facturas-mcp

Read-only MCP server for asking Claude Desktop about DWH.facturas.

How it works

• Claude Desktop launches this server locally (its own process, communicating over stdio).

• The server connects to SQL Server using a read-only login (mcp_readonly) that only has GRANT SELECT on DWH.facturas. That permission lives in the database, not in this code -- it is the real security barrier.

• It exposes two tools:

  • listar_columnas_facturas: so Claude can discover the columns before writing SQL.

  • consultar_facturas: runs a read-only SELECT against DWH.facturas.

Related MCP server: Microsoft SQL Server MCP Server

Step 1 -- Create the restricted login in SQL Server

Run setup-db-login.sql ONCE, with a user who has administrative permissions on the database. Change the example password before running it.

Step 2 -- Configure this server's credentials

Create a .env file in this folder (it is not committed to git) with:

MSSQL_SERVER=sintesiserp.com
MSSQL_DATABASE=Diverxamotos_4_2
MSSQL_USER=mcp_readonly
MSSQL_PASSWORD=la-contrasena-que-pusiste-en-el-paso-1

Step 3 -- Register the server in Claude Desktop

Open claude_desktop_config.json (on Windows: %APPDATA%\Claude\claude_desktop_config.json) and add this inside "mcpServers":

{
  "mcpServers": {
    "facturas": {
      "command": "node",
      "args": ["C:\\Users\\Developer-07\\Documents\\DESARROLLO\\facturas-mcp\\dist\\index.js"],
      "env": {
        "MSSQL_SERVER": "sintesiserp.com",
        "MSSQL_DATABASE": "Diverxamotos_4_2",
        "MSSQL_USER": "mcp_readonly",
        "MSSQL_PASSWORD": "la-contrasena-que-pusiste-en-el-paso-1"
      }
    }
  }
}

Close Claude Desktop completely and reopen it so it loads the new server.

Step 4 -- Test it

In Claude Desktop, ask something like: "How much did I sell today according to DWH.facturas?"

Adding another table later

1. In SQL Server: GRANT SELECT ON DWH.otratabla TO mcp_readonly;

2. In src/index.ts: add "DWH.OTRATABLA" to the ALLOWED_TABLES array, and optionally a listar_columnas_otratabla tool just like the existing one.

3. npm run build and restart Claude Desktop.

Remote mode (Render) -- so multiple people can use it from Claude.ai

By default the server runs in stdio mode (local, one process per user, launched by Claude Desktop). To let multiple people use it from Claude.ai without installing anything, it can be deployed as an HTTP service on Render. The same dist/index.js works for both modes -- the switch is the MCP_TRANSPORT environment variable.

Important: in HTTP mode the only protection for the database is still the read-only login, but the MCP server itself is exposed at a public URL. That is why HTTP mode requires a token (MCP_AUTH_TOKEN) -- without it, the process won't even start. Anyone with the URL and the token can run SELECT against DWH.facturas, so treat that token like a password: don't publish it, don't commit it to git, and rotate it if it leaks.

Step 1 -- Generate a strong token

For example, with PowerShell:

-join ((48..57)+(65..90)+(97..122)|Get-Random -Count 40|%{[char]$_})

Save that value -- it is your MCP_AUTH_TOKEN.

Step 2 -- Create the Web Service in Render

1. Push this project to a GitHub repository (you need node_modules and dist out of the repo -- they are already in .gitignore -- Render runs npm install and npm run build on its own).

2. In Render: New -> Web Service, connect the repo.

3. Build Command: npm install && npm run build

4. Start Command: npm start

5. Environment variables (Environment tab):

   MCP_TRANSPORT=http
   MCP_AUTH_TOKEN=<el token del paso 1>
   MSSQL_SERVER=sintesiserp.com
   MSSQL_DATABASE=Diverxamotos_4_2
   MSSQL_USER=mcp_readonly
   MSSQL_PASSWORD=<la contrasena del login de solo lectura>

   (Render sets PORT automatically -- no need to add it.)

6. Deploy. When it finishes, Render gives you a URL like https://facturas-mcp.onrender.com.

Step 3 -- Test that the server responds

curl https://facturas-mcp.onrender.com/health
# {"status":"ok"}

curl -X POST https://facturas-mcp.onrender.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer <tu MCP_AUTH_TOKEN>" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

If it responds with serverInfo and capabilities, the server is alive and accepting the token. Without the correct Authorization header it should respond with 401.

Step 4 -- Connect it from Claude.ai / Claude Desktop

In Claude.ai (or recent Claude Desktop): Settings -> Connectors -> Add custom connector, and register the URL https://facturas-mcp.onrender.com/mcp with the authentication header Authorization: Bearer <tu MCP_AUTH_TOKEN> (the exact UI may vary depending on the version of Claude -- look for the remote MCP server / custom connector option).

Note: Render's free plan "sleeps" the service after inactivity -- the first request after the sleep can take a few seconds to respond.