mcp-mssqlserver
The mcp-mssqlserver server enables interaction with Microsoft SQL Server databases through the following tools:
Execute SQL Queries (
execute_query): Run any SQL statement includingSELECT,INSERT,UPDATE, andDELETE, returning recordsets or affected row counts.List Databases (
list_databases): Enumerate all available databases on the connected SQL Server instance.List Tables (
list_tables): Discover all tables in the current database, with an optional filter by schema name.Describe Table (
describe_table): Inspect a table's structure, including column names, data types, nullability, default values, and primary key markers.Get Table Indexes (
get_table_indexes): Retrieve index information for a table, including index type, uniqueness, primary key status, and indexed columns.Get Foreign Keys (
get_foreign_keys): List all foreign key constraints on a table along with their referenced tables and columns.
Provides a remote MCP endpoint for n8n's MCP Client Tool node to interact with SQL Server databases.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-mssqlserverlist all tables in the database"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Server for Microsoft SQL Server
Production-oriented MCP server for Microsoft SQL Server, exposing database operations to MCP clients (Claude Desktop, VS Code Copilot, Cursor, and compatible hosts).
Features
Query execution (
SELECT,INSERT,UPDATE,DELETE)Database discovery and schema introspection
Table metadata inspection (columns, types, nullability, defaults, PK)
Index and foreign key discovery
Environment-driven configuration for secure deployment
Related MCP server: SQL Query Tools MCP Server
Available Tools
Tool | Description |
| Executes a SQL statement and returns recordsets or affected rows |
| Lists tables from |
| Returns table column metadata and primary key markers |
| Lists all SQL Server databases |
| Lists table indexes, type, uniqueness, PK, and indexed columns |
| Lists table foreign keys and referenced targets |
Requirements
Node.js 18+
Access to a Microsoft SQL Server instance
Network connectivity from MCP host to SQL Server (
host:port)
Configuration
Set connection settings using environment variables:
Variable | Required | Default | Description |
| No |
| SQL Server host or IP |
| No |
| SQL Server TCP port |
| Yes | — | Default database |
| No |
| Authentication mode: |
| Yes* | — | SQL login user (required only in |
| Yes* | — | SQL login password (required only in |
| No |
| Enables encrypted connection |
| No |
| Trusts server certificate when encryption is enabled |
* Required when MSSQL_AUTH_MODE=sql.
| MCP_TRANSPORT | No | stdio | Transport mode: stdio (default, for npx/Claude Desktop/VS Code) or http (Streamable HTTP, for Docker/remote clients such as n8n) |
| MCP_HTTP_PORT | No | 3001 | Port for the HTTP server (only used when MCP_TRANSPORT=http) |
| MCP_HTTP_HOST | No | 0.0.0.0 | Bind address for the HTTP server (only used when MCP_TRANSPORT=http) |
Note: the published Docker image always runs in
httpmode and does not build themsnodesqlv8native driver (used only forMSSQL_AUTH_MODE=windows). Windows Authentication is only available when running the server directly on a Windows host vianpx/npm start.
Usage
Run directly from GitHub
npx github:ferronicardoso/mcp-mssqlserverClaude Code (CLI)
claude mcp add mssqlserver --scope user -- npx -y github:ferronicardoso/mcp-mssqlserver--scope controls where the server registration is stored:
Scope | Stored in | Visible to |
| project-local, untracked | only you, only in this project |
|
| anyone who clones the repo (commit it to share) |
| your global Claude Code config | you, across every project |
Environment variables can be passed with repeated --env KEY=VALUE flags before the --, e.g.:
Bash (Linux/macOS/WSL):
claude mcp add mssqlserver --scope user \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
--env MSSQL_AUTH_MODE=sql \
--env MSSQL_USER=sa \
--env MSSQL_PASSWORD=your-password \
-- npx -y github:ferronicardoso/mcp-mssqlserverPowerShell:
claude mcp add mssqlserver --scope user `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
--env MSSQL_AUTH_MODE=sql `
--env MSSQL_USER=sa `
--env MSSQL_PASSWORD=your-password `
-- npx -y github:ferronicardoso/mcp-mssqlserverCodex CLI
Bash (Linux/macOS/WSL):
codex mcp add mssqlserver \
--env MSSQL_AUTH_MODE=sql \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
--env MSSQL_USER=sa \
--env MSSQL_PASSWORD=your-password \
npx -- -y github:ferronicardoso/mcp-mssqlserverPowerShell:
codex mcp add mssqlserver `
--env MSSQL_AUTH_MODE=sql `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
--env MSSQL_USER=sa `
--env MSSQL_PASSWORD=your-password `
npx -- -y github:ferronicardoso/mcp-mssqlserverFor Windows Authentication instead, drop MSSQL_USER/MSSQL_PASSWORD and set MSSQL_AUTH_MODE=windows:
Bash (Linux/macOS/WSL):
codex mcp add mssqlserver \
--env MSSQL_AUTH_MODE=windows \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
npx -- -y github:ferronicardoso/mcp-mssqlserverPowerShell:
codex mcp add mssqlserver `
--env MSSQL_AUTH_MODE=windows `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
npx -- -y github:ferronicardoso/mcp-mssqlserverThis registers the server in ~/.codex/config.toml. To remove it, run codex mcp remove mssqlserver.
Claude Desktop configuration
%APPDATA%\\Claude\\claude_desktop_config.json:
{
"mcpServers": {
"mssqlserver": {
"command": "npx",
"args": ["github:ferronicardoso/mcp-mssqlserver"],
"env": {
"MSSQL_HOST": "localhost",
"MSSQL_PORT": "1433",
"MSSQL_DATABASE": "master",
"MSSQL_AUTH_MODE": "sql",
"MSSQL_USER": "sa",
"MSSQL_PASSWORD": "your-password"
}
}
}
}VS Code MCP configuration
.vscode/mcp.json:
{
"servers": {
"mssqlserver": {
"command": "npx",
"args": ["github:ferronicardoso/mcp-mssqlserver"],
"env": {
"MSSQL_HOST": "localhost",
"MSSQL_PORT": "1433",
"MSSQL_DATABASE": "master",
"MSSQL_AUTH_MODE": "sql",
"MSSQL_USER": "sa",
"MSSQL_PASSWORD": "your-password"
}
}
}
}Run with Docker (HTTP transport)
The published image runs in Streamable HTTP mode by default, for use as a remote MCP endpoint (e.g. from n8n's MCP Client Tool node or any Streamable HTTP-compatible client):
Bash (Linux/macOS/WSL):
docker run -d --name mcp-mssqlserver \
-p 3001:3001 \
-e MSSQL_HOST=host.docker.internal \
-e MSSQL_PORT=1433 \
-e MSSQL_DATABASE=master \
-e MSSQL_AUTH_MODE=sql \
-e MSSQL_USER=sa \
-e MSSQL_PASSWORD=your-password \
ghcr.io/ferronicardoso/mcp-mssqlserver:latestPowerShell:
docker run -d --name mcp-mssqlserver `
-p 3001:3001 `
-e MSSQL_HOST=host.docker.internal `
-e MSSQL_PORT=1433 `
-e MSSQL_DATABASE=master `
-e MSSQL_AUTH_MODE=sql `
-e MSSQL_USER=sa `
-e MSSQL_PASSWORD=your-password `
ghcr.io/ferronicardoso/mcp-mssqlserver:latestThe MCP endpoint is then available at http://localhost:3001/mcp.
Local Development
git clone https://github.com/ferronicardoso/mcp-mssqlserver
cd mcp-mssqlserver
npm install
npm run buildStart the compiled server:
npm startBuild and Commit Workflow
This repository intentionally tracks dist/ to support npx github:user/repo usage.
The project uses a Husky pre-commit hook to:
build TypeScript (
npm run build)stage generated artifacts (
git add dist)
Manual fallback:
npm run build
git add distSecurity Notes
Never commit real credentials or
.envfiles.Prefer least-privilege SQL users for production use.
For public or untrusted networks, enable encryption (
MSSQL_ENCRYPT=true) and configure certificates appropriately.
Windows Authentication (Integrated Security)
To use Windows Authentication with Integrated Security (process account), configure:
MSSQL_AUTH_MODE=windows
MSSQL_HOST=sqlserver.company.local
MSSQL_PORT=1433
MSSQL_DATABASE=masterLicense
MIT © Raphael Augusto Ferroni Cardoso
Available Tools
6 toolsdescribe_tableB
Retorna a estrutura de uma tabela: colunas, tipos de dados, nulabilidade e valores padrão.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose any behavioral traits (e.g., read-only nature, auth requirements, performance impact). The read-only nature is only implied by the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that concisely and clearly conveys the tool's purpose with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately explains the return contents. Could mention error handling or ordering but sufficient for a simple describe tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description does not add extra meaning beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns table structure (columns, types, nullability, defaults) but does not explicitly distinguish from sibling tools like list_tables or get_foreign_keys.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives; usage is implied from the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_queryA
Executa uma query SQL no SQL Server e retorna os resultados. Use para SELECT, INSERT, UPDATE e DELETE.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | A query SQL a ser executada |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions that the tool can execute INSERT/UPDATE/DELETE, implying data modification, but lacks details on side effects, authentication needs, rate limits, transaction behavior, or error handling. The description does not go beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the purpose and lists supported SQL commands. It is concise and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one simple parameter and no output schema. The description mentions it returns results but not in what format (e.g., rows, affected rows). For a query execution tool, more details on return structure, error behavior, and supported SQL dialect would improve completeness, but it covers the essential purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (the schema describes the query parameter). The description adds that the query can be SELECT, INSERT, UPDATE, or DELETE, which is useful context but does not significantly deepen parameter understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it executes a SQL query on SQL Server and specifies it is for SELECT, INSERT, UPDATE, and DELETE. It differentiates itself from sibling tools that focus on metadata (describing tables, listing databases) by explicitly mentioning execution of DML and DQL statements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (for SQL queries of types SELECT, INSERT, UPDATE, DELETE). It provides clear context, though it does not explicitly exclude scenarios or mention alternatives. However, the sibling tools are distinctly different, so implicit differentiation exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_foreign_keysC
Lista as chaves estrangeiras de uma tabela e suas referências.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose any behavioral traits beyond the action. It does not mention that it is a read-only operation, required permissions, or any side effects. The description is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. It is concise and front-loads the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool lacks an output schema, yet the description does not explain the format of the returned data. It only says 'lists foreign keys and their references' without detailing what fields or structure to expect. Given the complexity of foreign key definitions, more information is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description does not add any additional meaning beyond what is in the schema. Baseline is 3, and there is no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists foreign keys and their references for a given table. The verb 'Lista' and resource are specific. However, it does not differentiate from sibling tools like describe_table, which may also show foreign keys, but the purpose is still distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as describe_table or get_table_indexes. The description only states what it does without any context about prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_table_indexesB
Lista os índices de uma tabela, incluindo colunas e tipo de índice.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present. The description only states what is listed (indexes, columns, type) but omits behavioral details like whether indexes are returned in a specific order, whether the operation is read-only (obvious but not stated), or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence conveying the core functionality without extraneous words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (listing indexes with columns and type) and full schema coverage, the description is largely complete. However, it could mention the output shape or that it covers all indexes in the table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for both parameters (table name, schema). The tool description adds no additional parameter detail beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the tool lists table indexes including columns and type. It is a specific verb and resource, but does not explicitly differentiate from siblings like describe_table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like describe_table or get_foreign_keys. The usage context is implied but not explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesA
Lista todos os bancos de dados disponíveis no servidor SQL Server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states the basic function. It does not disclose any behavioral traits such as read-only nature, required permissions, or whether operations are safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no wasted words. It is front-loaded and efficiently communicates the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters or annotations, the description is minimally viable but lacks details about output format or ordering. Could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description does not add parameter details because none exist. The baseline for zero parameters is 4, and the description is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'all available databases on the SQL Server server', making it distinct from sibling tools like list_tables which list tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for listing databases but does not provide explicit guidance on when to use it versus alternatives, nor does it mention prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesA
Lista todas as tabelas do banco de dados atual, opcionalmente filtrando por schema.
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema a filtrar (padrão: todos os schemas) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It reveals that the tool is a read operation (listing) with optional filtering, but does not disclose return format, permissions, or potential side effects. Lack of output schema leaves ambiguity about the result structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence containing no unnecessary words. It is well-suited for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool, the description covers the core purpose and optional filtering. However, the lack of output schema means the agent must infer the return format, which is a minor completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'schema' parameter. The description merely reiterates the filtering option without adding new semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all tables of the current database with optional schema filtering, which distinguishes it from siblings like describe_table (single table details) and execute_query (arbitrary SQL).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing tables with optional filtering, but does not explicitly contrast with siblings or state when not to use it. The context of sibling tools provides some implicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose: describing table structure, executing arbitrary queries, listing foreign keys, indexes, databases, and tables. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., describe_table, get_foreign_keys, list_databases), making them predictable and easy to understand.
With 6 tools, the set is well-scoped for a SQL Server utility server, covering essential introspection and query execution without being overly numerous or sparse.
The tools cover core database introspection (list databases, tables, describe table, get indexes/foreign keys) and query execution. Missing advanced features like schema management or stored procedure execution, but these are minor gaps for typical usage.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- SupabaseOAuthcom.supabase
MCP server for interacting with the Supabase platform
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
Read-only MCP server for ClassQuill, a tutoring-business-management platform.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides tools to connect, query, and manage Microsoft SQL Server databases through the MCP protocol, including support for stored procedures, transactions, and schema inspection.MIT
- FlicenseAqualityDmaintenanceMCP server for connecting to SQL Server in readonly mode. Allows any MCP client to explore the schema and run SELECT queries against a SQL Server database.6
- AlicenseNot gradedqualityDmaintenanceMCP server for executing SQL queries and managing connections to Microsoft SQL Server databases.3,3381MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for Microsoft SQL Server enabling safe read-only queries, schema discovery, and natural-language query via LangChain.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ferronicardoso/mcp-mssqlserver'
If you have feedback or need assistance with the MCP directory API, please join our Discord server