Provides comprehensive database operations including reading, writing, and managing MySQL databases with security features like SQL injection prevention, connection pooling, and transaction support.
KatCoder MySQL MCP Server
A secure and feature-rich MySQL Model Context Protocol (MCP) server that enables AI agents and applications to interact with MySQL databases through a standardized interface.
Features
🔒 Security First
SQL Injection Prevention: Comprehensive input validation and sanitization
Identifier Validation: Strict validation of table and column names
Query Whitelisting: Read-only operations by default, write operations require explicit permission
Connection Pooling: Secure connection management with timeout controls
Error Handling: Secure error messages that don't expose sensitive information
🛠️ Database Operations
List: Browse tables and view table structures
Read: Query data with filtering, pagination, and sorting
Create: Insert new records with validation
Add Column: Add new columns to existing tables with full type and constraint support
Drop Column: Remove columns from tables with safety checks
Modify Column: Change column definitions (type, constraints, defaults)
Rename Column: Rename existing columns while preserving data
Rename Table: Rename tables with safety validation
Add Index: Create indexes (BTREE, HASH, FULLTEXT, SPATIAL) with unique constraints
Drop Index: Remove indexes from tables
Bulk Insert: Efficiently insert multiple records in a single operation
Update: Modify existing records safely
Delete: Remove records with mandatory WHERE clauses
Execute: Run custom SQL queries with security restrictions
DDL: Execute Data Definition Language statements
Transaction: Execute multiple operations atomically
Utility: Database health checks and metadata operations
🔧 Configuration Options
Connection String: Standard MySQL connection format
Tool Selection: Enable only the tools you need
Connection Pooling: Configurable pool settings
Timeout Controls: Connection and query timeouts
Tool Permissions & Security
🎯 Recommended Approach: Use "all" Tools
For most use cases, we recommend enabling all tools by using "all" as the tool parameter. This provides:
Full Functionality: Access to all database operations including DDL, transactions, and advanced features
AI Agent Compatibility: Ensures AI agents can see and use all available tools
Future-Proof: Automatically includes new tools as they're added
Simplified Configuration: No need to manually list specific tools
🔒 Security-First Approach: Manual Tool Selection
Use manual tool selection only when you need to restrict access for security or compliance reasons:
Read-Only Access
Perfect for reporting, analytics, or read-only AI agents:
Available tools: list, read, utility
list: Browse tables and schema
read: Query data with filtering and pagination
utility: Database health checks and metadata
Basic Write Access
For applications that need to modify data but not schema:
Available tools: list, read, create, update, delete, utility
Includes all read-only tools plus:
create: Insert new records
update: Modify existing records
delete: Remove records (with mandatory WHERE clauses)
Full Database Access
For database administrators and development environments:
All available tools: list, read, create, update, delete, execute, ddl, transaction, bulk_insert, utility, add_column, drop_column, modify_column, rename_column, rename_table, add_index, drop_index, show_table_data
🛡️ Security Considerations
Database User Permissions
Always use MySQL user accounts with appropriate privileges:
Tool-Level vs Database-Level Security
Tool-level restrictions limit what operations the MCP server can perform
Database-level permissions provide the ultimate security boundary
Best practice: Use both layers for defense in depth
Production Recommendations
Use specific database users with minimal required privileges
Enable only necessary tools for production environments
Use read-only connections for reporting and analytics
Monitor database access and audit tool usage
Use environment variables for connection strings (never hardcode passwords)
📊 Tool Selection Quick Reference
Use Case | Recommended Tools | Security Level |
AI Development |
| Medium (use dev database) |
Production AI |
| High (restricted DB user) |
Reporting/Analytics |
| High |
Data Entry Apps |
| Medium |
Database Admin |
| Low (trusted environment) |
CI/CD Pipelines |
| Medium (isolated environment) |
Installation
Note: This package is currently in development and not yet published to npm. Use the development installation method below.
Development Installation (Recommended)
Future npm Installation (Coming Soon)
Once published to npm, you will be able to install globally:
Local npm Installation (Coming Soon)
Usage
Command Line Interface
Current Development Usage
Future npm Usage (After Publication)
Configuration for AI Agents
Current Development Configuration
Claude Desktop Configuration: Add this configuration to your Claude Desktop configuration file:
Cursor IDE Configuration: For Cursor IDE, add to your settings:
Future npm Configuration (After Publication)
Claude Desktop Configuration:
Cursor IDE Configuration:
Connection String Format
Basic Examples:
mysql://root@localhost:3306/mydb- Local database without passwordmysql://user:password@localhost:3306/mydb- Local database with passwordmysql://user:password@192.168.1.100:3306/mydb- Remote database
Advanced Examples:
mysql://user:password@db.example.com:3306/production?ssl=true- Remote database with SSLmysql://root:password@mysql-container:3306/docker_db- Docker databasemysql://user:password@localhost:3307/alternative_port- Different port
Available Tools
1. List Tool
Browse database structure and table information.
Parameters:
table(optional): Specific table name to get column information
Examples:
Practical Usage Scenarios:
Database Discovery: When connecting to a new database, use the list tool without parameters to see all available tables
Schema Exploration: Use with a table name to understand the structure before writing queries
Data Modeling: Examine relationships between tables by checking foreign key constraints
Migration Planning: Understand existing schema before making changes
2. Read Tool
Query data from tables with filtering and pagination.
Parameters:
table(required): Table name to querycolumns(optional): Array of specific columns to selectwhere(optional): Object with filter conditionslimit(optional): Maximum number of rows (max: 10,000)offset(optional): Number of rows to skiporderBy(optional): Order by clause
Basic Examples:
Advanced Filtering Examples:
3. Bulk Insert Tool
Efficiently insert multiple records into a table in a single operation.
Parameters:
table(required): Target table namedata(required): Array of objects with identical column-value pairs
Examples:
Usage in Transactions:
Response Format:
4. Create Tool
Insert new records into tables.
Parameters:
table(required): Target table namedata(required): Object with column-value pairs
Examples:
4. Update Tool
Modify existing records safely.
Parameters:
table(required): Target table namedata(required): Object with column-value pairs to updatewhere(required): Object with filter conditions
Examples:
5. Delete Tool
Remove records with mandatory WHERE clauses.
Parameters:
table(required): Target table namewhere(required): Object with filter conditions
Examples:
6. Execute Tool
Run custom SQL queries with security restrictions.
Parameters:
query(required): SQL query stringparams(optional): Array of query parametersallowWrite(optional): Boolean to allow write operations
Basic Examples:
Complex Query Examples:
7. DDL Tool
Execute Data Definition Language statements.
Parameters:
statement(required): DDL statement
Examples:
8. Add Column Tool
Add new columns to existing tables with comprehensive type and constraint support.
Parameters:
table(required): Target table namecolumn(required): Object with column definitionname(required): New column nametype(required): Column data type (e.g., VARCHAR(255), INT, DATETIME)nullable(optional): Whether column can contain NULL valuesdefault(optional): Default value for the columnautoIncrement(optional): Whether column should auto-incrementcomment(optional): Column comment
position(optional): Object specifying column positionafter(optional): Place column after this existing columnfirst(optional): Place column as the first column
Examples:
9. Drop Column Tool
Remove columns from tables with safety validation.
Parameters:
table(required): Table name to remove column fromcolumn(required): Column name to drop
Examples:
10. Modify Column Tool
Change existing column definitions including type, constraints, and defaults.
Parameters:
table(required): Table name containing the columncolumn(required): Column name to modifynewDefinition(required): Object with new column definitiontype(required): New column data typenullable(optional): Whether column can contain NULL valuesdefault(optional): New default valuecomment(optional): Column comment
Examples:
11. Rename Column Tool
Rename existing columns while preserving data.
Parameters:
table(required): Table name containing the columnoldName(required): Current column namenewName(required): New column namenewDefinition(optional): Column definition for the renamed column
Examples:
12. Rename Table Tool
Rename tables with safety validation.
Parameters:
oldName(required): Current table namenewName(required): New table name
Examples:
13. Add Index Tool
Create indexes on tables for improved query performance.
Parameters:
table(required): Table name to add index toname(required): Index namecolumns(required): Array of column names to include in the indextype(optional): Index type (BTREE, HASH, FULLTEXT, SPATIAL)unique(optional): Whether the index should be unique
Examples:
14. Drop Index Tool
Remove indexes from tables.
Parameters:
table(required): Table name containing the indexname(required): Index name to drop
Examples:
15. Transaction Tool
Execute multiple operations atomically.
Parameters:
operations(required): Array of operations to execute in transaction
Basic Examples:
Advanced Transaction Examples with Schema Changes:
Response Format:
{ "name": "ddl", "arguments": { "statement": "ALTER TABLE users ADD COLUMN phone VARCHAR(20)" } }
Advanced Transaction Examples:
9. Utility Tool
Database health checks and metadata operations.
Parameters:
action(required): Utility action (ping, version, stats, describe_table)table(optional): Table name (required for describe_table)
Examples:
10. Show Table Data Tool
Display table data with advanced formatting, pagination, and schema information.
Parameters:
table(required): Table name to display data fromlimit(optional): Maximum number of rows to display (default: 50, max: 1000)offset(optional): Number of rows to skip for pagination (default: 0)columns(optional): Array of specific columns to display (default: all columns)where(optional): Object with filter conditions (same format as read tool)orderBy(optional): Column name to sort by (defaults to primary key or first column)orderDirection(optional): Sort direction - 'ASC' or 'DESC' (default: 'ASC')showSchema(optional): Include table schema information (default: true)format(optional): Output format - 'table', 'json', or 'csv' (default: 'table')
Basic Examples:
Advanced Examples:
Response Format:
Practical Usage Scenarios:
Data Exploration: Quickly browse table contents with automatic formatting
Data Export: Export table data in CSV format for external analysis
Debugging: View specific rows with filtering and pagination
Schema Analysis: Examine table structure alongside data
Report Generation: Generate formatted data displays for documentation
Security Features
SQL Injection Prevention
Input Sanitization: All table and column names are sanitized
Parameter Binding: All queries use parameterized statements
Query Validation: Dangerous SQL patterns are blocked
Write Operation Protection: Write operations require explicit permission
Identifier Validation
Table Names: Only alphanumeric characters and underscores allowed
Column Names: Validated against SQL injection patterns
Where Conditions: Values are checked for dangerous content
Connection Security
Connection Pooling: Secure connection management
Timeout Controls: Prevents hanging connections
Error Handling: Secure error messages without sensitive data
Security Best Practices
1. Recommended Setup: All Tools with Restricted Database User
Best practice for production and AI agents:
Why this approach works:
✅ AI agents can see and use all available tools
✅ Database user permissions control actual access
✅ Future-proof as new tools are automatically available
✅ Simplified configuration management
2. Security-First Scenarios
Read-Only Analytics/Reporting
Data Entry Applications (No Schema Changes)
3. Development Environment
4. Environment Variables (Recommended)
5. Docker/Container Environments
Quick Reference: Choosing the Right Permission Approach
Use Case | Recommended Tools | Database Permissions | Security Level |
AI Development & Prototyping |
| Full admin access | Low (dev only) |
Production AI Agent |
| Limited to specific database/schema | High ⭐ |
Read-only Analytics |
| SELECT only | High |
Data Entry App |
| No DDL permissions | Medium |
Schema Migration Tool |
| DDL permissions required | Medium |
Reporting Dashboard |
| SELECT only | High |
🎯 Most Common Setup (Recommended)
Why this works: Database permissions provide the real security boundary, while "all" tools ensure AI agents can see and use all available functionality.
Error Handling
The server provides detailed error messages while maintaining security:
Development
Building the Project
Running in Development Mode
Testing
Environment Variables
LOG_LEVEL: Set logging level (debug, info, warn, error)NODE_ENV: Set environment (development, production)
Troubleshooting
Connection Issues
Verify MySQL server is running
Check connection string format
Ensure database exists
Verify user permissions
Test Connection
Check Database Version
Permission Errors
Check MySQL user privileges
Ensure database access is granted
Verify table-level permissions
Performance Issues
Monitor connection pool usage
Check query execution times
Optimize database indexes
Monitor Performance
Advanced Configuration
Custom Connection Pool Settings
Logging Configuration
Contributing
Fork the repository
Create a feature branch
Make your changes
Add tests
Submit a pull request
License
MIT License - see LICENSE file for details.
Support
For issues and questions:
GitHub Issues: https://github.com/katkoder/katcoder-mysql-mcp/issues
Documentation: https://github.com/katkoder/katcoder-mysql-mcp/wiki
Changelog
v1.0.1 (Latest)
New Feature: Added Bulk Insert Tool for efficient multi-record insertion
Implemented
bulk_inserttool for batch data importsSupports inserting multiple records in a single database operation
Includes comprehensive validation and error handling
Can be used within transactions for atomic operations
Added detailed documentation with examples and usage scenarios
v1.0.0
Initial release
All database operations implemented
Comprehensive security features
Full documentation