The tool list is small; the defaults are the point. Nothing writes until a flag is set, and INSERT, UPDATE and DELETE each have their own, so you can permit inserts without permitting deletes. With a timeout and a row cap in front of every query, an agent exploring an unfamiliar schema cannot pull a million rows into the conversation by accident. The grants on the database user are still the real boundary; these flags are a second one you control from the client config.
A small server over a MariaDB or MySQL connection: list the databases the user can see, list a database's tables, describe a table's schema, and run a SQL statement — with writes disabled unless you enable them explicitly.
- list_databases returns every database the configured user can reach on the server
- list_tables lists the tables in a named database
- describe_table returns the schema of one table
- execute_query runs a SQL statement against a database
- Read-only by default — INSERT, UPDATE and DELETE each need their own environment flag before they are accepted
- Statements are validated before execution, so disallowed ones are refused rather than attempted
- A query timeout and a maximum row count bound every call, at 10000 milliseconds and 1000 rows unless you change them
- Insert IDs and BIGINT values from the driver are handled numerically rather than losing precision on the way back
Published as mariadb-mcp-server and launched over stdio with npx, or installed globally. Connection details come from the environment: MARIADB_HOST, MARIADB_PORT — 3306 by default — MARIADB_USER, MARIADB_PASSWORD, and an optional MARIADB_DATABASE as the default. Writes are opt-in per statement class through MARIADB_ALLOW_INSERT, MARIADB_ALLOW_UPDATE and MARIADB_ALLOW_DELETE, and MARIADB_TIMEOUT_MS and MARIADB_ROW_LIMIT set the per-query bounds.
One command plus a key — npx mariadb-mcp-server, then supply credentials