MCP Database Server

Pillar: Protocols & Interoperability
Status: Month 1 - essential

Python MCP server to expose schemas, safe queries, and stored procedures to LLM clients.

Problem

LLMs need to consult corporate databases without receiving broad credentials or the freedom to execute destructive SQL.

Related MCP server: DB Insights MCP Server

MVP

• MCP server with FastMCP

• Listing of allowed schemas

• Read-only queries

• Allowlist of stored procedures

• Audit of calls

Architecture

• MCP server (mcp.server.MCPServer, tools registered via @mcp.tool())

• Schema registry (allowlist of tables/columns, db.py)

• Read-only authorizer (sqlite3.Connection.set_authorizer, security.py)

• Audit logger (trail in memory of each tool call, audit.py)

Diagram

flowchart LR
    A0[MCP client] --> A1[MCP server: list_tables / describe_table / run_readonly_query]
    A1 --> A2[SQLite authorizer: allowlist + read-only]
    A2 --> A3[SQLite: invoices]
    A1 --> A4[Audit log]

Stack

• Python

• mcp (official Model Context Protocol SDK)

• SQLite (sqlite3 from the stdlib, with set_authorizer for access control)

• unittest

• Docker Compose

How to run

Real implementation with the official MCP SDK. Access control does not use regex over SQL (easy to bypass) — it uses SQLite's own set_authorizer, which approves or denies each table/column read and each statement type before any row runs. To run the MCP server:

python3.12 -m venv .venv && source .venv/bin/activate
pip install -e .
python -m mcp_database_server   # sobe o servidor MCP via stdio
python -m unittest discover -s tests

Tests

• test_security.py: authorizer blocks INSERT/UPDATE/DROP/ALTER, ATTACH, tables outside the allowlist (e.g., sqlite_master), and stacked statements (SELECT 1; DROP TABLE ...).

• test_server.py: logic of each tool called directly (without protocol), including that every call generates an audit event.

• test_integration.py: starts python -m mcp_database_server as a real subprocess and talks to it via mcp.client.stdio + ClientSession — proves the server actually speaks MCP, not just that the Python functions work.

Risks and decisions

• SQL injection and excessive permissions: solved via set_authorizer at the driver level, not regex.

• A single SQLite connection is not thread-safe; the MCP server dispatches each tool call into a worker thread, so ServerState.lock serializes access (real bug found and fixed during implementation, covered by test_integration.py).

• MCP tools return ValueError with a clear message to the LLM client instead of leaking a stack trace.

Next steps

• Replace SQLite with PostgreSQL via SQLAlchemy when real data is involved.

• Add per-client authentication/allowlist (today any connected MCP client has access to the tools).

• Persist the audit log outside the process (today it is only in memory).