Because everything runs through DMS, the credentials stay in DMS, permissions can be scoped to instance, table, column or row, high-risk statements are caught by its rule engine, and every statement lands in an audit log — which is a different proposition from handing a connection string to an assistant. The change-order tools follow from the same idea: routine reads go through executeScript, while anything that should be reviewed becomes an order with a submit-and-approve path rather than a direct write.
Alibaba Cloud's Data Management Service as an access gateway. Queries go through DMS instead of straight to the database, which is what keeps its permission controls, risk rules and audit trail in force; a single connection can reach many instances, or be pinned to one database.
- Instances added to DMS with addInstance, searched with listInstances by database type, environment and keyword, and inspected with getInstance by host and port
- Databases searched by name and read by host, port and schema; listTables finds tables inside a database, and getTableDetailInfo returns a table's schema and index details
- executeScript runs SQL against a database and returns structured results
- generateSql turns a natural-language question into a SELECT query, optionally against a knowledge base of your own business terms
- fixSql takes a failing statement and its error and returns the correction; answerSqlSyntax answers engine-specific syntax questions; optimizeSql analyses a statement's performance
- Change management as tools: createDataChangeOrder raises a change order for SQL that should go through approval, with getOrderInfo, submitOrderApproval and approveOrder covering the rest of the workflow
- Coverage across Alibaba Cloud's own services — RDS, PolarDB, ADB, Lindorm, TableStore, MaxCompute — and mainstream engines including MySQL, PostgreSQL, Oracle, SQL Server, Redis, MongoDB, StarRocks, ClickHouse, DB2 and OceanBase
An Alibaba Cloud account with DMS, and credentials in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET, plus ALIBABA_CLOUD_SECURITY_TOKEN when using an STS token. It is a Python package run through uvx, or from a clone with uv. Two modes: multi-instance by default, or single-database by setting CONNECTION_STRING to dbName@host:port, after which every call goes to that database. The instance's database account and password are held by DMS rather than by you, and DMS's own permission model — down to row and column level — decides what the calls can actually do.
One command plus a key — uvx alibabacloud-dms-mcp-server@latest, then supply credentials