mssql-mcp-server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mssql-mcp-serverShow me the top 10 rows from the Customers table."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mssql-mcp-server
A Model Context Protocol server for Microsoft SQL Server. Requires SQL Server 2017 or later (on-prem) or Azure SQL Database — several catalog queries (e.g. index/constraint/permission listings) use STRING_AGG, which does not exist before SQL Server 2017. Its tool surface — the 18 tool names, their operation values, parameters and output shapes — mirrors @henkey/postgres-mcp-server v1.0.7, the PostgreSQL MCP server many Claude/AI-client users already run, so a client that knows how to drive the Postgres server can drive this one the same way. henkey is AGPL-3.0; parity here is with the interface and behaviour, not the code — everything in this repository is written from scratch and licensed MIT (see LICENSE).
Quick start
npm install
npm run buildThis produces build/index.js, a stdio MCP server. Point an MCP client at it.
Claude Code (.mcp.json or claude mcp add):
{
"mssql-local": {
"type": "stdio",
"command": "node",
"args": [
"/path/to/mssql-mcp-server/build/index.js",
"--connection-string", "Server=localhost,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=true",
"--security-mode", "unsafe", "--allow-destructive"
]
}
}VS Code (mcp.json):
{
"servers": {
"mssql-local": {
"type": "stdio",
"command": "node",
"args": [
"/path/to/mssql-mcp-server/build/index.js",
"--connection-string", "Server=localhost,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=true",
"--security-mode", "unsafe", "--allow-destructive"
]
}
}
}Azure SQL Database, read-only — the default --security-mode is already readonly, so it does not need to be passed explicitly; shown here for clarity:
{
"mssql-azure": {
"type": "stdio",
"command": "node",
"args": [
"/path/to/mssql-mcp-server/build/index.js",
"--connection-string", "Server=<server>.database.windows.net,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=false",
"--security-mode", "readonly"
]
}
}Replace every placeholder (<server>.database.windows.net, MyDb, app, ***) with real values — never commit real credentials.
Connection strings may also be the ADO form shown above or a mssql:// URL (mssql://user:pass@host:1433/db?encrypt=true&trustServerCertificate=true); the server translates URL form itself (the underlying mssql driver only parses the ADO form).
Related MCP server: mcp-server-mssql
Security modes
Every tool call is classified into a risk category and checked against the server's --security-mode (default readonly) before it runs. destructive: true classifications additionally require --allow-destructive regardless of mode.
Mode | Allowed risks |
|
|
|
|
|
|
|
|
arbitrary_sqlalways requires--allow-destructiveas well asunsafe. A raw SQL fragment can contain any statement — awhereof1=1; DROP TABLE dbo.t --on anmssql_execute_mutationupdatereaches the engine as a multi-statement batch — so every classification of riskarbitrary_sqlis marked destructive, whatever produced it:whereonexecute_mutation/export_table_data/copy_between_databases,mssql_manage_queryexplainwithanalyze, a raw columndefaultonmanage_schema, a filtered-indexwhere, acheckExpression, RLS predicates, and function/trigger bodies. In practice--security-mode unsafeon its own now grants nothing beyondadmin;unsafeplus--allow-destructiveis what enables raw SQL.--allow-destructive— permits classifications marked destructive (drop/delete/truncate/revoke/disable/reset-style operations, and everyarbitrary_sqloperation above), on top of whatever the mode already allows. Several argument flags additionally escalate an otherwise non-destructive operation into this category, because each one silently discards or disables something that already exists:replace: trueonmssql_manage_functionscreateand onmssql_manage_triggerscreate(both emitCREATE OR ALTER, overwriting an existing body),replace: trueonmssql_manage_rlscreate_policy(drops and recreates the policy and its predicate functions), andlogin: falseonmssql_manage_usersalter(ALTER LOGIN … DISABLE).--allow-tool-connection-string— permits a tool call to supply its ownconnectionString(or, formssql_copy_between_databases,sourceConnectionString/targetConnectionString) instead of using the server's configured connection.mssql_copy_between_databaseshas no server-string fallback at all — both connection strings are required tool arguments, so the tool cannot be used unless this flag is set.
A denied call returns isError: true with one of two messages, taken verbatim from src/security/policy.ts:
Blocked by MSSQL MCP security policy: <reason>. Current mode "readonly" allows read operations.or, when the mode would allow the risk but the destructive flag is missing:
Blocked by MSSQL MCP security policy: <reason>. Destructive operations require --allow-destructive.Every denial is written to stderr as a single JSON line prefixed [MCP Audit] and, if --audit-file is set, appended to that file:
[MCP Audit] {"event":"mssql_mcp.security","outcome":"denied","reason":"security_policy_denied","toolName":"mssql_execute_sql","operation":null,"securityMode":"readonly","allowDestructive":false,"risk":"arbitrary_sql","destructive":true,"timestamp":"2026-08-26T12:00:00.000Z"}Allowed calls are recorded on the two channels differently, so the file can be a complete record without flooding the client's log:
--audit-fileadditionally records every allowed call whose risk is notread("outcome":"allowed") — everything that could have changed state.stderr carries an allowed call only when
MSSQL_MCP_AUDIT_ALLOWED=true.
MSSQL_MCP_AUDIT_ALLOWED is an environment variable only — there is no corresponding CLI flag. Audit lines never carry tool arguments, only the tool name, operation, mode and classification.
Warning at startup: in --security-mode admin or unsafe without --workspace-dir, the server prints once to stderr
[MCP Warning] File tools are enabled without --workspace-dir; export/import/copy can read and write any path this process can access. Set --workspace-dir to sandbox them.Configuration
Option | Env | Default | Meaning |
|
| — | Server-level connection string (ADO or |
|
|
|
|
|
|
| Permit drop/delete/truncate/revoke/disable/reset operations |
|
|
| Permit |
|
| — | JSON |
|
| — | If set, export/import paths must resolve inside it; relative paths resolve against it |
|
|
| Export/import size cap in bytes |
|
| — | Append JSON audit events to this file |
|
|
| Fallback for every |
|
-cs/-tc are rewritten to --connection-string/--tools-config before argument parsing (Commander v15 rejects multi-character short flags outright); --cs/--tc are additionally registered as ordinary long-form aliases, so -cs, --cs and --connection-string are all equivalent (likewise -tc/--tc/--tools-config).
An invalid --security-mode exits with status 1 and prints:
securityMode must be one of readonly, write, admin, or unsafe.Connection-string precedence (checked in this order): a tool-supplied connectionString (only when --allow-tool-connection-string is set) → --connection-string → MSSQL_CONNECTION_STRING → if none is set:
No connection string provided. Provide one in the tool arguments (requires --allow-tool-connection-string), via the --connection-string CLI option, or set the MSSQL_CONNECTION_STRING environment variable.Tools config: if --tools-config points at a file with an enabledTools array, only those tools are registered; unknown names log [MCP Warning] Tool "<n>" specified in config file but not found in available tools.; calling a known-but-disabled tool returns Error: Tool "<name>" is available but not enabled by the current server configuration.
The allow-list fails closed: a file that cannot be read or is not { "enabledTools": string[] } stops the server rather than quietly enabling every tool, printing one of
[MCP Error] Could not read tools configuration file at <path>: <reason>
[MCP Error] Invalid tools configuration file format at <path>: expected { "enabledTools": string[] }and exiting with status 1 before it serves anything.
Tools
All 18 tools are prefixed mssql_. Full parameter tables (types, defaults, whether each field is required) are generated from the server's own schemas in TOOL_SCHEMAS.md — run npm run docs to regenerate it after changing a tool's inputSchema.
Tool | Summary |
| Run a read-only |
|
|
| Run arbitrary T-SQL, including multi-batch scripts ( |
| Inspect tables, create/alter tables, manage enum-style |
| List, create, drop, rebuild/reorganize, and analyze index usage |
| List, create/drop primary key, unique, check and foreign key constraints |
| List, create, drop scalar/table-valued functions and stored procedures |
| List, create, drop, enable/disable DML triggers |
| Row-Level Security policies backed by generated predicate functions |
| Logins/users, role membership, grant/revoke permissions |
| Object/column descriptions stored as |
| Execution plans, slow-query and statistics reporting, stats reset |
| Configuration, performance and security analysis with recommendations |
| Diagnose connection, performance, lock and replication issues |
| Point-in-time database/table/query/lock/replication metrics and alerts |
| Stream a table (optionally filtered) to a local JSON or CSV file |
| Bulk-load a local JSON or CSV file into a table, inside one transaction |
| Stream rows from a table in one database into the same table in another |
Query execution notes
mssql_execute_queryruns exactly oneSELECT/WITHstatement. T-SQL does not need a;between statements, so a second one can simply be appended to a query —SELECT 1 AS a USE masterran both and left the pooled session inmasterfor every later call. Four rules enforce the single statement. The first three are applied to the query with the contents of string literals, comments and bracketed/quoted identifiers blanked out (so[Set],"Use"and'… use master'are data, not keywords); the fourth is a runtime check. Masking follows the engine's own lexing: a--comment ends at the first carriage return or newline (SELECT 1 AS a --\rUSE masteris not one long comment), block comments nest (/* a /* b */ c */is blanked whole), and the delimiters',",[,]are left in place so a blanked literal cannot be mistaken for "nothing was here":Statement keywords are rejected anywhere in the query:
USE,SET,DECLARE,BEGIN,WHILE,IF,GOTO,RETURN,PRINT,RAISERROR,THROW,COMMIT,ROLLBACK,SAVE,OPEN,CLOSE,DEALLOCATE,RECONFIGURE,CHECKPOINT,BREAK,CONTINUE,DISABLE,ENABLE,RECEIVE,SEND,REVERT,ADD, alongside the data-changing set (INSERT/UPDATE/DELETE/MERGE/INTO/EXEC/DDL/DBCC/WAITFOR/WRITETEXT/UPDATETEXT/READTEXT/SETUSER).Multi-word phrases whose individual words must stay legal on their own:
END CONVERSATION,MOVE CONVERSATION,GET CONVERSATION(a bareENDstill closes aCASE), andNEXT VALUE FOR— the one read-shaped expression that changes persistent state, because it advances aSEQUENCE(FETCH NEXT,(VALUES …),FOR XMLand a column namednext_valueare all unaffected).Structure: exactly one statement
SELECT— the firstSELECTat bracket depth 0 (for aWITHquery, the outer one after the CTE list). Any otherSELECTmust either sit inside brackets (a subquery, derived table, CTE body,EXISTS/IN,APPLY) or directly followUNION/UNION ALL/EXCEPT/INTERSECT. A(at depth 0 that opens a bracketedSELECTis itself only accepted where a subquery belongs — after a set operator,IN/EXISTS/ANY/ALL,FROM/JOIN/APPLY/AS/WHERE/ON, a comparison operator, a comma or another(— soSELECT 1 AS a (SELECT DB_NAME()), which SQL Server runs as two statements, is rejected. Anything that fails these isquery must contain exactly one statement.Result-set count, checked while the query runs. Every streamed path (
select, and thecount/existsfallbacks) refuses the query the moment the engine announces a second result set —query produced more than one result set; only a single SELECT statement is allowed— cancelling the request and returning that error instead of rows. This is what catchesSELECT 1 AS a ((SELECT DB_NAME())), where the smuggledSELECTis bracketed and so indistinguishable, token by token, from the subquery inISNULL((SELECT 1), 0). Precisely: a second SELECT smuggled inside doubled parentheses is refused when the engine announces its result set; if a rowlimitcancels the request before that happens, the smuggled statement may already have started executing server-side — it cannot return rows to the caller and, because the validator rejects every statement keyword and theNEXT VALUE FORconstruct, it cannot change database or session state. (The limit cancels as soon as a row beyond it arrives and the driver announces nothing afterwards; draining the whole first result set so the guard always fires would turn every limited readonly select into a full scan.) Subqueries,IN (SELECT …),EXISTS (SELECT …), CTEs (including recursive ones),CROSS APPLY, derived tables,(VALUES …)with an alias column list,UNION [ALL]/EXCEPT/INTERSECT,CASE … END,OFFSET … FETCH NEXT,WITH (NOLOCK)/WITH TIES,OPENJSON … WITH,GROUPING SETS,FOR XML/FOR JSON,OPTION (RECOMPILE),IIF,DATEADDand columns such asEndDate/BeginDate/Settings/Address/EndConversationall still work. Rules 1–3 are a keyword and structure scan, not a T-SQL parser, and they err towards rejection: an unbracketed column literally namedOpen,Close,SetorUseis rejected — bracket it. Usemssql_execute_sql(unsafe+--allow-destructive) for anything else.
mssql_execute_query'sselectoperation accepts an optionallimit, and defaults to 10000 rows when it is omitted; when the limit is reached the tool cancels the underlying request and returns exactly the rows collected so far. The success message then readsQuery executed successfully. Retrieved <n> rows. Row limit of <limit> reached; more rows may exist.— that second sentence is added only when a row beyond the limit actually arrived, so a result of exactlylimitrows never claims rows were left behind.countandexistsare unaffected (they never materialise rows).mssql_execute_sqlhas no row limit orlimitparameter at all; it returns every row every batch produces.
Export, import and copy
CSV parsing is strict, not lenient. A
"only opens quoted-field mode at the very start of a field; a"appearing elsewhere in an unquoted field is a literal character; a quoted field left open at end-of-file throwsUnterminated quoted field in CSV inputrather than silently merging the rest of the file into one record.mssql_import_table_datarequires a JSON file to contain a top-level array of objects (Input file does not contain an array of recordsotherwise). Two input columns that collapse to the same table column case-insensitively (e.g.Nameandname) are rejected asColumn <c> is specified more than once.timecolumns are coerced from a bareHH:MM:SS[.fff]string by anchoring it to1970-01-01in UTC; a cell that cannot be coerced to its column's type (an unparsable number, date, or hex binary value) is rejected withColumn <c>: cannot coerce "<v>" to <type>instead of reaching the driver as an opaque error or silently loading as NULL/zero.Computed and
rowversion/timestampcolumns are skipped, on bothmssql_import_table_dataandmssql_copy_between_databases: SQL Server refuses a supplied value for them (error 271), so any such column present in the input file or on the source table is dropped from the load and the target engine computes or stamps the value itself. This is silent — it is never reported as a missing or unknown column.Rows without an identity-column value present in the data are loaded through
mssql's bulksql.Tablepath withcheckConstraints: trueandfireTriggers: true— CHECK/FK constraints are enforced and INSERT triggers fire, just as they would for an ordinaryINSERT. Rows whose data does include identity-column values are loaded instead viaSET IDENTITY_INSERT ONand batched multi-rowINSERTstatements.mssql_copy_between_databasesreuses the same loader on the target side.mssql_export_table_datanever damages an existing file. Exporting to a path that already exists is an error —Output file already exists: <path>. Pass overwrite: true to replace it.— unless you passoverwrite: true. Either way rows are streamed into a temp file (<outputPath>.<pid>.<timestamp>.tmp) alongside the target and renamed onto it only once the export completed; if it fails partway (a permission error, a query error mid-stream, or the size cap being hit) only the temp file is removed, so the previous contents are still there and no corrupt/truncated file is left behind.CSV exports neutralise spreadsheet formulas. A string cell whose text starts with
=,+,-,@, a tab or a carriage return, and does not look like a number, is written with a leading'so Excel/Sheets treat it as text rather than evaluating it. Numeric-looking strings (-5,+62812) and real numbers are untouched, andmssql_import_table_datadoes not strip the quote — the exported file is the record.A cell that cannot be coerced on import is reported with at most 40 characters of its value (
Column Qty: cannot coerce "…" to int), so an error message and its[MCP Error]log line never carry a whole cell.File paths for export/import: when
--workspace-diris set, every resolved path must stay inside it (segment-based..and absolute-outside-workspace checks —Path "<path>" is outside the workspace directory.); a size cap from--max-file-bytesapplies to both the source file being read (File exceeds max file size of <n> bytes.) and the file being written (Generated export exceeds max file size of <n> bytes.); only.json/.csvextensions matching the requestedformatare accepted.
PostgreSQL → SQL Server differences
Because the tool surface mirrors a Postgres server, several tools map a Postgres concept onto a different SQL Server mechanism:
Postgres concept | SQL Server equivalent used here |
|
|
Row-level triggers, | SQL Server triggers are statement-level only; |
|
|
Roles |
|
|
|
|
|
|
|
manage_users behaviour notes
dropalways attemptsDROP LOGINfor a login-type user once the databaseUSERhas been dropped, whenever a server login with that name exists — it does not check whether some other database on the instance still maps a user to that login. (Design note: the spec originally described a "no other database user maps to it" check; the shipped behaviour is the simpler unconditional drop, reported and accepted as the code of record.)altermapssuperuser/createroletodb_owner/db_securityadmindatabase-role membership on Azure SQL Database (and to thesysadmin/securityadminserver roles elsewhere), the same mappingcreateuses;createdbhas no Azure SQL Database equivalent and is reported underunsupportedinstead of being applied.
Authentication
Connection strings accept:
SQL authentication:
User Id=...;Password=...(SQL login or Azure AD login with a password).Azure AD:
Authentication=Active Directory Password(withUser Id/Password) orAuthentication=Active Directory Default(uses the ambient Azure identity).NTLM:
Authentication=NTLM;Domain=CORPwithUser Id/Password.Windows integrated authentication (SSPI) is not supported. The underlying driver (
tedious) cannot do it; use a SQL login, NTLM with explicit credentials, or Azure AD instead.
Development
npm test # unit + integration (integration skipped without MSSQL_TEST_CONNECTION_STRING)
npm run test:unit
npm run test:integration
npm run typecheck
npm run docs # regenerate TOOL_SCHEMAS.mdIntegration tests need a local SQL Server instance and a dedicated login. .env.test (gitignored) supplies MSSQL_TEST_CONNECTION_STRING. The login is created once with a generated password (PowerShell, run against localhost\SQLEXPRESS with Windows auth):
$pw = -join ((48..57 + 65..90 + 97..122) | Get-Random -Count 24 | ForEach-Object { [char]$_ }) + 'aZ9!'
sqlcmd -S "localhost\SQLEXPRESS" -E -Q "IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = 'mssql_mcp_test') BEGIN CREATE LOGIN [mssql_mcp_test] WITH PASSWORD = N'$pw', CHECK_POLICY = OFF; ALTER SERVER ROLE [sysadmin] ADD MEMBER [mssql_mcp_test]; END ELSE ALTER LOGIN [mssql_mcp_test] WITH PASSWORD = N'$pw';"
"MSSQL_TEST_CONNECTION_STRING=Server=localhost,1433;Database=master;User Id=mssql_mcp_test;Password=$pw;Encrypt=true;TrustServerCertificate=true" | Set-Content -Encoding utf8 .env.test.env.test is gitignored; never commit or print its contents.
Known limitations
No Windows integrated auth.
OUTPUTon tables with triggers (returningin mutations) fails with SQL Server error 334.ONLINE = ONindex operations need Enterprise/Azure; Express returns an error.count/existson queries withORDER BYbut noTOPfall back to client-side streaming.Query Store statistics require Query Store to be enabled; plan-cache statistics are lost on restart /
DBCC FREEPROCCACHE.rolledBacktransaction count is not exposed by SQL Server DMVs and is alwaysnull.Computed and
rowversion/timestampcolumns are skipped on import and copy (SQL Server error 271 forbids supplying a value for them); the target engine assigns them.Symlinks and junctions inside
--workspace-dirare followed: the sandbox validates the path you pass, not where a link inside the workspace points. Do not place links to sensitive locations in a workspace directory.INSTEAD OFtriggers defined on views are not listed bymssql_manage_triggersgetand cannot be toggled withset_state— both work throughsys.tablesandALTER TABLE … ENABLE|DISABLE TRIGGER.The read-only validator for
mssql_execute_queryis a keyword and structure scan over masked SQL, not a T-SQL parser, and errs on the side of rejection: an unbracketed column namedOpen,Close,Set,Use,Save,SendorReturnis refused — bracket it ([Open]) or alias it. (Addis not affected:ADDis reserved in T-SQL, so it can never be an unbracketed column name.)mssql_export_table_datachecks that the output path does not exist and later renames its temp file onto it; those two steps are not atomic, so a file created by another process in between is replaced. The check guards against overwriting a file that was already there, not against a concurrent writer.Without
--workspace-dir, the file tools inadmin/unsafecan read and write anywhere the server process can reach; you are warned once at startup.Pools created from tool-supplied connection strings are closed after 60 seconds idle (swept every 15 seconds), measured from the last request issued on them and never while a request is in flight; the server's own
--connection-stringpool is never evicted. A call after eviction simply reconnects.
Available Tools
18 toolsmssql_analyze_databaseC
Analyze SQL Server database configuration and performance
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema for table sizes (defaults to dbo) | |
| analysisType | No | Type of analysis to perform | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'Analyze', which implies a read-only investigation, but it does not state whether the tool modifies anything, what it returns, what permissions are needed, or how the optional connection string behaves. The gap between the vague description and the tool's actual behavior is significant.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler, and it front-loads the verb and resource. It is efficient, though arguably too terse to be fully informative on its own.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description needs to explain what the analysis produces, whether it is read-only, and when to prefer it over sibling tools like mssql_monitor_database or mssql_debug_database. It does none of this, and it also omits the 'security' analysis option entirely, leaving the tool incomplete from an agent's perspective.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even though the description adds no parameter-level detail. The schema already documents schema, analysisType, and connectionString, including the enum values and the --allow-tool-connection-string requirement. The description's mention of 'configuration and performance' covers only two of the three enum values and adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Analyze'), a resource ('SQL Server database'), and a scope ('configuration and performance'), so an agent can tell it is an analysis tool. However, it does not distinguish it from sibling tools like mssql_monitor_database or mssql_debug_database, and it omits the 'security' analysis type that appears in the analysisType enum.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool over alternatives such as mssql_monitor_database, mssql_debug_database, or mssql_execute_query. There is no when-to-use, when-not-to-use, or mention of prerequisites like the connection string flag. The available enum values hint at use cases, but the description itself does not provide selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_copy_between_databasesC
Copy data between two SQL Server databases
| Name | Required | Description | Default |
|---|---|---|---|
| where | No | Filter for source rows (WHERE clause without the keyword) | |
| schema | No | Schema name on both sides (defaults to dbo) | |
| batchSize | No | ||
| tableName | Yes | Table name (same on both sides) | |
| truncateTarget | No | TRUNCATE the target table inside the copy transaction first | |
| sourceConnectionString | Yes | Source connection string (requires --allow-tool-connection-string) | |
| targetConnectionString | Yes | Target connection string (requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only says 'Copy data,' which implies a write to the target, but it omits important traits such as transactionality, target table prerequisites, truncateTarget behavior, and the --allow-tool-connection-string requirement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is concise, though it sacrifices useful operational context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 7 parameters, no output schema, and no annotations, the description is too minimal. It does not explain table existence requirements, transaction scope, batching, truncation behavior, or connection string permissions, leaving significant gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 86%, so the schema already documents most parameters. The description adds no parameter-level detail, but the baseline of 3 applies because the schema carries the load; only batchSize lacks a schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Copy data between two SQL Server databases.' This clearly conveys the core operation, though it does not explicitly differentiate itself from sibling tools like mssql_import_table_data or mssql_export_table_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives, nor are any prerequisites or exclusions mentioned. An agent would have to infer usage context from the tool name and schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_debug_databaseC
Debug common SQL Server issues
| Name | Required | Description | Default |
|---|---|---|---|
| issue | Yes | Issue to investigate | |
| logLevel | No | Accepted for compatibility; ignored | info |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior, but 'Debug common SQL Server issues' does not say whether the tool runs read-only diagnostics, changes server state, requires a connection string, or what output to expect. The only behavioral detail is hidden in the schema's logLevel note that it is ignored.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The sentence is short and front-loaded, with no wasted words. However, its brevity is partly under-specification: it skips purpose details, usage context, and behavior while only broadly naming the tool's intent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters, no output schema, and no annotations, the description is incomplete. It does not explain what 'debug' produces, whether side effects are possible, how connection string handling works, or how this differs from the extensive set of sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains 'issue', 'logLevel', and 'connectionString'. The main description adds no parameter semantics beyond the generic 'common SQL Server issues' phrase, yielding the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a verb and resource ('Debug... SQL Server') and the issue enum (connection, performance, locks, replication) suggests scope, but 'common SQL Server issues' is vague and does not distinguish 'debug' from sibling tools like mssql_analyze_database or mssql_monitor_database.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose this tool over the many sibling mssql_* tools. The enum values hint at problem categories, but the description never states conditions for use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_execute_mutationB
Execute data modification operations (INSERT/UPDATE/DELETE/UPSERT) - operation="insert/update/delete/upsert" with table and data. Examples: operation="insert", table="Users", data={"Name":"John","Email":"john@example.com"}
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Data object with column-value pairs (required for insert/update/upsert). Values are always bound as parameters. | |
| table | Yes | Table name for the operation | |
| where | No | WHERE clause for update/delete operations (without WHERE keyword). Use @w1, @w2 (or $1, $2) with whereParameters. | |
| schema | No | Schema name (defaults to dbo) | |
| operation | Yes | Mutation operation: insert (add rows), update (modify rows), delete (remove rows), upsert (insert or update) | |
| returning | No | Columns to return via OUTPUT: "*" or a comma-separated list | |
| conflictColumns | No | Key columns for upsert (MERGE ... ON) | |
| whereParameters | No | Parameter values for @w1, @w2, ... placeholders in the where clause | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure, and it falls short. It restates the operation enum but never warns that DELETE removes rows irreversibly or that UPDATE/DELETE without a WHERE clause could affect an entire table. The only behavioral detail (values bound as parameters, connection-string flag requirement) lives in the schema, not in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence plus one example, with the action verb front-loaded. It is compact and readable with no filler. The pseudo-code example is slightly informal (operation=... data={...} is not valid JSON), but it still earns its place as a quick orientation for the most common call.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a high-complexity tool (9 parameters, 4 operation modes, upsert with conflictColumns, parameterized WHERE placeholders) with no output schema and no annotations, yet the description only illustrates the simplest insert path. It never explains default return behavior without the returning parameter, the where/whereParameters pairing at tool level, or destructive-operation safeguards. The detailed schema compensates partially, but the tool-level description leaves an agent under-informed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with detailed per-parameter text (e.g., where: 'Use @w1, @w2 (or $1, $2) with whereParameters'), so the baseline is 3. The description's example adds a concrete invocation shape for operation+table+data but only demonstrates 3 of 9 parameters, leaving where/returning/conflictColumns to the schema. Net added value over the schema is marginal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Execute data modification operations (INSERT/UPDATE/DELETE/UPSERT)', reinforced by a concrete example (operation="insert", table="Users", data={...}). This clearly conveys scope and sets it apart from read-oriented siblings like mssql_execute_query. However, it never explicitly contrasts with mssql_execute_sql, which could also run DML, so sibling differentiation is implicit rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The worked example implies the invocation pattern: pass operation, table, and data for an insert. But the description gives no explicit guidance on when to prefer this structured tool over the raw mssql_execute_sql sibling, and no exclusion conditions (e.g., use mssql_execute_query for SELECT-only needs). Usage context is inferred from the example, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_execute_queryA
Execute SELECT queries and data retrieval operations - operation="select/count/exists" with query and optional parameters. Examples: operation="select", query="SELECT * FROM Users WHERE CreatedAt > @p1", parameters=["2024-01-01"]
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of rows to return (safety limit; defaults to 10000 for select) | |
| query | Yes | SQL SELECT query to execute | |
| timeout | No | Query timeout in milliseconds | |
| operation | Yes | Query operation: select (fetch rows), count (count rows), exists (check existence) | |
| parameters | No | Parameter values for placeholders (@p1, @p2, ... or $1, $2, ...) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It communicates that this is a read/retrieval tool and shows parameter binding via @p1, which is useful. However, it does not mention default row limits, timeout behavior, or explicit read-only guarantees beyond the word 'SELECT'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence followed by a representative example. Every element earns its place, and the core purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus schema covers the required inputs, operation modes, and example syntax adequately for a query tool. It does not explicitly differentiate from the similar sibling mssql_execute_sql, and there is no output schema, but the missing output information is inherently query-dependent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful value by showing a concrete example with @p1 and clarifying the relationship between operation, query, and parameters, which helps an agent assemble valid calls.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and resource: 'Execute SELECT queries and data retrieval operations', and further defines the allowed operation set (select/count/exists). This clearly distinguishes it from the mutation-oriented sibling mssql_execute_mutation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The stated scope (SELECT queries and data retrieval) gives a clear context for when to use this tool, and the example reinforces the intended pattern. It does not explicitly name alternatives or exclusion conditions, but the boundary is evident from the operation enum.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_execute_sqlA
Execute arbitrary T-SQL - sql="ANY_VALID_TSQL" with optional parameters, GO batch separators and transaction support. Examples: sql="CREATE INDEX ...", sql="WITH cte AS (...) SELECT ...", transactional=true
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | T-SQL to execute (any valid SQL Server SQL; GO separators split batches) | |
| timeout | No | Query timeout in milliseconds (per batch) | |
| expectRows | No | Whether to expect rows back (false for statements like CREATE, DROP, etc.) | |
| parameters | No | Parameter values for @p1, @p2, ... (or $1, $2, ...) placeholders | |
| transactional | No | Whether to wrap all batches in a single transaction | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden and does reveal key behavior: arbitrary SQL execution, GO batch splitting, optional parameters, and transaction support. However, it does not mention potential destructive side effects, result/return behavior, or permission requirements, so transparency is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: one clear declarative sentence followed by two illustrative examples. There is no filler, and the core behavior is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema covers all parameters and the description covers invocation patterns and transaction behavior, which is adequate for basic use. However, there is no output schema, and the description does not state what the tool returns (rows, affected counts, etc.), leaving a notable gap for a generic SQL executor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters. The description adds only a high-level mention of optional parameters and a transactional example, providing no additional meaning beyond what the input schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes arbitrary T-SQL, with examples spanning DDL (CREATE INDEX) and a CTE SELECT, so its generic scope is evident. However, it does not explicitly contrast itself with siblings like mssql_execute_query or mssql_execute_mutation, leaving some boundary inference to the agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'arbitrary T-SQL' and the examples imply this is the general-purpose runner, but the description never states when to prefer it over the specialized sibling tools or when not to use it. No exclusions or alternative routing guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_export_table_dataB
Export table data to JSON or CSV format
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows to export | |
| where | No | WHERE clause without the WHERE keyword | |
| format | No | json | |
| schema | No | Schema name (defaults to dbo) | |
| delimiter | No | CSV delimiter | , |
| overwrite | No | Replace the output file if it already exists | |
| tableName | Yes | Table to export | |
| outputPath | Yes | Path to save the exported data (.json or .csv); relative paths resolve against --workspace-dir or the working directory | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. It only says 'Export table data' and does not disclose that this creates a file on disk, respects overwrite=false by default, or that an optional connection string requires --allow-tool-connection-string. These are important side-effect and permission details that are left entirely to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It is concise and immediately states the core operation. It loses a point because it is so terse that it omits the file-writing nature and any usage distinction, which may be more important than brevity for a tool with nine parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no output schema, nine parameters, and many sibling tools, this description is not complete enough for reliable invocation. It does not explain output file behavior, overwrite semantics, the optional connection string flag, or how this differs from query/import tools. The schema fills some gaps, but the description itself provides only a high-level label.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high at 89%, so the parameter definitions already carry most of the meaning. The description adds only the high-level format idea ('JSON or CSV'), which is already present in the format enum. With this coverage level, the baseline of 3 is appropriate; the description neither substantially helps nor hurts parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Export'), a resource ('table data'), and the target formats ('JSON or CSV'). This clearly distinguishes it from read/query tools like mssql_execute_query and from the inverse mssql_import_table_data. However, it does not explicitly say 'to a file' or mention filtering, so it is clear but not maximally differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for exporting table data into JSON/CSV, which is a reasonable inference from both the name and the phrasing. But it provides no explicit guidance about when to choose this tool over mssql_execute_query or mssql_import_table_data, and no exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_import_table_dataC
Import data from JSON or CSV file into a table
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | json | |
| schema | No | Schema name (defaults to dbo) | |
| batchSize | No | ||
| delimiter | No | CSV delimiter | , |
| inputPath | Yes | Path to the .json (array of objects) or .csv file | |
| tableName | Yes | Target table | |
| truncateFirst | No | TRUNCATE the table inside the import transaction first | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden of behavioral disclosure. It only says 'Import data', which hints at a write operation, but it does't disclose that the table may be truncated first, that inserts are batched, that a connection string may be required, or that the operation is transactional. These meaningful behaviors are left to the schema or entirely undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded, waste-free sentence conveys the essential operation. There is no repetition of schema details, no filler, and the key semantic elements (import, format, file, table) appear in the expected order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 8 parameters, no output schema, no annotations, and many sibling tools, the description is underspecified. It does not clarify whether this is a mutating operation beyond the word 'import', when truncateFirst would be relevant, how connection strings are resolved, or what failure modes exist (e.g., file not accessible, schema mismatch).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so most parameters are already explained in the input schema. The description reinforces that the file is JSON/CSV and the target is a table, but it adds no new meaning for batching, delimiter, truncation, or connection string semantics. The two bare schema parameters (format and batchSize) receive no help from the description either.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the action (Import), the source data type (JSON or CSV file), and the target (table), making the core purpose clear. It is semantically distinct from the obvious sibling mssql_export_table_data, but it doesn't explicitly call out the difference from generic mutation tools such as mssql_execute_mutation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance about when to choose this tool over alternatives like mssql_execute_mutation or mssql_execute_sql, nor does it mention prerequisites such as accessible file paths or connection string requirements. Usage is only vaguely implied by the word 'Import'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_commentsA
Manage SQL Server object descriptions (MS_Description extended properties) - get, set, remove comments on tables, columns, functions, and other objects. Examples: operation="get" with objectType="table", objectName="Users", operation="set" with comment text, operation="bulk_get" for discovery
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema name (defaults to dbo) | |
| comment | No | Comment text (required for set operation) | |
| operation | Yes | Operation: get (retrieve comments), set (add/update comment), remove (delete comment), bulk_get (discovery mode) | |
| tableName | No | Parent table (required for index/constraint/trigger) | |
| columnName | No | Column name (required when objectType is "column") | |
| objectName | No | Name of the object (required for get/set/remove) | |
| objectType | No | Type of database object (required for get/set/remove) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| filterObjectType | No | Filter by object type in bulk_get operation | |
| includeSystemObjects | No | Include system objects in bulk_get |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not state that remove is destructive/deletes extended properties, whether set overwrites existing comments, what permissions are required, or what the tool returns. The description mostly restates the operation names rather than revealing side effects or runtime behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence followed by compact examples. It front-loads the core purpose and operation set, and the examples are informative rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives enough examples to make basic calls correctly, and the schema covers parameter details. However, with 10 parameters, no annotations, and no output schema, it omits return-value behavior, error cases, permission prerequisites, and the destructive impact of remove, leaving an agent under-informed for edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all parameters with 100% coverage, but the description adds useful examples that clarify parameter relationships, such as using operation='set' with comment text and operation='bulk_get' for discovery. It does not explain all conditional dependencies like tableName for index/constraint/trigger, but the schema already handles those.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages SQL Server object descriptions via MS_Description extended properties, with explicit get, set, remove, and bulk_get operations. Examples with operation/objectType/objectName make the tool's scope concrete and help distinguish it from sibling tools that manage indexes, constraints, triggers, or functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides operation examples that imply when the tool is useful, but it never explicitly says when to use this tool versus alternatives like mssql_execute_query, mssql_execute_mutation, or other mssql_manage_* tools. There is no exclusionary guidance or mention of when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_constraintsA
Manage SQL Server constraints - get, create foreign keys, drop foreign keys, create constraints, drop constraints. Examples: operation="get" to list constraints, operation="create_fk" with constraintName, tableName, columnNames, referencedTable, referencedColumns
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema name (defaults to dbo) | |
| cascade | No | Accepted for compatibility; SQL Server DROP CONSTRAINT has no CASCADE | |
| ifExists | No | Include IF EXISTS clause (for drop_fk/drop operations) | |
| onDelete | No | ON DELETE action (for create_fk); RESTRICT maps to NO ACTION | NO ACTION |
| onUpdate | No | ON UPDATE action (for create_fk); RESTRICT maps to NO ACTION | NO ACTION |
| clustered | No | CLUSTERED index for primary_key (default true) / unique (default false) | |
| operation | Yes | Operation: get (list constraints), create_fk (foreign key), drop_fk (drop foreign key), create (constraint), drop (constraint) | |
| tableName | No | Table name (optional filter for get, required for create_fk/drop_fk/create/drop) | |
| deferrable | No | Not supported by SQL Server; true is rejected | |
| columnNames | No | Column names in the table (required for create_fk and unique/primary_key create) | |
| constraintName | No | Constraint name (required for create_fk/drop_fk/create/drop) | |
| constraintType | No | Filter by constraint type (for get operation) | |
| checkExpression | No | Check expression (for create operation with check constraints) | |
| referencedTable | No | Referenced table name (required for create_fk) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| referencedSchema | No | Referenced table schema (for create_fk, defaults to same as table schema) | |
| initiallyDeferred | No | Not supported by SQL Server; true is rejected | |
| referencedColumns | No | Referenced column names (required for create_fk) | |
| constraintTypeCreate | No | Type of constraint to create (for create operation) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description and schema carry the full behavioral burden. The description does disclose the operation set, and the schema documents several genuine behavioral traits: CASCADE is accepted but ignored, RESTRICT maps to NO ACTION, deferrable/initiallyDeferred are rejected with true, and clustered defaults differ per constraint type. However, tool-level effects such as the irreversibility of drop operations, transaction/commit behavior, and what the get operation returns are left undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler; the operation enumeration is front-loaded and the example sentence carries dense invocation knowledge. The dash-heavy structure is slightly crammed and would scan better as a list, but every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high complexity (19 parameters, 5 operations, destructive DDL, no annotations, no output schema), the definition is adequate but gapped. The schema descriptions cover per-parameter requirements for every operation, which compensates substantially. But the tool-level description omits return semantics for get, provides no warning about the referential-integrity impact of drops despite having no safety annotations, and only exemplifies two of five operations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, establishing a baseline of 3. The description adds co-occurrence semantics above that baseline: the create_fk example binds constraintName, tableName, columnNames, referencedTable, and referencedColumns into a single valid parameter group, which is relational knowledge a flat schema does not directly convey. It loses a point because only two of the five operations get such grouping examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('SQL Server constraints') and enumerates the five supported operations (get, create_fk, drop_fk, create, drop) followed by worked examples. This makes the tool clearly distinct from constraint-adjacent siblings like mssql_manage_indexes. It loses the top mark because the verb 'manage' is broad and the opening clause partially restates the tool's own name without naming what the tool is not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied rather than stated: the constraint-specific resource and the per-operation examples suggest when to invoke it, and the sibling set (mssql_manage_indexes, mssql_manage_triggers, mssql_manage_schema) makes the division of labor inferable. However, there is no explicit statement of when to use this tool versus alternatives, no exclusion criteria, and no guidance on how it composes with mssql_execute_query or mssql_analyze_database.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_functionsA
Manage SQL Server functions and stored procedures - get, create, or drop with a single tool. Examples: operation="get" to list, operation="create" with functionName="fn_total", parameters="@price DECIMAL(10,2), @tax DECIMAL(5,2)", returnType="DECIMAL(10,2)", functionBody="RETURN @price + (@price * @tax)"
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema name (defaults to dbo) | |
| cascade | No | Accepted for compatibility; no effect | |
| replace | No | Use CREATE OR ALTER | |
| ifExists | No | Include IF EXISTS clause (for drop operation) | |
| language | No | Only T-SQL is supported | tsql |
| security | No | EXECUTE AS CALLER (INVOKER) or OWNER (DEFINER) | INVOKER |
| operation | Yes | Operation to perform: get (list/info), create (new function or procedure), or drop (remove) | |
| objectType | No | function (default for create/drop) or procedure; filters get when supplied | |
| parameters | No | Parameter list, e.g. "@a INT, @b nvarchar(50)". Use "" for no parameters | |
| returnType | No | Function return type: scalar type, "TABLE" (inline TVF) or "@name TABLE (...)" (multi-statement TVF). Not used for procedures | |
| volatility | No | Accepted for compatibility; ignored by SQL Server | |
| functionBody | No | Module body (T-SQL). BEGIN/END or RETURN wrappers are added automatically when missing | |
| functionName | No | Name of the function/procedure (required for create/drop, optional for get to filter) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. It only restates the operation labels (get, create, drop) which are already documented in the schema, and offers no warning about destructive side effects, permissions, reversibility, or what the operation actually does to the database. The example illustrates inputs but not behavioral consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is on sentence with a front-loaded purpose and an illustrative example, with no filler or redundant content. It is appropriately sized for the tool's scope and easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The rich schema compensates for much of the missing detail, but the description alone leaves gaps for a 14-parameter, no-annotation tool. It shows only a CREATE FUNCTION example, mentions stored procedures without any example, and does not surface conditionally required fields like functionName for create/drop. Get and drop behavior would rely entirely on the schema. Overall it is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the structured fields already document all 14 parameters. The description adds value by showing a concrete composed CREATE FUNCTION example that demonstrates how functionName, parameters, returnType, and functionBody relate to each other. This is genuinely useful beyond the per-parameter schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (SQL Server functions and stored procedures) and gives explicit verbs (get, create, drop), so an agent can clearly tell what this tool does. It also distinguishes itself from sibling tools like mssql_manage_triggers or mssql_execute_query by targeting function/procedure DDL management. The example reinforces the purpose with concrete operation usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use this tool: when managing SQL Server functions or stored procedures via get/create/drop operations. It does not explicitly contrast against alternatives such as mssql_execute_query or mssql_manage_schema, but the resource scope is a sufficiently clear routing signal. It provides context without explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_indexesB
Manage SQL Server indexes - get, create, drop, rebuild/reorganize, and analyze usage with a single tool. Examples: operation="get" to list indexes, operation="create" with indexName, tableName, columns, operation="analyze_usage" for performance analysis
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Reindex mode | rebuild |
| type | No | Type of target for reindex (required for reindex operation) | |
| where | No | Filter predicate for a filtered index (for create operation) | |
| method | No | Index type (for create operation) | nonclustered |
| schema | No | Schema name (defaults to dbo) | |
| target | No | Target name for reindex (required for reindex operation) | |
| unique | No | Create unique index (for create operation) | |
| cascade | No | Accepted for compatibility; SQL Server DROP INDEX has no CASCADE | |
| columns | No | Key column names (required for create, except clustered columnstore) | |
| include | No | INCLUDE columns (for create operation) | |
| ifExists | No | Include IF EXISTS clause (for drop operation) | |
| indexName | No | Index name (required for create/drop) | |
| operation | Yes | Operation: get (list indexes), create (new index), drop (remove index), reindex (rebuild/reorganize), analyze_usage (find unused/duplicate) | |
| tableName | No | Table name (optional for get/analyze_usage/drop, required for create) | |
| concurrent | No | Build ONLINE (for create operation; Enterprise/Azure only) | |
| showUnused | No | Include unused indexes (for analyze_usage operation) | |
| ifNotExists | No | Skip creation when the index exists (for create operation) | |
| includeStats | No | Include usage statistics (for get operation) | |
| minSizeBytes | No | Minimum index size in bytes (for analyze_usage operation) | |
| showDuplicates | No | Detect duplicate indexes (for analyze_usage operation) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It only lists operation names and gives a few examples; it does not warn about destructive drop behavior, rebuild/reorganize locking or availability impact, permission requirements, or the connectionString restriction that requires --allow-tool-connection-string.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact: two sentences covering scope and representative examples. It front-loads the tool's purpose and avoids filler. A bulleted list or operation table might be more scannable, but the current structure wastes little space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite rich schema coverage, this is a 21-parameter, five-operation tool with no annotations and no output schema. The description covers examples for only three operations and omits drop and reindex guidance, operation-specific parameter combinations, destructive-operation cautions, and any indication of what the tool returns. That is a significant gap for an agent selecting among many sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description's examples add marginal clarity by pairing operation='create' with indexName, tableName, and columns, but this largely repeats what the schema already documents as required-for-create. It does not add meaningful new meaning for most of the 21 parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (SQL Server indexes) and enumerates the specific operations: get, create, drop, rebuild/reorganize, and analyze usage. It establishes an index-focused scope that distinguishes it from sibling tools like mssql_manage_schema or mssql_execute_query, though it leans on the broad verb 'manage' rather than a single precise action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The examples imply usage: operation='get' for listing indexes, operation='create' for creating, and operation='analyze_usage' for performance analysis. However, there is no explicit statement about when to prefer this tool over alternatives, no when-not guidance, and no mention of related tools such as mssql_execute_query or mssql_analyze_database.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_queryB
Manage SQL Server query analysis and performance - operation="explain" for execution plans, operation="get_slow_queries" for slow query analysis (Query Store or plan cache), operation="get_stats" for query statistics, operation="reset_stats" for clearing statistics
| Name | Required | Description | Default |
|---|---|---|---|
| costs | No | Accepted for compatibility; ignored | |
| limit | No | Number of queries to return (for get_slow_queries/get_stats operations) | |
| query | No | SQL query to explain (required for explain operation) | |
| format | No | Output format (for explain operation); json = XML plan plus extracted metrics | json |
| analyze | No | Actual plan (SET STATISTICS XML) - executes the query (for explain operation) | |
| buffers | No | Accepted for compatibility; ignored | |
| orderBy | No | Sort order (for get_slow_queries and get_stats operations) | mean_time |
| queryId | No | Specific query ID (Query Store query_id) or 0x plan_handle (plan cache) to reset; resets all if not provided | |
| verbose | No | Accepted for compatibility; ignored | |
| minCalls | No | Minimum number of calls (for get_stats operation) | |
| operation | Yes | Operation: explain (estimated or actual execution plan), get_slow_queries, get_stats (with cache hit ratios), reset_stats (clear plan cache / Query Store stats) | |
| minDuration | No | Minimum average duration in milliseconds (for get_slow_queries operation) | |
| queryPattern | No | Filter queries containing this pattern (for get_stats operation) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| includeNormalized | No | Accepted for compatibility; ignored |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does state what each operation does, including that reset_stats clears statistics, which hints at mutating behavior. But it does not warn that reset_stats is destructive, that explain with analyze=true executes the query, or that some operations may require elevated permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the tool's purpose and then lists all four operations with their purposes. It wastes no words, though the long dash-separated enumeration could benefit from a more structured format for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives a sufficient high-level operation map for a 15-parameter dispatcher tool, and the rich schema fills in most invocation details. It lacks guidance on output shape, side effects, connection requirements, and when to choose this tool over database-level analysis tools, so it is complete enough only in combination with the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents every parameter, including enums, defaults, and operation-specific applicability. The tool description adds no parameter-level detail, which is acceptable given the strong schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly maps the tool to SQL Server query analysis and performance and enumerates four concrete operations: explain, get_slow_queries, get_stats, and reset_stats. It is much more specific than a mere restatement of the tool name, though it does not explicitly differentiate it from overlapping siblings like mssql_analyze_database or mssql_monitor_database.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Each operation has an implied use case ('operation="explain" for execution plans', 'operation="get_slow_queries" for slow query analysis'), which gives reasonable context. However, there is no explicit guidance about when to use this tool instead of related siblings, nor any when-not-to-use or exclusion notes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_rlsB
Manage SQL Server Row-Level Security - security policies with generated predicate functions. Examples: operation="create_policy" with tableName, policyName, predicateColumns=["TenantId"], using="@TenantId = CAST(SESSION_CONTEXT(N'TenantId') AS int)"
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Not supported: SQL Server policies apply to all principals | |
| check | No | BLOCK predicate expression over @Column parameters (optional) | |
| roles | No | Not supported: SQL Server policies apply to all principals | |
| using | No | FILTER predicate expression over @Column parameters (required for create_policy unless command is INSERT/UPDATE/DELETE) | |
| schema | No | Schema name (defaults to dbo) | |
| command | No | Which block operations the check predicate applies to (SELECT = filter only) | ALL |
| replace | No | Drop and recreate the policy if it exists (for create_policy) | |
| ifExists | No | Include IF EXISTS clause (for drop_policy) | |
| operation | Yes | Operation: enable/disable policies on a table, create_policy, edit_policy, drop_policy, get_policies | |
| tableName | No | Table name (required for enable/disable/create_policy/edit_policy, optional filter for get_policies) | |
| policyName | No | Policy name (required for create_policy/edit_policy/drop_policy) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| predicateColumns | No | Columns passed to the predicate functions; reference them as @Column in using/check |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry behavioral disclosure, but it only says 'Manage' and 'generated predicate functions'. It does not mention that create/edit/drop/replace operations are persistent DDL changes, that get_policies is a read operation, or that connectionString requires an explicit flag. Even the replace and ifExists behaviors are left entirely to the schema rather than the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded: the purpose is stated first, followed by a single illustrative example. There is no filler, but the example's internal inconsistency slightly tarnishes its structural value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex (13 params, 6 operations, no output schema) and has no annotations, yet the description is quite sparse. It provides a high-level orientation and one create_policy example, while the rich schema descriptions cover the operational details; however, it omits any sense of what operations return and does not orient the agent to edit/drop/get flows, making it only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all 13 parameters (100%), setting a baseline of 3, but the description's attempt to illustrate parameter use is flawed: it uses predicateColumns=['TenantId'] while the using expression references '@TenId', contradicting the schema rule that columns are referenced as @Column. This mismatch could lead an agent to generate an invalid predicate, so the example does more harm than good.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific domain ('SQL Server Row-Level Security') and an actionable verb ('Manage'), and reinforces it with a concrete create_policy example that names the key parameters. Among eighteen sibling tools, only this one targets RLS policies, so it is clearly distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The example demonstrates a valid invocation (operation='create_policy', tableName, policyName, predicateColumns, using), which gives an agent a concrete usage pattern. However, it never explicitly says when to prefer this tool over the many other mssql_manage_* siblings, or when not to use it. The guidance is implied by the RLS scope rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_schemaA
Manage SQL Server schema - get schema info, create/alter tables, manage enum-style CHECK constraints. Examples: operation="get_info" for table lists, operation="create_table" with tableName and columns, operation="get_enums" to list IN-list CHECK constraints, operation="create_enum" with enumName, tableName, columnName and values
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema name (defaults to dbo) | |
| values | No | Allowed values (required for create_enum) | |
| columns | No | Column definitions (required for create_table) | |
| enumName | No | CHECK constraint name (optional filter for get_enums, required for create_enum) | |
| operation | Yes | Operation: get_info (schema/table info), create_table (new table), alter_table (modify table), get_enums (list IN-list CHECK constraints), create_enum (new IN-list CHECK constraint) | |
| tableName | No | Table name (optional for get_info to get specific table info, required for create_table/alter_table/create_enum) | |
| columnName | No | Column the enum CHECK applies to (required for create_enum) | |
| operations | No | Alter operations (required for alter_table) | |
| ifNotExists | No | Include IF NOT EXISTS guard (for create_enum) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden of behavioral disclosure, and it discloses essentially none. It never warns that create_table, alter_table (whose schema supports 'drop' operations), and create_enum are permanent DDL mutations, nor does it mention privilege requirements, transactional behavior, or failure modes. An agent gets no behavioral context beyond the operation names.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded summary sentence followed by four thumbnall examples with zero filler. The content is scannable in one pass, and no sentence wastes the agent's attention.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, 5-opration tool with nested objects, no output schema, and no annotations, the description covers 4 of 5 operations in examples - alter_table is only named, never exemplified. It also omits any behavioral or permission guidance and any sibling delegation advice. The extensive schema masks these gaps, but the description alone would give an agent an incomplete picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents per-operation requirements ('required for create_enum', 'required for alter_table'), so the baseline is 3. The description's examples restate those groupings ('operation="create_table" with tableName and columns'), which is helpful but largely redundant with the schema's own per-parameter notes. No parameter is left undocumented across both sources.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific scope - 'get schema info, create/alter tables, manage enum-style CHECK constraints' - and backs it with four concrete examples ('operation="get_info" for table lists', 'operation="create_table" with tableName and columns'). This clearly separates it from raw-execution siblings like mssql_execute_query and mssql_execute_sql, which lack a DDL operation grammar of their own.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The examples give explicit per-opration routing: 'operation="get_info" for table lists' and 'operation="create_enum" with enumName, tableName, columnName and values'. This is clear context for choosing among the five operations, though it never states when not to use the tool or names alternatives such as mssql_manage_constraints for non-enum CHECK constraints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_triggersA
Manage SQL Server DML triggers - get, create, drop, and enable/disable triggers. Examples: operation="get" to list triggers, operation="create" with triggerName, tableName and triggerBody (or functionName to EXEC a procedure), operation="set_state" with triggerName, tableName, enable
| Name | Required | Description | Default |
|---|---|---|---|
| when | No | Not supported by SQL Server; rejected when supplied | |
| enable | No | Whether to enable the trigger (required for set_state operation) | |
| events | No | Trigger events (TRUNCATE is rejected) | |
| schema | No | Schema name (defaults to dbo) | |
| timing | No | Trigger timing (BEFORE is rejected: SQL Server has no BEFORE triggers) | AFTER |
| cascade | No | Accepted for compatibility; no effect | |
| forEach | No | SQL Server triggers are statement-level; ROW is rejected | STATEMENT |
| replace | No | Use CREATE OR ALTER | |
| ifExists | No | Include IF EXISTS clause (for drop operation) | |
| operation | Yes | Operation: get (list triggers), create (new trigger), drop (remove trigger), set_state (enable/disable trigger) | |
| tableName | No | Table name (optional filter for get, required for create/set_state) | |
| triggerBody | No | Trigger body T-SQL (required for create unless functionName is given) | |
| triggerName | No | Trigger name (required for create/drop/set_state) | |
| functionName | No | Stored procedure to EXEC as the trigger body (alternative to triggerBody) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It does disclose the major behaviors: list, create, drop, and enable/disable, and mentions that create can 'EXEC a procedure' as the trigger body. However, it does not describe side effects such as the permanence of drops, required permissions, whether changes persist immediately, or what the operation returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the core purpose, and packs the operation examples into a compact, scannable format. Every clause earns its place without unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus the detailed schema covers operation selection and parameter usage well, including SQL Server incompatibilities in the schema. However, there is no output schema, and the description does not explain return values, error behavior, or prerequisites/permissions, which leaves the agent with some uncertainty for a tool that can create and drop database objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value beyond the schema by specifying operation-specific parameter groupings, e.g. 'create' requires triggerName, tableName, and triggerBody (or functionName), and 'set_state' requires triggerName, tableName, and enable. This helps an agent assemble correct calls.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('SQL Server DML triggers') and enumerates the exact operations: 'get, create, drop, and enable/disable triggers.' This clearly distinguishes it from sibling tools like mssql_manage_indexes or mssql_manage_functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides concrete usage patterns via examples: 'operation="get" to list triggers', 'operation="create" with triggerName, tableName and triggerBody', and 'operation="set_state" with triggerName, tableName, enable'. This gives clear context for when to use each operation, though it does not explicitly state exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_manage_usersA
Manage SQL Server logins, database users and permissions - create, drop, alter users, grant/revoke permissions. Examples: operation="create" with username="app_user", password="...", operation="grant" with username, permissions, target, targetType
| Name | Required | Description | Default |
|---|---|---|---|
| login | No | Enable/disable the login | |
| schema | No | Schema of object targets (defaults to dbo); filter for get_permissions | |
| target | No | Target object/schema/database name (for grant/revoke operations) | |
| cascade | No | drop: transfer owned schemas to dbo first; revoke: CASCADE | |
| inherit | No | Accepted for compatibility; reported as unsupported | |
| createdb | No | dbcreator server role (unsupported on Azure SQL Database) | |
| ifExists | No | Include IF EXISTS clause (for drop operation) | |
| password | No | Password (required for create; optional for alter) | |
| userType | No | login = server login + database user; contained = database-scoped user; auto = contained on Azure SQL Database, login elsewhere | auto |
| username | No | User name (required for create/drop/alter/grant/revoke, optional filter for get_permissions/list) | |
| operation | Yes | Operation: create (login + user, or contained user), drop, alter, grant, revoke, get_permissions, list | |
| superuser | No | sysadmin server role (db_owner on Azure SQL Database) | |
| createrole | No | securityadmin server role (db_securityadmin on Azure SQL Database) | |
| targetType | No | Type of target (for grant/revoke; filter for get_permissions) | |
| validUntil | No | Accepted for compatibility; reported as unsupported | |
| permissions | No | Permissions to grant/revoke | |
| replication | No | Accepted for compatibility; reported as unsupported | |
| connectionLimit | No | Accepted for compatibility; reported as unsupported | |
| withGrantOption | No | Allow the user to grant these permissions to others (for grant operation) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| includeSystemRoles | No | Include system principals (for list operation) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions potentially destructive operations like drop and revoke but does not disclose side effects, required privileges, Azure SQL differences, behavior of compatibility-only parameters, or consequences like cascading. The schema fields hint at these but the description itself is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The first sentence defines the tool's purpose and scope; the second provides concrete example parameter groupings. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex 21-parameter tool with no output schema and no annotations, yet the description only covers two operation examples. It does not explain operation-specific required parameters, return behavior, Azure SQL behavioral differences, or how unsupported compatibility parameters are handled. Given the tool's complexity, the description is under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by showing realistic parameter combinations: operation='create' with username/password and operation='grant' with username, permissions, target, targetType. This helps the agent understand how parameters relate to operations beyond the individual schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource domain (SQL Server logins, database users, permissions) and enumerates exact operations (create, drop, alter, grant, revoke, get_permissions, list). This clearly differentiates it from sibling tools like mssql_manage_schema or mssql_execute_query by scope and action type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for user and permission administration through its operation list and examples, but it does not explicitly state when to choose this tool over alternatives like mssql_execute_query or mssql_execute_mutation. No exclusion conditions or alternative tool references are given, leaving selection to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_monitor_databaseC
Get real-time monitoring information for a SQL Server database
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema for table metrics (defaults to dbo) | |
| includeLocks | No | ||
| includeTables | No | ||
| includeQueries | No | ||
| alertThresholds | No | Alert thresholds | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| includeReplication | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden for behavioral disclosure. It does convey a read-only, current-state operation through 'Get' and 'real-time', but it omits specifics such as connection requirements, how the include flags alter behavior, what metrics are returned, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that is easy to scan and contains no filler. Brevity comes at the expense of substance, but that is a completeness problem rather than a conciseness problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has seven parameters, a nested alertThresholds object, no output schema, and no annotations, yet the description only restates the basic monitoring purpose. It does not explain return data, parameter effects, or prerequisites, so an agent cannot confidently predict behavior from this definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no parameter-specific meaning and does not compensate for the low 43% schema description coverage. The seven parameters, including includeLocks, includeTables, includeQueries, includeReplication, and alertThresholds, receive no explanatory help from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Get') and a resource ('SQL Server database'), and the qualifier 'real-time monitoring information' gives a clear purpose. It does not explicitly contrast with mssql_analyze_database or mssql_debug_database, and 'monitoring information' remains somewhat generic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings like mssql_execute_query, mssql_analyze_database, or mssql_execute_sql. The phrase 'real-time' implies operational monitoring, but there is no explicit when-to-use or when-not-to-use direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
18 tool updates
v0.1.1- First observed
mssql_analyze_database - First observed
mssql_copy_between_databases - First observed
mssql_debug_database - First observed
mssql_execute_mutation - First observed
mssql_execute_query - First observed
mssql_execute_sql - First observed
mssql_export_table_data - First observed
mssql_import_table_data - First observed
mssql_manage_comments - First observed
mssql_manage_constraints - First observed
mssql_manage_functions - First observed
mssql_manage_indexes - First observed
mssql_manage_query - First observed
mssql_manage_rls - First observed
mssql_manage_schema - First observed
mssql_manage_triggers - First observed
mssql_manage_users - First observed
mssql_monitor_database
TDQS
Scored across 18 tools
Most tools target distinct resources (indexes, constraints, triggers, users), but there is overlap among execute_query, execute_mutation, and execute_sql, and between analyze_database, monitor_database, debug_database, and manage_query for performance/diagnostic work. Descriptions help somewhat, but an agent could still pick the wrong tool for custom T-SQL or monitoring.
All tools follow the mssql_<verb>_<object> snake_case pattern with predictable verbs like execute, manage, analyze, export, import, and copy. The naming is highly consistent and easy to navigate.
18 tools is slightly above the typical 3-15 well-scoped range, but the broad SQL Server administration scope justifies most entries. Each tool encapsulates a meaningful subdomain, so the count is reasonable if a bit heavy.
The surface covers data operations, schema, indexes, constraints, functions/procedures, triggers, RLS, users, comments, query performance, import/export, and database copying. Dedicated backup/restore and database-level lifecycle tools are missing, though arbitrary T-SQL via mssql_execute_sql provides a workaround.
Maintenance
Related MCP Connectors
Draxlr's remote MCP server connects AI assistants to your SQL databases and dashboards. Explore schemas, run read-only queries, manage saved queries and dashboards, and export results, all with row-level security so each user sees only their own data.
- dataOAuthco.thinair
Read-only PostgreSQL, MySQL, SQL Server access via MCP — 24 dialect-aware hosted tools.
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Let AI agents query data and act across all your business apps via MCP.
Related MCP Servers
- AlicenseAqualityNot gradedmaintenanceEnables AI assistants to interact with both local SQL Server and Azure SQL Database through natural language, supporting queries, data manipulation, and schema operations with built-in security features.82,348 npm1-
- AlicenseBqualityCmaintenanceEnables AI agents to interact with Microsoft SQL Server databases via MCP, supporting table listing, schema retrieval, and CRUD operations.31MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to connect to Microsoft SQL Server via the MCP protocol, supporting database schema queries, data reading, and arbitrary SQL execution.-
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server for Microsoft SQL Server that enables AI agents to safely explore and query SQL Server databases.385 npmMIT