Nothing about a database lives in your MCP config: you authenticate first, hand a DSN to add_connection, and the connection becomes a named resource the agent reuses across sessions. That same design is what makes the comparison tools work — cross_db_query runs one statement against two to four registered connections, so staging against production or one region against another is a single call. Read-only rests on SQL guards plus session read-only mode where the engine supports it, with a per-connection firewall for tables you want out of reach; treat both as complements to a least-privilege database user rather than a replacement for one.
A hosted MCP server at https://data.thinair.co/mcp that gives an agent read-only access to PostgreSQL, MySQL and SQL Server in the same session. The tools are arranged in four tiers, from schema discovery through query execution to anomaly detection, PII scanning and a per-connection query firewall. Databases are registered at runtime with add_connection rather than configured at install time.
- list_connections and describe_schema map what is there: schema, columns, indexes and foreign keys across any registered connection
- query_sql executes a parameterized read-only query, and every tool routes dialect-correct syntax per connection — SELECT TOP 10 on SQL Server, LIMIT elsewhere
- query_history returns recent queries with timing, row counts and status, and find_n_plus_one reads that history to identify N+1 patterns
- data_profile reports distributions, null rates and cardinality for a table; detect_anomalies looks for statistical outliers in row growth, latency and value distributions
- pii_scan checks a table for SSN, email, phone and credit-card patterns
- cross_db_query runs the same query across 2-4 connections, which is how a regional or cross-dialect comparison happens in a single call
- query_firewall holds per-connection rules that deny specific tables or queries, alongside configure_allowlist
- add_connection and remove_connection manage connections during a session, with explain_query, optimize_query, suggest_queries, generate_migration, generate_seed_data, watch_table, saved_queries and impact_analysis filling out the rest
Point a client at https://data.thinair.co/mcp. Claude Desktop, Cursor and Windsurf complete OAuth at first use with no token to paste; clients without OAuth send Authorization: Bearer ta_live_… using a key from data.thinair.co/connect. Database credentials are separate from that: after sign-in you pass a DSN — postgresql://, mysql:// or sqlserver:// — to add_connection, and the connection becomes a tenant-scoped resource reusable across sessions. npx -y @thinairtelematics/data prints a config block for scripts. Read-only is enforced through SQL guards and database-session read-only mode where the engine supports it, and the publisher still recommends least-privilege credentials. MIT.
One command — npx -y @thinairtelematics/data