECT * FROM users LIMIT 10
Explain the execution plan for SELECT * FROM orders WHERE user_id = 5

Tools 13

listDatabases read-only

Lists accessible databases, paginated via cursor/nextCursor; not available for SQLite.

listTables read-only

Lists tables in a database with optional search and detailed mode (schema, columns, constraints, indexes, triggers metadata), paginated.

listViews read-only

Lists views in a database with optional search and detailed per-backend metadata, paginated.

listTriggers read-only

Lists user-defined table triggers (excluding internal constraint/foreign-key triggers), with search and detailed mode, paginated.

listFunctions read-only

Lists user-defined SQL functions (MySQL/MariaDB and PostgreSQL), with search and detailed mode, paginated.

listProcedures read-only

Lists user-defined stored procedures (MySQL/MariaDB and PostgreSQL 11+), with search and detailed mode, paginated.

listMaterializedViews read-only

Lists materialized views in the public schema (PostgreSQL only), with search and detailed mode, paginated.

readQuery read-only

Executes a read-only SQL query (SELECT, SHOW, DESCRIBE, USE, EXPLAIN) with enforced SQL validation; SELECT results paginate via cursor.

Show 5 more tools

writeQuery writes

Executes a write SQL query (INSERT, UPDATE, DELETE, CREATE, ALTER, DROP); only available when read-only mode is disabled.

createDatabase writes

Creates a database if it doesn't exist; only when read-only mode is disabled; not available for SQLite.

dropDatabase destructive

Drops an existing database (refuses to drop the currently connected one); only when read-only mode is disabled; not available for SQLite.

dropTable destructive

Drops a table from a database; PostgreSQL supports a cascade parameter; only when read-only mode is disabled.

explainQuery read-only

Returns the execution plan for a SQL query, with optional analyze for actual execution statistics (PostgreSQL/MySQL); in read-only mode, EXPLAIN ANALYZE is restricted to read-only statements.

Use cases

Safely let AI assistants explore schema and data in production or dev databases read-only

Unified querying and analysis across MySQL, PostgreSQL, and SQLite

Automatically redact PII in query output before it reaches an LLM

Analyze slow queries with explainQuery execution plans

Supported clients

Claude Desktop

Cursor

Claude Code

Listed from the project's documentation, not tested by this site.

Overview

DBMCP (ai.haymon/dbmcp) is an open-source (MIT-licensed) database MCP server maintained by haymon-ai, supporting MySQL/MariaDB, PostgreSQL, and SQLite. It ships as a ~7 MB single binary with no Python/Node/Docker runtime dependencies, and offers stdio and HTTP (streamable-http) transports. It runs in read-only mode by default (write tools hidden), with opt-in regex-based PII redaction (46 built-in entity types across 7 categories) and optional ONNX Runtime ML/NER detection (persons, locations, etc.). Connections support SSL/TLS, connection pooling, and query timeouts.

Similar servers

MCP ClickHouse 79 · B

Connect ClickHouse to your AI assistants

★ 889 · Tools 4 Compare with this →

ChEMBL MCP Server 75 · B

Unofficial MCP server providing advanced access to the ChEMBL chemical database

★ 89 · Tools 27 Compare with this →

MCP Toolbox for Databases 74 · B

Google's official database MCP toolbox — define AI-accessible database tools via config

★ 16.7k Compare with this →

DBHub 74 · B

Bytebase's official, minimalist two-tool database MCP server

★ 3.7k · Tools 2 Compare with this →

Compare with other MCP servers

Source revision a1ccacb271a5 Data synced 2026-10-19 Read the FMRS scoring method