OraLink MCP

Oracle Autonomous Database MCP Server — an OAuth 2.0-compatible, hosted connector for Claude.ai and any MCP client.

What is this?

OraLink MCP is a hosted, OAuth 2.0-compatible Model Context Protocol server that bridges any MCP client (Claude.ai, Claude Desktop, Cursor, VS Code Copilot, Cline, etc.) to Oracle Autonomous Database on OCI — with no SQLcl, no Oracle Instant Client, and no local tooling required.

Unlike Oracle's existing SQLcl MCP server (STDIO/local-only), OraLink MCP:

• Runs as an HTTPS endpoint reachable from the cloud

• Supports two auth paths: OAuth 2.0 (for Claude.ai marketplace) and static API keys (for OCI ADB public-endpoint / no-OAuth setups)

• Works from any device including mobile

• Connects to any Oracle ADB instance across regions

• Uses node-oracledb Thin Mode — no Oracle Client libraries needed

• Provides 28 MCP tools across connection mgmt, schema, query, objects, data, and admin categories

Related MCP server: Universal Database MCP Server

Architecture

Claude.ai / Cursor / Any MCP Client
        │  (MCP over HTTPS)
        │  Auth: Bearer <jwt>  — OAuth 2.0 flow
        │        ApiKey <key>  — static key (OCI public-endpoint path)
        ▼
┌──────────────────────────────────┐
│          OraLink MCP             │
│  ┌──────────────────────────┐   │
│  │   Auth layer             │   │
│  │  OAuth 2.0 /oauth/*      │   │
│  │  API Key  ORALINK_API_KEYS│  │
│  └───────────┬──────────────┘   │
│  ┌───────────▼──────────────┐   │
│  │   MCP Tools (28)         │   │
│  │ add/remove/test_conn /   │   │
│  │ schema / query / objects │   │
│  │ data / metadata / admin  │   │
│  └───────────┬──────────────┘   │
│  ┌───────────▼──────────────┐   │
│  │  node-oracledb (Thin v6) │   │
│  └───────────┬──────────────┘   │
└──────────────┼───────────────────┘
               │  (TLS / mTLS)
               ▼
     Oracle Autonomous Database
           (OCI Cloud)

Authentication paths

Path 1 — OAuth 2.0 (Claude.ai marketplace)

The standard OAuth 2.0 authorization code flow. Claude.ai handles the redirect; the user fills in their ADB connection details on the OraLink consent form.

1. User clicks "Connect Oracle ADB" in Claude.ai
2. Redirected → GET /oauth/authorize
3. User enters ADB details (connect string, ADMIN username, ADMIN password, optional wallet)
4. POST /oauth/authorize → stores encrypted credentials, issues auth code
5. POST /oauth/token → returns access_token (JWT) + refresh_token
6. Claude.ai stores token, sends as Bearer on every MCP request

Path 2 — Static API key (OCI ADB public endpoint, no OAuth)

OCI Autonomous Database does not provide its own OAuth server. When your ADB instance is on a public endpoint (access controlled via OCI network ACL or resource tag), you can skip the OAuth consent flow and connect with a static pre-shared API key instead.

OCI setup (one-time):

1. In OCI Console → your ADB → Network → Access Control List: add the IP address of your OraLink server (or use a CIDR / VCN OCID tag).

2. Under DB Connection: copy the TLS connect string (not the mTLS/wallet download — public-endpoint ADB-S has supported one-way TLS without a wallet since 2023). It looks like:

   (description=(retry_count=20)(retry_delay=3)
     (address=(protocol=tcps)(port=1522)
       (host=adb.us-ashburn-1.oraclecloud.com))
     (connect_data=(service_name=g1abc2def_mydb_high.adb.oraclecloud.com))
     (security=(ssl_server_dn_match=yes)))

OraLink server setup:

# Generate a key and a userId
export MY_KEY=$(openssl rand -hex 32)
export MY_USER=$(node -e "console.log(require('crypto').randomUUID())")

# Add to .env
echo "ORALINK_API_KEYS=${MY_KEY}:${MY_USER}" >> .env

MCP client config (~/.config/claude/claude_desktop_config.json or mcp.json):

{
  "mcpServers": {
    "oralink": {
      "type": "streamableHttp",
      "url": "https://your-oralink-server.example.com/mcp",
      "headers": {
        "Authorization": "ApiKey YOUR_KEY_HERE"
      }
    }
  }
}

Register your ADB connection (call from Claude / any MCP client):

Call tool: add_connection
  connection_name : "prod-adb"
  connect_string  : "(description=...paste TLS connect string here...)"
  db_user         : "ADMIN"
  db_password     : "<the ADMIN password you set when creating the ADB instance in OCI Console>"
  allow_dml       : false

Where is the ADMIN password?
OCI creates an ADMIN user automatically when you provision an Autonomous Database. The password for this user is whatever you typed in the "Administrator credentials" section of the Create Autonomous Database wizard in the OCI Console. If you forgot it, you can reset it from OCI Console → your ADB → More Actions → Reset Admin Password.

Then verify it works:

Call tool: test_connection
  connection : "prod-adb"

If the test passes you'll see the Oracle version banner. You're ready to use all 28 tools against your ADB instance with no OAuth flow required.

MCP Tools

Connection Management (3 tools)

Schema & Metadata (8 tools)

Object Inspection (7 tools)

Data Access & DML (4 tools)

Administration (6 tools)

Quick Start

Prerequisites

• Node.js 18+

• An Oracle Autonomous Database instance (19c or 26ai)

• OCI network ACL allowing your server's IP (public-endpoint path), or

• OCI wallet .zip (for mTLS / private-endpoint path)

Install & run

git clone https://github.com/hvrcharon1/oralink-mcp.git
cd oralink-mcp
npm install
cp .env.example .env
# Edit .env — see MANUAL_STEPS.md for secret generation
npm run dev

Discovery document

GET /.well-known/oauth-authorization-server returns the RFC 8414 metadata document required by Claude.ai marketplace registration.

Deployment

See MANUAL_STEPS.md for actions requiring human input.

# Docker
docker compose up -d

Security

• Credentials encrypted at rest with AES-256-GCM

• Per-user isolated connection pools

• Only SELECT allowed by default; DML requires explicit opt-in per connection

• All queries logged with user context

• Wallet content held in memory only — never written to disk

• SQL injection prevention via Oracle parameterized query API

• API keys never stored; only the key→userId mapping lives in env at startup

License

© 2026 Datacules LLC. All rights reserved.

This software is proprietary and confidential. Unauthorized use, reproduction, or distribution is strictly prohibited. See LICENSE for full terms.

For licensing inquiries: legal@datacules.com