SQL Server MCP Service

A secure and robust Model Context Protocol (MCP) service for executing SQL Server queries via MCP protocol. This service provides a safe way to interact with SQL Server databases while preventing destructive operations and SQL injection attacks.

🚀 Features

• 🔒 Secure Query Execution: Built-in protection against SQL injection and destructive operations

• 📊 Schema Discovery: Get table, function, and procedure schemas and database information

• 🛠️ Multiple Tools: 9 specialized tools for different database operations

• ⚡ High Performance: Connection pooling for efficient database operations

• 🔧 TypeScript Support: Full TypeScript implementation with type safety

• 🧪 Comprehensive Testing: Jest-based test suite for reliability

Related MCP server: MSSQL MCP Server

🛠️ Available Tools

1. execute_query

Executes safe SQL queries with parameter support.

Parameters:

• query (string, required): The SQL query to execute

• parameters (object, optional): Query parameters for prepared statements

Example:

2. get_table_schema

Retrieves detailed column information for a specific table.

Parameters:

• tableName (string, required): Name of the table

• schemaName (string, optional): Schema name (default: "dbo")

Example:

3. list_tables

Lists all tables in the database with optional schema filtering.

Parameters:

• schemaName (string, optional): Filter tables by specific schema

Example:

4. get_database_info

Retrieves general database information (name, version, edition, etc.).

Parameters: None

5. list_procedures

Lists all stored procedures in the database, optionally filtered by schema.

Parameters:

• schemaName (string, optional): Filter procedures by schema

Example:

6. list_functions

Lists all functions (scalar and table-valued) in the database, optionally filtered by schema and function type.

Parameters:

• schemaName (string, optional): Filter functions by schema

• functionType (string, optional): 'SCALAR' or 'TABLE'

Example:

7. get_procedure_schema

Gets the schema and parameters of a specific stored procedure.

Parameters:

• procedureName (string, required): Name of the procedure

• schemaName (string, optional): Schema name (default: "dbo")

Example:

8. get_function_schema

Gets the schema and parameters of a specific function.

Parameters:

• functionName (string, required): Name of the function

• schemaName (string, optional): Schema name (default: "dbo")

Example:

9. execute_procedure

Executes a stored procedure with parameters.

Parameters:

• procedureName (string, required): Name of the procedure

• parameters (object, optional): Procedure parameters

• schemaName (string, optional): Schema name (default: "dbo")

Example:

📦 Installation

Prerequisites

• Node.js >= 20.0.0

• SQL Server instance

• pnpm (recommended)

Install Dependencies

⚙️ Configuration

1. Copy Environment Template

2. Configure Environment Variables

Example .env:

🚀 Usage

Start HTTP Server (Recommended)

Build for Production

Running Tests

🖥️ Desktop App Integration

To integrate this server with a desktop app, add the following to your app's server configuration:

Using Node.js directly:

Using npx:

Note: Replace {ABSOLUTE PATH TO FILE HERE} with the actual absolute path to your project's dist/cli.js file.

🤖 OpenAI Integration

To use this MCP server with OpenAI's API, you can integrate it using the MCP protocol. Here's an example:

Note: Make sure your HTTP server is running on the specified port before making requests to OpenAI.

🔒 Security Features

Query Validation

The service automatically blocks potentially destructive operations:

• ❌ DROP TABLE

• ❌ DELETE FROM

• ❌ TRUNCATE TABLE

• ❌ INSERT INTO

• ❌ UPDATE

• ❌ CREATE TABLE

• ❌ ALTER TABLE

• ❌ Stored procedures (sp_, xp_)

• ❌ SQL injection patterns

• ❌ Comments (--, /* */)

Allowed Operations

• ✅ SELECT queries

• ✅ WITH clauses (CTEs)

• ✅ SHOW commands

• ✅ DESCRIBE commands

• ✅ EXPLAIN commands

• ✅ Safe EXEC/EXECUTE for procedures/functions

Parameter Sanitization

All query and procedure parameters are automatically sanitized to prevent injection attacks.

🧪 Testing

The project includes comprehensive tests for schema validation and core functionality:

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

👨‍💻 Author

Vinicius de Souza Santos

• Email: viniciuskt0@gmail.com

• GitHub: @vini-cius

🙏 Acknowledgments

• Model Context Protocol for the MCP specification

• mssql for SQL Server connectivity

• Zod for runtime type validation

⭐ If this project helps you, please give it a star!