AlibabaCloud DMS MCP Server

AI-Era Data Security Access Gateway ｜Intelligent Data Query Engine｜Supports 40+ Data Sources

Core Features

Secure Access

• Account and Password Security Management：Safely manage database account passwords without manual maintenance, effectively preventing sensitive information leakage.
• Intranet Access Support：Enables database access through an internal network, keeping data within the premises and significantly enhancing data security and privacy protection.
• Fine-grained Permission Control：Supports instance, database, table, field, and row-level access control, precisely restricting caller permissions to prevent unauthorized operations and ensure data security.
• High-risk SQL Identification and Blocking: Built-in rich rule engine that identifies and blocks potential high-risk SQL in real time to mitigate security risks.
• SQL Audit Trail: Records all SQL operation logs, supporting full traceability and compliance audits to meet regulatory requirements.

Intelligent Data Inquiry

• Built-in NL2SQL Algorithm: Based on natural language input questions, it intelligently matches data tables, understands business semantics within tables, generates and executes SQL queries, and quickly obtains results.
• Personalized Knowledge Base: Built-in metadata and knowledge base for data inquiry, supports custom business knowledge and query patterns to build tailored intelligent data inquiry capabilities aligned with business scenarios.

Multi-data Source Support

• Wide Range of Data Source Support: Supports over 40 mainstream databases/data warehouses, enabling unified access and integration from multiple sources.
• Unified Management Across Environments: Supports centralized management of database instances across development, testing, and production environments to improve operational efficiency.
• Seamless Integration Across Platforms: Covers major cloud platforms such as Alibaba Cloud and AWS, as well as self-built databases/data warehouses, effectively reducing maintenance costs.

Supported Ecosystem

• Supports all Alibaba Cloud data sources: RDS, PolarDB, ADB series, Lindorm series, TableStore series, Maxcompute series.
• Supports mainstream databases/data warehouses: MySQL, MariaDB, PostgreSQL, Oracle, SQLServer, Redis, MongoDB, StarRocks, Clickhouse, SelectDB, DB2, OceanBase, Gauss, BigQuery, etc.

Core Architecture

Tool List

Supported Data Sources

Contact us

For any questions or suggestions, join the Alibaba Cloud DMS MCP Group (DingTalk Group ID: 129600002740) .

Security

Network Binding

This MCP Server only binds to 127.0.0.1 (localhost). It does not support remote network access. All connections must originate from the local machine. This design ensures that even if the server is accidentally started, it will not be exposed to the network.

SQL Execution Disclaimer

IMPORTANT: This tool is designed to provide full SQL execution capabilities, including SELECT, INSERT, UPDATE, DELETE, and DDL statements.

By using this MCP Server, you acknowledge and accept the following:

1. You are solely responsible for ensuring that the AK/SK (AccessKey) used has appropriate, minimal permissions configured in Alibaba Cloud RAM.
2. It is strongly recommended to enable DMS Safe Hosting Mode for your database instances, which provides built-in SQL review, risk identification, and approval workflows.
3. The maintainers of this project are not responsible for any data loss, corruption, or security incidents resulting from SQL execution through this tool.
4. Best practices:
   • Use read-only AK/SK for query-only scenarios
   • Enable DMS fine-grained permission control
   • Enable SQL audit logging for compliance
   • Regularly review and rotate access credentials

Security Design

• No command injection risk: The codebase does not use subprocess, os.system, eval(), or exec(). All operations are performed through the Alibaba Cloud SDK.
• No SSRF risk: All network requests are sent to a fixed Alibaba Cloud endpoint (dms-enterprise.cn-hangzhou.aliyuncs.com) via the SDK. No user-controlled URLs are fetched.
• Input validation: Search interfaces validate input length and reject potentially dangerous SQL patterns to prevent injection through non-SQL-execution interfaces.

License

This project is licensed under the Apache 2.0 License.

Agent Skills (Independent of MCP)

In addition to the MCP Server, this project also hosts AI Agent skills for DMS Enterprise. These skills enable any AI agent (Codex, ChatGPT, Cursor, etc.) to manage DMS resources directly via OpenAPI — no MCP protocol required.

Quick Start (Skills)

1. Read the skill definition:
   skills/database/dms/alicloud-database-dms-enterprise/SKILL.md

2. Discover available APIs:

   Copy

   python3 skills/database/dms/alicloud-database-dms-enterprise/scripts/list_openapi_meta_apis.py

3. Configure AccessKey:

   Copy

   export ALICLOUD_ACCESS_KEY_ID="your-ak"
   export ALICLOUD_ACCESS_KEY_SECRET="your-sk"
   export ALICLOUD_REGION_ID="cn-hangzhou"

Skill Capabilities

Prompt Examples

See skills/examples/prompts/ for DMS scenario-based prompt templates:

• Instance management & resource query
• SQL execution & audit
• Permission & security management
• Task orchestration & data changes
• API discovery & metadata

Skill Index

For agent-specific guidelines, see AGENTS.md.

Usage Methods

DMS MCP Server currently supports two usage modes.

Mode One: Multi-instance Mode

• Supports adding instances to DMS, allowing access to multiple database instances.
• Suitable for scenarios where managing and accessing multiple database instances is required.

Scenario Example:

You are a company DBA who needs to manage and access various types of database instances (e.g., MySQL, Oracle, PostgreSQL) in production, test, and development environments. With DMS MCP Server, you can achieve unified access and centralized management of these heterogeneous databases.

Typical Question Examples:

• Which of my instances are in the production environment?
• Get a list of all databases named test.
• Retrieve details of the test_db database from the myHost:myPort instance.
• What tables are in the test_db database?
• Use a tool to query data from the test_db database and answer: "What is today's user traffic?"

Mode Two: Single Database Mode

• Directly specify the target database by configuring the CONNECTION_STRING parameter in the server (format: dbName@host:port).
• Suitable for scenarios that focus on accessing a single database.

Scenario Example 1:

You are a developer who frequently accesses a fixed database (e.g., mydb@192.168.1.100:3306) for development and testing. Set the CONNECTION_STRING parameter in the DMS MCP Server configuration as follows:

CONNECTION_STRING = mydb@192.168.1.100:3306

Afterward, every time the service starts, the DMS MCP Server will directly access this specified database without needing to switch instances.

Typical Question Examples:

• What tables do I have?
• Show the field structure of the test_table table.
• Retrieve the first 20 rows from the test_table table.
• Use a tool to answer: "What is today's user traffic?"

Scenario Example 2:

You are a data analyst at an e-commerce company, needing to frequently query and analyze business data such as orders, users, and products. The company's core business database is located at ecommerce@10.20.30.40:3306.

Configure the following parameters in DMS MCP Server:

CONNECTION_STRING = ecommerce@10.20.30.40:3306

Simply ask questions in natural language, and DMS MCP will parse the question into SQL and return the results.

Typical Question Examples:

• What is the total number of orders today?
• How are the order counts ranked by province?
• What is the number of new users each day over the past 7 days?
• Which product category has the highest sales revenue?

Prerequisites

• uv is installed
• Python 3.10+ is installed
• An AK/SK or STS Token with access rights to Alibaba Cloud DMS(AliyunDMSFullAccess).Add permission operations, see Authorization Management.

Pre-configuration

Before accessing a database instance via DMS, you must first add the instance to DMS.

There are two methods to add an instance:

Method One: Use the addInstance tool provided by DMS MCP to add an instance
The DMS MCP Server provides the addInstance tool for quickly adding an instance to DMS.
For more details, see the description of the addInstance tool in the "Tool List."

Method Two: Add an instance via the DMS console

1. Log in to the DMS Console.
2. On the home page of the console, click the Add Instance icon in the database instance area on the left.
3. On the Add Instance page, enter the instance information (e.g., instance address, port, username, password).
4. Click Submit to complete the instance addition.

Getting Started

Option 1: Run from Source Code

Download the Code

git clone https://github.com/aliyun/alibabacloud-dms-mcp-server.git

Configure MCP Client

Add the following content to the configuration file:

Multi-instance Mode

{
  "mcpServers": {
    "dms-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/alibabacloud-dms-mcp-server/src/alibabacloud_dms_mcp_server",
        "run",
        "server.py"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "access_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "access_key",
        "ALIBABA_CLOUD_SECURITY_TOKEN": "sts_security_token optional, required when using STS Token"
      }
    }
  }
}

Single Database Mode

{
  "mcpServers": {
    "dms-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/alibabacloud-dms-mcp-server/src/alibabacloud_dms_mcp_server",
        "run",
        "server.py"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "access_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "access_key",
        "ALIBABA_CLOUD_SECURITY_TOKEN": "sts_security_token optional, required when using STS Token",
        "CONNECTION_STRING": "dbName@host:port"
      }
    }
  }
}

Option 2: Run via PyPI Package

Multi-instance Mode

{
  "mcpServers": {
    "dms-mcp-server": {
      "command": "uvx",
      "args": [
        "alibabacloud-dms-mcp-server@latest"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "access_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "access_key",
        "ALIBABA_CLOUD_SECURITY_TOKEN": "sts_security_token optional, required when using STS Token"
      }
    }
  }
}

Single Database Mode

{
  "mcpServers": {
    "dms-mcp-server": {
      "command": "uvx",
      "args": [
        "alibabacloud-dms-mcp-server@latest"
      ],
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "access_id",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "access_key",
        "ALIBABA_CLOUD_SECURITY_TOKEN": "sts_security_token optional, required when using STS Token",
        "CONNECTION_STRING": "dbName@host:port"
      }
    }
  }
}