dbeaver-mcp
This server lets an AI agent securely work with your local DBeaver Community Postgres connections — reading, writing, inspecting, and fixing database objects through MCP tools.
List and inspect connections —
list_connectionsshows names, hosts, and SSH hop details without exposing passwords;test_connectionverifies a connection withSELECT 1.Run read-only queries —
execute_queryruns SELECT/WITH/EXPLAIN/SHOW inside aREAD ONLYtransaction and returns every result set.Run writes and scripts —
write_queryandrun_scripthandle INSERT/UPDATE/DELETE/DDL, with exact-name matching, transaction support, and confirmations for destructive SQL.Explain query plans —
explain_queryreturns Postgres plans as JSON, optionally with realanalyzetimings on reads only.Inspect and fix sequences —
inspect_sequencescompares sequence values againstMAX(column), andfix_sequencesresets lagging sequences (dry-run by default).Explore schemas and tables —
list_schemas,list_tables, anddescribe_tableprovide structure discovery.Handle SSH tunnels safely —
trust_ssh_hostshows a bastion host-key fingerprint and records it only after user confirmation; host keys are verified againstknown_hosts.Enforce safety and policy — reads are enforced by Postgres, transaction control is refused, sensitive reads are blocked, and environment variables restrict which connections are allowed, writable, or which tools are disabled.
Allows AI agents to query PostgreSQL databases through DBeaver Community connections, providing tools for listing connections, executing SQL queries, inspecting sequences, and managing SSH tunnels, with credentials handled locally.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@dbeaver-mcpWhat are the top 5 customers by total purchase?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
dbeaver-mcp
Let an AI agent query your Postgres through DBeaver Community connections already saved on this PC.
It reads DBeaver’s workspace, decrypts credentials locally, opens an SSH tunnel when the connection uses one, and runs SQL. Passwords never appear in tool results and never leave this process.
Works with Grok, Claude Code, Codex, and Agy (Antigravity). Node 20+ required.
Need tools, transactions, sequences, or live-DB rules? See HOWTO.md.
Before you start — two things to know
1. SSH tunnels will refuse to connect until the host key is known. This is deliberate, and it is the most likely reason your first tunnelled query fails. See SSH tunnels need a known host key below — it is a one-line fix.
2. Only tested on Windows. Developed and verified on Windows 11 with Node 22 against DBeaver
Community 25 and Postgres 15, including SSH-tunnelled connections. macOS and Linux paths are
implemented and unit-tested, but nobody has run this end-to-end on either. Expect rough edges
in workspace detection and in scripts/install-hosts.mjs, which writes agent config files and
creates symlinks.
If you hit something on macOS or Linux, please open an issue or send a PR — that is the
fastest way this gets properly cross-platform. npm test needs no database and should pass
everywhere; npm run doctor tells you what your machine looks like and is the most useful thing
to paste into an issue.
Platform | Status |
Windows | Verified end-to-end (direct + SSH tunnel) |
macOS | Implemented, untested — PRs welcome |
Linux (incl. Snap, Flatpak) | Implemented, untested — PRs welcome |
Related MCP server: PostgreSQL MCP Server
1. Install on this PC
git clone https://github.com/apsolut/dbeaver-mcp.git
cd dbeaver-mcp
npm run setupsetup installs dependencies and points every agent it can find at this checkout.
On npm the package is @apsolut/dbeaver-mcp — the scope matters. The unscoped dbeaver-mcp
is an unrelated project, so npx dbeaver-mcp gets you someone else's server.
Cloning is still the recommended route, because npm run setup is what registers the plugin with
every agent on the machine. Note that Windows is the only platform where a real query has been
verified end-to-end; see the table above.
Restart Grok / Claude / Codex / Agy.
2. Check the machine
npm run doctorYou want: Node 20+, DBeaver workspace found, at least one connection.
If DBeaver is not in the default place, point at the folder that contains General/.dbeaver/data-sources.json:
# Windows
set DBEAVER_WORKSPACE=%APPDATA%\DBeaverData\workspace6
# macOS
export DBEAVER_WORKSPACE="$HOME/Library/DBeaverData/workspace6"
# Linux
export DBEAVER_WORKSPACE="$HOME/.local/share/DBeaverData/workspace6"Then run npm run setup again so the agent inherits the env, or set DBEAVER_WORKSPACE in the agent’s MCP config.
3. SSH tunnels need a known host key
If any DBeaver connection uses an SSH tunnel, read this before your first query.
This plugin verifies the bastion's host key against ~/.ssh/known_hosts before sending your
SSH password or your database credentials. An unknown host, a changed key, or an @revoked entry
aborts the connection. DBeaver does the same thing; a tool that skipped the check would hand your
production credentials to anything that answers on that IP.
So the first tunnelled query against a host you have never reached from this machine, as this user fails with:
Unknown SSH host key for bastion.example.com:22 (SHA256:…)Fix it once, either way:
# Preferred: record the key, then eyeball the fingerprint against what you expect
ssh-keyscan -p 22 bastion.example.com >> ~/.ssh/known_hosts
# Or just connect once with ssh and accept the prompt
ssh you@bastion.example.comAlready have the host in known_hosts (hashed entries, wildcards, [host]:2222 forms and
@revoked markers are all understood)? Then nothing happens and the tunnel opens.
Or let the agent walk you through it. Ask it to run trust_ssh_host on the connection. It
probes the bastion without sending any credentials — the handshake is aborted at the host-key
stage — shows you the SHA256 fingerprint, and records it only after you confirm that exact value
back. A key that differs from one already recorded is refused outright, never offered for
confirmation.
Trust on first use, if you would rather not pre-seed keys:
export DBEAVER_MCP_SSH_HOST_KEY_POLICY=tofuThis records an unknown key the first time and warns you. A key that changes later is still refused — that case is indistinguishable from an attack.
There is also =insecure, which disables verification entirely and prints a warning on every
connection. It exists for throwaway local boxes. Do not point it at anything that matters.
known_hostsis per-user. The MCP server runs as you, so the file your terminal uses is the file it reads. If your agent runs under a different account or inside a container, pointDBEAVER_MCP_KNOWN_HOSTSat the right file.
Agent-based SSH auth is the one gap. If DBeaver is set to use an SSH agent, the MCP server
needs SSH_AUTH_SOCK in its environment, and desktop agent hosts usually do not pass it
through. Password and key auth work normally.
4. First ask
After restart:
list DBeaver connections
You should see tools named dbeaver__list_connections, dbeaver__execute_query, dbeaver__run_script, dbeaver__inspect_sequences.
The first start (and the first write of a session) prints a BACKUP FIRST YOUR DATABASE banner. Dump before write_query / run_script. The marker lives in ~/.dbeaver-mcp/backup-seen (override with DBEAVER_MCP_STATE).
Then:
test the connection named ACME LIVE
select id, name from regions limit 5 on ACME LIVE
The name argument is the DBeaver connection name or its id. Reads also accept a unique
substring (live → ACME LIVE); an ambiguous substring is an error, never a guess. Writes
(write_query, run_script) require the exact name or id, so a partial match can never land on
the wrong database.
5. Tools
Tool | Use it for |
| Names, hosts, SSH hop. No secrets. |
| Open tunnel + |
| Reads. Several |
| One mutating statement, or a few (writes are transactional) |
| Ordered list / script. Transaction when anything writes |
| Sequence |
| Reset the sequences that are behind. Dry run unless |
| Query plan as JSON. |
| Show a bastion's host key fingerprint and record it once you confirm |
| Non-system schemas |
| Tables in a schema |
| Columns |
execute_query refuses writes, including SELECT setval(...). Use write_query or run_script for those.
Destructive SQL needs confirm: true — DROP of any object, TRUNCATE, ALTER SYSTEM,
ALTER TABLE … DROP COLUMN, and DELETE / UPDATE with no WHERE. The check runs per statement
on the parsed batch, with string literals and quoted identifiers stripped, so neither a
;-separated batch, nor a WHERE inside a value, nor a column named "where" slips past.
CASCADE is called out separately, because it widens the blast radius. It's a confirmation rather
than a refusal on purpose: a flat block just teaches an agent to rephrase until it gets through.
Transaction control is refused, everywhere. COMMIT, ROLLBACK, BEGIN, SAVEPOINT,
SET TRANSACTION, SET ROLE, SET statement_timeout and friends are rejected on reads and writes
alike. This is not tidiness. Reads run inside BEGIN TRANSACTION READ ONLY, so a leading COMMIT
would end that transaction and leave every following statement running unprotected — including a
SELECT that calls a volatile function which writes. Use the transaction option instead; the
server owns its own transactions and timeouts.
Credential stores and server-side file readers are blocked. pg_authid and pg_shadow hold
password verifiers; pg_read_file, pg_ls_dir and pg_stat_file read the database server's
filesystem. All are plain reads, so a read-only transaction permits them happily — being
superuser-only is the only thing standing in the way, and that is not enough when the connection
is privileged. Set DBEAVER_MCP_ALLOW_SENSITIVE_READS=true if you genuinely need them. The
strongest mitigation remains connecting as a least-privilege role rather than postgres.
Restricting what the agent can reach
Policy lives in the environment, not in the conversation, so it holds regardless of what the agent decides to try. Set these in your MCP host config:
"env": {
"DBEAVER_MCP_ALLOWED_CONNECTIONS": "app-*,billing", // nothing else is even nameable
"DBEAVER_MCP_WRITABLE_CONNECTIONS": "app-dev", // read prod, write only dev
"DBEAVER_MCP_DISABLED_TOOLS": "run_script" // gone from the tool list
}Or lock the whole server down with DBEAVER_MCP_READ_ONLY=true, which unregisters
write_query, run_script and fix_sequences entirely — the agent never sees them.
Names match connection name or id, case-insensitively, with * and ? wildcards. A
connection outside the allow list cannot be resolved by name at all, so the error doesn't even
confirm it exists.
6. CLI (no agent)
npm run cli -- list
npm run cli -- test "ACME LIVE"
npm run cli -- query "ACME LIVE" "SELECT 1; SELECT current_database()"
npm run cli -- sequences "ACME LIVE"
npm run cli -- sequences "ACME LIVE" public pages7. One agent only
node scripts/install-hosts.mjs --hosts=grok
node scripts/install-hosts.mjs --hosts=claude
node scripts/install-hosts.mjs --hosts=codex
node scripts/install-hosts.mjs --hosts=agyOr wire stdio yourself (NODE = node or a full node.exe path, ENTRY = …/dbeaver-mcp/src/index.js):
Agent | Where | What |
Grok |
| or |
Claude Code |
|
|
Codex |
|
|
Agy |
|
|
Upgrading from 1.4
1.5 tightened three things that were previously permissive. If something that used to work now fails, it is almost certainly one of these — and in each case the older behaviour was unsafe.
Change | You will see | What to do |
SSH host keys are verified |
| Section 3. One |
| TLS errors on | Previously every mode skipped certificate checks. Point |
Writes need an exact connection name |
| Use the full name or id from |
1.7 adds two more refusals, both closing real holes:
Change | You will see | What to do |
Transaction control is refused |
| Drop the |
Credential tables and file readers are refused |
| Nothing, normally. If you really need them, |
Also new: queries time out after 30s by default (timeoutMs, or
DBEAVER_MCP_STATEMENT_TIMEOUT_MS), and large results are capped by total bytes — watch for
truncatedBytes: true.
Safety
This repo holds no connection passwords. See SECURITY.md.
Reads are enforced by Postgres, not by pattern matching:
execute_queryruns insideBEGIN TRANSACTION READ ONLY, so even aSELECTthat calls a data-modifying function fails.SSH host keys are verified against
~/.ssh/known_hosts. An unknown or changed host key aborts the tunnel.TLS follows your
sslmode.verify-ca/verify-fullreally verify.Writes need an exact connection name, and a live query cannot run forever (30s default).
Confirm with the user before
write_query/run_scripton a live database.DBeaver Community only. EE / PRO uses a different credential store.
Environment
Variable | Default | Purpose |
| auto-detected | Folder containing |
|
|
|
|
| Path list for host key lookup |
|
| CA bundle for |
|
| Server-side statement timeout |
|
| Server-side lock timeout |
|
| Kills sessions left idle in a transaction |
|
| Total result payload cap per call |
|
| Per-cell cap; |
|
| Where the backup-banner marker lives |
|
|
|
| all | Comma-separated names/ids, |
| = allowed | Narrower list that may be written to |
| none | Tool names to remove from the surface |
|
|
|
Contributing
macOS and Linux need a second pair of hands — see the platform table at the top. Useful contributions, roughly in order of value:
Run it on macOS or Linux and report what broke.
npm run doctoroutput plus your DBeaver version is enough to start. Snap and Flatpak workspace layouts especially.scripts/install-hosts.mjson a non-Windows box. It writes agent config files and creates symlinks. It backs up before writing and refuses to delete anything that is not a link, but it has only ever run for real on Windows.CI. A GitHub Actions matrix over windows/macos/ubuntu × Node 20/22 would close most of this gap by itself.
src/dbeaver.jsparser tests. JDBC URL shapes, SSH handler variants and credential blobs differ across DBeaver versions; that is where real-world variation will bite and where coverage is thinnest.
npm install
npm test # no database required, should pass on any platform
npm run doctor # what your machine looks likePlease do not include a real workspace, credentials-config.json, connection URLs or SQL dumps in
an issue or PR. Redact hostnames. Security issues: see SECURITY.md.
Layout
src/ MCP server
src/knownhosts.js OpenSSH known_hosts verification
scripts/doctor.mjs
scripts/install-hosts.mjs
HOWTO.md tools, scripts, sequences, troubleshooting
SECURITY.mdAvailable Tools
12 toolsdescribe_tableB
Describe columns of a table on a DBeaver connection.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id | |
| table | Yes | Table name | |
| schema | No | Schema name (default public) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It implies a read-only operation but does not explicitly state non-destructiveness, permissions required, or what the response contains. This is a significant gap for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It is front-loaded with the core action and resource, making it easy to scan and understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool, the description is minimally adequate, but it lacks details about the return format (e.g., column names, types, constraints). Since there is no output schema, the agent might benefit from knowing what the result looks like. However, the operation is common enough that the description suffices for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% description coverage for all three parameters, so the description adds no additional meaning beyond what the schema already documents. The baseline of 3 is appropriate since the schema handles parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Describe columns') and the resource ('a table on a DBeaver connection'). This is distinct from sibling tools like list_tables (which lists tables) and execute_query (which runs queries), so an agent can easily differentiate it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any context about prerequisites or typical use cases. It simply states what it does without explaining when it is the appropriate choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_queryA
Run read-only SQL inside a READ ONLY transaction. Multiple SELECTs return every result set (not only the last). SSH tunnels open automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id, e.g. "ACME LIVE" | |
| query | Yes | SELECT / WITH / EXPLAIN / SHOW. Multiple statements allowed. | |
| maxRows | No | Row cap per statement (default 200) | |
| timeoutMs | No | Statement timeout in ms (default 30000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full transparency burden. It goes beyond the basic operation by disclosing that execution happens inside a READ ONLY transaction, that multiple SELECTs return every result set, and that SSH tunnels open automatically. These are meaningful behavioral traits not visible in the schema, though it omits error behavior and permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences with zero filler. It front-loads the core purpose first, then adds the most important behavioral quirks (multiple result sets and SSH tunnel behavior) without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a SQL execution tool with no output schema, the description covers the key operational context: read-only transaction, multi-statement result behavior, and automatic SSH tunneling. Parameter semantics are fully covered by the schema. The only minor gap is not clarifying behavior for non-SELECT statements like EXPLAIN/SHOW in multi-statement scenarios, but overall it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already fully documents all four parameters. The description adds no parameter-specific meaning beyond what the schema provides, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Run') and resource ('read-only SQL') and clearly states the tool's purpose. It distinguishes itself from sibling tools by explicitly labeling the operation as read-only, which separates it from write_query and run_script. The extra detail about multiple result sets further sharpens the purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes the intended use case: running read-only SQL queries. This implicitly tells the agent this is not for writes, but it does not explicitly name alternatives like write_query or explain_query or state exclusion conditions. The read-only marker provides strong contextual guidance, though direct sibling routing is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_queryA
Show the Postgres query plan for one statement. analyze: true runs it for real timings and is refused on anything that writes.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id | |
| query | Yes | A single statement | |
| analyze | No | Execute the statement to get real timings (reads only) | |
| verbose | No | Include VERBOSE output |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly discloses that analyze executes the statement for real timings and that write operations are refused. This is the most critical safety behavior. It does not mention output format or connection authorization, but the main mutation guard is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with no wasted words. The core purpose is front-loaded, and the important analyze caveat is stated immediately after. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no annotations and no output schema, the description covers the essential purpose and the key side-effect risk. Parameter details are fully handled by the schema. It would benefit from explicitly routing users to execute_query or write_query for actual execution, but the core information needed for safe invocation is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds some semantic weight to analyze by explaining it 'runs it for real timings and is refused on anything that writes,' which extends the schema's 'reads only' note slightly. However, it adds little meaning for name, query, or verbose beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb plus resource: 'Show the Postgres query plan for one statement.' The phrase 'query plan' clearly distinguishes it from siblings like execute_query and write_query, even though no alternative is named.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: this tool is for explaining a single statement, not for general execution. It also provides a concrete usage condition for analyze, including the exclusion 'refused on anything that writes.' It does not explicitly name alternatives, but the behavior-based guidance is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fix_sequencesA
Reset serial/identity sequences that have fallen behind MAX(column) — the duplicate-key state a dump leaves behind. Defaults to a dry run; pass apply: true to write.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id (exact when apply: true) | |
| apply | No | Actually run setval (default false = dry run) | |
| table | No | Only this table | |
| schema | No | Schema (default: connection schema or public) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states that the tool defaults to a dry run and only writes when 'apply: true' is passed, which is a critical safety behavior. It also explains the underlying problem. It does not mention permissions, reversibility, or output format, but the dry-run default is a significant transparency win.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. The first sentence states the purpose and trigger condition; the second states the critical safety default. Information is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no output schema and no annotations, the description covers the essential invocation context: what it does, when it is needed, and the dry-run safety default. It does not describe the return value or side effects beyond 'write', but the core knowledge an agent needs to call it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description adds no new parameter-level meaning beyond what the schema provides; 'apply: true to write' merely restates the schema's boolean description. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Reset') with a specific resource ('serial/identity sequences') and a precise condition ('fallen behind MAX(column)'). It clearly distinguishes this fix operation from sibling tools like inspect_sequences by framing it as the corrective action for the duplicate-key state left by dumps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: when sequences have fallen behind MAX(column), i.e., the duplicate-key state. It also explains the dry-run default and how to switch to write mode. However, it does not explicitly name alternative tools or state when not to use it, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_sequencesA
Compare serial/identity sequences to MAX(column). needs_reset is true when the table is ahead of the sequence (typical after a dump or manual INSERT).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id | |
| table | No | Only this table | |
| schema | No | Schema (default: connection schema or public) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does add meaningful context by explaining what needs_reset indicates, which is a key output behavior. Yet it does not explicitly state that the operation is read-only or side-effect-free, which an agent would need to assume from 'Compare' rather than be told.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler, front-loading the primary action. It is concise and to the point, though it could arguably be more structured (e.g., separate output semantics), but the efficiency merits a high score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the core behavior (needs_reset flag) but does not specify the full return format—e.g., whether it returns a list of sequences, columns included, or only problematic ones. Since there is no output schema, the description should be more explicit about the result shape, leaving a gap for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is fully documented (100% coverage), with each parameter described. The description does not add any extra meaning about the parameters beyond what the schema already provides, so it earns the baseline score for a well-covered schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Compare serial/identity sequences to MAX(column)') with a clear resource and distinguishes it from sibling fix_sequences by its diagnostic nature. The added explanation of needs_reset reinforces the tool's purpose, leaving no ambiguity about what it does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a concrete scenario ('typical after a dump or manual INSERT') that tells an agent when this tool is useful. However, it does not explicitly mention alternatives or when not to use it, such as pointing to fix_sequences for resetting, so it falls short of the top tier.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_connectionsA
List DBeaver Community connections (names, hosts, SSH hop). Passwords are never returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does disclose that passwords are never returned, which is a useful safety-related trait. However, it does not mention whether the operation is read-only (though obvious), any potential side effects, or response format. For a simple list operation, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no wasted words. The core purpose is front-loaded, and the password disclosure is a valuable addition. It is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description covers the essential information: what is listed and what is explicitly excluded (passwords). It does not mention edge cases like disabled connections or pagination, but these are minor for a list operation. The description is sufficient for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (vacuously). The description does not need to explain parameters since there are none. The baseline for 0-parameter tools is 4, and the description adds no unnecessary parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('DBeaver Community connections') and specifies the returned fields (names, hosts, SSH hop). It is clear and unambiguous, though it does not explicitly differentiate from sibling tools like test_connection or list_schemas. The purpose is evident without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. It does not mention prerequisites, typical use cases, or when another tool might be more appropriate. The context is implied but not stated, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_schemasA
List non-system schemas on a DBeaver connection.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of behavioral disclosure. It only states what it lists, but does not mention that it is a read-only operation, what precisely qualifies as 'non-system', whether an active connection is required, or what the return format will be. The agent is left to infer these operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that leads with the core action and resource. Every word earns its place; no filler or unnecessary clauses. It is appropriately concise for a tool with one parameter and a straightforward function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description is largely sufficient. It states the purpose clearly. However, it could more explicitly note that it returns a list of schema names or that the operation is read-only, which would complete the context for an agent without additional hints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully describes the single parameter 'name' as 'Connection name or id' (100% coverage). The tool description adds nothing beyond this—it does not elaborate on parameter usage, constraints, or typical values. Since schema coverage is complete, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('non-system schemas') with a qualifier ('on a DBeaver connection'). This distinguishes it from sibling tools like list_connections (lists connections) and list_tables (lists tables). The purpose is unambiguous and specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when one needs to see available schemas on a connection, but it does not explicitly state when to use this tool over alternatives or mention any exclusions (e.g., 'for system schemas, use X'). The phrase 'non-system schemas' hints at a filtering behavior but provides no guidance on when this is the right choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesA
List tables in a schema for a DBeaver connection.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id | |
| schema | No | Schema name (default: connection schema or public) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states a read-only action ('list') which implies non-destructive behavior, but does not disclose return format, whether it includes views or system tables, or any connection prerequisites. The description is not misleading but is sparse on behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that immediately states the purpose. No wasted words and no redundancy with the schema. It is optimally front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should clarify what the tool returns (e.g., a list of table names) and any prerequisites (e.g., an active connection). It only says 'list tables,' which is a minimal definition but leaves some ambiguity about the exact output structure. For a simple list operation, this is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already described in the input schema. The description does not add any additional meaning to the parameters beyond what the schema provides, matching the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List tables') and the resource ('in a schema for a DBeaver connection'), which is specific and distinguishes it from sibling tools like list_schemas and describe_table. It fully conveys what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you need to list tables) but does not explicitly mention when not to use it or alternatives like list_schemas or describe_table. No exclusions or alternative routing is provided, so it relies on inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_scriptB
Run several SQL statements on one connection. Requires an exact connection name or id. Defaults to a transaction when any statement writes.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact connection name or id (no partial matching for writes) | |
| script | No | SQL script; split on top-level semicolons | |
| confirm | No | Required (true) if any statement is destructive | |
| maxRows | No | Row cap per statement (default 200) | |
| timeoutMs | No | Statement timeout in ms (default 30000) | |
| statements | No | SQL statements in order | |
| transaction | No | Force a transaction (default: on when any statement writes and there are 2+) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses a meaningful behavioral trait: automatic transaction default when any statement writes. It also communicates the exact-match requirement for connections, but does not mention confirmation for destructive statements, rollback behavior, or return data. This is partial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences carry high-signal information with no filler. The primary purpose is front-loaded, followed by the prerequisite and a key safety default. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity and lack of annotations or output schema, the description covers only the core use case and one safety behavior. It does not mention destructive-operation confirmation, when to prefer this over sibling tools, or what the response looks like. The schema fills in parameter details, but high-level operational context is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with clear descriptions, so the description does not need to compensate. The description adds some context around connection name exactness and transaction defaults, but these are already reflected in schema properties like name and transaction.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Run several SQL statements') and resource ('on one connection'), clearly indicating a batch execution tool. It implicitly distinguishes from single-statement siblings like execute_query and write_query, but does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a prerequisite ('Requires an exact connection name or id') and a default behavior, but gives no guidance on when to use this tool versus execute_query, write_query, or explain_query. No exclusions or alternative routing are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_connectionA
Open the DBeaver connection (starts a verified SSH tunnel if needed) and run SELECT 1.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It transparently mentions side effects: opening a connection and starting an SSH tunnel if needed. It runs SELECT 1, which is read-only, but the description does not explicitly state that it is non-destructive or that it does not modify data. It also does not cover failure behavior or whether the connection is kept open.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that conveys the essential behavior without any filler. It is front-loaded with the primary action and includes the conditional tunnel detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple connectivity test, the description is mostly adequate, but it does not specify the return value or success/failure indicators. Since there is no output schema and no annotations, an agent might be unsure whether the tool returns a result or just signals success. It also does not mention error handling or edge cases (e.g., invalid connection name).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema describes the only parameter (name) as 'Connection name or id', which is clear and complete. The tool description adds no additional meaning beyond the schema. Since schema coverage is 100%, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Open... and run SELECT 1') and a clear resource (DBeaver connection). It is distinct from siblings like list_connections (which lists connections) or execute_query (which runs arbitrary queries). The purpose of testing connectivity is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied: it tests a connection by running SELECT 1, and it notes that it starts an SSH tunnel if needed. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide exclusions or prerequisites. It relies on the context of sibling tools for differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trust_ssh_hostA
Show the SSH host key fingerprint for a tunnelled connection, and record it in known_hosts only when the user confirms that exact fingerprint. Use this when a tunnel fails with "Unknown SSH host key".
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Connection name or id | |
| confirmFingerprint | No | Echo back the SHA256:… fingerprint to record it. Show it to the user and get their agreement first — do not copy it from the previous response on your own. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden, and it succeeds. It discloses both the mutating behavior ('record it in known_hosts') and the safety gate ('only when the user confirms that exact fingerprint'). It does not hide the side effect behind the tool's name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and followed by the precise use-case trigger. Every phrase earns its place: what it shows, what it records, when recording happens, and when to use the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with full schema coverage and no output schema, the description is complete enough to select and invoke correctly. It names the trigger, the side effect, and the confirmation requirement. Nothing essential is missing for an agent deciding whether and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The tool description adds some framing about fingerprint confirmation, but the confirmFingerprint parameter's behavior is already well documented in the schema. The description does not materially extend what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Show the SSH host key fingerprint for a tunnelled connection', then states the recording action into known_hosts. This clearly distinguishes it from siblings like test_connection and execute_query by focusing on SSH host trust. The 'Unknown SSH host key' mention further pins down the exact job.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly gives a trigger condition: 'Use this when a tunnel fails with "Unknown SSH host key".' It also communicates the consent condition for the side effect. It does not name when-not-to-use cases or alternative sibling tools, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_queryA
Run INSERT/UPDATE/DELETE/DDL. Requires an exact connection name or id. Several statements in one string run on one connection; more than one write is wrapped in a transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact connection name or id (no partial matching for writes) | |
| query | Yes | Mutating SQL (one or more statements) | |
| confirm | No | Required (true) for destructive statements: DROP, TRUNCATE, ALTER SYSTEM, or DELETE/UPDATE without WHERE | |
| timeoutMs | No | Statement timeout in ms (default 30000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses transaction wrapping and the exact-connection requirement, which are useful behavioral traits. However, it doesn't mention the confirm parameter's role in destructive statements (though schema covers it) or any side effects/permissions. The transaction info adds value beyond schema, but more could be said about error handling or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose. Every clause adds value—purpose, connection requirement, and transaction behavior. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no output schema and no annotations, the description covers the essential behavioral context: what it executes, connection requirements, and transaction semantics. It doesn't explain the confirm parameter's necessity for destructive statements (but schema does) and omits return-value details (no output schema). Overall, it's complete enough for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by clarifying that 'name' must be an exact match (no partial matching) and that multiple statements in 'query' run on one connection and are wrapped in a transaction. This goes beyond the schema's parameter descriptions, earning a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Run INSERT/UPDATE/DELETE/DDL', which clearly states the verb and resource. It distinguishes itself from siblings like execute_query (likely read-only) by explicitly targeting mutating SQL, so an agent can immediately tell what it does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use it: it requires an exact connection name or id and explains transaction behavior for multiple statements. It doesn't explicitly contrast with execute_query, but the mutating-SQL focus and sibling names imply the division of labor. Lacks an explicit 'use this for writes, execute_query for reads' statement, so not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v1.6.1- First observed
describe_table - First observed
execute_query - First observed
explain_query - First observed
fix_sequences - First observed
inspect_sequences - First observed
list_connections - First observed
list_schemas - First observed
list_tables - First observed
run_script - First observed
test_connection - First observed
trust_ssh_host - First observed
write_query
TDQS
Scored across 12 tools
Most tools have distinct purposes, but execute_query and run_script both execute SQL, which could cause confusion. Descriptions clarify that execute_query is read-only while run_script handles mixed statements, so the overlap is manageable.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., test_connection, list_schemas, fix_sequences). No mixed conventions or vague verbs.
12 tools is well within the ideal 3-15 range and each tool addresses a specific database operation or connection concern. The count feels appropriately scoped for a DBeaver MCP server.
The surface covers connection testing, read/write queries, query planning, script execution, sequence management, SSH trust, and schema/table inspection. Minor gaps like view or procedure listing exist, but core workflows are well covered.
Maintenance
Related MCP Connectors
Query your Postgres from ChatGPT or Claude without exposing the database or handing over credentials. Run npx boltschema connect next to your database and it dials out over HTTPS — no inbound firewall rule, no open port, works with localhost and VPC-private databases. Read-only is enforced by a SQL guard, a Postgres READ ONLY transaction, and a scoped role generated for you.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
- dataOAuthco.thinair
PostgreSQL, MySQL, and SQL Server in one session. 26 read-only MCP tools for AI agents.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with PostgreSQL and Supabase databases through natural language. Supports secure database operations including queries, migrations, and schema management with user-provided credentials.15 npm1MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to query and manage local PostgreSQL databases through SQL execution and schema exploration tools. It supports both read-only queries and write operations including table creation and data modification via natural language.23 npm1ISC
- AlicenseAqualityDmaintenanceEnables executing SQL queries, schema introspection, and data management for PostgreSQL and MySQL databases via natural language, supporting local, SSH, and AWS RDS connections.850 npmMIT
- FlicenseNot gradedqualityDmaintenanceEnables AI models to execute SQL queries, list tables, and describe table structures on a local PostgreSQL database.1 npm-