mssql-mcp-server

The server implements extensive security measures including strict input validation, parameterized queries for all data modification and script execution, and comprehensive SQL injection prevention in 'read_data' (blocking dangerous keywords/patterns, multi-statement queries, obfuscation attempts). Mandatory preview/confirmation steps are required for data mutations ('update_data', 'delete_data') with configurable row limits. Secrets are managed via environment variables and placeholders, with explicit instructions against hardcoding. Centralized policy enforcement (allowed/denied tools, read-only modes, approval requirements, schema/database access control) and robust audit logging with sensitive data redaction further enhance security. No use of 'eval' or similar dangerous functions was found. Error handling avoids exposing internal system details unnecessarily.