The project says it plainly: `readOnlyHint` and `destructiveHint` only change how a client asks you, and security is enforced entirely by the credentials in your connection string. Create a dedicated SQL Server login with the narrowest grants the work needs — SELECT-only if the model should never write — and point the server at that instead of an administrative account.
A Python MCP server for Microsoft SQL Server with three tools, each carrying MCP annotations so a client knows which are safe to auto-approve and which should prompt.
- `list_tables` — every table in the configured database, annotated read-only and idempotent
- `query_sql` — read-only SELECT queries, annotated read-only and idempotent
- `execute_sql` — any statement, SELECT through INSERT, UPDATE, DELETE and DDL, annotated destructive
- Identifier validation against SQL injection, and query logging you can audit
- Stdio by default, or Streamable HTTP by setting `MCP_TRANSPORT`
Install with `pip install mssql-mcp-server`. `MSSQL_DATABASE` is required; then either `MSSQL_USER` and `MSSQL_PASSWORD`, or `Trusted_Connection=yes` for Windows and Kerberos auth. `MSSQL_HOST` (or `MSSQL_SERVER`) and `MSSQL_DRIVER` default to localhost and the built-in Windows driver — on Linux and macOS install Microsoft ODBC Driver 18 and name it in `MSSQL_DRIVER`.
One command plus a key — pip install mssql-mcp-server, then supply credentials