mysql-mcp

MCP server for MySQL and MariaDB: schema inspection, SELECT, and separate confirmation-gated write/DDL/transaction tools.

Works over the MySQL wire protocol (MySQL 5.7+/8+ and MariaDB). For Aurora IAM or RDS Data API, use AWS Labs’ MySQL MCP instead.

Secrets belong in agent mcp.json env (mcpServers.*.env) — not project .env. Do not create a project .env for runtime credentials.

Tools

Writes are separate tools from reads. Agents must not use read_query for DML/DDL.

Strong confirmation

MCP has no native UI modal. Mutating tools return an impact preview and do not execute until called again with the same sql and confirmed: true.

Client operators should require approval on write_query, schema_query, and transaction_query (destructiveHint / non-readOnly).

Auth / env

Privilege scope: prefer least privilege. Use a write-capable role only when write tools are needed.

mcp.json example

{
  "mcpServers": {
    "mysql": {
      "command": "node",
      "args": ["/Volumes/ADATA/Projects/mcp-mysql/dist/index.js"],
      "env": {
        "MYSQL_HOST": "127.0.0.1",
        "MYSQL_USER": "mcp_rw",
        "MYSQL_PASSWORD": "your-password",
        "MYSQL_DATABASE": "your_database"
      }
    }
  }
}

Develop

npm test && npm run build
# Smoke (pass env inline — never create a repo .env):
# MYSQL_HOST=… MYSQL_USER=… MYSQL_PASSWORD=… MYSQL_DATABASE=… npm run test:connections

Risks

• Row content is untrusted (prompt injection)

• Confirmed writes are permanent without DB-level undo

• Shared bot identity; transaction_query has large blast radius after confirm