How do I use mssql-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mssql-mcp describe the Orders table" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mssql-mcp

by blimyj

Overview Schema Source Related Servers Score Discussions Admin

TypeScript

Remote

mssql-mcp

A read-only MCP server for Microsoft SQL Server. It lets an MCP client run SELECT queries against a database and inspect how those queries perform.

It provides two main capabilities:

Run SELECT queries and return the rows as JSON.
Analyze a SELECT under SET STATISTICS XML/IO/TIME and return performance data as JSON: estimated vs. actual rows, logical and physical reads, statement timing, missing-index suggestions, and plan warnings.

For a local Docker/Colima setup, see local-readme.md. This document covers a Windows machine connecting to a remote SQL Server.

Tools

Tool	Description
`query`	Run a single `SELECT` and return the rows as JSON.
`analyze_query`	Run a `SELECT` with statistics collection enabled and return performance metrics.
`list_tables`	List tables and views in the current database.
`describe_table`	Column names, types, nullability, and defaults for a table.

By default only SELECT and WITH statements are permitted. See Security.

Related MCP server: mssql-mcp-server

Requirements

Node.js 18 or later. Install the LTS build from https://nodejs.org and confirm with node -v.
Network access from this machine to the SQL Server. The default port is TCP 1433; make sure any firewall between the two allows it.
A SQL Server Authentication login (username and password) with read access to the target database.

Setup

Open PowerShell in the project folder and run:

cd C:\Tools\mssql-mcp
copy .env.example .env
npm install
npm run build

Then edit .env with the details for your server (see the next section).

Connecting to a remote server

.env holds the connection settings. It is git-ignored and is the only place credentials are stored.

MSSQL_SERVER=sqlserver.corp.example.com
MSSQL_PORT=1433
MSSQL_USER=reporting_user
MSSQL_PASSWORD=your-password
MSSQL_DATABASE=Sales
MSSQL_ENCRYPT=true
MSSQL_TRUST_SERVER_CERT=false

MSSQL_SERVER can be a hostname, fully qualified domain name, or IP address. For a named instance, use HOST\INSTANCE and set MSSQL_PORT to that instance's port.
MSSQL_ENCRYPT=true encrypts the connection. Keep it on for a remote server.
MSSQL_TRUST_SERVER_CERT=false requires the server to present a certificate your machine already trusts. Set it to true only when the server uses a self-signed certificate.
To point at a different server or database later, edit .env and restart the client.

Verify the connection before wiring up a client:

node dist\index.js

It prints a readiness line to standard error and then waits for input. Press Ctrl+C to stop. If the connection fails, the error message states the reason.

Registering with a client

The client starts the server as a subprocess and communicates over standard input/output. Credentials stay in .env; the client configuration holds no secrets.

opencode (opencode.json):

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mssql": {
      "type": "local",
      "command": ["node", "C:\\Tools\\mssql-mcp\\dist\\index.js"],
      "enabled": true
    }
  }
}

Claude Code (.mcp.json):

{
  "mcpServers": {
    "mssql": {
      "command": "node",
      "args": ["C:\\Tools\\mssql-mcp\\dist\\index.js"]
    }
  }
}

Use the full path to dist\index.js, and double the backslashes in JSON. Start the client from the folder that contains its configuration file. Any env values set in the client configuration take precedence over .env.

analyze_query output

{
  "row_count": 100,
  "truncated": false,
  "rows": [ /* result rows, capped at maxRows */ ],
  "timing": { "cpu_ms": 53, "elapsed_ms": 53 },
  "io_by_table": [
    { "table": "Orders", "scan_count": 1, "logical_reads": 283,
      "physical_reads": 0, "read_ahead_reads": 0 }
  ],
  "statement": { "est_rows": 100, "subtree_cost": 0.30 },
  "operators": [
    { "node_id": 0, "parent_node_id": null, "depth": 0,
      "physical_op": "Sort", "cost_pct": 100 },
    { "node_id": 1, "parent_node_id": 0, "depth": 1,
      "physical_op": "Clustered Index Scan",
      "est_rows": 100, "actual_rows": 100, "rows_read": 50000,
      "actual_logical_reads": 283, "cost_pct": 88 }
  ],
  "missing_indexes": [
    { "impact_pct": 94.6, "table": "dbo.Orders",
      "create": "CREATE INDEX IX_Orders_CustomerId ON [dbo].[Orders] ([CustomerId]) INCLUDE ([Amount]);" }
  ],
  "warnings": []
}

Reads and timing come from the plan's runtime counters (ActualLogicalReads, QueryTimeStats). io_by_table is parsed from the STATISTICS IO messages, so it matches the Messages tab in SQL Server Management Studio.

Operators are returned in tree order. Each carries node_id, parent_node_id, and depth. The root (node_id 0) is the final step and runs last; the deepest leaf runs first and feeds its parent up toward the root.

Logging

Set MSSQL_LOG=true in .env to append a record of every tool call, including the arguments received and the result returned, to mssql-mcp\mcp.log. The file is git-ignored.

[2026-07-05T15:06:26Z]  CALL #2  query
INPUT (from client):
  { "sql": "SELECT TOP 2 name FROM sys.tables ORDER BY name" }
[2026-07-05T15:06:27Z]  DONE #2  query  ·  1002 ms
OUTPUT (to client):
  { "row_count": 2, "rows": [ { "name": "Orders" } ] }

Each call is numbered so a request and its response can be matched even when calls overlap. Set MSSQL_LOG_FILE for a custom path and MSSQL_LOG_MAX for the maximum characters per entry before truncation (default 20000).

To follow the log live in PowerShell:

Get-Content .\mcp.log -Wait

Rate limiting

Two limits guard against overloading the server, both configured in .env:

MSSQL_RATE_MAX requests per MSSQL_RATE_WINDOW_MS milliseconds.
MSSQL_MAX_CONCURRENT queries in flight at once.

Set any of them to 0 to disable that limit. When a limit is reached, the tool returns an error with a retry hint and does not contact the database.

Security

MSSQL_READONLY=true (the default) rejects anything that is not a single SELECT or WITH statement and blocks write and DDL keywords. This is a convenience check, not a replacement for database permissions.

Enforce read-only access at the server by connecting with a login that has read rights only:

CREATE LOGIN reporting_user WITH PASSWORD = 'your-password';
CREATE USER reporting_user FOR LOGIN reporting_user;
ALTER ROLE db_datareader ADD MEMBER reporting_user;

Point MSSQL_USER and MSSQL_PASSWORD at that login. Set MSSQL_READONLY=false only when you intend to allow writes.

Available Tools

4 tools

analyze_queryRun a query with SSMS-style performance statsA

Execute a SELECT under SET STATISTICS XML/IO/TIME and return structured performance data: per-operator estimated vs actual rows, logical/physical reads, statement timing, missing-index suggestions, and plan warnings. Use this to explain why a query is slow. Rate limit: 30 requests per 60s, 4 concurrent; exceeding it returns an error with a retry time, so pace your calls.

ParametersJSON Schema

Name	Required	Description
`sql`	Yes	A single SELECT query to analyze.
`maxRows`	No	Max result rows to include (default 50).
`includePlanXml`	No	Include the raw showplan XML (large). Default false.

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses rate limits (30 per 60s, 4 concurrent), the error behavior on exceeding them, and the nature of returned data (plan warnings, missing indexes, I/O stats). It implies read-only behavior via SELECT, which is sufficient for this tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core function and followed by a concise use case and rate-limit warning. Every sentence earns its place with no unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description enumerates the key return data (estimated vs actual rows, logical/physical reads, timing, missing-index suggestions, plan warnings). It also covers rate limits and execution scope, making it complete for an agent to select and invoke the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides full descriptions for all three parameters (sql, maxRows, includePlanXml) with 100% coverage. The description adds no additional parameter semantics beyond what the schema already states, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes a SELECT with SET STATISTICS and returns structured performance data including per-operator rows, reads, timing, missing-index suggestions, and plan warnings. This specific focus on performance diagnostics distinguishes it from the sibling query tool, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to explain why a query is slow,' which provides a clear use case. It does not explicitly contrast with the query sibling, but the performance-analysis angle implies it is for diagnostics rather than general execution. The SELECT-only constraint is also mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_tableDescribe a tableA

Return columns, types, nullability and defaults for a table.

ParametersJSON Schema

Name	Required	Description	Default
`table`	Yes	Table name (without schema).
`schema`	No	Schema name (default dbo).

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the tool's output (columns, types, nullability, defaults), which is the core behavior. However, it does not mention error handling, permissions, or what happens if the table does not exist, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of nine words, front-loaded with the verb and resource. Every word earns its place, making it extremely concise without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple describe operation with only two parameters and no output schema, the description provides the essential information about the return value. It does not specify output format or edge cases, but the tool's simplicity means this is minimally sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of the parameters with descriptions, so the baseline is 3. The description does not add any extra parameter-specific semantics, but the schema already defines the table and schema parameters adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Return' and identifies the resource as a table, listing the exact metadata fields (columns, types, nullability, defaults). This clearly differentiates it from siblings like query or list_tables, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used to retrieve table structure, which is an implied usage context. However, it does not explicitly state when to use it versus alternatives like list_tables or analyze_query, nor does it provide exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesList tables and viewsA

List tables and views in the current database (INFORMATION_SCHEMA).

ParametersJSON Schema

Name	Required	Description	Default
`schema`	No	Filter by schema, e.g. "dbo".

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description discloses that the tool reads from INFORMATION_SCHEMA, which implies a read-only metadata operation and scopes to the current database. However, it does not describe output format, ordering, or the impact of the schema filter beyond what the schema says.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence that directly states the tool's function without filler, earning a top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with one optional parameter and no output schema, the description is mostly adequate but lacks explicit return value information (e.g., whether it returns schema names, table types, or ordering). For a simple tool, this is acceptable, but it could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema describes the optional 'schema' parameter with an example, and the description does not add further parameter semantics. Since schema coverage is 100%, the schema carries the burden, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' with the resource 'tables and views' and scoping to the current database, clearly differentiating from sibling tools like describe_table (which targets a single table).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives; the description simply states its function without mentioning query, analyze_query, or describe_table. Usage is implied but not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryRun a SQL queryA

Execute a single SELECT query against SQL Server and return rows as JSON. Read-only: only SELECT / WITH statements are permitted. Rate limit: 30 requests per 60s, 4 concurrent; exceeding it returns an error with a retry time, so pace your calls.

ParametersJSON Schema

Name	Required	Description	Default
`sql`	Yes	A single SELECT query.
`maxRows`	No	Max rows to return (default 100).

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses read-only behavior, permitted statement types, rate limits, concurrency limits, and error/retry behavior. This is strong coverage, though it omits details like handling of non-SELECT statements or maxRows defaults, leaving a small gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff. The first sentence front-loads purpose and output format; the second adds rate limit and read-only constraints. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 2-parameter tool with no output schema or annotations, the description covers the essential operational context: purpose, output format, safety (read-only), and rate limits. It lacks explicit error scenarios, but the description is reasonably complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, so the schema already documents 'sql' and 'maxRows'. The description does not add extra parameter semantics beyond the schema, meeting the baseline but not exceeding it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific verb+resource: 'Execute a single SELECT query against SQL Server and return rows as JSON.' This distinguishes it from siblings like list_tables and describe_table, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for use (querying data with SELECT/WITH) and explicitly notes the read-only constraint. It does not mention alternatives or when not to use, so it falls short of a 5, but the intended usage is unmistakable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

4 tool updatesv0.1.0Jul 31, 2026
- First observedanalyze_query
- First observeddescribe_table
- First observedlist_tables
- First observedquery

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Scored 2026-07-31 13:05 across 4 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: query returns result rows, analyze_query returns performance metrics, list_tables enumerates tables/views, and describe_table returns column details. There is no overlap or ambiguity.

Naming Consistency4/5

Three tools follow the verb_noun pattern (analyze_query, list_tables, describe_table), while 'query' is a bare noun/verb, breaking the pattern slightly. All names use lowercase with underscores, so this minor deviation is acceptable.

Tool Count5/5

With only four tools, the server is well-scoped for a read-only SQL Server MCP. This count is squarely within the ideal 3-15 range and each tool earns its place.

Completeness4/5

The toolset covers data querying, query performance analysis, table enumeration, and schema inspection, which is solid for a read-only database server. Minor gaps like listing databases or schemas are not essential for the core workflow.

Maintenance

ActivityStale

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

SRI — MCP Server Inspector A
biz.sri-test
2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.
Developer Tools
21
LemonadoOAuth
io.github.lemonadolabs
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
Marketing Research & Data Databases
3
The Quiet Protocol Growth Offense MCP A
com.thequietprotocol.www
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Databases Research & Data Finance
292
dataOAuth
co.thinair
Read-only PostgreSQL, MySQL, SQL Server access via MCP — 24 dialect-aware hosted tools.
Databases Developer Tools
2

Related MCP Servers

SQL Server MCP Server
Databases Developer Tools
bulentkeskin-tk
F
license
Not graded
quality
D
maintenance
An MCP server that enables querying SQL Server databases via tools for table search, SELECT execution, and table info retrieval.
Updated 5 months ago (2026-04-03 01:39 UTC)
-
mssql-mcp-server
Databases Developer Tools
thochi
A
license
Not graded
quality
D
maintenance
MCP server for executing SQL queries and managing connections to Microsoft SQL Server databases.
Updated 2 years ago (2025-02-15 13:10 UTC)
2,289
1
MIT
mssql-explorer-mcp
Databases Developer Tools
debabsah
A
license
Not graded
quality
C
maintenance
A read-only MCP server for exploring on-premises, multi-instance Microsoft SQL Server estates from AI clients, with read-only enforcement and Windows authentication support.
Updated 3 months ago (2026-06-24 02:22 UTC)
Apache 2.0
sql-explorer-mcp
Databases Developer Tools
timsuv
F
license
A
quality
C
maintenance
A read-only MCP server for browsing and querying SQL Server databases, providing tools to list schemas, tables, describe columns, and execute safe SELECT queries with validated parameters.
Updated 2 months ago (2026-07-12 12:15 UTC)
15
-

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/blimyj/mssql-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server