Database MCP
A single-binary MCP server for MySQL, MariaDB, PostgreSQL and SQLite: read-only by default, with optional PII redaction
- 33 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The server holds the database password and reads working data, so personal data can reach the responses
- With read-only mode off, the agent writes data and drops databases and tables
Install
- Works in
Manual install
curl -fsSL https://dbmcp.haymon.ai/install.sh | bashInstall for macOS, Linux and WSL; Windows has PowerShell and CMD scripts, and the documentation covers Docker and Cargo.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The server holds the database password and reads working data, so personal data can reach the responses
- With read-only mode off, the agent writes data and drops databases and tables
This is third-party code. Review the repository files before installing.
What it does
Database MCP connects an agent to a MySQL, MariaDB, PostgreSQL or SQLite database. The server is a Rust build in a single file of about 7 MB, with no Python, Node or Docker needed. Tools fall into three groups: schema overview (listDatabases, listTables, listViews, listTriggers, listFunctions, listProcedures, listMaterializedViews), queries (readQuery, writeQuery, explainQuery) and structure changes (createDatabase, dropDatabase, dropTable). Read-only mode is on by default: write tools are hidden from the agent, and readQuery checks a query against a SQL parse, allows one statement and blocks dangerous functions such as LOAD_FILE and INTO OUTFILE. MySQL, MariaDB and PostgreSQL can be reached through an SSH bastion with a built-in client. PII redaction in responses is off by default. When on, it detects 46 entity types in seven categories, from email addresses and card numbers to JWTs and keys, and replaces, masks, drops or hashes what it finds. An optional NER model adds names, places and organizations. Settings come from DBMCP_* variables, an env file or YAML.
Who it is for. Developers and analysts who want to give an agent read access to a working database while keeping control over writes and personal data.
Good fit when
- An agent studies the schema of an unfamiliar PostgreSQL database and finds tables by name pattern
- A slow query is checked through explainQuery with an execution plan
- A local SQLite file is explored without installing Python or drivers
- A production selection goes to the model with emails, phones and cards masked
- A database behind an SSH bastion is read from Claude Code without manual port forwarding
Not a fit when
- An agent has to change data in a working database without human review
- You need a different database type: the server knows MySQL, MariaDB, PostgreSQL and SQLite
- You need name redaction in Russian: the NER model in version 1 targets English
- You plan to expose the server to a network without a token: on a non-loopback bind it refuses to start
Example request
List the tables in the orders database with user in the name and describe the columns of the users table.MCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
DBMCP_DB_BACKENDrequired- Database type: mysql, postgres or sqlite.
DBMCP_DB_HOST- Database server address.
DBMCP_DB_USER- Database user.
DBMCP_DB_PASSWORDsecret- Database user password.
DBMCP_DB_NAME- Database name or SQLite file path.
DBMCP_DB_READ_ONLY- Read-only mode, true by default.
DBMCP_HTTP_AUTH_TOKENsecret- Token for the HTTP transport, required on a non-loopback bind.
Limitations
Turning off read-only mode enables writeQuery and the tools that create and drop databases and tables. The password sits in the client's environment variables. Regex-based PII redaction does not guarantee that everything is found, and the NER model targets English text. The SSH tunnel works with MySQL, MariaDB and PostgreSQL but not with SQLite. Installation runs a script from a link, which is worth reading before you run it.
How to disable. Remove the dbmcp entry from .mcp.json or run claude mcp remove dbmcp. The binary is deleted like any file, and the server creates no background services.
FAQ
How do I install Database MCP?
On macOS, Linux and WSL run curl -fsSL https://dbmcp.haymon.ai/install.sh | bash. Windows has PowerShell and CMD scripts, and Docker and Cargo are described in the documentation at dbmcp.haymon.ai.
Can the agent change data?
Not by default: DBMCP_DB_READ_ONLY is on and the write tools are hidden. Turning it off exposes writeQuery, createDatabase, dropDatabase and dropTable.
How do I turn on PII redaction?
Set DBMCP_PII_ENABLE and pick an operator in DBMCP_PII_OPERATOR: replace, mask, redact or hash. Narrow the categories with DBMCP_PII_CATEGORIES, for example financial,government.
How do I connect over HTTP instead of stdio?
Start with DBMCP_TRANSPORT=http and set type http with the address in the client, http://127.0.0.1:9001/mcp by default. A non-loopback address needs the DBMCP_HTTP_AUTH_TOKEN token.
How is Database MCP different from DBHub?
Database MCP is written in Rust, installs as one binary, can redact PII and reach a database through an SSH bastion. DBHub also supports SQL Server and saves tokens on tool descriptions.
Discussion
No questions or reviews yet.
Related
MCP serversOne MCP server for SQLite, SQL Server, PostgreSQL and MySQL: read and change data, edit schemas and export to CSV and JSON
A Python MCP server for MySQL: listing tables, reading data, running SQL and inspecting schema through a controlled interface
MCP server that gives an agent access to MySQL: schema inspection and queries, read-only by default, writes behind flags
MySQL MCP Server Pro
mysql_mcp_server_pro
A MySQL MCP server that runs SQL under access roles, finds tables by comments and analyzes locks, indexes and query plans
A token-lean MCP server for PostgreSQL, MySQL, MariaDB, SQL Server and SQLite with a read-only mode
DB MCP Server
db-mcp-server
An MCP server for several databases with protection: a read-only mode per database and a row limit. Written in Go, launched in Docker
README in short
The README covers installation, a quick start through .mcp.json, environment variables and layered configuration with a fixed precedence: process, env files, YAML, defaults. Separate sections cover the tools, the security model and the crate layout.