Skip to main content
Glama
Andrian17

mssql-mcp-server

by Andrian17

mssql-mcp-server

A Model Context Protocol server for Microsoft SQL Server. Requires SQL Server 2017 or later (on-prem) or Azure SQL Database — several catalog queries (e.g. index/constraint/permission listings) use STRING_AGG, which does not exist before SQL Server 2017. Its tool surface — the 18 tool names, their operation values, parameters and output shapes — mirrors @henkey/postgres-mcp-server v1.0.7, the PostgreSQL MCP server many Claude/AI-client users already run, so a client that knows how to drive the Postgres server can drive this one the same way. henkey is AGPL-3.0; parity here is with the interface and behaviour, not the code — everything in this repository is written from scratch and licensed MIT (see LICENSE).

Quick start

npm install
npm run build

This produces build/index.js, a stdio MCP server. Point an MCP client at it.

Claude Code (.mcp.json or claude mcp add):

{
  "mssql-local": {
    "type": "stdio",
    "command": "node",
    "args": [
      "/path/to/mssql-mcp-server/build/index.js",
      "--connection-string", "Server=localhost,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=true",
      "--security-mode", "unsafe", "--allow-destructive"
    ]
  }
}

VS Code (mcp.json):

{
  "servers": {
    "mssql-local": {
      "type": "stdio",
      "command": "node",
      "args": [
        "/path/to/mssql-mcp-server/build/index.js",
        "--connection-string", "Server=localhost,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=true",
        "--security-mode", "unsafe", "--allow-destructive"
      ]
    }
  }
}

Azure SQL Database, read-only — the default --security-mode is already readonly, so it does not need to be passed explicitly; shown here for clarity:

{
  "mssql-azure": {
    "type": "stdio",
    "command": "node",
    "args": [
      "/path/to/mssql-mcp-server/build/index.js",
      "--connection-string", "Server=<server>.database.windows.net,1433;Database=MyDb;User Id=app;Password=***;Encrypt=true;TrustServerCertificate=false",
      "--security-mode", "readonly"
    ]
  }
}

Replace every placeholder (<server>.database.windows.net, MyDb, app, ***) with real values — never commit real credentials.

Connection strings may also be the ADO form shown above or a mssql:// URL (mssql://user:pass@host:1433/db?encrypt=true&trustServerCertificate=true); the server translates URL form itself (the underlying mssql driver only parses the ADO form).

Related MCP server: mcp-server-mssql

Security modes

Every tool call is classified into a risk category and checked against the server's --security-mode (default readonly) before it runs. destructive: true classifications additionally require --allow-destructive regardless of mode.

Mode

Allowed risks

readonly

read

write

read, write

admin

read, write, ddl, role_admin, filesystem

unsafe

read, write, ddl, role_admin, filesystem, arbitrary_sql

  • arbitrary_sql always requires --allow-destructive as well as unsafe. A raw SQL fragment can contain any statement — a where of 1=1; DROP TABLE dbo.t -- on an mssql_execute_mutation update reaches the engine as a multi-statement batch — so every classification of risk arbitrary_sql is marked destructive, whatever produced it: where on execute_mutation/export_table_data/copy_between_databases, mssql_manage_query explain with analyze, a raw column default on manage_schema, a filtered-index where, a checkExpression, RLS predicates, and function/trigger bodies. In practice --security-mode unsafe on its own now grants nothing beyond admin; unsafe plus --allow-destructive is what enables raw SQL.

  • --allow-destructive — permits classifications marked destructive (drop/delete/truncate/revoke/disable/reset-style operations, and every arbitrary_sql operation above), on top of whatever the mode already allows. Several argument flags additionally escalate an otherwise non-destructive operation into this category, because each one silently discards or disables something that already exists: replace: true on mssql_manage_functions create and on mssql_manage_triggers create (both emit CREATE OR ALTER, overwriting an existing body), replace: true on mssql_manage_rls create_policy (drops and recreates the policy and its predicate functions), and login: false on mssql_manage_users alter (ALTER LOGIN … DISABLE).

  • --allow-tool-connection-string — permits a tool call to supply its own connectionString (or, for mssql_copy_between_databases, sourceConnectionString/targetConnectionString) instead of using the server's configured connection. mssql_copy_between_databases has no server-string fallback at all — both connection strings are required tool arguments, so the tool cannot be used unless this flag is set.

A denied call returns isError: true with one of two messages, taken verbatim from src/security/policy.ts:

Blocked by MSSQL MCP security policy: <reason>. Current mode "readonly" allows read operations.

or, when the mode would allow the risk but the destructive flag is missing:

Blocked by MSSQL MCP security policy: <reason>. Destructive operations require --allow-destructive.

Every denial is written to stderr as a single JSON line prefixed [MCP Audit] and, if --audit-file is set, appended to that file:

[MCP Audit] {"event":"mssql_mcp.security","outcome":"denied","reason":"security_policy_denied","toolName":"mssql_execute_sql","operation":null,"securityMode":"readonly","allowDestructive":false,"risk":"arbitrary_sql","destructive":true,"timestamp":"2026-08-26T12:00:00.000Z"}

Allowed calls are recorded on the two channels differently, so the file can be a complete record without flooding the client's log:

  • --audit-file additionally records every allowed call whose risk is not read ("outcome":"allowed") — everything that could have changed state.

  • stderr carries an allowed call only when MSSQL_MCP_AUDIT_ALLOWED=true.

MSSQL_MCP_AUDIT_ALLOWED is an environment variable only — there is no corresponding CLI flag. Audit lines never carry tool arguments, only the tool name, operation, mode and classification.

Warning at startup: in --security-mode admin or unsafe without --workspace-dir, the server prints once to stderr

[MCP Warning] File tools are enabled without --workspace-dir; export/import/copy can read and write any path this process can access. Set --workspace-dir to sandbox them.

Configuration

Option

Env

Default

Meaning

-cs, --cs, --connection-string <string>

MSSQL_CONNECTION_STRING

Server-level connection string (ADO or mssql:// URL)

--security-mode <mode>

MSSQL_MCP_SECURITY_MODE

readonly

readonly | write | admin | unsafe

--allow-destructive

MSSQL_MCP_ALLOW_DESTRUCTIVE=true

false

Permit drop/delete/truncate/revoke/disable/reset operations

--allow-tool-connection-string

MSSQL_MCP_ALLOW_TOOL_CONNECTION_STRING=true

false

Permit connectionString / sourceConnectionString / targetConnectionString tool arguments

-tc, --tc, --tools-config <path>

MSSQL_MCP_TOOLS_CONFIG

JSON { "enabledTools": [...] } allow-list; see tools-config.readonly.json

--workspace-dir <dir>

MSSQL_MCP_WORKSPACE_DIR

If set, export/import paths must resolve inside it; relative paths resolve against it

--max-file-bytes <n>

MSSQL_MCP_MAX_FILE_BYTES

104857600 (100 MiB)

Export/import size cap in bytes

--audit-file <path>

MSSQL_MCP_AUDIT_FILE

Append JSON audit events to this file

--default-schema <name>

MSSQL_MCP_DEFAULT_SCHEMA

dbo

Fallback for every schema parameter

-V, --version, -h, --help

-cs/-tc are rewritten to --connection-string/--tools-config before argument parsing (Commander v15 rejects multi-character short flags outright); --cs/--tc are additionally registered as ordinary long-form aliases, so -cs, --cs and --connection-string are all equivalent (likewise -tc/--tc/--tools-config).

An invalid --security-mode exits with status 1 and prints:

securityMode must be one of readonly, write, admin, or unsafe.

Connection-string precedence (checked in this order): a tool-supplied connectionString (only when --allow-tool-connection-string is set) → --connection-stringMSSQL_CONNECTION_STRING → if none is set:

No connection string provided. Provide one in the tool arguments (requires --allow-tool-connection-string), via the --connection-string CLI option, or set the MSSQL_CONNECTION_STRING environment variable.

Tools config: if --tools-config points at a file with an enabledTools array, only those tools are registered; unknown names log [MCP Warning] Tool "<n>" specified in config file but not found in available tools.; calling a known-but-disabled tool returns Error: Tool "<name>" is available but not enabled by the current server configuration.

The allow-list fails closed: a file that cannot be read or is not { "enabledTools": string[] } stops the server rather than quietly enabling every tool, printing one of

[MCP Error] Could not read tools configuration file at <path>: <reason>
[MCP Error] Invalid tools configuration file format at <path>: expected { "enabledTools": string[] }

and exiting with status 1 before it serves anything.

Tools

All 18 tools are prefixed mssql_. Full parameter tables (types, defaults, whether each field is required) are generated from the server's own schemas in TOOL_SCHEMAS.md — run npm run docs to regenerate it after changing a tool's inputSchema.

Tool

Summary

mssql_execute_query

Run a read-only SELECT/WITH query: select, count, or exists

mssql_execute_mutation

insert / update / delete / upsert (MERGE) against one table

mssql_execute_sql

Run arbitrary T-SQL, including multi-batch scripts (GO) and transactions

mssql_manage_schema

Inspect tables, create/alter tables, manage enum-style CHECK constraints

mssql_manage_indexes

List, create, drop, rebuild/reorganize, and analyze index usage

mssql_manage_constraints

List, create/drop primary key, unique, check and foreign key constraints

mssql_manage_functions

List, create, drop scalar/table-valued functions and stored procedures

mssql_manage_triggers

List, create, drop, enable/disable DML triggers

mssql_manage_rls

Row-Level Security policies backed by generated predicate functions

mssql_manage_users

Logins/users, role membership, grant/revoke permissions

mssql_manage_comments

Object/column descriptions stored as MS_Description extended properties

mssql_manage_query

Execution plans, slow-query and statistics reporting, stats reset

mssql_analyze_database

Configuration, performance and security analysis with recommendations

mssql_debug_database

Diagnose connection, performance, lock and replication issues

mssql_monitor_database

Point-in-time database/table/query/lock/replication metrics and alerts

mssql_export_table_data

Stream a table (optionally filtered) to a local JSON or CSV file

mssql_import_table_data

Bulk-load a local JSON or CSV file into a table, inside one transaction

mssql_copy_between_databases

Stream rows from a table in one database into the same table in another

Query execution notes

  • mssql_execute_query runs exactly one SELECT/WITH statement. T-SQL does not need a ; between statements, so a second one can simply be appended to a query — SELECT 1 AS a USE master ran both and left the pooled session in master for every later call. Four rules enforce the single statement. The first three are applied to the query with the contents of string literals, comments and bracketed/quoted identifiers blanked out (so [Set], "Use" and '… use master' are data, not keywords); the fourth is a runtime check. Masking follows the engine's own lexing: a -- comment ends at the first carriage return or newline (SELECT 1 AS a --\rUSE master is not one long comment), block comments nest (/* a /* b */ c */ is blanked whole), and the delimiters ', ", [, ] are left in place so a blanked literal cannot be mistaken for "nothing was here":

    1. Statement keywords are rejected anywhere in the query: USE, SET, DECLARE, BEGIN, WHILE, IF, GOTO, RETURN, PRINT, RAISERROR, THROW, COMMIT, ROLLBACK, SAVE, OPEN, CLOSE, DEALLOCATE, RECONFIGURE, CHECKPOINT, BREAK, CONTINUE, DISABLE, ENABLE, RECEIVE, SEND, REVERT, ADD, alongside the data-changing set (INSERT/UPDATE/DELETE/MERGE/INTO/EXEC/DDL/DBCC/WAITFOR/WRITETEXT/UPDATETEXT/READTEXT/SETUSER).

    2. Multi-word phrases whose individual words must stay legal on their own: END CONVERSATION, MOVE CONVERSATION, GET CONVERSATION (a bare END still closes a CASE), and NEXT VALUE FOR — the one read-shaped expression that changes persistent state, because it advances a SEQUENCE (FETCH NEXT, (VALUES …), FOR XML and a column named next_value are all unaffected).

    3. Structure: exactly one statement SELECT — the first SELECT at bracket depth 0 (for a WITH query, the outer one after the CTE list). Any other SELECT must either sit inside brackets (a subquery, derived table, CTE body, EXISTS/IN, APPLY) or directly follow UNION/UNION ALL/EXCEPT/INTERSECT. A ( at depth 0 that opens a bracketed SELECT is itself only accepted where a subquery belongs — after a set operator, IN/EXISTS/ANY/ALL, FROM/JOIN/APPLY/AS/WHERE/ON, a comparison operator, a comma or another ( — so SELECT 1 AS a (SELECT DB_NAME()), which SQL Server runs as two statements, is rejected. Anything that fails these is query must contain exactly one statement.

    4. Result-set count, checked while the query runs. Every streamed path (select, and the count/exists fallbacks) refuses the query the moment the engine announces a second result set — query produced more than one result set; only a single SELECT statement is allowed — cancelling the request and returning that error instead of rows. This is what catches SELECT 1 AS a ((SELECT DB_NAME())), where the smuggled SELECT is bracketed and so indistinguishable, token by token, from the subquery in ISNULL((SELECT 1), 0). Precisely: a second SELECT smuggled inside doubled parentheses is refused when the engine announces its result set; if a row limit cancels the request before that happens, the smuggled statement may already have started executing server-side — it cannot return rows to the caller and, because the validator rejects every statement keyword and the NEXT VALUE FOR construct, it cannot change database or session state. (The limit cancels as soon as a row beyond it arrives and the driver announces nothing afterwards; draining the whole first result set so the guard always fires would turn every limited readonly select into a full scan.) Subqueries, IN (SELECT …), EXISTS (SELECT …), CTEs (including recursive ones), CROSS APPLY, derived tables, (VALUES …) with an alias column list, UNION [ALL]/EXCEPT/INTERSECT, CASE … END, OFFSET … FETCH NEXT, WITH (NOLOCK)/WITH TIES, OPENJSON … WITH, GROUPING SETS, FOR XML/FOR JSON, OPTION (RECOMPILE), IIF, DATEADD and columns such as EndDate/BeginDate/Settings/Address/EndConversation all still work. Rules 1–3 are a keyword and structure scan, not a T-SQL parser, and they err towards rejection: an unbracketed column literally named Open, Close, Set or Use is rejected — bracket it. Use mssql_execute_sql (unsafe + --allow-destructive) for anything else.

  • mssql_execute_query's select operation accepts an optional limit, and defaults to 10000 rows when it is omitted; when the limit is reached the tool cancels the underlying request and returns exactly the rows collected so far. The success message then reads Query executed successfully. Retrieved <n> rows. Row limit of <limit> reached; more rows may exist. — that second sentence is added only when a row beyond the limit actually arrived, so a result of exactly limit rows never claims rows were left behind. count and exists are unaffected (they never materialise rows).

  • mssql_execute_sql has no row limit or limit parameter at all; it returns every row every batch produces.

Export, import and copy

  • CSV parsing is strict, not lenient. A " only opens quoted-field mode at the very start of a field; a " appearing elsewhere in an unquoted field is a literal character; a quoted field left open at end-of-file throws Unterminated quoted field in CSV input rather than silently merging the rest of the file into one record.

  • mssql_import_table_data requires a JSON file to contain a top-level array of objects (Input file does not contain an array of records otherwise). Two input columns that collapse to the same table column case-insensitively (e.g. Name and name) are rejected as Column <c> is specified more than once. time columns are coerced from a bare HH:MM:SS[.fff] string by anchoring it to 1970-01-01 in UTC; a cell that cannot be coerced to its column's type (an unparsable number, date, or hex binary value) is rejected with Column <c>: cannot coerce "<v>" to <type> instead of reaching the driver as an opaque error or silently loading as NULL/zero.

  • Computed and rowversion/timestamp columns are skipped, on both mssql_import_table_data and mssql_copy_between_databases: SQL Server refuses a supplied value for them (error 271), so any such column present in the input file or on the source table is dropped from the load and the target engine computes or stamps the value itself. This is silent — it is never reported as a missing or unknown column.

  • Rows without an identity-column value present in the data are loaded through mssql's bulk sql.Table path with checkConstraints: true and fireTriggers: true — CHECK/FK constraints are enforced and INSERT triggers fire, just as they would for an ordinary INSERT. Rows whose data does include identity-column values are loaded instead via SET IDENTITY_INSERT ON and batched multi-row INSERT statements. mssql_copy_between_databases reuses the same loader on the target side.

  • mssql_export_table_data never damages an existing file. Exporting to a path that already exists is an error — Output file already exists: <path>. Pass overwrite: true to replace it. — unless you pass overwrite: true. Either way rows are streamed into a temp file (<outputPath>.<pid>.<timestamp>.tmp) alongside the target and renamed onto it only once the export completed; if it fails partway (a permission error, a query error mid-stream, or the size cap being hit) only the temp file is removed, so the previous contents are still there and no corrupt/truncated file is left behind.

  • CSV exports neutralise spreadsheet formulas. A string cell whose text starts with =, +, -, @, a tab or a carriage return, and does not look like a number, is written with a leading ' so Excel/Sheets treat it as text rather than evaluating it. Numeric-looking strings (-5, +62812) and real numbers are untouched, and mssql_import_table_data does not strip the quote — the exported file is the record.

  • A cell that cannot be coerced on import is reported with at most 40 characters of its value (Column Qty: cannot coerce "…" to int), so an error message and its [MCP Error] log line never carry a whole cell.

  • File paths for export/import: when --workspace-dir is set, every resolved path must stay inside it (segment-based .. and absolute-outside-workspace checks — Path "<path>" is outside the workspace directory.); a size cap from --max-file-bytes applies to both the source file being read (File exceeds max file size of <n> bytes.) and the file being written (Generated export exceeds max file size of <n> bytes.); only .json/.csv extensions matching the requested format are accepted.

PostgreSQL → SQL Server differences

Because the tool surface mirrors a Postgres server, several tools map a Postgres concept onto a different SQL Server mechanism:

Postgres concept

SQL Server equivalent used here

ENUM types

mssql_manage_schema's get_enums/create_enum operations read and write IN-list CHECK constraints (sys.check_constraints) — there is no native SQL Server enum type

Row-level triggers, BEFORE/WHEN

SQL Server triggers are statement-level only; mssql_manage_triggers rejects forEach: "ROW", timing: "BEFORE" (use INSTEAD OF), a TRUNCATE event, and a when clause, each with an explanatory error

CREATE POLICY ... USING/WITH CHECK

mssql_manage_rls compiles the using/check predicates into schema-bound inline table-valued functions and wires them into a CREATE SECURITY POLICY ... ADD FILTER/BLOCK PREDICATE

Roles

mssql_manage_users creates a server LOGIN plus a database USER (or a contained USER when userType is contained, the default on Azure SQL Database) rather than a single Postgres role

COMMENT ON ...

mssql_manage_comments reads/writes the MS_Description extended property via sp_addextendedproperty/sp_updateextendedproperty/sp_dropextendedproperty and fn_listextendedproperty

EXPLAIN [ANALYZE]

mssql_manage_query's explain operation uses `SET SHOWPLAN_XML

pg_stat_statements

get_slow_queries/get_stats/reset_stats read from Query Store when it is enabled and in a read-write state, otherwise fall back to the plan cache (sys.dm_exec_query_stats)

manage_users behaviour notes

  • drop always attempts DROP LOGIN for a login-type user once the database USER has been dropped, whenever a server login with that name exists — it does not check whether some other database on the instance still maps a user to that login. (Design note: the spec originally described a "no other database user maps to it" check; the shipped behaviour is the simpler unconditional drop, reported and accepted as the code of record.)

  • alter maps superuser/createrole to db_owner/db_securityadmin database-role membership on Azure SQL Database (and to the sysadmin/securityadmin server roles elsewhere), the same mapping create uses; createdb has no Azure SQL Database equivalent and is reported under unsupported instead of being applied.

Authentication

Connection strings accept:

  • SQL authentication: User Id=...;Password=... (SQL login or Azure AD login with a password).

  • Azure AD: Authentication=Active Directory Password (with User Id/Password) or Authentication=Active Directory Default (uses the ambient Azure identity).

  • NTLM: Authentication=NTLM;Domain=CORP with User Id/Password.

  • Windows integrated authentication (SSPI) is not supported. The underlying driver (tedious) cannot do it; use a SQL login, NTLM with explicit credentials, or Azure AD instead.

Development

npm test              # unit + integration (integration skipped without MSSQL_TEST_CONNECTION_STRING)
npm run test:unit
npm run test:integration
npm run typecheck
npm run docs           # regenerate TOOL_SCHEMAS.md

Integration tests need a local SQL Server instance and a dedicated login. .env.test (gitignored) supplies MSSQL_TEST_CONNECTION_STRING. The login is created once with a generated password (PowerShell, run against localhost\SQLEXPRESS with Windows auth):

$pw = -join ((48..57 + 65..90 + 97..122) | Get-Random -Count 24 | ForEach-Object { [char]$_ }) + 'aZ9!'
sqlcmd -S "localhost\SQLEXPRESS" -E -Q "IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = 'mssql_mcp_test') BEGIN CREATE LOGIN [mssql_mcp_test] WITH PASSWORD = N'$pw', CHECK_POLICY = OFF; ALTER SERVER ROLE [sysadmin] ADD MEMBER [mssql_mcp_test]; END ELSE ALTER LOGIN [mssql_mcp_test] WITH PASSWORD = N'$pw';"
"MSSQL_TEST_CONNECTION_STRING=Server=localhost,1433;Database=master;User Id=mssql_mcp_test;Password=$pw;Encrypt=true;TrustServerCertificate=true" | Set-Content -Encoding utf8 .env.test

.env.test is gitignored; never commit or print its contents.

Known limitations

  • No Windows integrated auth.

  • OUTPUT on tables with triggers (returning in mutations) fails with SQL Server error 334.

  • ONLINE = ON index operations need Enterprise/Azure; Express returns an error.

  • count/exists on queries with ORDER BY but no TOP fall back to client-side streaming.

  • Query Store statistics require Query Store to be enabled; plan-cache statistics are lost on restart / DBCC FREEPROCCACHE.

  • rolledBack transaction count is not exposed by SQL Server DMVs and is always null.

  • Computed and rowversion/timestamp columns are skipped on import and copy (SQL Server error 271 forbids supplying a value for them); the target engine assigns them.

  • Symlinks and junctions inside --workspace-dir are followed: the sandbox validates the path you pass, not where a link inside the workspace points. Do not place links to sensitive locations in a workspace directory.

  • INSTEAD OF triggers defined on views are not listed by mssql_manage_triggers get and cannot be toggled with set_state — both work through sys.tables and ALTER TABLE … ENABLE|DISABLE TRIGGER.

  • The read-only validator for mssql_execute_query is a keyword and structure scan over masked SQL, not a T-SQL parser, and errs on the side of rejection: an unbracketed column named Open, Close, Set, Use, Save, Send or Return is refused — bracket it ([Open]) or alias it. (Add is not affected: ADD is reserved in T-SQL, so it can never be an unbracketed column name.)

  • mssql_export_table_data checks that the output path does not exist and later renames its temp file onto it; those two steps are not atomic, so a file created by another process in between is replaced. The check guards against overwriting a file that was already there, not against a concurrent writer.

  • Without --workspace-dir, the file tools in admin/unsafe can read and write anywhere the server process can reach; you are warned once at startup.

  • Pools created from tool-supplied connection strings are closed after 60 seconds idle (swept every 15 seconds), measured from the last request issued on them and never while a request is in flight; the server's own --connection-string pool is never evicted. A call after eviction simply reconnects.

Available Tools

18 tools
mssql_analyze_databaseC

Analyze SQL Server database configuration and performance

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema for table sizes (defaults to dbo)
analysisTypeNoType of analysis to perform
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'Analyze', which implies a read-only investigation, but it does not state whether the tool modifies anything, what it returns, what permissions are needed, or how the optional connection string behaves. The gap between the vague description and the tool's actual behavior is significant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler, and it front-loads the verb and resource. It is efficient, though arguably too terse to be fully informative on its own.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description needs to explain what the analysis produces, whether it is read-only, and when to prefer it over sibling tools like mssql_monitor_database or mssql_debug_database. It does none of this, and it also omits the 'security' analysis option entirely, leaving the tool incomplete from an agent's perspective.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 even though the description adds no parameter-level detail. The schema already documents schema, analysisType, and connectionString, including the enum values and the --allow-tool-connection-string requirement. The description's mention of 'configuration and performance' covers only two of the three enum values and adds little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Analyze'), a resource ('SQL Server database'), and a scope ('configuration and performance'), so an agent can tell it is an analysis tool. However, it does not distinguish it from sibling tools like mssql_monitor_database or mssql_debug_database, and it omits the 'security' analysis type that appears in the analysisType enum.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool over alternatives such as mssql_monitor_database, mssql_debug_database, or mssql_execute_query. There is no when-to-use, when-not-to-use, or mention of prerequisites like the connection string flag. The available enum values hint at use cases, but the description itself does not provide selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_copy_between_databasesC

Copy data between two SQL Server databases

ParametersJSON Schema
NameRequiredDescriptionDefault
whereNoFilter for source rows (WHERE clause without the keyword)
schemaNoSchema name on both sides (defaults to dbo)
batchSizeNo
tableNameYesTable name (same on both sides)
truncateTargetNoTRUNCATE the target table inside the copy transaction first
sourceConnectionStringYesSource connection string (requires --allow-tool-connection-string)
targetConnectionStringYesTarget connection string (requires --allow-tool-connection-string)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only says 'Copy data,' which implies a write to the target, but it omits important traits such as transactionality, target table prerequisites, truncateTarget behavior, and the --allow-tool-connection-string requirement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It is concise, though it sacrifices useful operational context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 parameters, no output schema, and no annotations, the description is too minimal. It does not explain table existence requirements, transaction scope, batching, truncation behavior, or connection string permissions, leaving significant gaps for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, so the schema already documents most parameters. The description adds no parameter-level detail, but the baseline of 3 applies because the schema carries the load; only batchSize lacks a schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Copy data between two SQL Server databases.' This clearly conveys the core operation, though it does not explicitly differentiate itself from sibling tools like mssql_import_table_data or mssql_export_table_data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives, nor are any prerequisites or exclusions mentioned. An agent would have to infer usage context from the tool name and schema alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_debug_databaseC

Debug common SQL Server issues

ParametersJSON Schema
NameRequiredDescriptionDefault
issueYesIssue to investigate
logLevelNoAccepted for compatibility; ignoredinfo
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior, but 'Debug common SQL Server issues' does not say whether the tool runs read-only diagnostics, changes server state, requires a connection string, or what output to expect. The only behavioral detail is hidden in the schema's logLevel note that it is ignored.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The sentence is short and front-loaded, with no wasted words. However, its brevity is partly under-specification: it skips purpose details, usage context, and behavior while only broadly naming the tool's intent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with three parameters, no output schema, and no annotations, the description is incomplete. It does not explain what 'debug' produces, whether side effects are possible, how connection string handling works, or how this differs from the extensive set of sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains 'issue', 'logLevel', and 'connectionString'. The main description adds no parameter semantics beyond the generic 'common SQL Server issues' phrase, yielding the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a verb and resource ('Debug... SQL Server') and the issue enum (connection, performance, locks, replication) suggests scope, but 'common SQL Server issues' is vague and does not distinguish 'debug' from sibling tools like mssql_analyze_database or mssql_monitor_database.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to choose this tool over the many sibling mssql_* tools. The enum values hint at problem categories, but the description never states conditions for use or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_execute_mutationB

Execute data modification operations (INSERT/UPDATE/DELETE/UPSERT) - operation="insert/update/delete/upsert" with table and data. Examples: operation="insert", table="Users", data={"Name":"John","Email":"john@example.com"}

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNoData object with column-value pairs (required for insert/update/upsert). Values are always bound as parameters.
tableYesTable name for the operation
whereNoWHERE clause for update/delete operations (without WHERE keyword). Use @w1, @w2 (or $1, $2) with whereParameters.
schemaNoSchema name (defaults to dbo)
operationYesMutation operation: insert (add rows), update (modify rows), delete (remove rows), upsert (insert or update)
returningNoColumns to return via OUTPUT: "*" or a comma-separated list
conflictColumnsNoKey columns for upsert (MERGE ... ON)
whereParametersNoParameter values for @w1, @w2, ... placeholders in the where clause
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure, and it falls short. It restates the operation enum but never warns that DELETE removes rows irreversibly or that UPDATE/DELETE without a WHERE clause could affect an entire table. The only behavioral detail (values bound as parameters, connection-string flag requirement) lives in the schema, not in the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence plus one example, with the action verb front-loaded. It is compact and readable with no filler. The pseudo-code example is slightly informal (operation=... data={...} is not valid JSON), but it still earns its place as a quick orientation for the most common call.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a high-complexity tool (9 parameters, 4 operation modes, upsert with conflictColumns, parameterized WHERE placeholders) with no output schema and no annotations, yet the description only illustrates the simplest insert path. It never explains default return behavior without the returning parameter, the where/whereParameters pairing at tool level, or destructive-operation safeguards. The detailed schema compensates partially, but the tool-level description leaves an agent under-informed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with detailed per-parameter text (e.g., where: 'Use @w1, @w2 (or $1, $2) with whereParameters'), so the baseline is 3. The description's example adds a concrete invocation shape for operation+table+data but only demonstrates 3 of 9 parameters, leaving where/returning/conflictColumns to the schema. Net added value over the schema is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Execute data modification operations (INSERT/UPDATE/DELETE/UPSERT)', reinforced by a concrete example (operation="insert", table="Users", data={...}). This clearly conveys scope and sets it apart from read-oriented siblings like mssql_execute_query. However, it never explicitly contrasts with mssql_execute_sql, which could also run DML, so sibling differentiation is implicit rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The worked example implies the invocation pattern: pass operation, table, and data for an insert. But the description gives no explicit guidance on when to prefer this structured tool over the raw mssql_execute_sql sibling, and no exclusion conditions (e.g., use mssql_execute_query for SELECT-only needs). Usage context is inferred from the example, not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_execute_queryA

Execute SELECT queries and data retrieval operations - operation="select/count/exists" with query and optional parameters. Examples: operation="select", query="SELECT * FROM Users WHERE CreatedAt > @p1", parameters=["2024-01-01"]

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of rows to return (safety limit; defaults to 10000 for select)
queryYesSQL SELECT query to execute
timeoutNoQuery timeout in milliseconds
operationYesQuery operation: select (fetch rows), count (count rows), exists (check existence)
parametersNoParameter values for placeholders (@p1, @p2, ... or $1, $2, ...)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing behavior. It communicates that this is a read/retrieval tool and shows parameter binding via @p1, which is useful. However, it does not mention default row limits, timeout behavior, or explicit read-only guarantees beyond the word 'SELECT'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence followed by a representative example. Every element earns its place, and the core purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus schema covers the required inputs, operation modes, and example syntax adequately for a query tool. It does not explicitly differentiate from the similar sibling mssql_execute_sql, and there is no output schema, but the missing output information is inherently query-dependent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful value by showing a concrete example with @p1 and clarifying the relationship between operation, query, and parameters, which helps an agent assemble valid calls.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Execute SELECT queries and data retrieval operations', and further defines the allowed operation set (select/count/exists). This clearly distinguishes it from the mutation-oriented sibling mssql_execute_mutation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The stated scope (SELECT queries and data retrieval) gives a clear context for when to use this tool, and the example reinforces the intended pattern. It does not explicitly name alternatives or exclusion conditions, but the boundary is evident from the operation enum.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_execute_sqlA

Execute arbitrary T-SQL - sql="ANY_VALID_TSQL" with optional parameters, GO batch separators and transaction support. Examples: sql="CREATE INDEX ...", sql="WITH cte AS (...) SELECT ...", transactional=true

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYesT-SQL to execute (any valid SQL Server SQL; GO separators split batches)
timeoutNoQuery timeout in milliseconds (per batch)
expectRowsNoWhether to expect rows back (false for statements like CREATE, DROP, etc.)
parametersNoParameter values for @p1, @p2, ... (or $1, $2, ...) placeholders
transactionalNoWhether to wrap all batches in a single transaction
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden and does reveal key behavior: arbitrary SQL execution, GO batch splitting, optional parameters, and transaction support. However, it does not mention potential destructive side effects, result/return behavior, or permission requirements, so transparency is partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: one clear declarative sentence followed by two illustrative examples. There is no filler, and the core behavior is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema covers all parameters and the description covers invocation patterns and transaction behavior, which is adequate for basic use. However, there is no output schema, and the description does not state what the tool returns (rows, affected counts, etc.), leaving a notable gap for a generic SQL executor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters. The description adds only a high-level mention of optional parameters and a transactional example, providing no additional meaning beyond what the input schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes arbitrary T-SQL, with examples spanning DDL (CREATE INDEX) and a CTE SELECT, so its generic scope is evident. However, it does not explicitly contrast itself with siblings like mssql_execute_query or mssql_execute_mutation, leaving some boundary inference to the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'arbitrary T-SQL' and the examples imply this is the general-purpose runner, but the description never states when to prefer it over the specialized sibling tools or when not to use it. No exclusions or alternative routing guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_export_table_dataB

Export table data to JSON or CSV format

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum rows to export
whereNoWHERE clause without the WHERE keyword
formatNojson
schemaNoSchema name (defaults to dbo)
delimiterNoCSV delimiter,
overwriteNoReplace the output file if it already exists
tableNameYesTable to export
outputPathYesPath to save the exported data (.json or .csv); relative paths resolve against --workspace-dir or the working directory
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral disclosure burden. It only says 'Export table data' and does not disclose that this creates a file on disk, respects overwrite=false by default, or that an optional connection string requires --allow-tool-connection-string. These are important side-effect and permission details that are left entirely to the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It is concise and immediately states the core operation. It loses a point because it is so terse that it omits the file-writing nature and any usage distinction, which may be more important than brevity for a tool with nine parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, nine parameters, and many sibling tools, this description is not complete enough for reliable invocation. It does not explain output file behavior, overwrite semantics, the optional connection string flag, or how this differs from query/import tools. The schema fills some gaps, but the description itself provides only a high-level label.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high at 89%, so the parameter definitions already carry most of the meaning. The description adds only the high-level format idea ('JSON or CSV'), which is already present in the format enum. With this coverage level, the baseline of 3 is appropriate; the description neither substantially helps nor hurts parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Export'), a resource ('table data'), and the target formats ('JSON or CSV'). This clearly distinguishes it from read/query tools like mssql_execute_query and from the inverse mssql_import_table_data. However, it does not explicitly say 'to a file' or mention filtering, so it is clear but not maximally differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for exporting table data into JSON/CSV, which is a reasonable inference from both the name and the phrasing. But it provides no explicit guidance about when to choose this tool over mssql_execute_query or mssql_import_table_data, and no exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_import_table_dataC

Import data from JSON or CSV file into a table

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNojson
schemaNoSchema name (defaults to dbo)
batchSizeNo
delimiterNoCSV delimiter,
inputPathYesPath to the .json (array of objects) or .csv file
tableNameYesTarget table
truncateFirstNoTRUNCATE the table inside the import transaction first
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden of behavioral disclosure. It only says 'Import data', which hints at a write operation, but it does't disclose that the table may be truncated first, that inserts are batched, that a connection string may be required, or that the operation is transactional. These meaningful behaviors are left to the schema or entirely undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded, waste-free sentence conveys the essential operation. There is no repetition of schema details, no filler, and the key semantic elements (import, format, file, table) appear in the expected order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 parameters, no output schema, no annotations, and many sibling tools, the description is underspecified. It does not clarify whether this is a mutating operation beyond the word 'import', when truncateFirst would be relevant, how connection strings are resolved, or what failure modes exist (e.g., file not accessible, schema mismatch).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so most parameters are already explained in the input schema. The description reinforces that the file is JSON/CSV and the target is a table, but it adds no new meaning for batching, delimiter, truncation, or connection string semantics. The two bare schema parameters (format and batchSize) receive no help from the description either.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the action (Import), the source data type (JSON or CSV file), and the target (table), making the core purpose clear. It is semantically distinct from the obvious sibling mssql_export_table_data, but it doesn't explicitly call out the difference from generic mutation tools such as mssql_execute_mutation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance about when to choose this tool over alternatives like mssql_execute_mutation or mssql_execute_sql, nor does it mention prerequisites such as accessible file paths or connection string requirements. Usage is only vaguely implied by the word 'Import'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_commentsA

Manage SQL Server object descriptions (MS_Description extended properties) - get, set, remove comments on tables, columns, functions, and other objects. Examples: operation="get" with objectType="table", objectName="Users", operation="set" with comment text, operation="bulk_get" for discovery

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema name (defaults to dbo)
commentNoComment text (required for set operation)
operationYesOperation: get (retrieve comments), set (add/update comment), remove (delete comment), bulk_get (discovery mode)
tableNameNoParent table (required for index/constraint/trigger)
columnNameNoColumn name (required when objectType is "column")
objectNameNoName of the object (required for get/set/remove)
objectTypeNoType of database object (required for get/set/remove)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
filterObjectTypeNoFilter by object type in bulk_get operation
includeSystemObjectsNoInclude system objects in bulk_get

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not state that remove is destructive/deletes extended properties, whether set overwrites existing comments, what permissions are required, or what the tool returns. The description mostly restates the operation names rather than revealing side effects or runtime behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence followed by compact examples. It front-loads the core purpose and operation set, and the examples are informative rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives enough examples to make basic calls correctly, and the schema covers parameter details. However, with 10 parameters, no annotations, and no output schema, it omits return-value behavior, error cases, permission prerequisites, and the destructive impact of remove, leaving an agent under-informed for edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents all parameters with 100% coverage, but the description adds useful examples that clarify parameter relationships, such as using operation='set' with comment text and operation='bulk_get' for discovery. It does not explain all conditional dependencies like tableName for index/constraint/trigger, but the schema already handles those.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool manages SQL Server object descriptions via MS_Description extended properties, with explicit get, set, remove, and bulk_get operations. Examples with operation/objectType/objectName make the tool's scope concrete and help distinguish it from sibling tools that manage indexes, constraints, triggers, or functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides operation examples that imply when the tool is useful, but it never explicitly says when to use this tool versus alternatives like mssql_execute_query, mssql_execute_mutation, or other mssql_manage_* tools. There is no exclusionary guidance or mention of when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_constraintsA

Manage SQL Server constraints - get, create foreign keys, drop foreign keys, create constraints, drop constraints. Examples: operation="get" to list constraints, operation="create_fk" with constraintName, tableName, columnNames, referencedTable, referencedColumns

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema name (defaults to dbo)
cascadeNoAccepted for compatibility; SQL Server DROP CONSTRAINT has no CASCADE
ifExistsNoInclude IF EXISTS clause (for drop_fk/drop operations)
onDeleteNoON DELETE action (for create_fk); RESTRICT maps to NO ACTIONNO ACTION
onUpdateNoON UPDATE action (for create_fk); RESTRICT maps to NO ACTIONNO ACTION
clusteredNoCLUSTERED index for primary_key (default true) / unique (default false)
operationYesOperation: get (list constraints), create_fk (foreign key), drop_fk (drop foreign key), create (constraint), drop (constraint)
tableNameNoTable name (optional filter for get, required for create_fk/drop_fk/create/drop)
deferrableNoNot supported by SQL Server; true is rejected
columnNamesNoColumn names in the table (required for create_fk and unique/primary_key create)
constraintNameNoConstraint name (required for create_fk/drop_fk/create/drop)
constraintTypeNoFilter by constraint type (for get operation)
checkExpressionNoCheck expression (for create operation with check constraints)
referencedTableNoReferenced table name (required for create_fk)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
referencedSchemaNoReferenced table schema (for create_fk, defaults to same as table schema)
initiallyDeferredNoNot supported by SQL Server; true is rejected
referencedColumnsNoReferenced column names (required for create_fk)
constraintTypeCreateNoType of constraint to create (for create operation)

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description and schema carry the full behavioral burden. The description does disclose the operation set, and the schema documents several genuine behavioral traits: CASCADE is accepted but ignored, RESTRICT maps to NO ACTION, deferrable/initiallyDeferred are rejected with true, and clustered defaults differ per constraint type. However, tool-level effects such as the irreversibility of drop operations, transaction/commit behavior, and what the get operation returns are left undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler; the operation enumeration is front-loaded and the example sentence carries dense invocation knowledge. The dash-heavy structure is slightly crammed and would scan better as a list, but every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high complexity (19 parameters, 5 operations, destructive DDL, no annotations, no output schema), the definition is adequate but gapped. The schema descriptions cover per-parameter requirements for every operation, which compensates substantially. But the tool-level description omits return semantics for get, provides no warning about the referential-integrity impact of drops despite having no safety annotations, and only exemplifies two of five operations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, establishing a baseline of 3. The description adds co-occurrence semantics above that baseline: the create_fk example binds constraintName, tableName, columnNames, referencedTable, and referencedColumns into a single valid parameter group, which is relational knowledge a flat schema does not directly convey. It loses a point because only two of the five operations get such grouping examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource ('SQL Server constraints') and enumerates the five supported operations (get, create_fk, drop_fk, create, drop) followed by worked examples. This makes the tool clearly distinct from constraint-adjacent siblings like mssql_manage_indexes. It loses the top mark because the verb 'manage' is broad and the opening clause partially restates the tool's own name without naming what the tool is not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: the constraint-specific resource and the per-operation examples suggest when to invoke it, and the sibling set (mssql_manage_indexes, mssql_manage_triggers, mssql_manage_schema) makes the division of labor inferable. However, there is no explicit statement of when to use this tool versus alternatives, no exclusion criteria, and no guidance on how it composes with mssql_execute_query or mssql_analyze_database.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_functionsA

Manage SQL Server functions and stored procedures - get, create, or drop with a single tool. Examples: operation="get" to list, operation="create" with functionName="fn_total", parameters="@price DECIMAL(10,2), @tax DECIMAL(5,2)", returnType="DECIMAL(10,2)", functionBody="RETURN @price + (@price * @tax)"

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema name (defaults to dbo)
cascadeNoAccepted for compatibility; no effect
replaceNoUse CREATE OR ALTER
ifExistsNoInclude IF EXISTS clause (for drop operation)
languageNoOnly T-SQL is supportedtsql
securityNoEXECUTE AS CALLER (INVOKER) or OWNER (DEFINER)INVOKER
operationYesOperation to perform: get (list/info), create (new function or procedure), or drop (remove)
objectTypeNofunction (default for create/drop) or procedure; filters get when supplied
parametersNoParameter list, e.g. "@a INT, @b nvarchar(50)". Use "" for no parameters
returnTypeNoFunction return type: scalar type, "TABLE" (inline TVF) or "@name TABLE (...)" (multi-statement TVF). Not used for procedures
volatilityNoAccepted for compatibility; ignored by SQL Server
functionBodyNoModule body (T-SQL). BEGIN/END or RETURN wrappers are added automatically when missing
functionNameNoName of the function/procedure (required for create/drop, optional for get to filter)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

A3.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral disclosure burden. It only restates the operation labels (get, create, drop) which are already documented in the schema, and offers no warning about destructive side effects, permissions, reversibility, or what the operation actually does to the database. The example illustrates inputs but not behavioral consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is on sentence with a front-loaded purpose and an illustrative example, with no filler or redundant content. It is appropriately sized for the tool's scope and easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The rich schema compensates for much of the missing detail, but the description alone leaves gaps for a 14-parameter, no-annotation tool. It shows only a CREATE FUNCTION example, mentions stored procedures without any example, and does not surface conditionally required fields like functionName for create/drop. Get and drop behavior would rely entirely on the schema. Overall it is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the structured fields already document all 14 parameters. The description adds value by showing a concrete composed CREATE FUNCTION example that demonstrates how functionName, parameters, returnType, and functionBody relate to each other. This is genuinely useful beyond the per-parameter schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (SQL Server functions and stored procedures) and gives explicit verbs (get, create, drop), so an agent can clearly tell what this tool does. It also distinguishes itself from sibling tools like mssql_manage_triggers or mssql_execute_query by targeting function/procedure DDL management. The example reinforces the purpose with concrete operation usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: when managing SQL Server functions or stored procedures via get/create/drop operations. It does not explicitly contrast against alternatives such as mssql_execute_query or mssql_manage_schema, but the resource scope is a sufficiently clear routing signal. It provides context without explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_indexesB

Manage SQL Server indexes - get, create, drop, rebuild/reorganize, and analyze usage with a single tool. Examples: operation="get" to list indexes, operation="create" with indexName, tableName, columns, operation="analyze_usage" for performance analysis

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoReindex moderebuild
typeNoType of target for reindex (required for reindex operation)
whereNoFilter predicate for a filtered index (for create operation)
methodNoIndex type (for create operation)nonclustered
schemaNoSchema name (defaults to dbo)
targetNoTarget name for reindex (required for reindex operation)
uniqueNoCreate unique index (for create operation)
cascadeNoAccepted for compatibility; SQL Server DROP INDEX has no CASCADE
columnsNoKey column names (required for create, except clustered columnstore)
includeNoINCLUDE columns (for create operation)
ifExistsNoInclude IF EXISTS clause (for drop operation)
indexNameNoIndex name (required for create/drop)
operationYesOperation: get (list indexes), create (new index), drop (remove index), reindex (rebuild/reorganize), analyze_usage (find unused/duplicate)
tableNameNoTable name (optional for get/analyze_usage/drop, required for create)
concurrentNoBuild ONLINE (for create operation; Enterprise/Azure only)
showUnusedNoInclude unused indexes (for analyze_usage operation)
ifNotExistsNoSkip creation when the index exists (for create operation)
includeStatsNoInclude usage statistics (for get operation)
minSizeBytesNoMinimum index size in bytes (for analyze_usage operation)
showDuplicatesNoDetect duplicate indexes (for analyze_usage operation)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It only lists operation names and gives a few examples; it does not warn about destructive drop behavior, rebuild/reorganize locking or availability impact, permission requirements, or the connectionString restriction that requires --allow-tool-connection-string.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact: two sentences covering scope and representative examples. It front-loads the tool's purpose and avoids filler. A bulleted list or operation table might be more scannable, but the current structure wastes little space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite rich schema coverage, this is a 21-parameter, five-operation tool with no annotations and no output schema. The description covers examples for only three operations and omits drop and reindex guidance, operation-specific parameter combinations, destructive-operation cautions, and any indication of what the tool returns. That is a significant gap for an agent selecting among many sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description's examples add marginal clarity by pairing operation='create' with indexName, tableName, and columns, but this largely repeats what the schema already documents as required-for-create. It does not add meaningful new meaning for most of the 21 parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource (SQL Server indexes) and enumerates the specific operations: get, create, drop, rebuild/reorganize, and analyze usage. It establishes an index-focused scope that distinguishes it from sibling tools like mssql_manage_schema or mssql_execute_query, though it leans on the broad verb 'manage' rather than a single precise action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The examples imply usage: operation='get' for listing indexes, operation='create' for creating, and operation='analyze_usage' for performance analysis. However, there is no explicit statement about when to prefer this tool over alternatives, no when-not guidance, and no mention of related tools such as mssql_execute_query or mssql_analyze_database.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_queryB

Manage SQL Server query analysis and performance - operation="explain" for execution plans, operation="get_slow_queries" for slow query analysis (Query Store or plan cache), operation="get_stats" for query statistics, operation="reset_stats" for clearing statistics

ParametersJSON Schema
NameRequiredDescriptionDefault
costsNoAccepted for compatibility; ignored
limitNoNumber of queries to return (for get_slow_queries/get_stats operations)
queryNoSQL query to explain (required for explain operation)
formatNoOutput format (for explain operation); json = XML plan plus extracted metricsjson
analyzeNoActual plan (SET STATISTICS XML) - executes the query (for explain operation)
buffersNoAccepted for compatibility; ignored
orderByNoSort order (for get_slow_queries and get_stats operations)mean_time
queryIdNoSpecific query ID (Query Store query_id) or 0x plan_handle (plan cache) to reset; resets all if not provided
verboseNoAccepted for compatibility; ignored
minCallsNoMinimum number of calls (for get_stats operation)
operationYesOperation: explain (estimated or actual execution plan), get_slow_queries, get_stats (with cache hit ratios), reset_stats (clear plan cache / Query Store stats)
minDurationNoMinimum average duration in milliseconds (for get_slow_queries operation)
queryPatternNoFilter queries containing this pattern (for get_stats operation)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
includeNormalizedNoAccepted for compatibility; ignored

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does state what each operation does, including that reset_stats clears statistics, which hints at mutating behavior. But it does not warn that reset_stats is destructive, that explain with analyze=true executes the query, or that some operations may require elevated permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the tool's purpose and then lists all four operations with their purposes. It wastes no words, though the long dash-separated enumeration could benefit from a more structured format for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives a sufficient high-level operation map for a 15-parameter dispatcher tool, and the rich schema fills in most invocation details. It lacks guidance on output shape, side effects, connection requirements, and when to choose this tool over database-level analysis tools, so it is complete enough only in combination with the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents every parameter, including enums, defaults, and operation-specific applicability. The tool description adds no parameter-level detail, which is acceptable given the strong schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly maps the tool to SQL Server query analysis and performance and enumerates four concrete operations: explain, get_slow_queries, get_stats, and reset_stats. It is much more specific than a mere restatement of the tool name, though it does not explicitly differentiate it from overlapping siblings like mssql_analyze_database or mssql_monitor_database.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Each operation has an implied use case ('operation="explain" for execution plans', 'operation="get_slow_queries" for slow query analysis'), which gives reasonable context. However, there is no explicit guidance about when to use this tool instead of related siblings, nor any when-not-to-use or exclusion notes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_rlsB

Manage SQL Server Row-Level Security - security policies with generated predicate functions. Examples: operation="create_policy" with tableName, policyName, predicateColumns=["TenantId"], using="@TenantId = CAST(SESSION_CONTEXT(N'TenantId') AS int)"

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoNot supported: SQL Server policies apply to all principals
checkNoBLOCK predicate expression over @Column parameters (optional)
rolesNoNot supported: SQL Server policies apply to all principals
usingNoFILTER predicate expression over @Column parameters (required for create_policy unless command is INSERT/UPDATE/DELETE)
schemaNoSchema name (defaults to dbo)
commandNoWhich block operations the check predicate applies to (SELECT = filter only)ALL
replaceNoDrop and recreate the policy if it exists (for create_policy)
ifExistsNoInclude IF EXISTS clause (for drop_policy)
operationYesOperation: enable/disable policies on a table, create_policy, edit_policy, drop_policy, get_policies
tableNameNoTable name (required for enable/disable/create_policy/edit_policy, optional filter for get_policies)
policyNameNoPolicy name (required for create_policy/edit_policy/drop_policy)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
predicateColumnsNoColumns passed to the predicate functions; reference them as @Column in using/check

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry behavioral disclosure, but it only says 'Manage' and 'generated predicate functions'. It does not mention that create/edit/drop/replace operations are persistent DDL changes, that get_policies is a read operation, or that connectionString requires an explicit flag. Even the replace and ifExists behaviors are left entirely to the schema rather than the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded: the purpose is stated first, followed by a single illustrative example. There is no filler, but the example's internal inconsistency slightly tarnishes its structural value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (13 params, 6 operations, no output schema) and has no annotations, yet the description is quite sparse. It provides a high-level orientation and one create_policy example, while the rich schema descriptions cover the operational details; however, it omits any sense of what operations return and does not orient the agent to edit/drop/get flows, making it only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all 13 parameters (100%), setting a baseline of 3, but the description's attempt to illustrate parameter use is flawed: it uses predicateColumns=['TenantId'] while the using expression references '@TenId', contradicting the schema rule that columns are referenced as @Column. This mismatch could lead an agent to generate an invalid predicate, so the example does more harm than good.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific domain ('SQL Server Row-Level Security') and an actionable verb ('Manage'), and reinforces it with a concrete create_policy example that names the key parameters. Among eighteen sibling tools, only this one targets RLS policies, so it is clearly distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The example demonstrates a valid invocation (operation='create_policy', tableName, policyName, predicateColumns, using), which gives an agent a concrete usage pattern. However, it never explicitly says when to prefer this tool over the many other mssql_manage_* siblings, or when not to use it. The guidance is implied by the RLS scope rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_schemaA

Manage SQL Server schema - get schema info, create/alter tables, manage enum-style CHECK constraints. Examples: operation="get_info" for table lists, operation="create_table" with tableName and columns, operation="get_enums" to list IN-list CHECK constraints, operation="create_enum" with enumName, tableName, columnName and values

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema name (defaults to dbo)
valuesNoAllowed values (required for create_enum)
columnsNoColumn definitions (required for create_table)
enumNameNoCHECK constraint name (optional filter for get_enums, required for create_enum)
operationYesOperation: get_info (schema/table info), create_table (new table), alter_table (modify table), get_enums (list IN-list CHECK constraints), create_enum (new IN-list CHECK constraint)
tableNameNoTable name (optional for get_info to get specific table info, required for create_table/alter_table/create_enum)
columnNameNoColumn the enum CHECK applies to (required for create_enum)
operationsNoAlter operations (required for alter_table)
ifNotExistsNoInclude IF NOT EXISTS guard (for create_enum)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden of behavioral disclosure, and it discloses essentially none. It never warns that create_table, alter_table (whose schema supports 'drop' operations), and create_enum are permanent DDL mutations, nor does it mention privilege requirements, transactional behavior, or failure modes. An agent gets no behavioral context beyond the operation names.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded summary sentence followed by four thumbnall examples with zero filler. The content is scannable in one pass, and no sentence wastes the agent's attention.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, 5-opration tool with nested objects, no output schema, and no annotations, the description covers 4 of 5 operations in examples - alter_table is only named, never exemplified. It also omits any behavioral or permission guidance and any sibling delegation advice. The extensive schema masks these gaps, but the description alone would give an agent an incomplete picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents per-operation requirements ('required for create_enum', 'required for alter_table'), so the baseline is 3. The description's examples restate those groupings ('operation="create_table" with tableName and columns'), which is helpful but largely redundant with the schema's own per-parameter notes. No parameter is left undocumented across both sources.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific scope - 'get schema info, create/alter tables, manage enum-style CHECK constraints' - and backs it with four concrete examples ('operation="get_info" for table lists', 'operation="create_table" with tableName and columns'). This clearly separates it from raw-execution siblings like mssql_execute_query and mssql_execute_sql, which lack a DDL operation grammar of their own.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The examples give explicit per-opration routing: 'operation="get_info" for table lists' and 'operation="create_enum" with enumName, tableName, columnName and values'. This is clear context for choosing among the five operations, though it never states when not to use the tool or names alternatives such as mssql_manage_constraints for non-enum CHECK constraints.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_triggersA

Manage SQL Server DML triggers - get, create, drop, and enable/disable triggers. Examples: operation="get" to list triggers, operation="create" with triggerName, tableName and triggerBody (or functionName to EXEC a procedure), operation="set_state" with triggerName, tableName, enable

ParametersJSON Schema
NameRequiredDescriptionDefault
whenNoNot supported by SQL Server; rejected when supplied
enableNoWhether to enable the trigger (required for set_state operation)
eventsNoTrigger events (TRUNCATE is rejected)
schemaNoSchema name (defaults to dbo)
timingNoTrigger timing (BEFORE is rejected: SQL Server has no BEFORE triggers)AFTER
cascadeNoAccepted for compatibility; no effect
forEachNoSQL Server triggers are statement-level; ROW is rejectedSTATEMENT
replaceNoUse CREATE OR ALTER
ifExistsNoInclude IF EXISTS clause (for drop operation)
operationYesOperation: get (list triggers), create (new trigger), drop (remove trigger), set_state (enable/disable trigger)
tableNameNoTable name (optional filter for get, required for create/set_state)
triggerBodyNoTrigger body T-SQL (required for create unless functionName is given)
triggerNameNoTrigger name (required for create/drop/set_state)
functionNameNoStored procedure to EXEC as the trigger body (alternative to triggerBody)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral disclosure burden. It does disclose the major behaviors: list, create, drop, and enable/disable, and mentions that create can 'EXEC a procedure' as the trigger body. However, it does not describe side effects such as the permanence of drops, required permissions, whether changes persist immediately, or what the operation returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loads the core purpose, and packs the operation examples into a compact, scannable format. Every clause earns its place without unnecessary filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus the detailed schema covers operation selection and parameter usage well, including SQL Server incompatibilities in the schema. However, there is no output schema, and the description does not explain return values, error behavior, or prerequisites/permissions, which leaves the agent with some uncertainty for a tool that can create and drop database objects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value beyond the schema by specifying operation-specific parameter groupings, e.g. 'create' requires triggerName, tableName, and triggerBody (or functionName), and 'set_state' requires triggerName, tableName, and enable. This helps an agent assemble correct calls.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource ('SQL Server DML triggers') and enumerates the exact operations: 'get, create, drop, and enable/disable triggers.' This clearly distinguishes it from sibling tools like mssql_manage_indexes or mssql_manage_functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete usage patterns via examples: 'operation="get" to list triggers', 'operation="create" with triggerName, tableName and triggerBody', and 'operation="set_state" with triggerName, tableName, enable'. This gives clear context for when to use each operation, though it does not explicitly state exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_manage_usersA

Manage SQL Server logins, database users and permissions - create, drop, alter users, grant/revoke permissions. Examples: operation="create" with username="app_user", password="...", operation="grant" with username, permissions, target, targetType

ParametersJSON Schema
NameRequiredDescriptionDefault
loginNoEnable/disable the login
schemaNoSchema of object targets (defaults to dbo); filter for get_permissions
targetNoTarget object/schema/database name (for grant/revoke operations)
cascadeNodrop: transfer owned schemas to dbo first; revoke: CASCADE
inheritNoAccepted for compatibility; reported as unsupported
createdbNodbcreator server role (unsupported on Azure SQL Database)
ifExistsNoInclude IF EXISTS clause (for drop operation)
passwordNoPassword (required for create; optional for alter)
userTypeNologin = server login + database user; contained = database-scoped user; auto = contained on Azure SQL Database, login elsewhereauto
usernameNoUser name (required for create/drop/alter/grant/revoke, optional filter for get_permissions/list)
operationYesOperation: create (login + user, or contained user), drop, alter, grant, revoke, get_permissions, list
superuserNosysadmin server role (db_owner on Azure SQL Database)
createroleNosecurityadmin server role (db_securityadmin on Azure SQL Database)
targetTypeNoType of target (for grant/revoke; filter for get_permissions)
validUntilNoAccepted for compatibility; reported as unsupported
permissionsNoPermissions to grant/revoke
replicationNoAccepted for compatibility; reported as unsupported
connectionLimitNoAccepted for compatibility; reported as unsupported
withGrantOptionNoAllow the user to grant these permissions to others (for grant operation)
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
includeSystemRolesNoInclude system principals (for list operation)

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions potentially destructive operations like drop and revoke but does not disclose side effects, required privileges, Azure SQL differences, behavior of compatibility-only parameters, or consequences like cascading. The schema fields hint at these but the description itself is thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The first sentence defines the tool's purpose and scope; the second provides concrete example parameter groupings. The most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex 21-parameter tool with no output schema and no annotations, yet the description only covers two operation examples. It does not explain operation-specific required parameters, return behavior, Azure SQL behavioral differences, or how unsupported compatibility parameters are handled. Given the tool's complexity, the description is under-specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by showing realistic parameter combinations: operation='create' with username/password and operation='grant' with username, permissions, target, targetType. This helps the agent understand how parameters relate to operations beyond the individual schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource domain (SQL Server logins, database users, permissions) and enumerates exact operations (create, drop, alter, grant, revoke, get_permissions, list). This clearly differentiates it from sibling tools like mssql_manage_schema or mssql_execute_query by scope and action type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for user and permission administration through its operation list and examples, but it does not explicitly state when to choose this tool over alternatives like mssql_execute_query or mssql_execute_mutation. No exclusion conditions or alternative tool references are given, leaving selection to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mssql_monitor_databaseC

Get real-time monitoring information for a SQL Server database

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema for table metrics (defaults to dbo)
includeLocksNo
includeTablesNo
includeQueriesNo
alertThresholdsNoAlert thresholds
connectionStringNoSQL Server connection string (optional; requires --allow-tool-connection-string)
includeReplicationNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral disclosure. It does convey a read-only, current-state operation through 'Get' and 'real-time', but it omits specifics such as connection requirements, how the include flags alter behavior, what metrics are returned, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that is easy to scan and contains no filler. Brevity comes at the expense of substance, but that is a completeness problem rather than a conciseness problem.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has seven parameters, a nested alertThresholds object, no output schema, and no annotations, yet the description only restates the basic monitoring purpose. It does not explain return data, parameter effects, or prerequisites, so an agent cannot confidently predict behavior from this definition alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter-specific meaning and does not compensate for the low 43% schema description coverage. The seven parameters, including includeLocks, includeTables, includeQueries, includeReplication, and alertThresholds, receive no explanatory help from the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Get') and a resource ('SQL Server database'), and the qualifier 'real-time monitoring information' gives a clear purpose. It does not explicitly contrast with mssql_analyze_database or mssql_debug_database, and 'monitoring information' remains somewhat generic.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus siblings like mssql_execute_query, mssql_analyze_database, or mssql_execute_sql. The phrase 'real-time' implies operational monitoring, but there is no explicit when-to-use or when-not-to-use direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 18 tool updatesv0.1.1
    • First observedmssql_analyze_database
    • First observedmssql_copy_between_databases
    • First observedmssql_debug_database
    • First observedmssql_execute_mutation
    • First observedmssql_execute_query
    • First observedmssql_execute_sql
    • First observedmssql_export_table_data
    • First observedmssql_import_table_data
    • First observedmssql_manage_comments
    • First observedmssql_manage_constraints
    • First observedmssql_manage_functions
    • First observedmssql_manage_indexes
    • First observedmssql_manage_query
    • First observedmssql_manage_rls
    • First observedmssql_manage_schema
    • First observedmssql_manage_triggers
    • First observedmssql_manage_users
    • First observedmssql_monitor_database

TDQS

B3.3/5.0

Scored across 18 tools

Disambiguation3/5

Most tools target distinct resources (indexes, constraints, triggers, users), but there is overlap among execute_query, execute_mutation, and execute_sql, and between analyze_database, monitor_database, debug_database, and manage_query for performance/diagnostic work. Descriptions help somewhat, but an agent could still pick the wrong tool for custom T-SQL or monitoring.

Naming Consistency5/5

All tools follow the mssql_<verb>_<object> snake_case pattern with predictable verbs like execute, manage, analyze, export, import, and copy. The naming is highly consistent and easy to navigate.

Tool Count4/5

18 tools is slightly above the typical 3-15 well-scoped range, but the broad SQL Server administration scope justifies most entries. Each tool encapsulates a meaningful subdomain, so the count is reasonable if a bit heavy.

Completeness4/5

The surface covers data operations, schema, indexes, constraints, functions/procedures, triggers, RLS, users, comments, query performance, import/export, and database copying. Dedicated backup/restore and database-level lifecycle tools are missing, though arbitrary T-SQL via mssql_execute_sql provides a workaround.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    Not graded
    maintenance
    Enables AI assistants to interact with both local SQL Server and Azure SQL Database through natural language, supporting queries, data manipulation, and schema operations with built-in security features.
    8
    2,348 npm
    1
    -
  • A
    license
    B
    quality
    C
    maintenance
    Enables AI agents to interact with Microsoft SQL Server databases via MCP, supporting table listing, schema retrieval, and CRUD operations.
    3
    1
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to connect to Microsoft SQL Server via the MCP protocol, supporting database schema queries, data reading, and arbitrary SQL execution.
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    A read-only MCP server for Microsoft SQL Server that enables AI agents to safely explore and query SQL Server databases.
    385 npm
    MIT