Skip to main content
Glama
ferronicardoso

mcp-mssqlserver

MCP Server for Microsoft SQL Server

Docker Publish GHCR Node.js

Production-oriented MCP server for Microsoft SQL Server, exposing database operations to MCP clients (Claude Desktop, VS Code Copilot, Cursor, and compatible hosts).

Features

  • Query execution (SELECT, INSERT, UPDATE, DELETE)

  • Database discovery and schema introspection

  • Table metadata inspection (columns, types, nullability, defaults, PK)

  • Index and foreign key discovery

  • Environment-driven configuration for secure deployment

Related MCP server: SQL Query Tools MCP Server

Available Tools

Tool

Description

execute_query

Executes a SQL statement and returns recordsets or affected rows

list_tables

Lists tables from INFORMATION_SCHEMA.TABLES (optional schema filter)

describe_table

Returns table column metadata and primary key markers

list_databases

Lists all SQL Server databases

get_table_indexes

Lists table indexes, type, uniqueness, PK, and indexed columns

get_foreign_keys

Lists table foreign keys and referenced targets

Requirements

  • Node.js 18+

  • Access to a Microsoft SQL Server instance

  • Network connectivity from MCP host to SQL Server (host:port)

Configuration

Set connection settings using environment variables:

Variable

Required

Default

Description

MSSQL_HOST

No

localhost

SQL Server host or IP

MSSQL_PORT

No

1433

SQL Server TCP port

MSSQL_DATABASE

Yes

Default database

MSSQL_AUTH_MODE

No

sql

Authentication mode: sql or windows

MSSQL_USER

Yes*

SQL login user (required only in sql)

MSSQL_PASSWORD

Yes*

SQL login password (required only in sql)

MSSQL_ENCRYPT

No

false

Enables encrypted connection

MSSQL_TRUST_SERVER_CERTIFICATE

No

true

Trusts server certificate when encryption is enabled

* Required when MSSQL_AUTH_MODE=sql.

| MCP_TRANSPORT | No | stdio | Transport mode: stdio (default, for npx/Claude Desktop/VS Code) or http (Streamable HTTP, for Docker/remote clients such as n8n) | | MCP_HTTP_PORT | No | 3001 | Port for the HTTP server (only used when MCP_TRANSPORT=http) | | MCP_HTTP_HOST | No | 0.0.0.0 | Bind address for the HTTP server (only used when MCP_TRANSPORT=http) |

Note: the published Docker image always runs in http mode and does not build the msnodesqlv8 native driver (used only for MSSQL_AUTH_MODE=windows). Windows Authentication is only available when running the server directly on a Windows host via npx/npm start.

Usage

Run directly from GitHub

npx github:ferronicardoso/mcp-mssqlserver

Claude Code (CLI)

claude mcp add mssqlserver --scope user -- npx -y github:ferronicardoso/mcp-mssqlserver

--scope controls where the server registration is stored:

Scope

Stored in

Visible to

local (default)

project-local, untracked

only you, only in this project

project

.mcp.json at the project root

anyone who clones the repo (commit it to share)

user

your global Claude Code config

you, across every project

Environment variables can be passed with repeated --env KEY=VALUE flags before the --, e.g.:

Bash (Linux/macOS/WSL):

claude mcp add mssqlserver --scope user \
  --env MSSQL_HOST=localhost \
  --env MSSQL_PORT=1433 \
  --env MSSQL_DATABASE=master \
  --env MSSQL_AUTH_MODE=sql \
  --env MSSQL_USER=sa \
  --env MSSQL_PASSWORD=your-password \
  -- npx -y github:ferronicardoso/mcp-mssqlserver

PowerShell:

claude mcp add mssqlserver --scope user `
  --env MSSQL_HOST=localhost `
  --env MSSQL_PORT=1433 `
  --env MSSQL_DATABASE=master `
  --env MSSQL_AUTH_MODE=sql `
  --env MSSQL_USER=sa `
  --env MSSQL_PASSWORD=your-password `
  -- npx -y github:ferronicardoso/mcp-mssqlserver

Codex CLI

Bash (Linux/macOS/WSL):

codex mcp add mssqlserver \
  --env MSSQL_AUTH_MODE=sql \
  --env MSSQL_HOST=localhost \
  --env MSSQL_PORT=1433 \
  --env MSSQL_DATABASE=master \
  --env MSSQL_USER=sa \
  --env MSSQL_PASSWORD=your-password \
  npx -- -y github:ferronicardoso/mcp-mssqlserver

PowerShell:

codex mcp add mssqlserver `
  --env MSSQL_AUTH_MODE=sql `
  --env MSSQL_HOST=localhost `
  --env MSSQL_PORT=1433 `
  --env MSSQL_DATABASE=master `
  --env MSSQL_USER=sa `
  --env MSSQL_PASSWORD=your-password `
  npx -- -y github:ferronicardoso/mcp-mssqlserver

For Windows Authentication instead, drop MSSQL_USER/MSSQL_PASSWORD and set MSSQL_AUTH_MODE=windows:

Bash (Linux/macOS/WSL):

codex mcp add mssqlserver \
  --env MSSQL_AUTH_MODE=windows \
  --env MSSQL_HOST=localhost \
  --env MSSQL_PORT=1433 \
  --env MSSQL_DATABASE=master \
  npx -- -y github:ferronicardoso/mcp-mssqlserver

PowerShell:

codex mcp add mssqlserver `
  --env MSSQL_AUTH_MODE=windows `
  --env MSSQL_HOST=localhost `
  --env MSSQL_PORT=1433 `
  --env MSSQL_DATABASE=master `
  npx -- -y github:ferronicardoso/mcp-mssqlserver

This registers the server in ~/.codex/config.toml. To remove it, run codex mcp remove mssqlserver.

Claude Desktop configuration

%APPDATA%\\Claude\\claude_desktop_config.json:

{
  "mcpServers": {
    "mssqlserver": {
      "command": "npx",
      "args": ["github:ferronicardoso/mcp-mssqlserver"],
      "env": {
        "MSSQL_HOST": "localhost",
        "MSSQL_PORT": "1433",
        "MSSQL_DATABASE": "master",
        "MSSQL_AUTH_MODE": "sql",
        "MSSQL_USER": "sa",
        "MSSQL_PASSWORD": "your-password"
      }
    }
  }
}

VS Code MCP configuration

.vscode/mcp.json:

{
  "servers": {
    "mssqlserver": {
      "command": "npx",
      "args": ["github:ferronicardoso/mcp-mssqlserver"],
      "env": {
        "MSSQL_HOST": "localhost",
        "MSSQL_PORT": "1433",
        "MSSQL_DATABASE": "master",
        "MSSQL_AUTH_MODE": "sql",
        "MSSQL_USER": "sa",
        "MSSQL_PASSWORD": "your-password"
      }
    }
  }
}

Run with Docker (HTTP transport)

The published image runs in Streamable HTTP mode by default, for use as a remote MCP endpoint (e.g. from n8n's MCP Client Tool node or any Streamable HTTP-compatible client):

Bash (Linux/macOS/WSL):

docker run -d --name mcp-mssqlserver \
  -p 3001:3001 \
  -e MSSQL_HOST=host.docker.internal \
  -e MSSQL_PORT=1433 \
  -e MSSQL_DATABASE=master \
  -e MSSQL_AUTH_MODE=sql \
  -e MSSQL_USER=sa \
  -e MSSQL_PASSWORD=your-password \
  ghcr.io/ferronicardoso/mcp-mssqlserver:latest

PowerShell:

docker run -d --name mcp-mssqlserver `
  -p 3001:3001 `
  -e MSSQL_HOST=host.docker.internal `
  -e MSSQL_PORT=1433 `
  -e MSSQL_DATABASE=master `
  -e MSSQL_AUTH_MODE=sql `
  -e MSSQL_USER=sa `
  -e MSSQL_PASSWORD=your-password `
  ghcr.io/ferronicardoso/mcp-mssqlserver:latest

The MCP endpoint is then available at http://localhost:3001/mcp.

Local Development

git clone https://github.com/ferronicardoso/mcp-mssqlserver
cd mcp-mssqlserver
npm install
npm run build

Start the compiled server:

npm start

Build and Commit Workflow

This repository intentionally tracks dist/ to support npx github:user/repo usage.

The project uses a Husky pre-commit hook to:

  1. build TypeScript (npm run build)

  2. stage generated artifacts (git add dist)

Manual fallback:

npm run build
git add dist

Security Notes

  • Never commit real credentials or .env files.

  • Prefer least-privilege SQL users for production use.

  • For public or untrusted networks, enable encryption (MSSQL_ENCRYPT=true) and configure certificates appropriately.

Windows Authentication (Integrated Security)

To use Windows Authentication with Integrated Security (process account), configure:

MSSQL_AUTH_MODE=windows
MSSQL_HOST=sqlserver.company.local
MSSQL_PORT=1433
MSSQL_DATABASE=master

License

MIT © Raphael Augusto Ferroni Cardoso

Available Tools

6 tools
describe_tableB

Retorna a estrutura de uma tabela: colunas, tipos de dados, nulabilidade e valores padrão.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesNome da tabela
schemaNoSchema da tabela (padrão: dbo)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description does not disclose any behavioral traits (e.g., read-only nature, auth requirements, performance impact). The read-only nature is only implied by the tool name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that concisely and clearly conveys the tool's purpose with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains the return contents. Could mention error handling or ordering but sufficient for a simple describe tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description does not add extra meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns table structure (columns, types, nullability, defaults) but does not explicitly distinguish from sibling tools like list_tables or get_foreign_keys.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives; usage is implied from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_queryA

Executa uma query SQL no SQL Server e retorna os resultados. Use para SELECT, INSERT, UPDATE e DELETE.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesA query SQL a ser executada

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions that the tool can execute INSERT/UPDATE/DELETE, implying data modification, but lacks details on side effects, authentication needs, rate limits, transaction behavior, or error handling. The description does not go beyond the obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the purpose and lists supported SQL commands. It is concise and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one simple parameter and no output schema. The description mentions it returns results but not in what format (e.g., rows, affected rows). For a query execution tool, more details on return structure, error behavior, and supported SQL dialect would improve completeness, but it covers the essential purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the schema describes the query parameter). The description adds that the query can be SELECT, INSERT, UPDATE, or DELETE, which is useful context but does not significantly deepen parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it executes a SQL query on SQL Server and specifies it is for SELECT, INSERT, UPDATE, and DELETE. It differentiates itself from sibling tools that focus on metadata (describing tables, listing databases) by explicitly mentioning execution of DML and DQL statements.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use the tool (for SQL queries of types SELECT, INSERT, UPDATE, DELETE). It provides clear context, though it does not explicitly exclude scenarios or mention alternatives. However, the sibling tools are distinctly different, so implicit differentiation exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_foreign_keysC

Lista as chaves estrangeiras de uma tabela e suas referências.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesNome da tabela
schemaNoSchema da tabela (padrão: dbo)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, and the description does not disclose any behavioral traits beyond the action. It does not mention that it is a read-only operation, required permissions, or any side effects. The description is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no unnecessary words. It is concise and front-loads the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool lacks an output schema, yet the description does not explain the format of the returned data. It only says 'lists foreign keys and their references' without detailing what fields or structure to expect. Given the complexity of foreign key definitions, more information is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description does not add any additional meaning beyond what is in the schema. Baseline is 3, and there is no extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists foreign keys and their references for a given table. The verb 'Lista' and resource are specific. However, it does not differentiate from sibling tools like describe_table, which may also show foreign keys, but the purpose is still distinct enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as describe_table or get_table_indexes. The description only states what it does without any context about prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_table_indexesB

Lista os índices de uma tabela, incluindo colunas e tipo de índice.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesNome da tabela
schemaNoSchema da tabela (padrão: dbo)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations present. The description only states what is listed (indexes, columns, type) but omits behavioral details like whether indexes are returned in a specific order, whether the operation is read-only (obvious but not stated), or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence conveying the core functionality without extraneous words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple nature of the tool (listing indexes with columns and type) and full schema coverage, the description is largely complete. However, it could mention the output shape or that it covers all indexes in the table.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both parameters (table name, schema). The tool description adds no additional parameter detail beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool lists table indexes including columns and type. It is a specific verb and resource, but does not explicitly differentiate from siblings like describe_table.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like describe_table or get_foreign_keys. The usage context is implied but not explained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_databasesA

Lista todos os bancos de dados disponíveis no servidor SQL Server.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only states the basic function. It does not disclose any behavioral traits such as read-only nature, required permissions, or whether operations are safe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no wasted words. It is front-loaded and efficiently communicates the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters or annotations, the description is minimally viable but lacks details about output format or ordering. Could be more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the description does not add parameter details because none exist. The baseline for zero parameters is 4, and the description is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'all available databases on the SQL Server server', making it distinct from sibling tools like list_tables which list tables.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for listing databases but does not provide explicit guidance on when to use it versus alternatives, nor does it mention prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesA

Lista todas as tabelas do banco de dados atual, opcionalmente filtrando por schema.

ParametersJSON Schema
NameRequiredDescriptionDefault
schemaNoSchema a filtrar (padrão: todos os schemas)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It reveals that the tool is a read operation (listing) with optional filtering, but does not disclose return format, permissions, or potential side effects. Lack of output schema leaves ambiguity about the result structure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence containing no unnecessary words. It is well-suited for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool, the description covers the core purpose and optional filtering. However, the lack of output schema means the agent must infer the return format, which is a minor completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the 'schema' parameter. The description merely reiterates the filtering option without adding new semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists all tables of the current database with optional schema filtering, which distinguishes it from siblings like describe_table (single table details) and execute_query (arbitrary SQL).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing tables with optional filtering, but does not explicitly contrast with siblings or state when not to use it. The context of sibling tools provides some implicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.7/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: describing table structure, executing arbitrary queries, listing foreign keys, indexes, databases, and tables. No overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern using snake_case (e.g., describe_table, get_foreign_keys, list_databases), making them predictable and easy to understand.

Tool Count5/5

With 6 tools, the set is well-scoped for a SQL Server utility server, covering essential introspection and query execution without being overly numerous or sparse.

Completeness4/5

The tools cover core database introspection (list databases, tables, describe table, get indexes/foreign keys) and query execution. Missing advanced features like schema management or stored procedure execution, but these are minor gaps for typical usage.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Provides tools to connect, query, and manage Microsoft SQL Server databases through the MCP protocol, including support for stored procedures, transactions, and schema inspection.
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    MCP server for connecting to SQL Server in readonly mode. Allows any MCP client to explore the schema and run SELECT queries against a SQL Server database.
    6
  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server for executing SQL queries and managing connections to Microsoft SQL Server databases.
    3,338
    1
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ferronicardoso/mcp-mssqlserver'

If you have feedback or need assistance with the MCP directory API, please join our Discord server