MySQL MCP Server

What it does

MySQL MCP Server is a Python server that sits between an MCP client and a MySQL database you point it at with environment variables. It has three tools. One runs a single SQL statement and hands back the rows as comma-separated text, one describes the columns of a table or of the whole configured database, and one pulls a few sample rows. Tables are also served as MCP resources, and two prompts, explore_database and analyze_table, walk the client through a survey of the schema or of one table.

With MYSQL_DATABASE set it works inside that database. Leave it out and it lists every non-system database instead, and you write database.table names. It can reach a remote server through an SSH tunnel (the MYSQL_SSH_* settings) and supports SSL modes from DISABLED to VERIFY_IDENTITY. It speaks stdio by default, and MCP_TRANSPORT=sse starts an HTTP server.

The code of version 0.4.5 (server.py) is looser than the README suggests. execute_sql has no statement filter: the README names SELECT, SHOW, DESCRIBE and INSERT/UPDATE/DELETE, but DROP, ALTER or GRANT go through just the same, on a connection with autocommit on. What it can change depends only on the grants of the MySQL user you give it. The single-statement rule is a plain check for a semicolon anywhere but the end of the query, so a semicolon inside a string literal gets the query refused too. The code also reads MYSQL_SSL_CA for the VERIFY_CA and VERIFY_IDENTITY modes, a setting the README never lists.

What it needs

Install uv for the uvx command, or use pip install mysql-mcp-server. MYSQL_USER and MYSQL_PASSWORD go in the client's env block (the password may be an empty string). SSE mode needs the extra packages from pip install mysql-mcp-server[sse]. SSH tunnelling needs a jump host and a private key file.

Limits

• Not covered One statement per call: a semicolon anywhere but the end is refused, even inside a quoted string, so USE db; SELECT ... fails
• Size cap get_table_sample returns 5 rows by default and at most 20; reading a table resource returns its first 100 rows
• Size cap execute_sql has no row cap and fetches the whole result set
• Not covered Table names for the schema and sample tools may hold only letters, digits, the _ and $ signs, and one dot
• Not covered get_schema_info without a table name covers only the database in MYSQL_DATABASE, so it returns nothing in multi-database mode
• Limit A .env file is found only when the server starts in the project folder. Claude Desktop and Claude Code start it elsewhere, so put settings in the client config
• Limit SSE mode has no authentication of its own and listens on 0.0.0.0 unless MCP_SSE_HOST is set

Single statements only: multi-statement input such as USE db; SELECT ... is not supported. get_table_sample returns 5 rows by default and at most 20; reading a table resource returns its first 100 rows; execute_sql has no row cap and fetches the whole result. Table names passed to the schema and sample tools may contain only letters, digits, underscores, $ and one dot. A .env file is only found when the server runs from the project folder: Claude Desktop and Claude Code start it elsewhere, so settings must go in the client config. SSE mode has no authentication of its own and listens on 0.0.0.0 by default.

Who it suits

Suits developers who want an assistant to explore and query a MySQL database they control, locally or over SSH, and who can create a dedicated MySQL user with only the privileges they want it to have. Since execute_sql passes any statement through, anyone who wants the server itself to refuse writes should look at read-only-local-mysql-mcp-server, which we also list: it accepts only SELECT, WITH, SHOW, DESCRIBE and EXPLAIN and runs them in a read-only transaction. With this one, read-only access has to come from the MySQL user's grants.