mysql-mcp

MCP server for MySQL and MariaDB: schema inspection, SELECT, and separate confirmation-gated write/DDL/transaction tools.

Works over the MySQL wire protocol (MySQL 5.7+/8+ and MariaDB). For Aurora IAM or RDS Data API, use AWS Labs’ MySQL MCP instead.

Secrets belong in agent mcp.json env (mcpServers.*.env) — not project .env. Do not create a project .env for runtime credentials.

Tools

Tool	Notes
list_databases / list_tables / describe_table / show_create_table	Schema inspect
list_indexes / list_foreign_keys / list_routines / list_triggers / list_events	Schema inspect
read_query	SELECT only; locks/INTO @var need confirmed
write_query	INSERT/UPDATE/DELETE/REPLACE/TRUNCATE — strong confirm
schema_query	CREATE/ALTER/DROP/RENAME — strong confirm
transaction_query	Multi-statement txn — per-stmt preview + strong confirm
explain_query	EXPLAIN

Writes are separate tools from reads. Agents must not use read_query for DML/DDL.

Strong confirmation

MCP has no native UI modal. Mutating tools return an impact preview and do not execute until called again with the same sql and confirmed: true.

Client operators should require approval on write_query, schema_query, and transaction_query (destructiveHint / non-readOnly).

Auth / env

Variable	Required	Purpose
MYSQL_URL	no*	mysql://user:pass@host:3306/db
MYSQL_HOST / MYSQL_PORT / MYSQL_USER / MYSQL_PASSWORD / MYSQL_DATABASE	*	Discrete connection
MYSQL_SSL (+ CA/CERT/KEY)	no	TLS
MYSQL_QUERY_TIMEOUT_MS / MYSQL_MAX_ROWS	no	Caps

Privilege scope: prefer least privilege. Use a write-capable role only when write tools are needed.

mcp.json example

{
  "mcpServers": {
    "mysql": {
      "command": "node",
      "args": ["/Volumes/ADATA/Projects/mcp-mysql/dist/index.js"],
      "env": {
        "MYSQL_HOST": "127.0.0.1",
        "MYSQL_USER": "mcp_rw",
        "MYSQL_PASSWORD": "your-password",
        "MYSQL_DATABASE": "your_database"
      }
    }
  }
}

Develop

npm test && npm run build
# Smoke (pass env inline — never create a repo .env):
# MYSQL_HOST=… MYSQL_USER=… MYSQL_PASSWORD=… MYSQL_DATABASE=… npm run test:connections

Risks

• Row content is untrusted (prompt injection)
• Confirmed writes are permanent without DB-level undo
• Shared bot identity; transaction_query has large blast radius after confirm