Summary

Two independent switches, and neither one is the other's shortcut.

`MCP_TOOLSETS` decides which families of tools exist; `ENABLE_SQL_WRITE_TOOLS` decides whether `execute_sql` may do more than read. Enabling the SQL group does not grant writes, and enabling writes does not pull in the administration tools — which means the read-only query setup most people want is the default rather than something to configure. The OpenAPI group includes account creation, whitelist changes and query termination, so turn it on deliberately.

What it is

Alibaba Cloud's MCP server for AnalyticDB for MySQL, split into two tool groups you enable independently. The `sql` group connects to a cluster and runs read-only queries, EXPLAIN and EXPLAIN ANALYZE, and exposes database metadata as resources. The `openapi` group manages clusters, whitelists, accounts and networking and pulls performance, health, diagnostics and audit data through Alibaba Cloud OpenAPI. Read-only tools are annotated so a client can tell them apart from mutating ones.

What you get

SQL executed against a cluster — read-only by default — with EXPLAIN and EXPLAIN ANALYZE for a single SELECT or read-only CTE — `execute_sql`, `get_query_plan`, `get_execution_plan`
Database metadata as read-only resources — `adbmysql:///databases` and `adbmysql:///{database}/tables`
Cluster inventory and networking: clusters in a region, cluster attributes, IP whitelist read and modify, accounts, network connection info and server time — `describe_db_clusters`, `describe_db_cluster_attribute`, `describe_cluster_access_whitelist`, `modify_cluster_access_whitelist`, `describe_accounts`, `describe_cluster_net_info`, `get_current_time`
Diagnostics and monitoring: performance metrics, health status, SQL diagnosis records and execution details, bad-SQL detection, SQL patterns and table statistics — `describe_db_cluster_performance`, `describe_db_cluster_health_status`, `describe_diagnosis_records`, `describe_diagnosis_sql_info`, `describe_bad_sql_detection`, `describe_sql_patterns`, `describe_table_statistics`
Administration and audit: create an account, change the cluster description, storage space summary and SQL audit log records — `create_account`, `modify_db_cluster_description`, `describe_db_cluster_space_summary`, `describe_audit_log_records`
Deeper diagnostics: compute, storage and access node detection, optimisation advice, process termination, resource groups, and schema problems such as excessive primary keys, oversized non-partitioned tables, partitioning issues and data skew — `describe_executor_detection`, `describe_worker_detection`, `describe_controller_detection`, `describe_available_advices`, `kill_process`, `describe_db_resource_group`, `describe_excessive_primary_keys`, `describe_oversize_non_partition_table_infos`, `describe_table_partition_diagnose`, `describe_inclined_tables`

Requirements

Python >= 3.13 and `uv`. An Alibaba Cloud AccessKey is required for the OpenAPI tools; the SQL tools additionally want a direct connection — `ADB_MYSQL_HOST`, `ADB_MYSQL_PORT` (3306 in the example), `ADB_MYSQL_USER`, `ADB_MYSQL_PASSWORD` and optionally `ADB_MYSQL_DATABASE`. If those user credentials are absent but an AccessKey is present, the server creates a temporary database account through OpenAPI, and SQL calls must then carry `region_id` and `db_cluster_id`. `MCP_TOOLSETS` picks the groups — `sql`, `openapi`, or both. Full SQL execution is not a tool group: `execute_sql` is read-only until `ENABLE_SQL_WRITE_TOOLS=true` is set explicitly, which the documentation says to do only for trusted users and clients, with a least-privilege database account. For remote SSE or Streamable HTTP where `SERVER_HOST` is not a loopback address, set `API_KEY` on the server and send `Authorization: Bearer <API_KEY>` from the client.

Setup effort

One command plus a key — npx -y mcp-remote http://your-server-host:8000/sse, then supply credentials