mcp-mssqlserver
MCP Server for Microsoft SQL Server
面向生产的 Microsoft SQL Server MCP 服务器,向 MCP 客户端(Claude Desktop、VS Code Copilot、Cursor 及兼容主机)公开数据库操作。
功能
查询执行(
SELECT、INSERT、UPDATE、DELETE)数据库发现与 Schema 内省
表元数据检查(列、类型、可空性、默认值、主键 PK)
索引和外键发现
基于环境变量的配置,支持安全部署
Related MCP server: SQL Query Tools MCP Server
可用工具
工具 | 说明 |
| 执行 SQL 语句并返回记录集或受影响的行数 |
| 从 |
| 返回表的列元数据及主键标记 |
| 列出所有 SQL Server 数据库 |
| 列出表的索引、类型、唯一性、PK 和被索引的列 |
| 列出表的外键及被引用的目标 |
要求
Node.js 18+
可访问 Microsoft SQL Server 实例
MCP 主机到 SQL Server 的网络连通性(
host:port)
配置
使用环境变量设置连接参数:
变量 | 必填 | 默认值 | 说明 |
| 否 |
| SQL Server 主机或 IP |
| 否 |
| SQL Server TCP 端口 |
| 是 | — | 默认数据库 |
| 否 |
| 身份验证模式: |
| 是* | — | SQL 登录用户(仅在 |
| 是* | — | SQL 登录密码(仅在 |
| 否 |
| 启用加密连接 |
| 否 |
| 启用加密时信任服务器证书 |
* 当 MSSQL_AUTH_MODE=sql 时必填。
| MCP_TRANSPORT | 否 | stdio | 传输模式:stdio(默认,用于 npx/Claude Desktop/VS Code)或 http(Streamable HTTP,用于 Docker/远程客户端,如 n8n) |
| MCP_HTTP_PORT | 否 | 3001 | HTTP 服务器端口(仅当 MCP_TRANSPORT=http 时使用) |
| MCP_HTTP_HOST | 否 | 0.0.0.0 | HTTP 服务器绑定地址(仅当 MCP_TRANSPORT=http 时使用) |
注意:已发布的 Docker 镜像始终以
http模式运行,并且不构建msnodesqlv8原生驱动(仅用于MSSQL_AUTH_MODE=windows)。Windows 身份验证仅在通过npx/npm start直接在 Windows 主机上运行服务器时可用。
用法
直接从 GitHub 运行
npx github:ferronicardoso/mcp-mssqlserverClaude Code(CLI)
claude mcp add mssqlserver --scope user -- npx -y github:ferronicardoso/mcp-mssqlserver--scope 控制服务器注册信息的存储位置:
作用域 | 存储位置 | 可见范围 |
| 项目本地,未跟踪 | 仅你自己,且仅在本项目中 |
| 项目根目录下的 | 任何克隆仓库的人(提交该文件即可共享) |
| 你的全局 Claude Code 配置 | 你本人,在所有项目中均可见 |
可以通过在 -- 之前重复使用 --env KEY=VALUE 标志来传递环境变量,例如:
Bash(Linux/macOS/WSL):
claude mcp add mssqlserver --scope user \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
--env MSSQL_AUTH_MODE=sql \
--env MSSQL_USER=sa \
--env MSSQL_PASSWORD=your-password \
-- npx -y github:ferronicardoso/mcp-mssqlserverPowerShell:
claude mcp add mssqlserver --scope user `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
--env MSSQL_AUTH_MODE=sql `
--env MSSQL_USER=sa `
--env MSSQL_PASSWORD=your-password `
-- npx -y github:ferronicardoso/mcp-mssqlserverCodex CLI
Bash(Linux/macOS/WSL):
codex mcp add mssqlserver \
--env MSSQL_AUTH_MODE=sql \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
--env MSSQL_USER=sa \
--env MSSQL_PASSWORD=your-password \
npx -- -y github:ferronicardoso/mcp-mssqlserverPowerShell:
codex mcp add mssqlserver `
--env MSSQL_AUTH_MODE=sql `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
--env MSSQL_USER=sa `
--env MSSQL_PASSWORD=your-password `
npx -- -y github:ferronicardoso/mcp-mssqlserver如需改用 Windows 身份验证,请去掉 MSSQL_USER/MSSQL_PASSWORD 并设置 MSSQL_AUTH_MODE=windows:
Bash(Linux/macOS/WSL):
codex mcp add mssqlserver \
--env MSSQL_AUTH_MODE=windows \
--env MSSQL_HOST=localhost \
--env MSSQL_PORT=1433 \
--env MSSQL_DATABASE=master \
npx -- -y github:ferronicardoso/mcp-mssqlserverPowerShell:
codex mcp add mssqlserver `
--env MSSQL_AUTH_MODE=windows `
--env MSSQL_HOST=localhost `
--env MSSQL_PORT=1433 `
--env MSSQL_DATABASE=master `
npx -- -y github:ferronicardoso/mcp-mssqlserver这会将服务器注册到 ~/.codex/config.toml。要移除它,请运行 codex mcp remove mssqlserver。
Claude Desktop 配置
%APPDATA%\\Claude\\claude_desktop_config.json:
{
"mcpServers": {
"mssqlserver": {
"command": "npx",
"args": ["github:ferronicardoso/mcp-mssqlserver"],
"env": {
"MSSQL_HOST": "localhost",
"MSSQL_PORT": "1433",
"MSSQL_DATABASE": "master",
"MSSQL_AUTH_MODE": "sql",
"MSSQL_USER": "sa",
"MSSQL_PASSWORD": "your-password"
}
}
}
}VS Code MCP 配置
.vscode/mcp.json:
{
"servers": {
"mssqlserver": {
"command": "npx",
"args": ["github:ferronicardoso/mcp-mssqlserver"],
"env": {
"MSSQL_HOST": "localhost",
"MSSQL_PORT": "1433",
"MSSQL_DATABASE": "master",
"MSSQL_AUTH_MODE": "sql",
"MSSQL_USER": "sa",
"MSSQL_PASSWORD": "your-password"
}
}
}
}使用 Docker 运行(HTTP 传输)
已发布的镜像默认以 Streamable HTTP 模式运行,可用作远程 MCP 端点(例如供 n8n 的 MCP Client Tool 节点或任何兼容 Streamable HTTP 的客户端使用):
Bash(Linux/macOS/WSL):
docker run -d --name mcp-mssqlserver \
-p 3001:3001 \
-e MSSQL_HOST=host.docker.internal \
-e MSSQL_PORT=1433 \
-e MSSQL_DATABASE=master \
-e MSSQL_AUTH_MODE=sql \
-e MSSQL_USER=sa \
-e MSSQL_PASSWORD=your-password \
ghcr.io/ferronicardoso/mcp-mssqlserver:latestPowerShell:
docker run -d --name mcp-mssqlserver `
-p 3001:3001 `
-e MSSQL_HOST=host.docker.internal `
-e MSSQL_PORT=1433 `
-e MSSQL_DATABASE=master `
-e MSSQL_AUTH_MODE=sql `
-e MSSQL_USER=sa `
-e MSSQL_PASSWORD=your-password `
ghcr.io/ferronicardoso/mcp-mssqlserver:latest随后可通过 http://localhost:3001/mcp 访问 MCP 端点。
本地开发
git clone https://github.com/ferronicardoso/mcp-mssqlserver
cd mcp-mssqlserver
npm install
npm run build启动编译后的服务器:
npm start构建与提交工作流
此仓库有意将 dist/ 纳入版本控制,以支持 npx github:user/repo 的用法。
该项目使用 Husky 的 pre-commit 钩子来:
构建 TypeScript(
npm run build)暂存生成的产物(
git add dist)
手动备用方案:
npm run build
git add dist安全注意事项
切勿提交真实凭据或
.env文件。生产环境请优先使用最小权限的 SQL 用户。
对于公共或不信任的网络,请启用加密(
MSSQL_ENCRYPT=true)并正确配置证书。
Windows 身份验证(集成安全性)
如需使用基于集成安全性(进程帐户)的 Windows 身份验证,请配置:
MSSQL_AUTH_MODE=windows
MSSQL_HOST=sqlserver.company.local
MSSQL_PORT=1433
MSSQL_DATABASE=master许可证
MIT © Raphael Augusto Ferroni Cardoso
Available Tools
6 toolsdescribe_tableB
Retorna a estrutura de uma tabela: colunas, tipos de dados, nulabilidade e valores padrão.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose any behavioral traits (e.g., read-only nature, auth requirements, performance impact). The read-only nature is only implied by the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that concisely and clearly conveys the tool's purpose with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately explains the return contents. Could mention error handling or ordering but sufficient for a simple describe tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description does not add extra meaning beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns table structure (columns, types, nullability, defaults) but does not explicitly distinguish from sibling tools like list_tables or get_foreign_keys.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives; usage is implied from the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_queryA
Executa uma query SQL no SQL Server e retorna os resultados. Use para SELECT, INSERT, UPDATE e DELETE.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | A query SQL a ser executada |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions that the tool can execute INSERT/UPDATE/DELETE, implying data modification, but lacks details on side effects, authentication needs, rate limits, transaction behavior, or error handling. The description does not go beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the purpose and lists supported SQL commands. It is concise and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has one simple parameter and no output schema. The description mentions it returns results but not in what format (e.g., rows, affected rows). For a query execution tool, more details on return structure, error behavior, and supported SQL dialect would improve completeness, but it covers the essential purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (the schema describes the query parameter). The description adds that the query can be SELECT, INSERT, UPDATE, or DELETE, which is useful context but does not significantly deepen parameter understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it executes a SQL query on SQL Server and specifies it is for SELECT, INSERT, UPDATE, and DELETE. It differentiates itself from sibling tools that focus on metadata (describing tables, listing databases) by explicitly mentioning execution of DML and DQL statements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (for SQL queries of types SELECT, INSERT, UPDATE, DELETE). It provides clear context, though it does not explicitly exclude scenarios or mention alternatives. However, the sibling tools are distinctly different, so implicit differentiation exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_foreign_keysC
Lista as chaves estrangeiras de uma tabela e suas referências.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose any behavioral traits beyond the action. It does not mention that it is a read-only operation, required permissions, or any side effects. The description is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. It is concise and front-loads the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool lacks an output schema, yet the description does not explain the format of the returned data. It only says 'lists foreign keys and their references' without detailing what fields or structure to expect. Given the complexity of foreign key definitions, more information is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description does not add any additional meaning beyond what is in the schema. Baseline is 3, and there is no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists foreign keys and their references for a given table. The verb 'Lista' and resource are specific. However, it does not differentiate from sibling tools like describe_table, which may also show foreign keys, but the purpose is still distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as describe_table or get_table_indexes. The description only states what it does without any context about prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_table_indexesB
Lista os índices de uma tabela, incluindo colunas e tipo de índice.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Nome da tabela | |
| schema | No | Schema da tabela (padrão: dbo) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present. The description only states what is listed (indexes, columns, type) but omits behavioral details like whether indexes are returned in a specific order, whether the operation is read-only (obvious but not stated), or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence conveying the core functionality without extraneous words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (listing indexes with columns and type) and full schema coverage, the description is largely complete. However, it could mention the output shape or that it covers all indexes in the table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for both parameters (table name, schema). The tool description adds no additional parameter detail beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the tool lists table indexes including columns and type. It is a specific verb and resource, but does not explicitly differentiate from siblings like describe_table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like describe_table or get_foreign_keys. The usage context is implied but not explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesA
Lista todos os bancos de dados disponíveis no servidor SQL Server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states the basic function. It does not disclose any behavioral traits such as read-only nature, required permissions, or whether operations are safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no wasted words. It is front-loaded and efficiently communicates the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters or annotations, the description is minimally viable but lacks details about output format or ordering. Could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description does not add parameter details because none exist. The baseline for zero parameters is 4, and the description is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'all available databases on the SQL Server server', making it distinct from sibling tools like list_tables which list tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for listing databases but does not provide explicit guidance on when to use it versus alternatives, nor does it mention prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesA
Lista todas as tabelas do banco de dados atual, opcionalmente filtrando por schema.
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | Schema a filtrar (padrão: todos os schemas) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It reveals that the tool is a read operation (listing) with optional filtering, but does not disclose return format, permissions, or potential side effects. Lack of output schema leaves ambiguity about the result structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence containing no unnecessary words. It is well-suited for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool, the description covers the core purpose and optional filtering. However, the lack of output schema means the agent must infer the return format, which is a minor completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the 'schema' parameter. The description merely reiterates the filtering option without adding new semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all tables of the current database with optional schema filtering, which distinguishes it from siblings like describe_table (single table details) and execute_query (arbitrary SQL).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing tables with optional filtering, but does not explicitly contrast with siblings or state when not to use it. The context of sibling tools provides some implicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
describe_table - First observed
execute_query - First observed
get_foreign_keys - First observed
get_table_indexes - First observed
list_databases - First observed
list_tables
TDQS
Scored across 6 tools
Each tool has a clearly distinct purpose: describing table structure, executing arbitrary queries, listing foreign keys, indexes, databases, and tables. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., describe_table, get_foreign_keys, list_databases), making them predictable and easy to understand.
With 6 tools, the set is well-scoped for a SQL Server utility server, covering essential introspection and query execution without being overly numerous or sparse.
The tools cover core database introspection (list databases, tables, describe table, get indexes/foreign keys) and query execution. Missing advanced features like schema management or stored procedure execution, but these are minor gaps for typical usage.
Maintenance
Related MCP Connectors
Text-to-SQL MCP server: read-only queries on PostgreSQL, MySQL and SQL Server with your real schema
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
- SupabaseOAuthcom.supabase
MCP server for interacting with the Supabase platform
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides tools to connect, query, and manage Microsoft SQL Server databases through the MCP protocol, including support for stored procedures, transactions, and schema inspection.30 PyPIMIT
- FlicenseAqualityDmaintenanceMCP server for connecting to SQL Server in readonly mode. Allows any MCP client to explore the schema and run SELECT queries against a SQL Server database.6-
- AlicenseNot gradedqualityDmaintenanceMCP server for executing SQL queries and managing connections to Microsoft SQL Server databases.3,569 npm1MIT
- AlicenseNot gradedqualityDmaintenanceMCP server for Microsoft SQL Server enabling safe read-only queries, schema discovery, and natural-language query via LangChain.MIT