SQL Server MCP Service

SQL Server MCP Service

A secure and robust Model Context Protocol (MCP) service for executing SQL Server queries via MCP protocol. This service provides a safe way to interact with SQL Server databases while preventing destructive operations and SQL injection attacks.

🚀 Features

• 🔒 Secure Query Execution: Built-in protection against SQL injection and destructive operations
• 📊 Schema Discovery: Get table, function, and procedure schemas and database information
• 🛠️ Multiple Tools: 9 specialized tools for different database operations
• ⚡ High Performance: Connection pooling for efficient database operations
• 🔧 TypeScript Support: Full TypeScript implementation with type safety
• 🧪 Comprehensive Testing: Jest-based test suite for reliability

🛠️ Available Tools

1. execute_query

Executes safe SQL queries with parameter support.

Parameters:

• query (string, required): The SQL query to execute
• parameters (object, optional): Query parameters for prepared statements

Example:

2. get_table_schema

Retrieves detailed column information for a specific table.

Parameters:

• tableName (string, required): Name of the table
• schemaName (string, optional): Schema name (default: "dbo")

Example:

3. list_tables

Lists all tables in the database with optional schema filtering.

Parameters:

• schemaName (string, optional): Filter tables by specific schema

Example:

4. get_database_info

Retrieves general database information (name, version, edition, etc.).

Parameters: None

5. list_procedures

Lists all stored procedures in the database, optionally filtered by schema.

Parameters:

• schemaName (string, optional): Filter procedures by schema

Example:

6. list_functions

Lists all functions (scalar and table-valued) in the database, optionally filtered by schema and function type.

Parameters:

• schemaName (string, optional): Filter functions by schema
• functionType (string, optional): 'SCALAR' or 'TABLE'

Example:

7. get_procedure_schema

Gets the schema and parameters of a specific stored procedure.

Parameters:

• procedureName (string, required): Name of the procedure
• schemaName (string, optional): Schema name (default: "dbo")

Example:

8. get_function_schema

Gets the schema and parameters of a specific function.

Parameters:

• functionName (string, required): Name of the function
• schemaName (string, optional): Schema name (default: "dbo")

Example:

9. execute_procedure

Executes a stored procedure with parameters.

Parameters:

• procedureName (string, required): Name of the procedure
• parameters (object, optional): Procedure parameters
• schemaName (string, optional): Schema name (default: "dbo")

Example:

📦 Installation

Prerequisites

• Node.js >= 20.0.0
• SQL Server instance
• pnpm (recommended)

Install Dependencies

⚙️ Configuration

1. Copy Environment Template

2. Configure Environment Variables

Example .env:

🚀 Usage

Start HTTP Server (Recommended)

Build for Production

Running Tests

🔒 Security Features

Query Validation

The service automatically blocks potentially destructive operations:

• ❌ DROP TABLE
• ❌ DELETE FROM
• ❌ TRUNCATE TABLE
• ❌ INSERT INTO
• ❌ UPDATE
• ❌ CREATE TABLE
• ❌ ALTER TABLE
• ❌ Stored procedures (sp_, xp_)
• ❌ SQL injection patterns
• ❌ Comments (--, /* */)

Allowed Operations

• ✅ SELECT queries
• ✅ WITH clauses (CTEs)
• ✅ SHOW commands
• ✅ DESCRIBE commands
• ✅ EXPLAIN commands
• ✅ Safe EXEC/EXECUTE for procedures/functions

Parameter Sanitization

All query and procedure parameters are automatically sanitized to prevent injection attacks.

🧪 Testing

The project includes comprehensive tests for schema validation and core functionality:

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

👨‍💻 Author

Vinicius de Souza Santos

• Email: viniciuskt0@gmail.com
• GitHub: @vini-cius

🙏 Acknowledgments

• Model Context Protocol for the MCP specification
• mssql for SQL Server connectivity
• Zod for runtime type validation

⭐ If this project helps you, please give it a star!