Labsco
MCP SERVER

SQL Server MCP

by alyiox ↗

Query SQL Server read-only by default — SELECT with parameter binding, catalog metadata, execution-plan analysis — and unlock writes only on a profile you explicitly opt in.

Relational SQL Databases
Summary
Says plainly that its write lock is not a security boundary.

`AllowWrite` defaults to false and the write tool rejects at call time on locked profiles — but the README states outright that this is an application-level guard constraining the server, not the database, and points you at a `db_datareader` login for a real read-only guarantee. That honesty is worth more than the flag. Plan and snapshot resources expire on their own, at 7 days and 1 day, so nothing accumulates.

What it is

A .NET MCP server for Microsoft SQL Server built for safe exploration: metadata discovery, parameterized queries and query analysis, organised around named connection profiles. The query tools enforce SELECT-only with no DML or DDL, and the one tool that can write is rejected unless its profile opts in.

What you get
  • Configured connection profiles listed, so a multi-database setup is discoverable — `list_profiles`
  • Server properties and the live execution limits — timeouts, row caps, guardrails — `get_server_properties`
  • Catalog metadata by kind: databases, schemas, tables and views, procedures and functions — `list_objects`; and one relation or routine in detail with `columns`, `indexes`, `constraints` or `definition` — `get_object`
  • Read-only T-SQL executed with `@paramName` binding, returned as CSV inline (limit 500 rows, hard ceiling 1000) or as a snapshot resource for larger results — `run_query`
  • An execution plan summarised as compact JSON — cost, operators, cardinality, warnings, indexes, waits and stats — with the full XML fetched from `plan_uri` — `analyze_query`
  • Write T-SQL for profiles that set `AllowWrite=true`, returning `rows_affected` and server messages, marked destructive — `run_command`
  • The same data as browsable resources: `mssql://profiles`, `mssql://server-properties`, `mssql://objects`, plus `mssql://plans/{id}` (XML, expires after 7 days) and `mssql://snapshots/{id}` (CSV, expires after 1 day)
Requirements

A SQL Server instance and a connection string in `MCPMSSQL_CONNECTION_STRING`, plus a .NET 8.0 or later runtime — the tool targets `net8.0` and `net10.0`. Install it as a global tool with `dotnet tool install --global Alyio.McpMssql --prerelease` and run `mcp-mssql` over stdio; the published version is 1.2.0. For several databases, use the user-scoped `appsettings.json` under `~/.config/mcp-mssql/`. Tunables are all `MCPMSSQL_`-prefixed environment variables: `MCPMSSQL_QUERY_MAX_ROWS` (default 500, ceiling 1000), `MCPMSSQL_QUERY_COMMAND_TIMEOUT_SECONDS` (default 30), `MCPMSSQL_ALLOW_WRITE` (default false). Azure SQL works through Microsoft Entra authentication modes set in the connection string. MIT licensed.

Setup effort

One command plus a key — dotnet tool install --global Alyio.McpMssql --prerelease, then supply credentials