MS SQL Server MCP Server
MS SQL Server MCP 服务器
一个面向 Microsoft SQL Server 的安全、只读的模型上下文协议(MCP)服务器,内置性能监控和锁检测功能。
📦 npm: @piyapat/mssql-mcp-server
环境要求
Node.js 22 或更高版本。 在 v2.0.2 中从 18 提升:
mssql12 依赖tedious20,后者要求 Node 22。SQL Server 2019(15.x)、2022(16.x)或 2025(17.x)——包括 Express 在内的所有版本。Azure SQL Database 可用于查询/架构工具;请参阅
mssql_test_connection中各版本的说明。
Related MCP server: mssql-explorer-mcp
使用 npx 快速开始
您无需安装即可直接使用 npx 运行此 MCP 服务器:
npx @piyapat/mssql-mcp-server安装
选项 1:与 npx 一起使用(推荐用于测试)
# Run directly with environment variables
MSSQL_SERVER=localhost \
MSSQL_DATABASE=mydb \
MSSQL_USER=readonly \
MSSQL_PASSWORD=password \
npx @piyapat/mssql-mcp-server选项 2:全局安装
# Install globally
npm install -g @piyapat/mssql-mcp-server
# Run
mssql-mcp-server选项 3:本地安装
# Clone and install
git clone https://github.com/PiyapatRag/mssql-mcp-server.git
cd mssql-mcp-server
npm install
npm run build
# Run
npm start配置
第 1 步:创建 .env 文件(推荐)
凭据存放在 .env 文件中——而非硬编码在 MCP 客户端的 JSON 配置中:
cp .env.example .env
# then edit .env with your credentials服务器按以下顺序查找 .env 文件(先找到者优先):
MSSQL_ENV_FILE中指定的路径(显式覆盖)当前工作目录中的
.env项目根目录中的
.env(与package.json同级)
MCP 客户端 "env" 块中已设置的变量始终优先于
.env 文件,且 .env 已被 git 忽略。
第 2 步:将 Claude Desktop 指向服务器
编辑您的 Claude Desktop 配置:
Windows: %APPDATA%\Claude\claude_desktop_config.json
macOS/Linux: ~/Library/Application Support/Claude/claude_desktop_config.json
如果项目根目录中有 .env,则 JSON 中完全不需要凭据:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["C:\\path\\to\\mssql-mcp-server\\build\\index.js"]
}
}
}如果 .env 位于其他位置,只需传入其路径:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["C:\\path\\to\\mssql-mcp-server\\build\\index.js"],
"env": {
"MSSQL_ENV_FILE": "C:\\secure\\location\\mssql.env"
}
}
}
}直接在 "env" 块中设置变量仍然有效(并会覆盖
.env 文件)——适用于 npx 设置或针对不同数据库运行多个服务器的情况。
环境变量
变量 | 描述 | 默认值 | 必需 |
| SQL Server 主机名或 IP |
| 是 |
| 数据库名称 | - | 是 |
| SQL Server 用户名(当设置了 | - | 是 |
| 密码 | - | 是 |
| Windows/NTLM 域。设置后,将使用 Windows 身份验证而非 SQL 身份验证 | - | 否 |
| SQL Server 端口 |
| 否 |
| 加密连接(true/false)。只有字面量 |
| 否 |
| 跳过证书验证(true/false)。选择加入——生产环境中请勿开启 |
| 否 |
|
|
| 否 |
| 逗号分隔的存储过程白名单, | - | 否 |
|
| - | 否 |
| 查询超时时间(毫秒) |
| 否 |
| 最大连接池数量 |
| 否 |
| 将每次工具调用以一行 JSON 记录到 stderr(工具、模式、截断的查询、行数、持续时间、结果)。设置为 |
| 否 |
| 将驱动程序的完整错误文本返回给客户端。默认关闭:错误被限制为第一行,这样失败的查询无法被用来映射架构。完整详情始终输出到 stderr |
| 否 |
服务器模式
只读模式(MSSQL_READ_ONLY=true,默认)
mssql_query 仅接受:
单个
SELECT/WITH...SELECT以
DECLARE、INSERT或CREATE TABLE #...开头、仅写入会话本地#temp表 /@table变量的多语句批处理—— 例如INSERT INTO #t SELECT ...或CREATE TABLE #t (...); INSERT INTO #t ...; SELECT * FROM #t。 此类批处理中也允许CREATE INDEX ... ON #t、TRUNCATE/ALTER/DROP TABLE #t。 全局##temp表绝不允许(它们对所有会话可见,因此被视为持久对象)。执行定义不写入持久表的白名单存储过程(
EXEC)
其他一切均被拒绝:对持久对象的写入/DDL、动态 SQL、
批处理中的 EXEC(防止绕过存储过程白名单)、DBCC,
以及 SELECT/WITH/EXEC 之后的堆叠语句。
写入模式(MSSQL_READ_ONLY=false)
允许 INSERT / UPDATE / DELETE / DDL,但以下操作无论何种模式始终被阻止:
xp_cmdshell、xp_reg*(读写)、xp_dirtree、xp_fileexist、
sp_OA*、sp_configure、RECONFIGURE、SHUTDOWN、KILL、DROP DATABASE、
ALTER DATABASE、RESTORE、BULK INSERT、CREATE ASSEMBLY、
CREATE/ALTER/DROP LOGIN/USER/CREDENTIAL/CERTIFICATE、ALTER SERVER、
ALTER SERVER ROLE/ALTER ROLE、sp_addrolemember/sp_addsrvrolemember/
sp_droprolemember、sp_addlinkedserver、EXECUTE AS、sp_executesql、
GRANT/DENY/REVOKE、OPENROWSET/OPENDATASOURCE/OPENQUERY,以及
服务器端文件读取器 fn_get_audit_file、fn_xe_file_target_read_file、
fn_trace_gettable、sp_readerrorlog/xp_readerrorlog。
⚠️ 仅当使用权限同样受限的 SQL 登录名时才使用写入模式——数据库登录名仍然是主要的安全边界。
主要功能
安全优先
✅ 双层只读强制 - 数据库只读登录名(主要)加上应用层白名单(纵深防御)。应用接受
SELECT/WITH...SELECT、仅写入#temp表 /@table变量的DECLARE批处理,以及执行定义从不写入持久表的白名单存储过程(EXEC)✅ 引号感知的 SQL 扫描 - 注释和字面量在单次从左到右的遍历中被移除,同时跟踪引号状态,因此隐藏在字符串字面量中的
--或;无法绕过分析器走私第二条语句✅ 参数化查询 - 内置 SQL 注入防护
✅ 默认启用 SSL/TLS - 加密和证书验证是选择退出而非选择加入
✅ 流式结果分页 - 行被流式传输,读取在请求页之后一行处取消,因此大型
SELECT不会耗尽服务器内存✅ 审计跟踪 - 每次工具调用都以一行 JSON 记录到 stderr(
MSSQL_AUDIT_LOG)✅ 连接池 - 优化的资源管理
性能监控
📊 实时锁检测 - 识别阻塞和死锁情况
📈 资源使用跟踪 - CPU、内存和查询性能指标
🔍 顶级查询分析 - 查找资源密集型查询
⚡ 会话监控 - 跟踪活动和被阻塞的会话
数据库探索
🗂️ 架构内省 - 表、列、键和约束
📝 存储过程分析 - 查看定义和参数
🔎 智能查询 - 使用 Claude 将自然语言转换为 SQL
可用工具(19 个)
核心
工具 | 描述 |
| 执行 SQL。默认进行只读验证;通过 |
| 测试连接;返回服务器/版本/版本号、数据库、登录名和当前模式。 |
| 所有数据库及其状态、恢复模式、兼容级别。 |
| 表及其行数和大小(MB),可选按架构过滤。 |
| 预览表中的行(默认 10,最大 100)——无需 SQL,注入安全。 |
架构探索
工具 | 描述 |
| 每个表的列、数据类型、主键/外键。 |
| 外键关系图:来源/目标表+列、删除/更新操作。 |
| 视图及其完整 SQL 定义。 |
| 存储过程及其参数和完整定义。 |
| 在所有过程/视图/函数/触发器的源码中搜索文本片段——用于遗留系统的影响分析。 |
性能与存储
工具 | 描述 |
| 索引使用统计(查找/扫描/更新)+ 优化器建议的缺失索引。 |
| 每个索引的碎片化情况,附带 REBUILD(≥ 30%)/ REORGANIZE(5–30%)建议以及可直接运行的 |
| 按 |
| 健康检查:主要等待统计(已过滤良性等待)、内存计数器(PLE、待处理授予、总计与目标)、工作负载计数器,以及基于规则的调优建议。 |
| 按大小排序的最大表 + 数据库文件大小。 |
| 会话、CPU、缓冲缓存、按 CPU 排序的顶级查询。 |
锁、阻塞与死锁
支持 SQL Server 2019 (15.x)、2022 (16.x) 和 2025 (17.x)——包括 Express 在内的所有版本。输出包含检测到的服务器版本/版本类型,并在旧版本上运行时发出警告(尽力而为)。需要 VIEW SERVER STATE 权限。
版本与版本类型兼容性:
Express | Standard | Enterprise / Developer / Eval | Azure SQL MI | Azure SQL DB | |
查询 / 架构 / 存储工具 | ✅ | ✅ | ✅ | ✅ | ✅ |
| ✅ | ✅ | ✅ | ✅ | ✅ |
| ✅ | ✅ | ✅ | ✅ | ❌(工具会说明替代方案) |
| ✅ | ✅ | ✅ | ✅ | ⚠️ 范围有限 |
以上行/列适用于 SQL Server 2019、2022 和 2025。较旧版本(2016/2017)大多可用,但在工具输出中标记为尽力而为。mssql_test_connection 会报告检测到的版本类型类别及其引擎限制(例如 Express:10 GB/数据库、约 1.4 GB 缓冲池、4 核)。
工具 | 描述 |
| 每个会话当前锁和等待的原始视图。 |
| 阻塞链(受害者 ← 阻塞者)、领头阻塞者识别(包括持有未提交事务的空闲会话),并附带双方的 SQL 文本。 |
| 来自内置 |
Claude 示例:
"Show me the top 10 customers by order count"
"Which tables are the largest, and which indexes are unused?"
"Which sessions are blocked right now, and who is the root blocker?"
"Were there any deadlocks last night, and which query caused them?"
"Find every stored procedure that references the CustomerOrders table"安全设置
只读通过两层机制强制执行。 数据库登录是主要防线——即使写语句到达服务器也无法执行。应用层允许列表(src/index.ts 中的
classifyQuery)是纵深防御:它只接受只读入口点,并拒绝其他一切(写入、DDL、动态 SQL、堆叠查询)。由于它采用允许列表方式匹配开头关键字而非屏蔽单词,因此名为Create、Update、CreatedDate等的列或别名不会被屏蔽。
创建只读 SQL 用户(推荐)
现成脚本位于
scripts/create-readonly-login.sql——编辑
占位符并以 sysadmin 身份运行。它应用以下最小权限设置:
-- 1. Create login
CREATE LOGIN mcp_readonly WITH PASSWORD = 'SecurePassword123!';
-- 2. Switch to your database
USE YourDatabase;
-- 3. Create user
CREATE USER mcp_readonly FOR LOGIN mcp_readonly;
-- 4. Grant read permissions
ALTER ROLE db_datareader ADD MEMBER mcp_readonly;
-- 4b. Explicitly DENY writes (defense-in-depth)
ALTER ROLE db_denydatawriter ADD MEMBER mcp_readonly;
-- 5. Grant monitoring permissions
GRANT VIEW SERVER STATE TO mcp_readonly;
GRANT VIEW DATABASE STATE TO mcp_readonly;
GRANT VIEW DEFINITION TO mcp_readonly;
-- 6. Verify permissions
SELECT
dp.name AS DatabaseUser,
dp.type_desc,
r.name AS RoleName
FROM sys.database_principals dp
LEFT JOIN sys.database_role_members drm ON dp.principal_id = drm.member_principal_id
LEFT JOIN sys.database_principals r ON drm.role_principal_id = r.principal_id
WHERE dp.name = 'mcp_readonly';开发
构建
npm run build监视模式
npm run dev本地测试
# Set environment variables
export MSSQL_SERVER=localhost
export MSSQL_DATABASE=testdb
export MSSQL_USER=sa
export MSSQL_PASSWORD=password
# Run
npm start故障排除
使用 npx 时出现"command not found"错误
如果使用 npx 运行时出现错误:
确保已安装 Node.js 22+:
node --version清除 npm 缓存:
npm cache clean --force尝试使用完整包名:
npx --package=@piyapat/mssql-mcp-server mssql-mcp-server连接错误
错误:用户登录失败
-- Check authentication mode (must be Mixed Mode)
USE master;
GO
EXEC xp_instance_regread
N'HKEY_LOCAL_MACHINE',
N'Software\Microsoft\MSSQLServer\MSSQLServer',
N'LoginMode';
GO
-- Should return 2 for Mixed Mode错误:无法连接到服务器
验证 SQL Server Browser 服务正在运行
检查防火墙是否允许端口 1433
确保在 SQL Server 配置管理器中启用了 TCP/IP 协议
权限错误
-- Grant additional permissions if needed
USE YourDatabase;
GRANT EXECUTE TO mcp_readonly; -- If you need to call stored procedures
GRANT SHOWPLAN TO mcp_readonly; -- For execution plans报告漏洞
请不要为安全漏洞公开提交 issue。请使用 GitHub 私有漏洞报告, 或 npm 包页面上的维护者地址。范围、响应目标和 安全港条款见 SECURITY.md。
scripts/security-validation.mjs 中的防护测试套件
对约 100 个攻击案例运行真实编译后的分析器,并在 CI 中运行——npm run test:security 可在本地复现。
安全致谢
🙏 感谢 Kietgboiz17 (kietgboiz17@gmail.com) 的安全审查、漏洞报告和 红队测试,使本项目更加坚固——包括 2.0.2 中修复的只读防护绕过 以及 2.0.3 中的额外防护加固。参见 CHANGELOG.md 和 SECURITY_REVIEW.md。
最佳实践
在生产环境中始终使用只读账户
保持加密开启(
MSSQL_ENCRYPT=true、MSSQL_TRUST_CERT=false)——两者均为默认值定期监控 - 设置定期监控检查
限制结果集 - 使用 maxRows;行是流式传输的,因此只读取一页
索引优化 - 监控慢查询并添加索引
定期维护 - 保持统计信息更新
审计访问 - 保持
MSSQL_AUDIT_LOG开启并保留服务器的 stderr 日志
贡献
欢迎贡献——开发环境搭建、拉取请求指南和发布流程请参见 CONTRIBUTING.md。版本历史记录在 CHANGELOG.md 中。
许可证
MIT 许可证——可自由使用和修改以满足您的需求。
构建工具
@modelcontextprotocol/sdk - MCP SDK
mssql - Node.js 的 SQL Server 客户端
支持
如有问题:
查看故障排除部分
检查 SQL Server 错误日志
验证 Claude Desktop 日志
检查数据库权限
为 Claude Desktop 构建 • 安全第一 • 性能优先
Available Tools
17 toolsmssql_analyze_indexesARead-only
Analyze index usage (seeks/scans/lookups/updates per index) and list potentially missing indexes suggested by the query optimizer. Optionally filter usage stats by table name.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: only show index usage for this table. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the tool is read-only. The description adds valuable behavioral context (e.g., it returns seeks/scans/lookups/updates and missing index suggestions) beyond the annotations, without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the core purpose and listing the key outputs (seeks/scans/lookups/updates and missing indexes). Every word adds value, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 2 parameters, no output schema. The description explains the output (index usage metrics and missing index suggestions) but does not detail the response format or how missing indexes are presented. Still, it covers the main functionality adequately for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds minimal extra meaning: it rephrases the tableName parameter as 'Optionally filter usage stats by table name' and response_format is self-explanatory. No substantive enrichment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes index usage and lists missing indexes, with optional table filtering. It is distinct from siblings like mssql_index_fragmentation (focuses on fragmentation) and mssql_get_schema, but does not explicitly differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it should be used for analyzing index performance and finding optimization opportunities, but provides no explicit 'when to use' or 'when not to use' guidance, nor does it mention alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_analyze_storageARead-only
Analyze storage: largest tables by size (row count, total/used MB) and database file sizes. Useful for capacity planning and finding space hogs.
| Name | Required | Description | Default |
|---|---|---|---|
| topTables | No | Number of largest tables to return (default: 20) | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false, so the description does not contradict them. It adds value by detailing what is analyzed (largest tables, file sizes) beyond the annotations. No additional behavioral traits are disclosed, but the description is consistent and provides useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that effectively communicates the tool's purpose and output. It is front-loaded with the key action and resource, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description explicitly lists the output elements (row count, total/used MB for tables, database file sizes). It covers the needed context for an analysis tool with simple parameters. Parameter coverage is complete, and the description is sufficient for understanding what the tool returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, meaning both parameters (topTables, response_format) have descriptions in the input schema. The description does not add significant meaning beyond what the schema provides; it only implies that topTables refers to largest tables by size. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes storage, specifically largest tables by size (row count, total/used MB) and database file sizes. This is a specific verb+resource combination that distinguishes it from siblings like mssql_analyze_indexes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'useful for capacity planning and finding space hogs', providing a clear context for use. However, it does not explicitly state when not to use it or suggest alternatives, which would improve guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_find_blockingARead-only
Find current blocking chains: which sessions are blocked, by whom, on what resource, and for how long. Identifies lead blockers (including idle sessions holding open transactions) with their SQL text. Supported: SQL Server 2019 (15.x), 2022 (16.x), 2025 (17.x) — all editions including Express. Requires VIEW SERVER STATE.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true and destructiveHint=false. The description adds that it requires VIEW SERVER STATE permission, providing important behavioral context. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences), front-loads the core purpose, and includes version support and permission requirement without extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description adequately covers what the tool does and what it returns (lead blockers with SQL text). No output schema exists, so the description provides sufficient context for a focused diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a single parameter (response_format) and enum. The description does not add further meaning beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Find current blocking chains', specifying what it identifies (sessions, blocked, by whom, resource, duration) and lead blockers with SQL text. This is specific and distinct from sibling tools like mssql_monitor_locks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions version support and required permission (VIEW SERVER STATE), providing some usage context. However, it does not explicitly state when to use this tool over alternatives like mssql_monitor_locks or mssql_get_deadlocks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_deadlocksARead-only
Retrieve recent deadlock events from the built-in system_health Extended Events session, including the full deadlock graph XML, victim sessions, and the queries involved. Source 'ring_buffer' (default, fast, recent events only) or 'file' (reads system_health .xel files, further back but slower). Supported: SQL Server 2019 (15.x), 2022 (16.x), 2025 (17.x) — all editions including Express. Requires VIEW SERVER STATE.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | 'ring_buffer' = in-memory recent events (fast). 'file' = system_health event files (older history, slower). | ring_buffer |
| maxEvents | No | Maximum number of deadlock events to return (default: 5, max: 25) | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only and non-destructive. The description expands with version support, permission requirement (VIEW SERVER STATE), and source behavior. Adds significant value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with main purpose, then efficiently covers sources, version support, and permissions. Every sentence is informative with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three optional parameters and no output schema, the description covers return content, version support, permission, and source behavior. Complete for a deadlock retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and parameter descriptions are already detailed. The description adds context about source trade-offs (fast vs far back) not fully captured in schema enum descriptions. Overall adds value but not critical.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (retrieve), the resource (deadlock events from system_health session), and specifies included content (deadlock graph XML, victim sessions, queries). It distinguishes from sibling tools, none of which are about deadlocks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides guidance on choosing between 'ring_buffer' and 'file' sources based on recency and speed. Also mentions supported versions and required permission. Lacks explicit when-not-to-use or alternatives, but no direct sibling alternatives exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_relationshipsARead-onlyIdempotent
Get foreign key relationships between tables: constraint name, from/to table and column, and delete/update actions. Optionally filter by table name (matches either side).
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: only show relationships involving this table. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the description only adds minor context (filtering behavior). No contradictions, but no additional behavioral traits like performance impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the core purpose and then the optional filter. No superfluous words, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately explains the return fields. It implies the output includes all relationships when no filter is applied. Lacks explicit statement about default behavior (all relationships) but is sufficient for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are fully described in the schema (100% coverage). The description adds value by clarifying that tableName matches on either side of the relationship, which is not evident from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves foreign key relationships and lists the specific fields returned (constraint name, tables/columns, actions). It distinguishes from siblings like mssql_get_schema or mssql_list_tables by focusing on foreign key constraints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions optional filtering by table name, but does not provide guidance on when to use this tool versus alternatives like mssql_get_schema. No exclusions or prerequisites are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_schemaARead-onlyIdempotent
Get database schema information including tables, columns, data types, primary keys, and foreign keys. Optionally filter by table name.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: specific table name to get schema for. If not provided, returns all tables. | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the agent knows this is a safe read-only operation. The description adds what data is returned but does not disclose additional behavioral traits (e.g., performance impact, system table queries). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the core purpose and then adds optional detail. Every word adds value, with no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description sufficiently covers the tool's functionality for a simple read-only schema retrieval tool. It mentions the key return components and optional filtering. However, it could be slightly more complete by noting that the output format can be specified (already in param schema) and that all tables are returned if no filter is given (already in param schema).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters (tableName and response_format). The description adds context about the returned data (tables, columns, types, keys) that is not in the schema, enhancing understanding beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves database schema information including tables, columns, data types, primary keys, and foreign keys, with optional table name filtering. This distinguishes it from sibling tools like mssql_get_relationships, mssql_get_views, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. While the purpose is clear, it lacks guidance like 'For relationships only, use mssql_get_relationships' or 'Use this for a full schema overview.' Usage is implied but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_stored_proceduresARead-onlyIdempotent
List stored procedures in the database with their definitions and parameters. Optionally filter by procedure name.
| Name | Required | Description | Default |
|---|---|---|---|
| procedureName | No | Optional: specific procedure name to get details for. If not provided, returns all procedures. | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only and idempotent. The description adds that it returns definitions and parameters, which provides extra context. No behavioral traits beyond annotations are disclosed, but no contradictions either.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first conveys the main purpose, the second adds a key option. Every sentence is necessary, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should ideally hint at the return structure. It mentions 'definitions and parameters' but lacks specifics. For a simple listing tool with safe annotations, this is somewhat adequate but could benefit from more detail about what the output contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are fully described. The description adds a brief explanation for the optional filter and clarifies the response_format enum values, but does not add significant meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists stored procedures with definitions and parameters, using a specific verb and resource. It distinguishes from siblings like mssql_get_views or mssql_get_schema by focusing on stored procedures.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions optional filtering by procedure name, giving a hint about usage. However, it does not explicitly state when to use this tool versus alternatives (e.g., mssql_get_schema or mssql_query), nor does it provide any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_get_viewsARead-onlyIdempotent
List views in the database with their full SQL definitions. Optionally filter by view name to get a single view's definition.
| Name | Required | Description | Default |
|---|---|---|---|
| viewName | No | Optional: specific view name to get the definition for. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that it returns full SQL definitions but no further behavioral context like permissions or performance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, concise and front-loaded. Every sentence adds value with no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with complete annotations and schema, the description is adequate. It explains the return content (full SQL definitions). Minor: no mention of result format beyond response_format parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The tool description repeats the filtering functionality but adds no new meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists views with their full SQL definitions and optionally filters by view name. It distinguishes from sibling tools that focus on relationships, indexes, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or alternatives, but the purpose is specific enough to infer appropriate use cases. No guidance on when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_index_fragmentationARead-only
Analyze index fragmentation and recommend maintenance: REBUILD (fragmentation ≥ 30%), REORGANIZE (5–30%), or OK (< 5%). Generates ready-to-run ALTER INDEX statements (ONLINE=ON suggested automatically on editions that support it). Small indexes below minPageCount are excluded since fragmentation there is harmless.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional: analyze only this table. | |
| minPageCount | No | Ignore indexes smaller than this many pages (default: 100 ≈ 800 KB). | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations (readOnlyHint=true, destructiveHint=false) by explaining that it generates ready-to-run ALTER INDEX statements (not executing them), suggests ONLINE=ON on supported editions, and excludes small indexes. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, clearly structured. The first sentence covers core functionality and thresholds; the second provides details on output and edge cases. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully covers what the tool does, how to use it (input parameters), what it produces (ALTER INDEX statements), and important edge cases (small indexes). Given the simplicity (3 optional params, no output schema, read-only), it is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The description adds value by explaining the purpose of minPageCount (harmless fragmentation below threshold) and the format options. This enriches the meaning beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes index fragmentation and recommends maintenance actions with specific thresholds (REBUILD ≥30%, REORGANIZE 5-30%, OK <5%). It also mentions generating ALTER INDEX statements and excluding small indexes. This distinguishes it from sibling tools like mssql_analyze_indexes or mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (to check fragmentation and get maintenance scripts) and includes thresholds. It implicitly excludes small indexes via minPageCount, but does not explicitly state when not to use it or compare to alternatives like mssql_analyze_indexes. However, the guidance is sufficient for most cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_list_databasesARead-onlyIdempotent
List all databases on the SQL Server instance with state, recovery model, compatibility level, and creation date.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and idempotent. Description adds specifics about returned data (state, recovery model, compatibility level, creation date), beyond annotation details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no redundant words, efficiently conveys tool action and output contents.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation, description covers key output attributes. No output schema, but return values are implied. Slightly lacking in specifying that it returns a list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (response_format) with 100% schema description coverage. Tool description adds no additional parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'List all databases' with specific attributes (state, recovery model, etc.), distinguishing it from sibling tools like mssql_list_tables or mssql_get_schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like mssql_get_schema or mssql_analyze_storage, and no exclusion criteria provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_list_tablesARead-onlyIdempotent
List tables in the current database with schema, row count, and size in MB. Optionally filter by schema name.
| Name | Required | Description | Default |
|---|---|---|---|
| schemaName | No | Optional: filter tables by schema (e.g. 'dbo'). Default: all schemas. | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. Description adds that it returns schema, row count, size in MB, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single sentence, front-loaded with core purpose, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with clear annotations and full schema coverage, the description is sufficiently complete. It explains output fields and optional filter, no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. Description only restates that schemaName filter is optional, adding no new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it lists tables with schema, row count, and size in MB, and allows optional filtering. This distinguishes it from sibling tools like mssql_get_views or mssql_get_schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description mentions optional schema filter but does not explicitly state when to use this tool versus alternatives. However, the purpose is clear enough for selection among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_monitor_locksARead-only
Monitor database locks, blocking sessions, and potential deadlocks. Shows lock types, resources, and wait times.
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the tool is safe. The description adds context about outputs (lock types, resources, wait times) beyond the annotation, enhancing transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. Information is front-loaded and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity monitoring tool with no output schema, the description adequately covers what it monitors and shows. It could mention that it returns a snapshot, but overall complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter response_format, with enum and default descriptions. The tool description does not add further parameter meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool monitors database locks, blocking sessions, and deadlocks, with specific outputs. It distinguishes from siblings like mssql_find_blocking and mssql_get_deadlocks, but could be more explicit about its broader scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention scenarios, prerequisites, or when to prefer mssql_find_blocking or mssql_get_deadlocks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_monitor_usageBRead-only
Get database resource usage statistics including CPU, memory, active sessions, and top resource-consuming queries.
| Name | Required | Description | Default |
|---|---|---|---|
| topQueries | No | Number of top CPU-consuming queries to return (default: 10) | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's role is light. It adds context about the types of statistics returned (CPU, memory, sessions, top queries), which is useful. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb, no filler. Every word is necessary and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (2 optional params, no output schema), the description covers the key data returned. It could optionally mention the time window or aggregation level, but overall it provides sufficient context for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description adds no additional semantic detail beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves database resource usage statistics including CPU, memory, sessions, and top queries. It is specific and actionable, but does not explicitly differentiate it from sibling tools like mssql_top_queries or mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. For example, it doesn't explain that for detailed query-level analysis one should use mssql_top_queries. Agents receive no contextual hints for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_performance_healthARead-only
Overall performance health check: top wait statistics (with benign waits filtered out), memory counters (Page Life Expectancy, memory grants pending, total vs target memory), workload counters (batch requests, compilations), and rule-based optimization recommendations (e.g. high CXPACKET → review MAXDOP, PAGEIOLATCH → check I/O and indexes, LCK_M → run mssql_find_blocking).
| Name | Required | Description | Default |
|---|---|---|---|
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, destructiveHint=false. Description expands on what is read (wait stats, memory, workload) and adds behavioral details like filtering benign waits and offering recommendations. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence includes all necessary details without excessive verbosity. Well-structured and front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description adequately covers return categories (wait stats, memory, workload, recommendations). References sibling tools for further action. Complete for a summary health check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter (response_format) with 100% schema coverage; description does not add additional semantics beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly identifies it as an overall performance health check, listing specific areas (wait stats, memory, workload, recommendations). It distinguishes itself from siblings by mentioning rule-based recommendations that reference other tools like mssql_find_blocking.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for an overall health check. Provides context by referencing sibling tools for specific scenarios (e.g., LCK_M → mssql_find_blocking). Does not explicitly state when not to use or provide exclusions, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_queryARead-onlyIdempotent
Execute a read-only SQL query against the MS SQL Server database. Accepts: a single SELECT / WITH...SELECT; a multi-statement batch led by DECLARE, INSERT, or CREATE TABLE # that writes ONLY to session-local #temp tables or @table variables (global ##temp is never allowed); or EXEC of a whitelisted stored procedure whose definition does not write to a persistent table. Writes to real tables, DDL on persistent objects, dynamic SQL, EXEC inside batches, and DBCC are blocked (server runs with MSSQL_READ_ONLY=true). Returns results as JSON or Markdown.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | The SQL to execute. Must be read-only: a SELECT/WITH query, a DECLARE batch using only #temp/@table targets, or EXEC of an allowed read-only stored procedure. | |
| offset | No | Row offset for pagination (default: 0) | |
| maxRows | No | Maximum number of rows to return per page (default: 100, max: 1000) | |
| response_format | No | Response format: 'json' for machine-readable, 'markdown' for human-readable (default: json) | json |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral context beyond annotations (readOnlyHint, idempotentHint, destructiveHint), explaining allowed query patterns, blocked operations, server configuration (MSSQL_READ_ONLY=true), and response formats. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense paragraph that front-loads the main purpose. It is informative but could be more concise by splitting into bullet points or shortening examples. Nonetheless, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of SQL execution and no output schema, the description covers allowed queries, blocked operations, and response formats. It lacks details on error handling or pagination behavior, which would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the baseline is 3. The description reinforces the query parameter's allowed forms, adding detail beyond the schema's brief description. However, it does not add new semantics for offset, maxRows, or response_format beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a read-only SQL query against MS SQL Server, and distinguishes it from sibling tools by specifying exact allowed query types (SELECT, WITH...SELECT, temp-table batches, whitelisted procs) and blocked operations (writes, DDL, dynamic SQL).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly details when to use (read-only queries) and when not (writes, DDL, dynamic SQL, DBCC), providing clear constraints. It implicitly guides the agent to select this tool for read queries versus sibling tools for schema or analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_sample_dataARead-onlyIdempotent
Retrieve sample rows from a table (default 10, max 100). Safe way to preview data without writing SQL. Accepts 'table' or 'schema.table'.
| Name | Required | Description | Default |
|---|---|---|---|
| rows | No | Number of rows to sample (default: 10, max: 100) | |
| tableName | Yes | Table name, optionally schema-qualified (e.g. 'Orders' or 'dbo.Orders'). | |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that it's a safe preview, reinforces non-destructive behavior, and provides row limits – all consistent with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no extraneous text. Key information (purpose, defaults, safety) is front-loaded for quick parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, parameters, and safety adequately. No output schema, but description doesn't need to detail return format beyond what schema provides. Minor gap: doesn't specify sampling method (e.g., TOP vs random).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have schema descriptions (100% coverage). The description adds valuable context: default row count, max 100, and format for table names, complementing the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states retrieving sample rows from a table, specifying defaults and limits. It distinguishes from sibling tools like mssql_query (requires SQL) and mssql_get_schema (schema metadata).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly positions the tool as a safe, low-friction way to preview data without writing SQL. While it doesn't explicitly list alternatives, the context of sibling tools implies when not to use it (e.g., for complex queries).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mssql_top_queriesARead-only
Find the most expensive queries from the plan cache, ranked by a chosen metric: cpu, duration, reads (logical I/O), writes, memory (grant size), or executions. Returns per-query totals and averages with the SQL text — the starting point for performance tuning.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Number of queries to return (default: 10, max: 50) | |
| metric | No | Ranking metric (default: cpu) | cpu |
| response_format | No | Response format (default: markdown) | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description confirms read-only behavior (finding expensive queries) which aligns with annotations (readOnlyHint=true). No additional behavioral traits beyond annotations are disclosed, but no contradictions exist. The description adds minimal value beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, direct, and contains no redundant information. Every word serves a purpose, making it highly efficient for an AI agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has three well-described parameters, no output schema, and clear annotations, the description adequately explains purpose, metrics, and return content. It could provide more detail on output structure, but for a starting-point tool, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds context by explaining the metrics (e.g., 'reads (logical I/O)') and that returns include per-query totals and averages, enhancing understanding beyond the raw schema. This justifies a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds the most expensive queries from the plan cache, ranked by a chosen metric, and returns per-query totals and averages with SQL text. It distinguishes itself from siblings by focusing on plan cache and performance tuning, though it does not explicitly contrast with similar tools like mssql_performance_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description describes the tool as 'the starting point for performance tuning', which implies when to use it. However, it lacks explicit guidance on when not to use it or clear differentiation from sibling tools. The context is implied but not directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a clearly distinct area: schema inspection, data preview, query execution, performance analysis, and monitoring. Even related tools like find_blocking, monitor_locks, and get_deadlocks have specific, non-overlapping purposes.
Most tools follow a verb_noun pattern (get_, analyze_, monitor_, list_), but several deviate: mssql_index_fragmentation, mssql_top_queries, mssql_sample_data, mssql_query, and mssql_performance_health lack a clear verb prefix, breaking consistency.
17 tools is well-scoped for a SQL Server database server covering schema, data, queries, performance, and monitoring. Each tool adds distinct value without being overwhelming.
The tool set covers schema browsing, data sampling, ad-hoc queries, performance tuning, and monitoring comprehensively. Minor gaps exist (e.g., missing query plan details, table statistics), but core workflows are well-supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Paid remote MCP for governed database query review, SQL simulation, approvals, and audits.
Hosted MCP server for PostgreSQL diagnostics: slow queries, missing indexes, connection pressure.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceRead-only SQL Server MCP server enabling safe database queries, table listing, and schema inspection with built-in security protections.MIT
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server for exploring on-premises, multi-instance Microsoft SQL Server estates from AI clients, with read-only enforcement and Windows authentication support.Apache 2.0
- AlicenseAqualityCmaintenanceA read-only MCP server for Microsoft SQL Server that allows running SELECT queries and analyzing query performance with statistics.4907MIT
- FlicenseAqualityCmaintenanceA read-only MCP server for browsing and querying SQL Server databases, providing tools to list schemas, tables, describe columns, and execute safe SELECT queries with validated parameters.15
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/PiyapatRag/mssql-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server