mysql_query is the whole surface, which makes the risk profile easy to reason about: what an agent can reach is decided by the account in MYSQL_USER and the database in MYSQL_DB, and there is no write path to disable separately. The cost of that minimalism is that everything else — listing tables, reading column types, checking indexes — has to be expressed as SQL the caller writes, and a wide SELECT comes back with no row cap to stop it.
A MySQL access server with a single tool, mysql_query, which runs read-only SQL against the database named in its configuration.
- SQL as the entire interface: mysql_query takes one sql string and runs it against the connected MySQL database, marked read-only, so anything the database can answer is reachable through the statement itself.
- A target the caller cannot move: host, port, account and database come from configuration rather than from the call, so a query cannot reach a database the server was not started against.
- Schema exploration through the same door: there is no separate describe or list call, so learning the shape of the data means asking for it in SQL like anything else.
A reachable MySQL server and an account on it: MYSQL_HOST, MYSQL_PORT, MYSQL_USER, MYSQL_PASS and MYSQL_DB.
One command plus a key — npx -y @benborla29/mcp-server-mysql, then supply credentials