MCP SERVERReach databases through Alibaba Cloud DMS rather than directly — fine-grained permissions, high-risk SQL blocking and audit logs stay in the path, and natural-language questions become SQL.
LABSCO SUMMARY
Because everything runs through DMS, the credentials stay in DMS, permissions can be scoped to instance, table, column or row, high-risk statements are caught by its rule engine, and every statement lands in an audit log — which is a different proposition from handing a connection string to an assistant. The change-order tools follow from the same idea: routine reads go through executeScript, while anything that should be reviewed becomes an order with a submit-and-approve path rather than a direct write.
Alibaba Cloud's Data Management Service as an access gateway. Queries go through DMS instead of straight to the database, which is what keeps its permission controls, risk rules and audit trail in force; a single connection can reach many instances, or be pinned to one database.
An Alibaba Cloud account with DMS, and credentials in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET, plus ALIBABA_CLOUD_SECURITY_TOKEN when using an STS token. It is a Python package run through uvx, or from a clone with uv. Two modes: multi-instance by default, or single-database by setting CONNECTION_STRING to <YOUR_DB_NAME>@<YOUR_DB_HOST>:<YOUR_DB_PORT>, after which every call goes to that database. The instance's database account and password are held by DMS rather than by you, and DMS's own permission model — down to row and column level — decides what the calls can actually do.
One command plus a key — uvx alibabacloud-dms-mcp-server@latest, then supply credentials
USE CASES
DMS holds the account; the question runs through it under the permissions that account is scoped to, and the statement is logged.
Turn the question into a SELECT against the right database, with your own knowledge base guiding table and column choice, then run it.
List the instances by environment and engine, find the database you mean, and read what tables it holds.
Send the statement and the error back for a correction, and ask the syntax question directly when the engine's dialect is the problem.
Raise it as a change order rather than executing it, submit it for approval, and approve or reject through the workflow.
Have the statement analysed for performance, then check the table's schema and indexes to see whether the plan has anything to work with.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
addInstanceAdd an instance to DMS. The username and password are required. Only Aliyun instances are supported. Either instance_resource_id or host and port must be provided. The region is optional, but it's recommended to include it.If the instance already exists, it will return the existing instance information.
answerSqlSyntaxAnswer syntax-related questions for the corresponding database engine based on the database ID.If you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
approveOrderApprove or reject an order in DMS. The workflow_instance_id can be obtained from getOrderInfo.
createDataChangeOrderExecute SQL changes through a data change order, and a corresponding order ID will be returned. Prefer using the executeScript tool for SQL execution;only use this tool when explicitly instructed to perform the operation via a order.If you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
executeScriptExecute SQL script against a database in DMS and return structured results.If you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
fixSqlAnalyze and fix the SQL error based on the provided SQL statement, error message, and database ID.If you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
generateSqlGenerate SELECT-type SQL queries from natural language input.
getDatabaseObtain detailed information about a specific database in DMS when the host and port are provided.
getInstanceRetrieve detailed instance information from DMS using the host and port.
getOrderInfoRetrieve order information from DMS using the order ID.
getTableDetailInfoRetrieve detailed metadata information about a specific database table including schema and index details. If you don't know the table_guid parameter, retrieve it using listTables.
listInstancesSearch for instances from DMS.
listTablesSearch for tables by databaseId and (optional) table name. If you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
optimizeSqlAnalyze and optimize SQL performance based on the provided SQL statement and database IDIf you don't know the databaseId, first use getDatabase or searchDatabase to retrieve it. (1) If you have the exact host, port, and database name, use getDatabase. (2) If you only know the database name, use searchDatabase. (3) If you don't know any information, ask the user to provide the necessary details. Note: searchDatabase may return multiple databases. In this case, let the user choose which one to use.
searchDatabaseSearch databases in DMS by name.
submitOrderApprovalSubmit the order for approval in DMS using the order ID.
BEFORE YOU INSTALL
16 tools when we connected; the project documents 17. askDatabase works only in Single Database Mode and generateSql only in Multi-instance Mode, so no single connection shows all seventeen.
INSTALLATION
uvx alibabacloud-dms-mcp-server@latestUsing an STS token instead of an AccessKey pair? Add "ALIBABA_CLOUD_SECURITY_TOKEN" with your token to env; otherwise leave it out.
{
"mcpServers": {
"dms-mcp-server": {
"command": "uvx",
"args": [
"alibabacloud-dms-mcp-server@latest"
],
"env": {
"ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_ID>",
"ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
}
}
}
}Using an STS token instead of an AccessKey pair? Add "ALIBABA_CLOUD_SECURITY_TOKEN" with your token to env; otherwise leave it out.
{
"mcpServers": {
"dms-mcp-server": {
"command": "uvx",
"args": [
"alibabacloud-dms-mcp-server@latest"
],
"env": {
"ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_ID>",
"ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_SECRET>",
"CONNECTION_STRING": "<YOUR_DB_NAME>@<YOUR_DB_HOST>:<YOUR_DB_PORT>"
}
}
}
}Using an STS token instead of an AccessKey pair? Add "ALIBABA_CLOUD_SECURITY_TOKEN" with your token to env; otherwise leave it out.
Download the code
git clone https://github.com/aliyun/alibabacloud-dms-mcp-server.gitAdd this to your MCP client. <YOUR_PATH_TO_ALIBABACLOUD_DMS_MCP_SERVER> is the full path of the alibabacloud-dms-mcp-server folder you cloned.
{
"mcpServers": {
"dms-mcp-server": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_ALIBABACLOUD_DMS_MCP_SERVER>/src/alibabacloud_dms_mcp_server",
"run",
"server.py"
],
"env": {
"ALIBABA_CLOUD_ACCESS_KEY_ID": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_ID>",
"ALIBABA_CLOUD_ACCESS_KEY_SECRET": "<YOUR_ALIBABA_CLOUD_ACCESS_KEY_SECRET>"
}
}
}
}MCP servers
spences10
Gcluowenqiang
oualib
quantiio