MS SQL Server MCP Server
MS SQL Server MCP サーバー
Microsoft SQL Server 向けの安全な読み取り専用 Model Context Protocol (MCP) サーバー。パフォーマンス監視とロック検出を内蔵しています。
📦 npm: @piyapat/mssql-mcp-server
要件
Node.js 22 以降。 v2.0.2 で 18 から引き上げられました:
mssql12 はtedious20 に依存しており、これには Node 22 が必要です。SQL Server 2019 (15.x)、2022 (16.x)、または 2025 (17.x) — Express を含むすべてのエディション。Azure SQL Database はクエリ/スキーマツールで動作します。
mssql_test_connectionのエディション別の注意事項を参照してください。
Related MCP server: mssql-explorer-mcp
npx によるクイックスタート
npx を使用すると、インストールなしでこの MCP サーバーを直接実行できます:
npx @piyapat/mssql-mcp-serverインストール
オプション 1: npx で使用する(テスト推奨)
# Run directly with environment variables
MSSQL_SERVER=localhost \
MSSQL_DATABASE=mydb \
MSSQL_USER=readonly \
MSSQL_PASSWORD=password \
npx @piyapat/mssql-mcp-serverオプション 2: グローバルインストール
# Install globally
npm install -g @piyapat/mssql-mcp-server
# Run
mssql-mcp-serverオプション 3: ローカルインストール
# Clone and install
git clone https://github.com/PiyapatRag/mssql-mcp-server.git
cd mssql-mcp-server
npm install
npm run build
# Run
npm start設定
ステップ 1: .env ファイルを作成する(推奨)
資格情報は .env ファイルに置きます — MCP クライアントの JSON 設定にハードコードしないでください:
cp .env.example .env
# then edit .env with your credentialsサーバーは次の順序で .env ファイルを探します(最初に見つかったものが優先):
MSSQL_ENV_FILEで指定されたパス(明示的な上書き)現在の作業ディレクトリの
.envプロジェクトルート(
package.jsonの隣)の.env
MCP クライアントの "env" ブロックで既に設定された変数は常に .env ファイルより優先され、.env は git で無視されます。
ステップ 2: Claude Desktop をサーバーに向ける
Claude Desktop の設定を編集します:
Windows: %APPDATA%\Claude\claude_desktop_config.json
macOS/Linux: ~/Library/Application Support/Claude/claude_desktop_config.json
プロジェクトルートに .env があれば、JSON に資格情報は一切不要です:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["C:\\path\\to\\mssql-mcp-server\\build\\index.js"]
}
}
}.env が別の場所にある場合は、そのパスのみを渡します:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["C:\\path\\to\\mssql-mcp-server\\build\\index.js"],
"env": {
"MSSQL_ENV_FILE": "C:\\secure\\location\\mssql.env"
}
}
}
}"env" ブロックで直接変数を設定することも引き続き可能です(.env ファイルより優先されます)— npx セットアップや、複数のサーバーを異なるデータベースに対して実行する場合に便利です。
環境変数
変数 | 説明 | デフォルト | 必須 |
| SQL Server のホスト名または IP |
| はい |
| データベース名 | - | はい |
| SQL Server ユーザー名( | - | はい |
| パスワード | - | はい |
| Windows/NTLM ドメイン。設定すると、SQL 認証の代わりに Windows 認証が使用されます | - | いいえ |
| SQL Server のポート |
| いいえ |
| 接続を暗号化するかどうか(true/false)。リテラル |
| いいえ |
| 証明書の検証をスキップするかどうか(true/false)。オプトイン — 本番ではオフのままにしてください |
| いいえ |
|
|
| いいえ |
| 読み取り専用モードで | - | いいえ |
|
| - | いいえ |
| クエリのタイムアウト(ミリ秒) |
| いいえ |
| プールされる接続の最大数 |
| いいえ |
| すべてのツール呼び出しを stderr に 1 行の JSON として記録します(ツール、モード、切り詰められたクエリ、行数、所要時間、結果)。無効にするには |
| いいえ |
| ドライバーの完全なエラーテキストをクライアントに返します。デフォルトではオフ: エラーは最初の行に切り詰められるため、失敗したクエリでスキーマを推測できません。完全な詳細は常に stderr に出力されます |
| いいえ |
サーバーモード
読み取り専用モード(MSSQL_READ_ONLY=true、デフォルト)
mssql_query は次のもののみを受け付けます:
単一の
SELECT/WITH...SELECTDECLARE、INSERT、またはCREATE TABLE #...で始まり、セッションローカルの#tempテーブル /@table変数のみに書き込む複数ステートメントのバッチ — 例:INSERT INTO #t SELECT ...またはCREATE TABLE #t (...); INSERT INTO #t ...; SELECT * FROM #t。CREATE INDEX ... ON #t、TRUNCATE/ALTER/DROP TABLE #tもそのようなバッチ内で許可されます。グローバル##tempテーブルは決して許可されません(すべてのセッションから見えるため、永続的と見なされます)。永続テーブルに書き込まない定義を持つ、ホワイトリスト登録されたプロシージャの
EXEC
それ以外はすべて拒否されます: 永続オブジェクトへの書き込み/DDL、動的 SQL、バッチ内の EXEC(プロシージャのホワイトリストを回避するのを防ぐ)、DBCC、および SELECT/WITH/EXEC の後のスタックされたステートメント。
書き込みモード(MSSQL_READ_ONLY=false)
INSERT / UPDATE / DELETE / DDL は許可されますが、モードに関係なく以下は常にブロックされます:
xp_cmdshell、xp_reg*(読み取りと書き込み)、xp_dirtree、xp_fileexist、sp_OA*、sp_configure、RECONFIGURE、SHUTDOWN、KILL、DROP DATABASE、ALTER DATABASE、RESTORE、BULK INSERT、CREATE ASSEMBLY、CREATE/ALTER/DROP LOGIN/USER/CREDENTIAL/CERTIFICATE、ALTER SERVER、ALTER SERVER ROLE/ALTER ROLE、sp_addrolemember/sp_addsrvrolemember/sp_droprolemember、sp_addlinkedserver、EXECUTE AS、sp_executesql、GRANT/DENY/REVOKE、OPENROWSET/OPENDATASOURCE/OPENQUERY、およびサーバーサイドのファイルリーダー fn_get_audit_file、fn_xe_file_target_read_file、fn_trace_gettable、sp_readerrorlog/xp_readerrorlog。
⚠️ 書き込みモードは、自身の権限も同様に制限された SQL ログインでのみ使用してください — データベースログインが引き続き主要なセキュリティ境界です。
主な機能
セキュリティ最優先
✅ 2 層の読み取り専用強制 - データベースの読み取り専用ログイン(プライマリ)に加え、アプリケーションレベルの許可リスト(多層防御)。アプリは
SELECT/WITH...SELECT、#tempテーブル /@table変数のみに書き込むDECLAREバッチ、および永続テーブルに書き込まない定義を持つホワイトリスト登録されたプロシージャのEXECを受け付けます✅ 引用符を認識する SQL スキャン - コメントとリテラルは、引用符の状態を追跡する単一の左から右へのパスで削除されるため、文字列リテラル内に隠された
--や;がアナライザーをすり抜けて 2 番目のステートメントを密輸することはできません✅ パラメータ化クエリ - 組み込みの SQL インジェクション保護
✅ デフォルトで SSL/TLS - 暗号化と証明書の検証はオプトアウトであり、オプトインではありません
✅ ストリーミング結果のページング - 行はストリーミングされ、要求されたページを 1 行超えた時点で読み取りがキャンセルされるため、大きな
SELECTでサーバーのメモリが枯渇することはありません✅ 監査証跡 - すべてのツール呼び出しが stderr に 1 行の JSON として記録されます(
MSSQL_AUDIT_LOG)✅ 接続プーリング - 最適化されたリソース管理
パフォーマンス監視
📊 リアルタイムのロック検出 - ブロッキングとデッドロックの状況を特定
📈 リソース使用量の追跡 - CPU、メモリ、クエリパフォーマンスのメトリクス
🔍 トップクエリ分析 - リソースを大量に消費するクエリを発見
⚡ セッション監視 - アクティブなセッションとブロックされたセッションを追跡
データベース探索
🗂️ スキーマのイントロスペクション - テーブル、列、キー、制約
📝 ストアドプロシージャの分析 - 定義とパラメータを表示
🔎 インテリジェントなクエリ - Claude による自然言語から SQL へ
利用可能なツール(19)
コア
ツール | 説明 |
| SQL を実行します。デフォルトでは読み取り専用の検証。 |
| 接続をテストします。サーバー/エディション/バージョン、データベース、ログイン、現在のモードを返します。 |
| すべてのデータベースを、状態、復旧モデル、互換性レベルとともに返します。 |
| 行数とサイズ(MB)を含むテーブル。スキーマでオプションでフィルタリング可能。 |
| テーブルから行をプレビュー(デフォルト 10、最大 100)— SQL は不要、インジェクション安全。 |
スキーマ探索
ツール | 説明 |
| テーブルごとの列、データ型、PK/FK。 |
| 外部キーグラフ: 参照元/参照先のテーブル+列、削除/更新アクション。 |
| 完全なSQL定義を含むビュー。 |
| パラメータと完全な定義を含むストアドプロシージャ。 |
| すべてのプロシージャ/ビュー/関数/トリガーのソースからテキスト断片を検索 — レガシーシステム向けの影響分析。 |
パフォーマンスとストレージ
ツール | 説明 |
| インデックス使用統計(シーク/スキャン/更新)+ オプティマイザが推奨する欠落インデックス。 |
| インデックスごとの断片化と、REBUILD(30%以上)/ REORGANIZE(5〜30%)の推奨、および実行可能な |
|
|
| ヘルスチェック: 主要な待機統計(無害な待機は除外)、メモリカウンタ(PLE、保留中の許可、合計と目標)、ワークロードカウンタ、およびルールベースのチューニング推奨。 |
| サイズ別の最大テーブル + データベースファイルサイズ。 |
| セッション、CPU、バッファキャッシュ、CPU別の上位クエリ。 |
ロック、ブロッキング、デッドロック
SQL Server 2019 (15.x)、2022 (16.x)、2025 (17.x) — Expressを含む全エディションでサポート。
出力には検出されたサーバーバージョン/エディションが含まれ、古いバージョンで実行している場合は警告が表示されます(ベストエフォート)。
VIEW SERVER STATEが必要です。
バージョンとエディションの互換性:
Express | Standard | Enterprise / Developer / Eval | Azure SQL MI | Azure SQL DB | |
クエリ / スキーマ / ストレージツール | ✅ | ✅ | ✅ | ✅ | ✅ |
| ✅ | ✅ | ✅ | ✅ | ✅ |
| ✅ | ✅ | ✅ | ✅ | ❌ (ツールが代替案を説明) |
| ✅ | ✅ | ✅ | ✅ | ⚠️ 限定スコープ |
上記の行/列はSQL Server 2019、2022、2025に適用されます。古いバージョン
(2016/2017)はほとんど動作しますが、ツール出力ではベストエフォートとして報告されます。
mssql_test_connectionは検出されたエディションクラスとそのエンジン
制限(例: Express: データベースあたり10 GB、約1.4 GBのバッファプール、4コア)を報告します。
ツール | 説明 |
| セッションごとの現在のロックと待機の生ビュー。 |
| ブロッキングチェーン(被害者 ← ブロッカー)、開いたトランザクションを保持するアイドルセッションを含むリードブロッカーの特定、両側のSQLテキスト付き。 |
| 組み込みの |
Claudeの例:
"Show me the top 10 customers by order count"
"Which tables are the largest, and which indexes are unused?"
"Which sessions are blocked right now, and who is the root blocker?"
"Were there any deadlocks last night, and which query caused them?"
"Find every stored procedure that references the CustomerOrders table"セキュリティ設定
読み取り専用は2層で強制されます。 データベースログインがプライマリ ガードです — サーバーに到達した書き込みステートメントでも実行できません。 アプリケーションレベルの許可リスト(src/index.tsの
classifyQuery)は 多層防御です: 読み取り専用のエントリポイントのみを受け入れ、それ以外の すべて(書き込み、DDL、動的SQL、スタッククエリ)を拒否します。単語をブロックするのではなく 先頭キーワードを許可リスト化するため、Create、Update、CreatedDateなどと 名付けられた列やエイリアスはブロックされません。
読み取り専用SQLユーザーの作成(推奨)
実行可能なスクリプトが
scripts/create-readonly-login.sqlに用意されています —
プレースホルダを編集してsysadminとして実行してください。以下の最小権限設定を適用します:
-- 1. Create login
CREATE LOGIN mcp_readonly WITH PASSWORD = 'SecurePassword123!';
-- 2. Switch to your database
USE YourDatabase;
-- 3. Create user
CREATE USER mcp_readonly FOR LOGIN mcp_readonly;
-- 4. Grant read permissions
ALTER ROLE db_datareader ADD MEMBER mcp_readonly;
-- 4b. Explicitly DENY writes (defense-in-depth)
ALTER ROLE db_denydatawriter ADD MEMBER mcp_readonly;
-- 5. Grant monitoring permissions
GRANT VIEW SERVER STATE TO mcp_readonly;
GRANT VIEW DATABASE STATE TO mcp_readonly;
GRANT VIEW DEFINITION TO mcp_readonly;
-- 6. Verify permissions
SELECT
dp.name AS DatabaseUser,
dp.type_desc,
r.name AS RoleName
FROM sys.database_principals dp
LEFT JOIN sys.database_role_members drm ON dp.principal_id = drm.member_principal_id
LEFT JOIN sys.database_principals r ON drm.role_principal_id = r.principal_id
WHERE dp.name = 'mcp_readonly';開発
ビルド
npm run buildウォッチモード
npm run devローカルでのテスト
# Set environment variables
export MSSQL_SERVER=localhost
export MSSQL_DATABASE=testdb
export MSSQL_USER=sa
export MSSQL_PASSWORD=password
# Run
npm startトラブルシューティング
npxでの「command not found」エラー
npxで実行中にエラーが発生した場合:
Node.js 22+がインストールされていることを確認:
node --versionnpmキャッシュをクリア:
npm cache clean --force完全なパッケージ名で試す:
npx --package=@piyapat/mssql-mcp-server mssql-mcp-server接続エラー
エラー: ユーザーのログインに失敗しました
-- Check authentication mode (must be Mixed Mode)
USE master;
GO
EXEC xp_instance_regread
N'HKEY_LOCAL_MACHINE',
N'Software\Microsoft\MSSQLServer\MSSQLServer',
N'LoginMode';
GO
-- Should return 2 for Mixed Modeエラー: サーバーに接続できません
SQL Server Browserサービスが実行されていることを確認
ファイアウォールがポート1433を許可していることを確認
SQL Server構成マネージャーでTCP/IPプロトコルが有効になっていることを確認
権限エラー
-- Grant additional permissions if needed
USE YourDatabase;
GRANT EXECUTE TO mcp_readonly; -- If you need to call stored procedures
GRANT SHOWPLAN TO mcp_readonly; -- For execution plans脆弱性の報告
セキュリティバグについては公開のissueを開かないでください。 GitHubのプライベート脆弱性報告、 またはnpmパッケージページのメンテナーアドレスを使用してください。範囲、対応目標、 およびセーフハーバー条件はSECURITY.mdに記載されています。
scripts/security-validation.mjsのガードバッテリーは、
実際のコンパイル済みアナライザーを約100件の攻撃ケースに対して実行し、CIで実行されます —
npm run test:securityでローカルに再現できます。
セキュリティ謝辞
🙏 Kietgboiz17に感謝します (kietgboiz17@gmail.com) — このプロジェクトを強化したセキュリティレビュー、脆弱性報告、 およびレッドチーミングに対して。2.0.2で修正された読み取り専用ガードのバイパスや、 2.0.3での追加のガード強化を含みます。 CHANGELOG.mdとSECURITY_REVIEW.mdを参照してください。
ベストプラクティス
本番環境では常に読み取り専用アカウントを使用
暗号化を有効に保つ(
MSSQL_ENCRYPT=true、MSSQL_TRUST_CERT=false) — 両方ともデフォルトです定期的に監視 - 定期的な監視チェックを設定
結果セットを制限 - maxRowsを使用。行はストリーミングされるため、ページ分だけが読み取られます
インデックス最適化 - 遅いクエリを監視し、インデックスを追加
定期的なメンテナンス - 統計を最新に保つ
アクセスの監査 -
MSSQL_AUDIT_LOGをオンにし、サーバーのstderrログを保持
コントリビューション
コントリビューションは歓迎します — 開発環境のセットアップ、プルリクエストのガイドライン、 リリースプロセスについてはCONTRIBUTING.mdを参照してください。 バージョン履歴はCHANGELOG.mdで追跡されています。
ライセンス
MITライセンス - ニーズに合わせて自由に使用・変更できます。
使用技術
@modelcontextprotocol/sdk - MCP SDK
mssql - Node.js用SQL Serverクライアント
サポート
問題が発生した場合:
トラブルシューティングセクションを確認
SQL Serverのエラーログを確認
Claude Desktopのログを確認
データベースの権限を確認
Claude Desktop向けに構築 • セキュリティ最優先 • パフォーマンス重視
Available Tools
17 toolsmssql_analyze_indexesARead-only
Analyze index usage (seeks/scans/lookups/updates per index) and list potentially missing indexes suggested by the query optimizer. Optionally filter usage stats by table name.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: only show index usage for this table. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the tool is read-only. The description adds valuable behavioral context (e.g., it returns seeks/scans/lookups/updates and missing index suggestions) beyond the annotations, without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the core purpose and listing the key outputs (seeks/scans/lookups/updates and missing indexes). Every word adds value, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 2 parameters, no output schema. The description explains the output (index usage metrics and missing index suggestions) but does not detail the response format or how missing indexes are presented. Still, it covers the main functionality adequately for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds minimal extra meaning: it rephrases the tableName parameter as 'Optionally filter usage stats by table name' and response_format is self-explanatory. No substantive enrichment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes index usage and lists missing indexes, with optional table filtering. It is distinct from siblings like mssql_index_fragmentation (focuses on fragmentation) and mssql_get_schema, but does not explicitly differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it should be used for analyzing index performance and finding optimization opportunities, but provides no explicit 'when to use' or 'when not to use' guidance, nor does it mention alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_analyze_storageARead-only
Analyze storage: largest tables by size (row count, total/used MB) and database file sizes. Useful for capacity planning and finding space hogs.
| Name | Required | Description | Default |
|---|---|---|---|
| topTables | No | Number of largest tables to return (default: 20) | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false, so the description does not contradict them. It adds value by detailing what is analyzed (largest tables, file sizes) beyond the annotations. No additional behavioral traits are disclosed, but the description is consistent and provides useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that effectively communicates the tool's purpose and output. It is front-loaded with the key action and resource, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description explicitly lists the output elements (row count, total/used MB for tables, database file sizes). It covers the needed context for an analysis tool with simple parameters. Parameter coverage is complete, and the description is sufficient for understanding what the tool returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, meaning both parameters (topTables, response_format) have descriptions in the input schema. The description does not add significant meaning beyond what the schema provides; it only implies that topTables refers to largest tables by size. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes storage, specifically largest tables by size (row count, total/used MB) and database file sizes. This is a specific verb+resource combination that distinguishes it from siblings like mssql_analyze_indexes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'useful for capacity planning and finding space hogs', providing a clear context for use. However, it does not explicitly state when not to use it or suggest alternatives, which would improve guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_find_blockingARead-only
Find current blocking chains: which sessions are blocked, by whom, on what resource, and for how long. Identifies lead blockers (including idle sessions holding open transactions) with their SQL text. Supported: SQL Server 2019 (15.x), 2022 (16.x), 2025 (17.x) — all editions including Express. Requires VIEW SERVER STATE.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true and destructiveHint=false. The description adds that it requires VIEW SERVER STATE permission, providing important behavioral context. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences), front-loads the core purpose, and includes version support and permission requirement without extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description adequately covers what the tool does and what it returns (lead blockers with SQL text). No output schema exists, so the description provides sufficient context for a focused diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a single parameter (response_format) and enum. The description does not add further meaning beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Find current blocking chains', specifying what it identifies (sessions, blocked, by whom, resource, duration) and lead blockers with SQL text. This is specific and distinct from sibling tools like mssql_monitor_locks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions version support and required permission (VIEW SERVER STATE), providing some usage context. However, it does not explicitly state when to use this tool over alternatives like mssql_monitor_locks or mssql_get_deadlocks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_deadlocksARead-only
Retrieve recent deadlock events from the built-in system_health Extended Events session, including the full deadlock graph XML, victim sessions, and the queries involved. Source 'ring_buffer' (default, fast, recent events only) or 'file' (reads system_health .xel files, further back but slower). Supported: SQL Server 2019 (15.x), 2022 (16.x), 2025 (17.x) — all editions including Express. Requires VIEW SERVER STATE.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | 'ring_buffer' = in-memory recent events (fast). 'file' = system_health event files (older history, slower). | ring_buffer |
| maxEvents | No | Maximum number of deadlock events to return (default: 5, max: 25) | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only and non-destructive. The description expands with version support, permission requirement (VIEW SERVER STATE), and source behavior. Adds significant value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with main purpose, then efficiently covers sources, version support, and permissions. Every sentence is informative with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three optional parameters and no output schema, the description covers return content, version support, permission, and source behavior. Complete for a deadlock retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and parameter descriptions are already detailed. The description adds context about source trade-offs (fast vs far back) not fully captured in schema enum descriptions. Overall adds value but not critical.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (retrieve), the resource (deadlock events from system_health session), and specifies included content (deadlock graph XML, victim sessions, queries). It distinguishes from sibling tools, none of which are about deadlocks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides guidance on choosing between 'ring_buffer' and 'file' sources based on recency and speed. Also mentions supported versions and required permission. Lacks explicit when-not-to-use or alternatives, but no direct sibling alternatives exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_relationshipsARead-onlyIdempotent
Get foreign key relationships between tables: constraint name, from/to table and column, and delete/update actions. Optionally filter by table name (matches either side).
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: only show relationships involving this table. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the description only adds minor context (filtering behavior). No contradictions, but no additional behavioral traits like performance impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the core purpose and then the optional filter. No superfluous words, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately explains the return fields. It implies the output includes all relationships when no filter is applied. Lacks explicit statement about default behavior (all relationships) but is sufficient for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are fully described in the schema (100% coverage). The description adds value by clarifying that tableName matches on either side of the relationship, which is not evident from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves foreign key relationships and lists the specific fields returned (constraint name, tables/columns, actions). It distinguishes from siblings like mssql_get_schema or mssql_list_tables by focusing on foreign key constraints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions optional filtering by table name, but does not provide guidance on when to use this tool versus alternatives like mssql_get_schema. No exclusions or prerequisites are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_schemaARead-onlyIdempotent
Get database schema information including tables, columns, data types, primary keys, and foreign keys. Optionally filter by table name.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: specific table name to get schema for. If not provided, returns all tables. | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the agent knows this is a safe read-only operation. The description adds what data is returned but does not disclose additional behavioral traits (e.g., performance impact, system table queries). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose and then adds optional detail. Every word adds value, with no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description sufficiently covers the tool's functionality for a simple read-only schema retrieval tool. It mentions the key return components and optional filtering. However, it could be slightly more complete by noting that the output format can be specified (already in param schema) and that all tables are returned if no filter is given (already in param schema).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters (tableName and response_format). The description adds context about the returned data (tables, columns, types, keys) that is not in the schema, enhancing understanding beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves database schema information including tables, columns, data types, primary keys, and foreign keys, with optional table name filtering. This distinguishes it from sibling tools like mssql_get_relationships, mssql_get_views, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. While the purpose is clear, it lacks guidance like 'For relationships only, use mssql_get_relationships' or 'Use this for a full schema overview.' Usage is implied but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_stored_proceduresARead-onlyIdempotent
List stored procedures in the database with their definitions and parameters. Optionally filter by procedure name.
| Name | Required | Description | Default |
|---|---|---|---|
| procedureName | No | Optional: specific procedure name to get details for. If not provided, returns all procedures. | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only and idempotent. The description adds that it returns definitions and parameters, which provides extra context. No behavioral traits beyond annotations are disclosed, but no contradictions either.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first conveys the main purpose, the second adds a key option. Every sentence is necessary, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should ideally hint at the return structure. It mentions 'definitions and parameters' but lacks specifics. For a simple listing tool with safe annotations, this is somewhat adequate but could benefit from more detail about what the output contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are fully described. The description adds a brief explanation for the optional filter and clarifies the response_format enum values, but does not add significant meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists stored procedures with definitions and parameters, using a specific verb and resource. It distinguishes from siblings like mssql_get_views or mssql_get_schema by focusing on stored procedures.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions optional filtering by procedure name, giving a hint about usage. However, it does not explicitly state when to use this tool versus alternatives (e.g., mssql_get_schema or mssql_query), nor does it provide any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_viewsARead-onlyIdempotent
List views in the database with their full SQL definitions. Optionally filter by view name to get a single view's definition.
| Name | Required | Description | Default |
|---|---|---|---|
| viewName | No | Optional: specific view name to get the definition for. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that it returns full SQL definitions but no further behavioral context like permissions or performance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, concise and front-loaded. Every sentence adds value with no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with complete annotations and schema, the description is adequate. It explains the return content (full SQL definitions). Minor: no mention of result format beyond response_format parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The tool description repeats the filtering functionality but adds no new meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists views with their full SQL definitions and optionally filters by view name. It distinguishes from sibling tools that focus on relationships, indexes, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or alternatives, but the purpose is specific enough to infer appropriate use cases. No guidance on when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_index_fragmentationARead-only
Analyze index fragmentation and recommend maintenance: REBUILD (fragmentation ≥ 30%), REORGANIZE (5–30%), or OK (< 5%). Generates ready-to-run ALTER INDEX statements (ONLINE=ON suggested automatically on editions that support it). Small indexes below minPageCount are excluded since fragmentation there is harmless.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: analyze only this table. | |
| minPageCount | No | Ignore indexes smaller than this many pages (default: 100 ≈ 800 KB). | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations (readOnlyHint=true, destructiveHint=false) by explaining that it generates ready-to-run ALTER INDEX statements (not executing them), suggests ONLINE=ON on supported editions, and excludes small indexes. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, clearly structured. The first sentence covers core functionality and thresholds; the second provides details on output and edge cases. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully covers what the tool does, how to use it (input parameters), what it produces (ALTER INDEX statements), and important edge cases (small indexes). Given the simplicity (3 optional params, no output schema, read-only), it is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The description adds value by explaining the purpose of minPageCount (harmless fragmentation below threshold) and the format options. This enriches the meaning beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes index fragmentation and recommends maintenance actions with specific thresholds (REBUILD ≥30%, REORGANIZE 5-30%, OK <5%). It also mentions generating ALTER INDEX statements and excluding small indexes. This distinguishes it from sibling tools like mssql_analyze_indexes or mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (to check fragmentation and get maintenance scripts) and includes thresholds. It implicitly excludes small indexes via minPageCount, but does not explicitly state when not to use it or compare to alternatives like mssql_analyze_indexes. However, the guidance is sufficient for most cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_list_databasesARead-onlyIdempotent
List all databases on the SQL Server instance with state, recovery model, compatibility level, and creation date.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and idempotent. Description adds specifics about returned data (state, recovery model, compatibility level, creation date), beyond annotation details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no redundant words, efficiently conveys tool action and output contents.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation, description covers key output attributes. No output schema, but return values are implied. Slightly lacking in specifying that it returns a list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (response_format) with 100% schema description coverage. Tool description adds no additional parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'List all databases' with specific attributes (state, recovery model, etc.), distinguishing it from sibling tools like mssql_list_tables or mssql_get_schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like mssql_get_schema or mssql_analyze_storage, and no exclusion criteria provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_list_tablesARead-onlyIdempotent
List tables in the current database with schema, row count, and size in MB. Optionally filter by schema name.
| Name | Required | Description | Default |
|---|---|---|---|
| schemaName | No | Optional: filter tables by schema (e.g. 'dbo'). Default: all schemas. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. Description adds that it returns schema, row count, size in MB, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single sentence, front-loaded with core purpose, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with clear annotations and full schema coverage, the description is sufficiently complete. It explains output fields and optional filter, no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. Description only restates that schemaName filter is optional, adding no new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it lists tables with schema, row count, and size in MB, and allows optional filtering. This distinguishes it from sibling tools like mssql_get_views or mssql_get_schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description mentions optional schema filter but does not explicitly state when to use this tool versus alternatives. However, the purpose is clear enough for selection among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_monitor_locksARead-only
Monitor database locks, blocking sessions, and potential deadlocks. Shows lock types, resources, and wait times.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the tool is safe. The description adds context about outputs (lock types, resources, wait times) beyond the annotation, enhancing transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. Information is front-loaded and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity monitoring tool with no output schema, the description adequately covers what it monitors and shows. It could mention that it returns a snapshot, but overall complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter response_format, with enum and default descriptions. The tool description does not add further parameter meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool monitors database locks, blocking sessions, and deadlocks, with specific outputs. It distinguishes from siblings like mssql_find_blocking and mssql_get_deadlocks, but could be more explicit about its broader scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention scenarios, prerequisites, or when to prefer mssql_find_blocking or mssql_get_deadlocks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_monitor_usageBRead-only
Get database resource usage statistics including CPU, memory, active sessions, and top resource-consuming queries.
| Name | Required | Description | Default |
|---|---|---|---|
| topQueries | No | Number of top CPU-consuming queries to return (default: 10) | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's role is light. It adds context about the types of statistics returned (CPU, memory, sessions, top queries), which is useful. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb, no filler. Every word is necessary and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (2 optional params, no output schema), the description covers the key data returned. It could optionally mention the time window or aggregation level, but overall it provides sufficient context for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description adds no additional semantic detail beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves database resource usage statistics including CPU, memory, sessions, and top queries. It is specific and actionable, but does not explicitly differentiate it from sibling tools like mssql_top_queries or mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. For example, it doesn't explain that for detailed query-level analysis one should use mssql_top_queries. Agents receive no contextual hints for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_performance_healthARead-only
Overall performance health check: top wait statistics (with benign waits filtered out), memory counters (Page Life Expectancy, memory grants pending, total vs target memory), workload counters (batch requests, compilations), and rule-based optimization recommendations (e.g. high CXPACKET → review MAXDOP, PAGEIOLATCH → check I/O and indexes, LCK_M → run mssql_find_blocking).
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, destructiveHint=false. Description expands on what is read (wait stats, memory, workload) and adds behavioral details like filtering benign waits and offering recommendations. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence includes all necessary details without excessive verbosity. Well-structured and front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description adequately covers return categories (wait stats, memory, workload, recommendations). References sibling tools for further action. Complete for a summary health check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter (response_format) with 100% schema coverage; description does not add additional semantics beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly identifies it as an overall performance health check, listing specific areas (wait stats, memory, workload, recommendations). It distinguishes itself from siblings by mentioning rule-based recommendations that reference other tools like mssql_find_blocking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for an overall health check. Provides context by referencing sibling tools for specific scenarios (e.g., LCK_M → mssql_find_blocking). Does not explicitly state when not to use or provide exclusions, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_queryARead-onlyIdempotent
Execute a read-only SQL query against the MS SQL Server database. Accepts: a single SELECT / WITH...SELECT; a multi-statement batch led by DECLARE, INSERT, or CREATE TABLE # that writes ONLY to session-local #temp tables or @table variables (global ##temp is never allowed); or EXEC of a whitelisted stored procedure whose definition does not write to a persistent table. Writes to real tables, DDL on persistent objects, dynamic SQL, EXEC inside batches, and DBCC are blocked (server runs with MSSQL_READ_ONLY=true). Returns results as JSON or Markdown.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | The SQL to execute. Must be read-only: a SELECT/WITH query, a DECLARE batch using only #temp/@table targets, or EXEC of an allowed read-only stored procedure. | |
| offset | No | Row offset for pagination (default: 0) | |
| maxRows | No | Maximum number of rows to return per page (default: 100, max: 1000) | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: json) | json |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral context beyond annotations (readOnlyHint, idempotentHint, destructiveHint), explaining allowed query patterns, blocked operations, server configuration (MSSQL_READ_ONLY=true), and response formats. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that front-loads the main purpose. It is informative but could be more concise by splitting into bullet points or shortening examples. Nonetheless, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of SQL execution and no output schema, the description covers allowed queries, blocked operations, and response formats. It lacks details on error handling or pagination behavior, which would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the baseline is 3. The description reinforces the query parameter's allowed forms, adding detail beyond the schema's brief description. However, it does not add new semantics for offset, maxRows, or response_format beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a read-only SQL query against MS SQL Server, and distinguishes it from sibling tools by specifying exact allowed query types (SELECT, WITH...SELECT, temp-table batches, whitelisted procs) and blocked operations (writes, DDL, dynamic SQL).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly details when to use (read-only queries) and when not (writes, DDL, dynamic SQL, DBCC), providing clear constraints. It implicitly guides the agent to select this tool for read queries versus sibling tools for schema or analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_sample_dataARead-onlyIdempotent
Retrieve sample rows from a table (default 10, max 100). Safe way to preview data without writing SQL. Accepts 'table' or 'schema.table'.
| Name | Required | Description | Default |
|---|---|---|---|
| rows | No | Number of rows to sample (default: 10, max: 100) | |
| tableName | Yes | Table name, optionally schema-qualified (e.g. 'Orders' or 'dbo.Orders'). | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that it's a safe preview, reinforces non-destructive behavior, and provides row limits – all consistent with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no extraneous text. Key information (purpose, defaults, safety) is front-loaded for quick parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, parameters, and safety adequately. No output schema, but description doesn't need to detail return format beyond what schema provides. Minor gap: doesn't specify sampling method (e.g., TOP vs random).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have schema descriptions (100% coverage). The description adds valuable context: default row count, max 100, and format for table names, complementing the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states retrieving sample rows from a table, specifying defaults and limits. It distinguishes from sibling tools like mssql_query (requires SQL) and mssql_get_schema (schema metadata).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly positions the tool as a safe, low-friction way to preview data without writing SQL. While it doesn't explicitly list alternatives, the context of sibling tools implies when not to use it (e.g., for complex queries).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_top_queriesARead-only
Find the most expensive queries from the plan cache, ranked by a chosen metric: cpu, duration, reads (logical I/O), writes, memory (grant size), or executions. Returns per-query totals and averages with the SQL text — the starting point for performance tuning.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Number of queries to return (default: 10, max: 50) | |
| metric | No | Ranking metric (default: cpu) | cpu |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description confirms read-only behavior (finding expensive queries) which aligns with annotations (readOnlyHint=true). No additional behavioral traits beyond annotations are disclosed, but no contradictions exist. The description adds minimal value beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, direct, and contains no redundant information. Every word serves a purpose, making it highly efficient for an AI agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has three well-described parameters, no output schema, and clear annotations, the description adequately explains purpose, metrics, and return content. It could provide more detail on output structure, but for a starting-point tool, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds context by explaining the metrics (e.g., 'reads (logical I/O)') and that returns include per-query totals and averages, enhancing understanding beyond the raw schema. This justifies a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds the most expensive queries from the plan cache, ranked by a chosen metric, and returns per-query totals and averages with SQL text. It distinguishes itself from siblings by focusing on plan cache and performance tuning, though it does not explicitly contrast with similar tools like mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description describes the tool as 'the starting point for performance tuning', which implies when to use it. However, it lacks explicit guidance on when not to use it or clear differentiation from sibling tools. The context is implied but not directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a clearly distinct area: schema inspection, data preview, query execution, performance analysis, and monitoring. Even related tools like find_blocking, monitor_locks, and get_deadlocks have specific, non-overlapping purposes.
Most tools follow a verb_noun pattern (get_, analyze_, monitor_, list_), but several deviate: mssql_index_fragmentation, mssql_top_queries, mssql_sample_data, mssql_query, and mssql_performance_health lack a clear verb prefix, breaking consistency.
17 tools is well-scoped for a SQL Server database server covering schema, data, queries, performance, and monitoring. Each tool adds distinct value without being overwhelming.
The tool set covers schema browsing, data sampling, ad-hoc queries, performance tuning, and monitoring comprehensively. Minor gaps exist (e.g., missing query plan details, table statistics), but core workflows are well-supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Paid remote MCP for governed database query review, SQL simulation, approvals, and audits.
Hosted MCP server for PostgreSQL diagnostics: slow queries, missing indexes, connection pressure.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceRead-only SQL Server MCP server enabling safe database queries, table listing, and schema inspection with built-in security protections.MIT
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server for exploring on-premises, multi-instance Microsoft SQL Server estates from AI clients, with read-only enforcement and Windows authentication support.Apache 2.0
- AlicenseAqualityCmaintenanceA read-only MCP server for Microsoft SQL Server that allows running SELECT queries and analyzing query performance with statistics.4907MIT
- FlicenseAqualityCmaintenanceA read-only MCP server for browsing and querying SQL Server databases, providing tools to list schemas, tables, describe columns, and execute safe SELECT queries with validated parameters.15
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/PiyapatRag/mssql-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server