db-mcp-server-npx

The server employs robust security measures against SQL injection by using parameterized queries in most database adapters (MySQL, PostgreSQL, SQLite, Oracle). Table names passed to `describe_table` and `inspect_table` tools are rigorously validated using a regex to prevent injection. The `MCP_DB_READ_ONLY` environment variable provides a critical safeguard to disable all write operations. Audit logs capture detailed information about tool calls, queries, and parameters. While the SQL Server adapter's parameter conversion logic could theoretically misinterpret '?' within string literals in AI-generated SQL, the underlying driver's parameter binding still mitigates direct SQL injection from user-supplied values.