Labsco
MCP SERVER

MySQL

by benborla ↗

Let an agent inspect schemas and query MySQL — read-only by default, with writes opt-in one operation at a time.

Relational SQL Databases✓ Verified
Summary
Questions get answered from the database, and what it may change is a decision you make once.

Instead of pasting a table into the conversation, the model writes the query and reads the rows back. Writes are not a single on switch — insert, update, delete and DDL are separate flags, and they can be set per database, so a development schema can be writable while production stays read-only on the same connection.

What it is

A MySQL server with one tool and one resource: `mysql_query` runs SQL, and `mysql://tables` lists the tables and their column metadata. Everything else is configuration — what it may write, which databases it can reach, how the connection is secured, and what gets masked on the way out.

What you get
  • SQL run against the configured MySQL database, returning rows (`mysql_query`)
  • Tables and their column metadata listed as a resource, so a schema question does not need a query (`mysql://tables`)
  • Read-only by default: `ALLOW_INSERT_OPERATION`, `ALLOW_UPDATE_OPERATION`, `ALLOW_DELETE_OPERATION` and `ALLOW_DDL_OPERATION` each turn on one class of write and nothing else
  • Per-database overrides on all four, so development can write while production stays readable — and a multi-DB mode that queries across databases without reconnecting, with writes off across all of them by default
  • PII redaction that masks sensitive columns in results, with extra column names and regex patterns you supply, and `SELECT *` refused while it is on unless you allow it
  • Guardrails on cost as well as risk: `MYSQL_RATE_LIMIT` at 100 queries a minute, `MYSQL_MAX_QUERY_COMPLEXITY`, a 30000 ms query timeout and a 10-connection pool, all adjustable
  • SSL and TLS with an mTLS option, a Unix socket path instead of host and port, a connection string for rotating credentials, an SSH tunnel for remote databases, and a remote HTTP mode behind a bearer token
Requirements

Node.js v20 or newer, MySQL 5.7 or newer with 8.0 recommended, and a MySQL user with the privileges you intend to use. `npx @benborla29/mcp-server-mysql` with `MYSQL_HOST`, `MYSQL_PORT`, `MYSQL_USER`, `MYSQL_PASS` and `MYSQL_DB` set — omit `MYSQL_DB` for multi-DB mode. Every write class is off until you turn it on, and the read-only transaction enforcement behind them has its own disable flag that is worth leaving alone. Grant the database user only what the flags allow, so the two limits agree.

Setup effort

One command plus a key — npm install -g @benborla29/mcp-server-mysql, then supply credentials