Skip to main content
Glama
shibbirweb

mcp-mysql-read-only

by shibbirweb

mcp-mysql-read-only

CI M8ven Verified npm npm downloads Docker Hub Docker pulls Image size License: MIT

An MCP server that gives an AI assistant read-only access to MySQL, and lets it change database, server and credentials mid-conversation without restarting the client.

Most MySQL MCP servers read their connection from environment variables once at startup. Pointing one at a different database means editing a config file and restarting the assistant, which loses your conversation. This server keeps the connection as runtime state, so switching is just another tool call.

Runs from npm with npx, or entirely in Docker with nothing installed on your machine.

flowchart LR
    A["AI assistant<br/>Claude Desktop / Claude Code"]
    B["mcp-mysql-read-only<br/>one process, whole session"]
    C[("app_dev")]
    D[("staging")]
    E[("analytics")]
    F[("any server<br/>reached with connect")]

    A <-->|"MCP over stdio"| B
    B -.->|"pooled per target"| C
    B -.->|"pooled per target"| D
    B -.->|"pooled per target"| E
    B -.->|"opened at runtime"| F

The server lives for the whole session, so the active connection is just state inside it. Switching selects a different pool rather than reconnecting, and switching back reuses a warm one.


Quick start

Two ways to run it. npm is the shorter setup; Docker keeps the server inside a container.

npm

MYSQL_HOST=127.0.0.1 \
MYSQL_USER=readonly \
MYSQL_PASSWORD=secret \
MYSQL_DATABASE=my_database \
npx -y @shibbirweb/mcp-mysql-read-only

Requires Node 22 or newer. There is no container in the way, so 127.0.0.1 means what you expect.

Docker

docker run -i --rm \
  --add-host host.docker.internal:host-gateway \
  -e MYSQL_HOST=host.docker.internal \
  -e MYSQL_USER=readonly \
  -e MYSQL_PASSWORD=secret \
  -e MYSQL_DATABASE=my_database \
  shibbirweb/mcp-mysql-read-only

Use host.docker.internal to reach a MySQL running on the same machine as Docker. Inside the container, localhost means the container itself.

The container is the more isolated of the two: the server runs with only what the image and the environment give it. Over npm it runs directly on your machine with your user's access. Both enforce the same read-only guarantee.

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mysql": {
      "command": "npx",
      "args": ["-y", "@shibbirweb/mcp-mysql-read-only"],
      "env": {
        "MYSQL_HOST": "127.0.0.1",
        "MYSQL_USER": "readonly",
        "MYSQL_PASSWORD": "secret",
        "MYSQL_DATABASE": "my_database"
      }
    }
  }
}

Or the same server in Docker:

{
  "mcpServers": {
    "mysql": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--add-host", "host.docker.internal:host-gateway",
        "-e", "MYSQL_HOST=host.docker.internal",
        "-e", "MYSQL_USER=readonly",
        "-e", "MYSQL_PASSWORD=secret",
        "-e", "MYSQL_DATABASE=my_database",
        "shibbirweb/mcp-mysql-read-only"
      ]
    }
  }
}

Claude Code

Same shape, in .mcp.json at your project root:

{
  "mcpServers": {
    "mysql": {
      "command": "npx",
      "args": ["-y", "@shibbirweb/mcp-mysql-read-only"],
      "env": {
        "MYSQL_HOST": "127.0.0.1",
        "MYSQL_USER": "readonly",
        "MYSQL_PASSWORD": "secret",
        "MYSQL_DATABASE": "my_database"
      }
    }
  }
}

Either form from the Claude Desktop section works here too.

Restart the client once. After that you never need to restart it to change database.

Credentials in these files sit on disk in plain text. Prefer a MySQL account with only SELECT grants, and keep the file out of version control. See Security.


Related MCP server: Simple MCP MySQL Server

Switching connections

Just ask. These map onto the connection tools:

"switch to the staging database" "what tables are in analytics?" "connect to MySQL on 10.0.0.5 as reporting_user"

Want

Restart?

Another database on the same server

No

Another named profile

No

A different server or credentials

No

A new permanent profile in MYSQL_PROFILES

Yes, once

sequenceDiagram
    autonumber
    actor You
    participant A as Assistant
    participant S as MCP server
    participant M as MySQL

    You->>A: "how many users in staging?"
    A->>S: use_connection(staging)
    S->>M: open + SELECT 1
    M-->>S: ok
    Note over S: verified, so the switch is committed
    S-->>A: Switched to staging
    A->>S: run_query(SELECT COUNT(*) ...)
    S->>M: SELECT COUNT(*) ...
    M-->>S: 4821
    A-->>You: 4821 users in staging

    You->>A: "and in production?"
    Note over A,S: same session, no restart
    A->>S: use_connection(production)

A switch that fails verification is never committed, so the previous connection stays active and the session keeps working:

sequenceDiagram
    participant S as MCP server
    participant M as MySQL

    S->>M: open "no_such_db" + SELECT 1
    M-->>S: Unknown database
    Note over S: active connection left untouched
    S-->>S: Error: Unknown database 'no_such_db'

Named profiles

Define several connections up front with MYSQL_PROFILES, a JSON object:

{
  "local":   { "host": "host.docker.internal", "user": "root",      "password": "",       "database": "app_dev" },
  "staging": { "host": "db.staging.internal",  "user": "readonly",  "password": "secret", "database": "app" },
  "reports": { "host": "db.staging.internal",  "user": "readonly",  "password": "secret", "database": "analytics" }
}

Passed as a single environment variable:

docker run -i --rm \
  -e MYSQL_PROFILES='{"local":{"host":"host.docker.internal","user":"root","password":"","database":"app_dev"}}' \
  -e MYSQL_DEFAULT_PROFILE=local \
  shibbirweb/mcp-mysql-read-only

host defaults to host.docker.internal, port to 3306, password to empty. user and database are required; a profile missing either is skipped with a warning rather than taking the server down.

Reaching somewhere not in the profiles

The connect tool takes a host, user, password and database at runtime and keeps it for the rest of the session under an alias. Nothing is written to disk, and no restart is involved, so you never have to edit MYSQL_PROFILES just to look at one database once.


Tools

Connection

Tool

Purpose

current_connection

Which server and database is active

list_connections

Available profiles, * marks the active one

list_databases

Databases on the connected server

use_database

Switch schema on the current server

use_connection

Switch to a named profile, optional database override

connect

Open any server with explicit credentials, optional alias

Reading

Tool

Purpose

list_tables

Tables in the active database

describe_table

Columns and types for one table

get_table_indexes

Indexes for one table

get_foreign_keys

Foreign key relationships for one table

get_table_sample

Up to 50 sample rows

run_query

One read-only statement

Every reading tool also accepts an optional database, applied to that call only, leaving the active connection alone. Useful for comparing two databases without switching back and forth.

use_database, use_connection and connect each open the connection and run SELECT 1 before committing the switch, so a bad database name or unreachable host fails immediately. A failed switch leaves the previous connection active.


Configuration

Variable

Default

Purpose

MYSQL_PROFILES

none

JSON object of named profiles

MYSQL_DEFAULT_PROFILE

none

Which profile starts active

MYSQL_HOST

host.docker.internal

Single-connection fallback

MYSQL_PORT

3306

"

MYSQL_USER

none

"

MYSQL_PASSWORD

empty

"

MYSQL_DATABASE

none

"

MYSQL_QUERY_TIMEOUT_MS

30000

Statement timeout

MYSQL_CONNECT_TIMEOUT_MS

10000

Connection timeout

MYSQL_USER plus MYSQL_DATABASE register a profile named default. None of these are required: with no configuration at all the server still starts, and the tools tell you to call connect.

Starting profile: MYSQL_DEFAULT_PROFILE if it names a real profile, else default, else the first one defined.


Security

Two independent layers keep this read-only, so a hole in one is not automatically a write.

flowchart TD
    Q["run_query"] --> V{"SQL validator"}
    V -->|"DELETE, DROP, stacked statements,<br/>write behind a CTE, INTO OUTFILE"| R1["rejected, no connection used"]
    V -->|"reads only"| D{"mysql2 driver"}
    D -->|"multipleStatements: false"| R2["a second statement<br/>cannot even be sent"]
    D --> M{"MySQL session"}
    M -->|"SET SESSION TRANSACTION READ ONLY"| R3["writes rejected by the server<br/>with error 1792"]
    M -->|"read"| OK["rows returned"]

    style R1 fill:#fde,stroke:#b55
    style R2 fill:#fde,stroke:#b55
    style R3 fill:#fde,stroke:#b55
    style OK fill:#dfd,stroke:#5b5

A SQL validator. Only SELECT, WITH, SHOW, DESCRIBE, DESC and EXPLAIN may lead a statement. Before any keyword check, string literals, backtick identifiers and --, # and /* */ comments are blanked out, so a keyword or semicolon hidden inside a literal is never mistaken for SQL. Statement stacking is rejected. WITH and EXPLAIN ANALYZE have their bodies scanned for write keywords, because both can carry a write behind a harmless first word. INTO OUTFILE, INTO DUMPFILE, LOAD DATA, SLEEP() and BENCHMARK() are blocked. Table and database names passed as tool arguments must match ^[A-Za-z0-9_$]+$, so they cannot break out of the identifier they are interpolated into.

The MySQL session. Every pooled connection runs SET SESSION TRANSACTION READ ONLY and SET SESSION MAX_EXECUTION_TIME. With autocommit on, each statement is its own read-only transaction, so the server rejects a write with error 1792 even if the validator were somehow bypassed. The driver runs with multipleStatements: false, so a second statement cannot be smuggled in at all.

What this is not

This is a guard, not a permission system. It stops an assistant from writing through this server. It does not stop anyone holding the same credentials from writing through any other client.

Point it at a read-only MySQL user. This is the real protection:

CREATE USER 'readonly'@'%' IDENTIFIED BY 'a strong password';
GRANT SELECT ON your_database.* TO 'readonly'@'%';

With that, a bug in this server still cannot write anything.

Other limits worth knowing:

  • SLEEP() and BENCHMARK() are blocked outright as a blunt guard against hanging the session.

  • A column named exactly update or delete inside a WITH query is rejected. Backtick it.

  • Results are truncated to 100 rows in the tool output. The query itself is not limited, so add a LIMIT when reading large tables.


Known behaviour

Parallel tool calls. The active connection is a single piece of process state. If a client issues several tool calls in one batch they are handled concurrently, so a use_database batched alongside a run_query is not guaranteed to land first. Sequential calls behave as expected. When a read must be pinned to a particular database, pass the per-call database argument instead of relying on a switch made in the same batch.

Shutdown. The server exits on SIGINT/SIGTERM, not when stdin closes. Open pool sockets keep the event loop alive, and stdin reaching EOF only means no further requests were buffered; treating that as a shutdown signal tears down pools while calls are still in flight. Any script driving the server directly should read until it has the responses it expects, then terminate the process.


Development

Everything runs in Docker, so a clone and Docker are the only requirements:

git clone https://github.com/shibbirweb/mcp-mysql-read-only.git
cd mcp-mysql-read-only
./scripts/test-in-docker.sh

That starts a throwaway MySQL container, builds the test image, runs the full suite against it and tears everything down. Your own MySQL is never touched.

With Node 22 installed locally:

npm ci
npm run build
npm run test:unit          # no database needed
npm test                   # integration tests need MySQL, see below

Integration tests read TEST_MYSQL_HOST, TEST_MYSQL_PORT, TEST_MYSQL_USER, TEST_MYSQL_PASSWORD. They create and drop two scratch databases (mcp_test, mcp_test_alt), so point them at a disposable server. When MySQL is unreachable they skip rather than fail.

Project structure

src/
  index.ts                Entry point
  ApplicationFactory.ts   Composition root: the only file that wires things together
  types/                  Interfaces and type aliases, one file per concern
  errors/                 Named error classes
  domain/                 ConnectionTarget, ConnectionProfile (immutable value objects)
  config/                 Reading configuration from the environment
  connections/            Target factory, profile registry, connection manager
  database/               Pool manager, read-only session initializer, query executor
  validation/             SQL skeletonizer, validators, rules/
  formatting/             Response and row rendering
  tools/                  BaseTool, DatabaseScopedTool, connection/, reading/
  server/                 McpMySqlServer

Dependencies point inward, and no class constructs its own collaborators: everything is injected by ApplicationFactory, which is what lets each part be unit tested without a database or the environment.

Developer documentation, including why each class is built the way it is and which design patterns are used where, lives in the wiki (source in docs/wiki/).


Contributing

Pull requests target master. CI runs the full suite against MySQL 8.0 and 8.4 and builds the image for amd64 and arm64. Please keep changes covered by tests, and update docs/wiki/ when behaviour changes.

There is a second copy of this document, README.dockerhub.md, which is what the release workflow publishes as the Docker Hub description. Docker Hub renders neither mermaid nor relative links, so that copy uses ASCII diagrams and absolute URLs. If you change user-facing behaviour here, change it there too.

Changelog

Release history, including which versions reached npm and which reached only Docker Hub, is in CHANGELOG.md.

Privacy

The server sends nothing anywhere except to the MySQL you point it at: no telemetry, no analytics, nothing written to disk, nothing kept after it exits. What does leave your machine is whatever your assistant reads, since query results become conversation content. PRIVACY.md sets out both halves.

License

MIT © Md. Shibbir Ahmed

Available Tools

12 tools
connectConnect to MySQL ServerA
Idempotent

Connect to any MySQL server at runtime with explicit credentials. Not persisted to disk, but kept for the rest of the session under an alias

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoHostname. Use host.docker.internal for MySQL on this Machost.docker.internal
portNoPort
userYesMySQL user
aliasNoName to remember this connection under for use_connection later
databaseYesDatabase to open
passwordNoMySQL password, empty string if none

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, so the description is not redundant. It adds critical lifecycle info: 'Not persisted to disk, but kept for the rest of the session under an alias', which explains the tool's side effects beyond safety. This is valuable transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that leads with the primary action and follows with essential caveats. It avoids fluff and is appropriately front-loaded, though slightly long. It earns its place with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, lifecycle, and alias persistence, which is sufficient for an agent to decide to call it. It does not describe what happens on failure or whether the connection becomes active immediately, but given no output schema and the simple nature of connection establishment, these gaps are minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters (host, port, user, alias, database, password) are fully documented in the schema. The description mentions 'explicit credentials' and 'alias' but does not add parameter-level detail beyond what the schema already provides. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Connect' and the resource 'any MySQL server at runtime with explicit credentials'. It also explains the session-scoped alias behavior, which distinguishes it from siblings like use_connection. The purpose is unambiguous and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for establishing new connections and mentions alias for use_connection later, but does not explicitly say 'use use_connection for existing aliases' or provide exclusion criteria. While the context is clear, it leaves the agent to infer when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

current_connectionShow Current ConnectionA
Read-onlyIdempotent

Show which MySQL server and database the read-only tools are currently pointed at

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the read-only and idempotent nature of the tool, so the description's main contribution is clarifying that the connection shown is the one used by read-only tools. This adds useful shared-state context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that leads with the action and specifies exactly what the tool reports. It contains no filler, no repetition of the title, and no unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter status tool with no output schema, the description fully conveys what the agent will learn (the current server and database) and the relevant scope (read-only tools). Nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty, so there are no parameters to document. Per the baseline for a zero-parameter tool, a score of 4 applies because the description does not need to add parameter meaning that does not exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise operation ('Show') and a concrete object: which MySQL server and database the read-only tools are currently pointed at. This differentiates it from siblings like list_connections and list_databases, which concern available connections and databases rather than the active context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool: when an agent needs to know the current MySQL server and database context for read-only tools. It does not explicitly name alternatives or exclusions, but for a zero-parameter status check the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_tableDescribe TableA
Read-onlyIdempotent

Show columns and schema for a specific table

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesTable name
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds no extra behavioral context, such as whether the result includes column types, default values, or indexes. Given the annotations, a score of 3 is appropriate because the description doesn't contradict but also doesn't enrich beyond the annotation-set baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the primary action ('Show columns and schema') and specifies the target ('a specific table'). There is no redundancy or filler, making it highly efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, read-only schema inspection tool, the description combined with the schema and annotations provides sufficient information. The schema fully documents the two parameters, and annotations cover safety and idempotency. While the description doesn't explicitly mention the optional 'database' parameter or return details, these are covered elsewhere, so the definition is complete enough for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both 'table' and 'database' clearly described in the schema. The description mentions 'a specific table' which aligns with the required 'table' parameter but adds no additional meaning beyond the schema. With high coverage, the baseline of 3 holds; the description doesn't need to compensate for undocumented parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Show columns and schema for a specific table'. The verb 'Show' and the resource 'columns and schema' are specific, and it differentiates from siblings like list_tables (which lists table names) and get_table_sample (which returns data). An agent can immediately distinguish this from other schema-related tools without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as get_table_indexes or get_foreign_keys. The description does not mention any conditions, exclusions, or recommended contexts. An agent is left to infer usage from the name and schema alone, with no explicit routing to this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_foreign_keysGet Foreign KeysA
Read-onlyIdempotent

Show foreign key relationships for a specific table

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesTable name
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds no extra behavioral context beyond the basic 'show' operation, such as error behavior or output structure, but it does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly worded sentence with no filler. It front-loads the core action and resource, making the purpose immediately apparent. Every word contributes to the meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with strong annotations and full schema coverage, the description is mostly complete. The only gap is that with no output schema, a brief note about the result format (e.g., a list of FK relationships) would improve completeness, but it is not critical for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters ('table' and 'database') are already documented with clear descriptions. The phrase 'for a specific table' in the description maps to the 'table' parameter but adds no new semantic detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Show') and a specific resource ('foreign key relationships') scoped to a specific table. This clearly differentiates it from sibling tools like get_table_indexes and describe_table, which target different structures, so an agent can distinguish it without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives, when not to use it, or any prerequisites. There is no mention of preferring this over run_query or describe_table for FK-related needs, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_table_indexesGet Table IndexesA
Read-onlyIdempotent

Show indexes for a specific table

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesTable name
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is well covered. The description adds only the scoping detail that a specific table is required, which is consistent but not a major behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence with no filler, front-loading the action and target. Every word contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only metadata query, the description plus schema and annotations are adequate: the required parameter is clear and the return concept is implied by 'indexes'. No output schema is present, but the tool's purpose is simple enough that this is not a significant gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the schema. The description's mention of 'a specific table' aligns with the required 'table' parameter but does not add extra meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Show') and resource ('indexes for a specific table'), making the tool's function immediately clear. It is clearly distinguishable from sibling tools like get_foreign_keys and describe_table, which target different metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance about when to choose this tool over alternatives such as describe_table or get_foreign_keys. There are no exclusions, prerequisites, or context cues beyond the general idea of showing indexes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_table_sampleGet Table SampleB
Read-onlyIdempotent

Get sample rows from a table

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoNumber of rows to return (1-50, default 5)
tableYesTable name
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the operation read-only, idempotent, and non-destructive, so no safety contradiction exists. The description adds only the word 'sample', which hints at subset behavior, but does not explain whether rows are random, ordered, or arbitrary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence with no filler. It is appropriately front-loaded and easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool itself is simple and the annotations cover safety, but no output schema exists and the description does not clarify the nature of the sample or distinguish it from running a query. An agent could invoke it correctly, yet the ambiguity about ordering and randomness remains a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well documented in the input schema. The description adds no additional parameter-level meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and identifies the resource ('sample rows from a table'), making the core function clear. It does not explicitly distinguish this from siblings like describe_table or run_query, but the phrase 'sample rows' communicates the idea of a lightweight preview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to prefer this tool over alternatives such as run_query or describe_table. The description implies quick data preview but never states the intended context or mentions exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_connectionsList Connection ProfilesA
Read-onlyIdempotent

List the connection profiles available to switch to, including any added during this session

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, covering safety and side-effect expectations. The description adds meaningful context by noting that the list includes profiles added during the current session, which is a behavioral detail not derivable from annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence delivers the core purpose first and appends the only important extra behavior. Every word earns its place, and the structure is immediately scannable for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list operation, the description provides enough context to invoke it correctly: it lists connection profiles and notes session additions. While there is no output schema, the description does not detail the returned profile fields, but for this simple listing tool that is a minor gap rather than a blocker.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description is not required to add parameter-level detail. The baseline of 4 is appropriate because there is no parameter surface to clarify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('List') and resource ('connection profiles'), and clarifies the purpose is to find profiles to switch to. The phrase 'including any added during this session' adds scope that separates this from a static registry, and the tool is clearly distinct from siblings like current_connection or use_connection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description communicates a clear usage context: call this when you need to see which connection profiles are available to switch to, including session-created ones. It does not explicitly name alternatives or exclusions, but the simple read-only nature and obvious contrast with siblings like current_connection make the intended use clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_databasesList DatabasesA
Read-onlyIdempotent

List databases on the currently connected MySQL server

ParametersJSON Schema
NameRequiredDescriptionDefault
include_systemNoInclude information_schema, performance_schema, mysql and sys

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations clearly indicate read-only, idempotent, and non-destructive behavior, so the description doesn't need to reiterate safety. The description adds the modifier 'currently connected MySQL server', which clarifies that it operates on a specific connection context, giving more detail than the annotations alone. It doesn't mention output format, but that's fine for a simple list tool and is not a contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler. It is front-loaded with the main action and resource, and the contextual modifier is added naturally. Every word earns its place, making it highly readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional boolean parameter, no output schema, low complexity), the description is nearly complete. It mentions the connection context, which is useful. The only minor gap is that it doesn't explicitly note that the default behavior excludes system databases, but that is implied by the include_system parameter and its default value. All essential information for correct invocation is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, meaning the parameter 'include_system' is fully described in the schema. The description of the tool does not add extra clarification about this parameter, but it doesn't need to because the schema is sufficient. Baseline 3 is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('list') and the resource ('databases') on the currently connected MySQL server. It distinguishes itself from sibling tools like list_tables and get_table_sample by being specific to databases. This is unambiguous and sufficient.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'on the currently connected MySQL server', which implies a prerequisite that a connection is active, but does not explicitly state when not to use this tool or name alternatives. However, the sibling names like list_connections or use_database provide implicit context, and the scope of 'databases' is clear. Could be improved by noting that it is not for listing tables or connections, but the current phrasing is clean and workable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesList TablesA
Read-onlyIdempotent

List all tables in the active database

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, so the safety profile is fully covered. The description adds the 'active database' scoping context but does not describe return shape, pagination, or the optional database override behavior, which keeps it at the baseline for an annotation-covered tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence conveys the core action and scope with no filler. It is appropriately sized for a simple listing operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity read-only tool with rich annotations and a fully documented schema, the description is sufficient for correct invocation. It could have mentioned the optional database parameter or return format, but those are either in the schema or obvious from the verb.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single optional database parameter, including its 'call only / without changing active connection' semantics. The description does not add parameter meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('list all tables') and scopes it to the active database, distinguishing it from siblings like list_databases and describe_table. The word 'all' also communicates full enumeration, so the agent knows the scope without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to choose this tool over siblings such as list_databases or describe_table. There are no stated prerequisites, exclusions, or alternative routing; usage must be inferred entirely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_queryRun Read-Only QueryA
Read-onlyIdempotent

Execute a read-only SQL query (SELECT, WITH, SHOW, DESCRIBE, EXPLAIN only) against the active connection

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesSQL query to execute
databaseNoOptional database to read from for this call only, without changing the active connection

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds the allowed statement set and the active-connection scope, which is useful behavioral context, but it doesn't disclose error behavior, result size limits, or the consequence of having no active connection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that front-loads the core operation ('Execute a read-only SQL query'), immediately constrains allowed statements, and states the target. There is no filler, repetition, or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with rich annotations and fully described parameters, covers the essential invocation details: required query, allowed statement types, optional database override, and the active-connection prerequisite. It omits result format and pagination, which is a minor gap for a query execution tool, but overall an agent has enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning by constraining the 'query' parameter to SELECT, WITH, SHOW, DESCRIBE, and EXPLAIN, which is stronger than the schema's generic 'SQL query to execute'. The 'database' parameter is already well described in the schema, so the net addition is moderate but valuable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Execute'), a precise resource ('read-only SQL query'), enumerates the allowed SQL statement types, and anchors it to the active connection. This clearly differentiates it from sibling metadata tools like describe_table or list_tables by framing it as arbitrary SQL rather than a structured listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: whenever a read-only SQL query needs to run against the active connection.page The explicit allowlist of SQL verbs provides implicit exclusion of write queries Mend. However, it does not name sibling alternatives or state when to prefer them, so it stops short of fully explicit routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

use_connectionSwitch Connection ProfileA
Idempotent

Switch to a named connection profile. Takes effect immediately, no restart needed

ParametersJSON Schema
NameRequiredDescriptionDefault
profileYesProfile name from list_connections
databaseNoOptional database to use instead of the profile's own database

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context by stating 'Takes effect immediately, no restart needed', which is not covered by annotations. This clarifies the impact and side effects of switching profiles.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no wasted words. It front-loads the core purpose and immediately adds a key behavioral detail. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two parameters and no output schema, the description covers the essential purpose and a critical behavioral trait. It lacks details about error handling or side effects on the current session, but given the annotation coverage and schema richness, it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both 'profile' and 'database' documented. The description adds no additional parameter information beyond what the schema provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Switch' and the resource 'named connection profile', making the tool's purpose unambiguous. It distinguishes from sibling tools like 'use_database' (switches database, not profile) and 'connect' (likely establishes a new connection rather than switching profiles).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as 'connect' or 'use_database'. It does not mention any conditions or exclusions, leaving the agent to infer the appropriate context from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

use_databaseSwitch DatabaseA
Idempotent

Switch the active database on the current MySQL server. Takes effect immediately, no restart needed

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYesDatabase name to switch to

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds 'Takes effect immediately, no restart needed', which conveys that the operation is a live runtime change without requiring server restart—useful behavioral context beyond what the annotations capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero filler. The core action is front-loaded first, and the immediate-effect note earns its place by providing behavioral nuance. Every word contributes to the agent's understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter switch operation with no output schema and comprehensive annotations, the description is nearly complete. It could explicitly mention that the target database must already exist or that the change is session-scoped, but these are minor gaps given the tool's simplicity and context from sibling list_databases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage: the single 'database' parameter is clearly documented as 'Database name to switch to'. The tool description does not add syntax, format, or existence requirements beyond the schema, so the baseline score of 3 is appropriate; nothing is missing, but nothing extra is contributed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Switch'), a clear resource ('the active database'), and scopes it to 'the current MySQL server'. This distinguishes it from sibling tools like use_connection, which operates on connections, and list_databases, which only lists. No ambiguity remains about the tool's function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating 'current MySQL server' and 'Takes effect immediately', suggesting it changes the session's default schema for subsequent operations. However, it does not explicitly name alternatives, exclusion conditions, or when to prefer run_query or use_connection instead. Guidance is present but left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv1.1.5
    • First observedconnect
    • First observedcurrent_connection
    • First observeddescribe_table
    • First observedget_foreign_keys
    • First observedget_table_indexes
    • First observedget_table_sample
    • First observedlist_connections
    • First observedlist_databases
    • First observedlist_tables
    • First observedrun_query
    • First observeduse_connection
    • First observeduse_database

TDQS

A3.7/5.0

Scored across 12 tools

Disambiguation4/5

Most tools have clear, distinct purposes: connection management (connect, use_connection, list_connections, current_connection), database selection (list_databases, use_database), schema inspection (list_tables, describe_table, get_table_indexes, get_foreign_keys), and data sampling (get_table_sample, run_query). However, there is slight overlap between get_table_sample and run_query (both can retrieve data), and between list_connections and current_connection, though descriptions clarify the difference.

Naming Consistency4/5

The naming is mostly consistent with verb_noun (e.g., list_tables, describe_table, use_database, get_table_indexes). The only minor deviation is the use of 'current_connection' as a noun phrase instead of a verb, and 'run_query' is fine. The pattern is predictable and readable.

Tool Count4/5

12 tools is a reasonable number for a database inspection server. Each tool serves a clear purpose, and the count is within the typical 3-15 range, though it's on the higher end. No tool feels extraneous, and the set covers connection management and schema exploration comprehensively.

Completeness3/5

The server covers connection management and schema inspection well, but it lacks write operations (by design, since it's read-only) and query execution is limited to read-only. Missing tools like 'list_views' or 'get_table_data' (full table dump) would be nice, but the core read-only workflow is covered. The read-only limitation is intentional, so the surface is fairly complete for its stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Enables AI assistants to safely query MySQL databases with read-only access, featuring SQL injection protection, connection pooling, and automatic query limits for secure database exploration.
    4
    105 npm
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to securely interact with MySQL databases, including listing tables, viewing schemas, and executing read-only SQL queries through natural language.
    6
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to read and write MySQL databases, dynamically switch databases/servers, and auto-configure from Spring Boot projects.
    3,689 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to directly query MySQL databases, list tables, and view table structures through natural language.
    15 npm
    MIT