MSSQL-MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MSSQL-MCPlist all tables and their row counts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MSSQL-MCP
Microsoft SQL Server için güvenlik öncelikli, salt-okunur MCP (Model Context Protocol) sunucusu.
Security-first, read-only MCP (Model Context Protocol) server for Microsoft SQL Server.
🇹🇷 Türkçe
Bu proje nedir?
MSSQL-MCP, LLM'leri (Claude gibi) kurumsal Microsoft SQL Server veritabanlarına güvenle bağlamak için tasarlanmış bir MCP sunucusudur. LLM doğal dil sorusunu SQL'e çevirir, MSSQL-MCP bu SQL'i katmanlı güvenlik filtrelerinden geçirip yalnızca okuma amaçlıysa çalıştırır.
Neden? — LLM'i veritabanına doğrudan bağlamanın riskleri
Bir LLM'e veritabanı erişimi vermek güçlüdür ama tehlikelidir:
LLM yanlışlıkla (veya prompt injection ile kasıtlı olarak)
DELETE,UPDATE,DROPgibi yıkıcı sorgular üretebilir."Salt-okunur olduğunu varsaydığınız" kullanıcı, fark etmediğiniz bir
GRANTyüzünden yazma yetkisine sahip olabilir.Sınırsız bir
SELECTbile milyonlarca satır çekip sunucuyu kilitleyebilir.xp_cmdshell,OPENROWSETgibi kapılar veritabanının çok ötesine geçer.
Güvenlik felsefesi: salt-okunur doğrulama + savunma derinliği
MSSQL-MCP tek bir güvenlik katmanına güvenmez:
Katman 1 — Başlangıçta aktif salt-okunurluk doğrulaması. Sunucu açılırken bağlanan kullanıcının salt-okunur olduğunu aktif olarak kanıtlamasını ister. Üç bağımsız kontrolün TÜMÜ geçmelidir:
Kontrol | Nasıl | Neden |
Sunucu rolleri |
| Sunucu yöneticisi hesaplar her şeyi yapabilir |
Veritabanı rolleri |
| Yazma/DDL yetkisi veren standart roller |
Efektif izinler |
| Rol üyeliği olmadan doğrudan |
Doğrulama başarısızsa sunucu hiçbir sorgu aracı açmaz; hangi yetkilerin sorun olduğunu listeleyen, yol gösterici bir hata döner (yalnızca verify_connection aracı kalır).
Katman 2 — Sorgu seviyesinde savunma derinliği. Kullanıcı salt-okunur olsa BİLE her sorgu şu filtrelerden geçer:
Tek statement: Noktalı virgülle ayrılmış çoklu statement reddedilir. String literal içindeki
;yanlış pozitif üretmez — düz regex değil, string/yorum/köşeli parantez bilinçli bir tokenizer kullanılır.Yalnızca SELECT: Statement
SELECTveyaWITH ... SELECT(CTE) ile başlamalıdır.Kara liste (kelime sınırı duyarlı, büyük/küçük harf duyarsız):
INSERT,UPDATE,DELETE,MERGE,DROP,CREATE,ALTER,TRUNCATE,GRANT,REVOKE,DENY,EXEC,EXECUTE,sp_*,xp_*,OPENROWSET,OPENQUERY,OPENDATASOURCE,BULK,BACKUP,RESTORE,SHUTDOWN,KILL,RECONFIGURE,WAITFOR,INTO(SELECT ... INTOtablo yaratır — reddedilir).Tablo beyaz listesi (opsiyonel):
ALLOWED_TABLEStanımlıysaFROM/JOINsonrası geçen her tablo listede olmalıdır (şema önekli adlar desteklenir; CTE adları muaftır).Zaman aşımı ve satır limiti: Her sorguya
QUERY_TIMEOUT_MSuygulanır; sonuçlar sürücü seviyesinde stream edilipMAX_ROWS'ta kesilir vetruncated: truebildirilir (sorgunuzaTOPenjekte edilmez).Reddedilen her sorguda hangi kuralın tetiklendiği açıkça söylenir.
Ek güvenlik varsayılanları: bağlantı havuzu tek ve paylaşımlıdır, kimlik bilgileri asla loglanmaz ve hata mesajlarından temizlenir, TLS varsayılan olarak açıktır.
Kurulum
# npx ile (önerilen) — kurulum gerektirmez, her çalıştırmada güncel sürümü kullanır
npx -y @esasiyun17/mssql-mcp
# veya kalıcı kurulum
npm install -g @esasiyun17/mssql-mcpKaynak koddan kurulum (air-gap / kapalı ağ ortamları)
İnternet erişimi olmayan ortamlarda npx çalışmaz. Repoyu klonlayıp (veya
arşiv olarak taşıyıp) yerinde derleyin:
git clone https://github.com/esasiyun17/MSSQL-MCP.git
cd MSSQL-MCP
npm install
npm run buildArdından MCP yapılandırmasında npx yerine doğrudan node + tam yol kullanın:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["/tam/yol/MSSQL-MCP/dist/index.js"],
"env": { "MSSQL_HOST": "...", "MSSQL_USER": "...", "MSSQL_PASSWORD": "...", "MSSQL_DATABASE": "..." }
}
}
}İpucu:
npm installadımı için bağımlılıkları internet erişimli bir makinede indiripnode_modulesile birlikte taşıyabilir veyanpm packçıktısını kullanabilirsiniz.
Salt-okunur kullanıcı oluşturma
Sunucu, yazma yetkisi olan kullanıcılarla çalışmayı reddeder. Hazır script ile salt-okunur kullanıcı oluşturun:
-- scripts/create-readonly-user.sql dosyasını açın,
-- YOUR_LOGIN_NAME / YOUR_STRONG_PASSWORD / YOUR_DATABASE değerlerini değiştirip
-- sysadmin bir hesapla çalıştırın. Özet:
CREATE LOGIN [mcp_reader] WITH PASSWORD = 'YOUR_STRONG_PASSWORD';
USE [YOUR_DATABASE];
CREATE USER [mcp_reader] FOR LOGIN [mcp_reader];
ALTER ROLE [db_datareader] ADD MEMBER [mcp_reader];Claude Desktop / Claude Code yapılandırması
claude_desktop_config.json (Claude Desktop) veya .mcp.json (Claude Code):
{
"mcpServers": {
"mssql": {
"command": "npx",
"args": ["-y", "@esasiyun17/mssql-mcp"],
"env": {
"MSSQL_HOST": "192.168.1.10",
"MSSQL_PORT": "1433",
"MSSQL_USER": "mcp_reader",
"MSSQL_PASSWORD": "YOUR_PASSWORD",
"MSSQL_DATABASE": "ErpDb",
"MSSQL_ENCRYPT": "true",
"MSSQL_TRUST_CERT": "false",
"MAX_ROWS": "1000",
"ALLOWED_TABLES": "dbo.Customers,dbo.Orders,dbo.OrderLines"
}
}
}
}Claude Code CLI ile:
claude mcp add mssql -e MSSQL_HOST=192.168.1.10 -e MSSQL_USER=mcp_reader \
-e MSSQL_PASSWORD=YOUR_PASSWORD -e MSSQL_DATABASE=ErpDb -- npx -y @esasiyun17/mssql-mcpOrtam değişkenleri
Değişken | Zorunlu | Varsayılan | Açıklama |
| ✅ | — | Sunucu IP veya hostname |
|
| TCP port | |
| ✅ | — | SQL auth kullanıcı adı (salt-okunur olmalı) |
| ✅ | — | Parola (asla loglanmaz) |
| ✅ | — | Veritabanı adı |
|
| TLS şifreleme | |
|
| Self-signed sertifika kabulü | |
|
| Sorgu zaman aşımı (ms) | |
|
| Satır limiti; aşımda sonuç kesilir ve bildirilir | |
| (boş = tümü) | Virgülle ayrılmış tablo beyaz listesi, örn. | |
| (kapalı) | JSON-satırı denetim logu dosya yolu |
Araçlar
Araç | Açıklama |
| Bağlantı durumu + salt-okunurluk doğrulama raporu (hangi kontroller geçti/kaldı) |
|
|
| Kolonlar, tipler, null'luk, PK/FK, index listesi |
| İlk N satır (varsayılan 5, en fazla 50) |
| Tüm filtrelerden geçen tek bir SELECT'i çalıştırır |
Örnek kullanım (Claude'a doğal dille):
"Veritabanındaki tabloları listele" →
list_tables"Orders tablosunun yapısını göster" →describe_table("dbo.Orders")"Geçen ayın en çok satan 5 ürünü?" →run_query("SELECT TOP 5 ...")
run_query çıktısı: columns, rows, rowCount, truncated, durationMs.
Denetim logu
LOG_FILE tanımlıysa her araç çağrısı bir JSON satırı olarak yazılır: zaman damgası, araç adı, sorgu metni, süre (ms), satır sayısı, hata. Kimlik bilgileri asla loglanmaz.
Yol haritası
Windows Authentication (v1 yalnızca SQL auth destekler — kapsam bilinçli dar tutuldu)
Katkı
PR ve issue'lara açığız! Özellikle: yeni guard senaryoları için test, farklı SQL Server sürümleriyle uyumluluk raporları, dokümantasyon iyileştirmeleri. Tek kırmızı çizgi: yazma yeteneği ekleyen hiçbir katkı kabul edilmez — salt-okunurluk bu projenin kimliğidir. Güvenlik açıkları için SECURITY.md.
Related MCP server: MCP PostgreSQL
🇬🇧 English
What is this?
MSSQL-MCP is an MCP server designed to connect LLMs (like Claude) to enterprise Microsoft SQL Server databases safely. The LLM translates natural-language questions into SQL; MSSQL-MCP runs that SQL only after it passes layered security filters that guarantee it is read-only.
Why? — The risks of wiring an LLM straight into your database
Giving an LLM database access is powerful but dangerous:
The LLM can produce destructive queries (
DELETE,UPDATE,DROP) by accident — or deliberately, via prompt injection.The user you assumed was read-only may have write access through a forgotten
GRANT.Even an unbounded
SELECTcan pull millions of rows and choke the server.Escape hatches like
xp_cmdshellandOPENROWSETreach far beyond the database.
Security philosophy: read-only verification + defense in depth
MSSQL-MCP never trusts a single layer:
Layer 1 — Active read-only verification at startup. When the server starts, the connecting user must actively prove it is read-only. ALL three independent checks must pass:
Check | How | Why |
Server roles |
| Server-admin accounts can do anything |
Database roles |
| The standard roles that grant write/DDL |
Effective permissions |
| Only this catches write permissions GRANTed directly, outside any role |
If verification fails the server exposes no query tools at all; it returns an actionable error listing exactly which privileges are the problem (only verify_connection remains available).
Layer 2 — Query-level defense in depth. EVEN IF the user is read-only, every query passes these filters:
Single statement only: multiple semicolon-separated statements are rejected. A
;inside a string literal is not a false positive — a tokenizer aware of strings, comments and bracketed identifiers is used, not a plain regex.SELECT only: the statement must start with
SELECTorWITH ... SELECT(CTE).Keyword blacklist (word-boundary aware, case-insensitive):
INSERT,UPDATE,DELETE,MERGE,DROP,CREATE,ALTER,TRUNCATE,GRANT,REVOKE,DENY,EXEC,EXECUTE,sp_*,xp_*,OPENROWSET,OPENQUERY,OPENDATASOURCE,BULK,BACKUP,RESTORE,SHUTDOWN,KILL,RECONFIGURE,WAITFOR,INTO(SELECT ... INTOcreates a table — rejected).Optional table allowlist: when
ALLOWED_TABLESis set, every table appearing afterFROM/JOINmust be on the list (schema-qualified names supported; CTE names are exempt).Timeout & row cap:
QUERY_TIMEOUT_MSapplies to every query; results are streamed at the driver level and cut off atMAX_ROWSwithtruncated: truereported (noTOPis injected into your SQL).Every rejected query states exactly which rule fired.
Additional safe defaults: one shared connection pool, credentials are never logged and are scrubbed from error messages, TLS is on by default.
Installation
# via npx (recommended) — no install step, always runs the latest version
npx -y @esasiyun17/mssql-mcp
# or install globally
npm install -g @esasiyun17/mssql-mcpInstalling from source (air-gapped / offline environments)
npx won't work without internet access. Clone the repo (or carry it over as
an archive) and build in place:
git clone https://github.com/esasiyun17/MSSQL-MCP.git
cd MSSQL-MCP
npm install
npm run buildThen point your MCP configuration at node + the absolute path instead of npx:
{
"mcpServers": {
"mssql": {
"command": "node",
"args": ["/absolute/path/MSSQL-MCP/dist/index.js"],
"env": { "MSSQL_HOST": "...", "MSSQL_USER": "...", "MSSQL_PASSWORD": "...", "MSSQL_DATABASE": "..." }
}
}
}Tip: for the
npm installstep you can download dependencies on a machine with internet access and carry thenode_modulesfolder over, or use the output ofnpm pack.
Creating a read-only user
The server refuses to run with users that hold write privileges. Use the bundled script to create a read-only user:
-- Open scripts/create-readonly-user.sql, replace
-- YOUR_LOGIN_NAME / YOUR_STRONG_PASSWORD / YOUR_DATABASE and run as sysadmin. Summary:
CREATE LOGIN [mcp_reader] WITH PASSWORD = 'YOUR_STRONG_PASSWORD';
USE [YOUR_DATABASE];
CREATE USER [mcp_reader] FOR LOGIN [mcp_reader];
ALTER ROLE [db_datareader] ADD MEMBER [mcp_reader];Claude Desktop / Claude Code configuration
claude_desktop_config.json (Claude Desktop) or .mcp.json (Claude Code):
{
"mcpServers": {
"mssql": {
"command": "npx",
"args": ["-y", "@esasiyun17/mssql-mcp"],
"env": {
"MSSQL_HOST": "192.168.1.10",
"MSSQL_PORT": "1433",
"MSSQL_USER": "mcp_reader",
"MSSQL_PASSWORD": "YOUR_PASSWORD",
"MSSQL_DATABASE": "ErpDb",
"MSSQL_ENCRYPT": "true",
"MSSQL_TRUST_CERT": "false",
"MAX_ROWS": "1000",
"ALLOWED_TABLES": "dbo.Customers,dbo.Orders,dbo.OrderLines"
}
}
}
}With the Claude Code CLI:
claude mcp add mssql -e MSSQL_HOST=192.168.1.10 -e MSSQL_USER=mcp_reader \
-e MSSQL_PASSWORD=YOUR_PASSWORD -e MSSQL_DATABASE=ErpDb -- npx -y @esasiyun17/mssql-mcpEnvironment variables
Variable | Required | Default | Description |
| ✅ | — | Server IP or hostname |
|
| TCP port | |
| ✅ | — | SQL auth user name (must be read-only) |
| ✅ | — | Password (never logged) |
| ✅ | — | Database name |
|
| TLS encryption | |
|
| Accept self-signed certificates | |
|
| Per-query timeout (ms) | |
|
| Row cap; results are truncated and flagged | |
| (empty = all) | Comma-separated table allowlist, e.g. | |
| (off) | Path for the JSON-lines audit log |
Tools
Tool | Description |
| Connection status + read-only verification report (which checks passed/failed) |
|
|
| Columns, types, nullability, PK/FK, index list |
| First N rows (default 5, max 50) |
| Runs a single SELECT after all defense filters |
Example usage (natural language, via Claude):
"List the tables in the database" →
list_tables"Show me the structure of Orders" →describe_table("dbo.Orders")"Top 5 products by revenue last month?" →run_query("SELECT TOP 5 ...")
run_query output: columns, rows, rowCount, truncated, durationMs.
Audit log
When LOG_FILE is set, every tool call is appended as one JSON line: timestamp, tool name, query text, duration (ms), row count, error. Credentials are never logged.
Roadmap
Windows Authentication (v1 supports SQL auth only — scope kept deliberately narrow)
Contributing
PRs and issues welcome! Especially: tests for new guard scenarios, compatibility reports for different SQL Server versions, documentation improvements. One hard line: no contribution that adds write capability will be accepted — read-only is this project's identity. For vulnerabilities see SECURITY.md.
License / Lisans
MIT © esasiyun17
Available Tools
5 toolsdescribe_tableDescribe tableA
Describe a table: columns (name, type, nullability, identity), primary key, foreign keys and indexes, read from INFORMATION_SCHEMA / sys catalog views. Accepts "Table" or "schema.Table". Subject to the table allowlist if configured.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name, optionally schema-qualified, e.g. "dbo.Orders" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses that data is read from INFORMATION_SCHEMA / sys catalog views, which implies a read-only, metadata-only operation, and it warns of a table allowlist that may restrict access. But it doesn't state whether it returns empty or errors on a nonexistent table, so transparency is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose, then the detail of what is returned, then the naming convention, then the allowlist caveat. Three compact sentences, no filler, every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, metadata-read tool with no output schema and no annotations, the description covers purpose, return contents, input format, and the allowlist precondition. What's missing is edge-case behavior (nonexistent table, allowlist rejection), which an agent would want but isn't essential to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the sole parameter already documents the schema-qualified format. The description reinforces this by explicitly accepting both "Table" and "schema.Table", which adds a small amount of practical clarity beyond the schema. With one parameter, baseline is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Describe) and resource (a table), and enumerates exactly what is returned: columns with sub-attributes, primary key, foreign keys, indexes. An agent can distinguish this from list_tables (enumeration) and sample_rows (data preview) without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the nature of the tool — you describe a table to learn its structure before querying. However, the description never explicitly says when to reach for this versus list_tables (to find a table) or verify_connection (to check connectivity). The allowlist note hints at a precondition but is not framed as guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesList tablesA
List all tables in the database as schema.table with approximate row counts (taken from sys.partitions metadata — no COUNT(*) is executed). If a table allowlist is configured, only allowed tables are returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does well: it discloses that row counts are approximate and sourced from sys.partitions with no COUNT(*) executed, which is a real performance trait an agent should know, and it discloses allowlist filtering that can silently reduce results. It stops short of stating read-only/pagination behavior explicitly, but 'List' plus 'no COUNT(*) is executed' conveys a safe, cheap read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler, front-loaded with what is returned before the metadata caveat and the allowlist caveat. Every clause adds information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must describe returns — and it does, naming the identifier format and the row-count caveat. Combined with the allowlist note, an agent has everything needed to call this zero-parameter tool correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description correctly adds no parameter detail and instead spends its words on output semantics, which is the right allocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb and resource ('List all tables in the database') and goes further by specifying the exact return shape ('as schema.table with approximate row counts'). This clearly separates it from siblings like describe_table (single table) and run_query (arbitrary SQL), which is a meaningful distinction an agent can act on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the agent can infer this is the discovery tool to call before describe_table or sample_rows, but no explicit when-to-use or when-not-to-use guidance is given. It never names an alternative or a condition that would select it over run_query.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_queryRun read-only SQL queryA
Execute a single read-only SELECT statement (WITH/CTE supported) against the database. Every query is validated first: exactly one statement, SELECT-only, no write/exec keywords, optional table allowlist. Results are truncated at the configured MAX_ROWS (reported via the "truncated" flag) and a query timeout applies. Rejected queries name the exact rule that was violated.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | A single T-SQL SELECT statement (CTEs allowed) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses validation order, the destructive-operation prohibition, the allowlist restriction, MAX_ROWS truncation surfaced via a 'truncated' flag, a query timeout, and that rejections name the violated rule. These are exactly the behavioral traits an agent needs before invoking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each carrying distinct information (what it runs, how it's validated, what limits apply and how errors surface). Front-loaded with the core action and free of padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the description covers the safety profile, execution limits, truncation signaling, and error behavior. An agent has everything needed to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one parameter and schema coverage is 100%, so the schema already documents the SQL string. The description reinforces that it must be a single SELECT (CTE allowed) but adds no syntax or formatting detail beyond the schema, matching the baseline for full-coverage params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (execute a read-only SELECT against the database) and marks scope (single statement, WITH/CTE supported). It is clearly distinguishable from the list/describe/sample siblings, which are narrower introspection tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The validation rules (exactly one statement, SELECT-only, no write/exec keywords, optional allowlist) tell the agent what is acceptable input and imply when this tool is the right choice versus the narrow siblings. It stops short of explicitly naming those siblings or stating when to prefer them, so it is clear context rather than full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sample_rowsSample rowsA
Return the first N rows of a table (default 5, maximum 50) to inspect its content. Accepts "Table" or "schema.Table". Subject to the table allowlist if configured.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Number of rows to return (1-50, default 5) | |
| table | Yes | Table name, optionally schema-qualified, e.g. "dbo.Orders" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does add value: it discloses the cap (max 50), the default, and that the call is 'subject to the table allowlist if configured' — a real access constraint not in the schema. It omits error behavior for non-allowlisted tables, but the safety profile (read-only inspection) is clear from the wording.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the row limit is front-loaded, then the naming format, then the allowlist caveat. No filler and every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema or annotation, but for a simple sampling tool the description conveys the return shape (first N rows) and the key constraints. A note on behavior when the table is not allowlisted or does not exist would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented. The description's mention of the default (5) and maximum (50) and the 'Table' or 'schema.Table' format largely repeats what the schema descriptions already say, adding no syntax or behavioral detail beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return the first N rows of a table') plus the intent ('to inspect its content'), which distinguishes it from list_tables and describe_table. It does not explicitly contrast with run_query, which could also return rows, so the sibling differentiation is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'To inspect its content' implies a quick-peek use case versus a full query, giving some usage context. However, it never states when to prefer run_query instead, nor any exclusions, so the guidance remains implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_connectionVerify connection & read-only statusA
Verify the database connection and report the read-only verification result: which checks ran (server roles, database roles, effective permissions), which passed, and any write privileges that were detected. Use this to diagnose why the server refuses to expose query tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the internal check set and the reported outcome, and the absence of parameters implies a safe, non-mutating probe. However, it does not state failure behavior (exception vs. reported failure), idempotency, or required permissions for the verification itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the reported content front-loaded and the usage trigger placed last. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description correctly takes on explaining the return content (checks run, pass/fail, detected privileges), which it does well. It stops short of describing error/failure modes or what to do after a failed verification, a minor gap for a diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a no-param tool applies. No parameter-related confusion is possible.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource (verify the database connection) and precisely enumerates what is reported: which checks ran (server roles, database roles, effective permissions), which passed, and any detected write privileges. This clearly distinguishes it from the sibling data-access tools (list_tables, describe_table, sample_rows, run_query).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger: 'Use this to diagnose why the server refuses to expose query tools.' That is a clear when-to-use condition. It does not name or exclude alternatives explicitly, but the sibling set makes the boundary obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.0.1- First observed
describe_table - First observed
list_tables - First observed
run_query - First observed
sample_rows - First observed
verify_connection
TDQS
Scored across 5 tools
Each tool targets a unique aspect: connection verification, table listing, schema description, row sampling, and arbitrary SELECT queries. The boundaries are clear, with no overlapping purposes that could cause misselection.
All five tools use a consistent snake_case verb_noun pattern (verify_connection, list_tables, describe_table, sample_rows, run_query). The naming is predictable and readable.
Five tools is well-scoped for a read-only MSSQL query interface. It covers connection diagnostics, metadata discovery, data sampling, and custom queries without bloat.
The surface covers the core read-only workflow: verify, list, describe, sample, and query. Minor gaps exist, such as no explicit tools for listing schemas, views, or stored procedures, though run_query can retrieve such metadata.
Maintenance
Related MCP Connectors
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
- mcpOAuthcom.gibsonai
GibsonAI MCP server: manage your databases with natural language
Official Microsoft MCP Server to query Microsoft Entra data using natural language
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Related MCP Servers
- AlicenseAqualityDmaintenanceRead-only MCP server for Microsoft SQL Server that retrieves connection details from AWS Secrets Manager, enabling database exploration and querying via natural language.125 npmMIT
- AlicenseNot gradedqualityDmaintenanceA read-only MCP server for PostgreSQL that enables safe database introspection and querying via natural language.306 npmMIT
- AlicenseNot gradedqualityBmaintenanceMCP server for safely exposing SQL Server database capabilities to LLM clients, with read-only mode, security features, and observability.28MIT
- AlicenseNot gradedqualityDmaintenanceMCP server for Microsoft SQL Server enabling safe read-only queries, schema discovery, and natural-language query via LangChain.MIT