Handing a model a free-text SQL tool means every value it looked up gets concatenated into a string, which is exactly the pattern parameterisation exists to prevent. Supporting a typed parameter list gives the model somewhere correct to put those values. Pair it with schema discovery — list the tables, describe the one you need — and the SQL it writes is grounded in your actual columns rather than a guess.
A SQL Server client for assistants with one feature most minimal database servers skip: parameterised queries. You pass the SQL with placeholders and a typed parameter list, rather than having the model splice values into a string. It runs over stdio or HTTP and logs to files in either mode.
- `execute_sql_query` runs a query, optionally with a typed `parameters` array of name, type and value
- `list_tables` lists every table in the connected database
- `describe_table` returns the schema for a named table
- Stdio and HTTP transport modes from the same server
- Logging split into `error.log` and `combined.log`, with console output in HTTP mode
Node.js with ES module support and a reachable MS SQL Server instance. `npm install` locally or `npm install -g mcp-mssql-server` (package `mcp-mssql-server`, version 1.0.1), then a `.env` with `DB_SERVER`, `DB_USER`, `DB_PASSWORD` and `DB_DATABASE_NAME`. `npm start` gives stdio; `npm run start:http` gives HTTP. Queries execute as the configured user, so a read-only login is what keeps `execute_sql_query` a lookup rather than a write path.
One command plus a key — npm install -g mcp-mssql-server, then supply credentials