LabscoMCP early access ↗
turkeryildirimMCP SERVER

MySQL Security Filter MCP

Query and change MySQL from an agent — parameterized statements, atomic transactions, schema and database management — with a permanent block on privilege and system commands.

by turkeryildirim ↗Relational SQL DatabasesCommunity

LABSCO SUMMARY

The blocked list is the feature.

GRANT, CREATE USER, SET GLOBAL, FLUSH, SHUTDOWN, replication control, LOAD DATA INFILE and SELECT INTO OUTFILE are refused by the filter under all circumstances, and stacked statements separated by a semicolon are refused too — so the furthest an injected instruction reaches is the data the connection's user can already touch. Destructive DDL is off by default and result sets are capped, which means the first surprise is usually a truncated result rather than a dropped table; add a LIMIT clause or raise MAX_ROWS when that happens.

What it is

A Node MCP server that hands an agent a MySQL connection. It runs SELECT, INSERT, UPDATE and DELETE with ? placeholders, executes multi-statement transactions atomically, manages schemas and databases, and screens every statement against a filter that cannot be bypassed.

What you get

  • Parameterized statements, and multi-statement batches that roll back entirely if any statement fails — execute_query, execute_transaction
  • Schema work: create and alter tables, list tables, describe a table, read detailed column information — create_table, alter_table, show_tables, describe_table, show_columns
  • Database-level work with system databases excluded from listings — list_databases, create_database, drop_database
  • Connection health and server facts: version, character set and collation — ping, get_server_info
  • A database parameter on every tool, so one session can move between databases without reconfiguration
  • Two guards with sensible defaults: drop_table and drop_database error out unless ALLOW_DESTRUCTIVE_DDL=true, and results are capped by MAX_ROWS, default 1000

Requirements

Node.js 20+, a reachable MySQL server, and credentials in MYSQL_HOST, MYSQL_PORT, MYSQL_USER and MYSQL_PASSWORD, with MYSQL_DATABASE and MYSQL_POOL_SIZE optional. Install is a clone plus npm install and npm run build, then pointing the client at dist/index.js — the README also covers a project-scoped .mcp.json and claude mcp add. The recommended posture is a dedicated MySQL user granted SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER and INDEX and nothing else — not SUPER, FILE, RELOAD or GRANT OPTION.

Setup effort

Build from source — git clone https://github.com/turkeryildirim/mysql-mcp

See installation options