Back to Home
askdba icon

mysql-mcp-server

Verified Safe

by askdba

Overview

Acts as a read-only MySQL server proxy that exposes database introspection and query execution tools to AI clients via the Model Context Protocol (MCP) or a REST API.

Installation

Run Command
docker run -e MYSQL_DSN="user:password@tcp(host.docker.internal:3306)/mydb" ghcr.io/askdba/mysql-mcp-server:latest

Environment Variables

  • MYSQL_DSN
  • MYSQL_CONNECTIONS
  • MYSQL_DSN_1
  • MYSQL_DSN_1_NAME
  • MYSQL_DSN_1_DESC
  • MYSQL_DSN_1_SSL
  • MYSQL_MAX_ROWS
  • MYSQL_QUERY_TIMEOUT_SECONDS
  • MYSQL_MCP_EXTENDED
  • MYSQL_MCP_JSON_LOGS
  • MYSQL_MCP_TOKEN_TRACKING
  • MYSQL_MCP_TOKEN_MODEL
  • MYSQL_MCP_AUDIT_LOG
  • MYSQL_MCP_VECTOR
  • MYSQL_MCP_HTTP
  • MYSQL_HTTP_PORT
  • MYSQL_HTTP_RATE_LIMIT
  • MYSQL_HTTP_RATE_LIMIT_RPS
  • MYSQL_HTTP_RATE_LIMIT_BURST
  • MYSQL_MAX_OPEN_CONNS
  • MYSQL_MAX_IDLE_CONNS
  • MYSQL_CONN_MAX_LIFETIME_MINUTES
  • MYSQL_CONN_MAX_IDLE_TIME_MINUTES
  • MYSQL_PING_TIMEOUT_SECONDS
  • MYSQL_HTTP_REQUEST_TIMEOUT_SECONDS
  • MYSQL_SSL
  • MYSQL_MCP_CONFIG

Security Notes

The server implements a robust, multi-layered security model for read-only access. It uses both regex and AST-based SQL parsing (defense-in-depth) to strictly block DDL, DML, administrative commands, transaction control, multi-statement queries, and dangerous functions (e.g., SLEEP, LOAD_FILE). Access to system schemas like `mysql`, `information_schema`, `performance_schema`, and `sys` is also explicitly blocked. It recommends and helps create a dedicated read-only MySQL user. DSNs are masked in logs and output. HTTP mode includes configurable rate limiting and mindful handling of X-Forwarded-For headers. Audit logging is available for transparency. No direct `eval` or dynamic code execution is observed, and the Go codebase appears clean and purpose-built.

Similar Servers

Stats

Interest Score34
Security Score9
Cost ClassLow
Avg Tokens350
Stars3
Forks1
Last Update2026-01-17

Tags

GoMySQLMCPRead-onlyAI Agent ToolDatabase Introspection