execute_query
Execute SQL queries on SQL Server databases with parameter support while maintaining security against SQL injection and blocking destructive operations.
Instructions
Executes a SQL query in SQL Server
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| parameters | No | Query parameters (optional) | |
| query | Yes | SQL query to execute |
Implementation Reference
- src/tools/execute-query.ts:7-49 (handler)Core handler function that executes the SQL query using the database pool, sanitizes parameters, validates the query, runs the query, and returns the resultset as JSON or an error message.export async function executeQuery( db: DatabaseConnection, query: string, parameters?: Record<string, unknown> ): Promise<CallToolResult> { try { const pool = db.getPool() const request = pool.request() if (parameters) { const sanitizedParams = sanitizeParameters(parameters) for (const [key, value] of Object.entries(sanitizedParams)) { request.input(key, value) } } if (!validateQuery(query)) { throw new Error('Potentially destructive command blocked.') } const result = await request.query(query) return { content: [ { type: 'text', text: JSON.stringify(result.recordset, null, 2), }, ], } } catch (error) { return { content: [ { type: 'text', text: `Erro: ${error instanceof Error ? error.message : 'Erro desconhecido'}`, }, ], isError: true, } } }
- src/schemas.ts:3-9 (schema)Zod input schema for the execute_query tool, defining 'query' as required string and optional 'parameters' record.export const executeQueryInput = z.object({ query: z.string().describe('SQL query to execute'), parameters: z .record(z.string(), z.union([z.string(), z.number(), z.boolean()])) .optional() .describe('Query parameters (optional)'), })
- src/services/SqlServerMCPService.ts:73-76 (registration)Registers the 'execute_query' handler in the MCP service's toolHandlers Map, parsing args with ExecuteQueryInput type and delegating to the core executeQuery function.handlers.set('execute_query', async (database, args) => { const { query, parameters } = args as ExecuteQueryInput return await executeQuery(database, query, parameters ?? {}) })
- src/tools/index.ts:28-31 (registration)Tool specification registration in toolsList(), providing name, description, and JSON schema for the execute_query tool.name: 'execute_query', description: 'Executes a SQL query in SQL Server', inputSchema: zodToJsonSchema(executeQueryInput), },