← Microsoft SQL Server MCP

Microsoft SQL Server MCP 2.3.6

npm · mssql-mcp · current release

14
Tools
3
Resources
0
Templates
0
Prompts

Observation

Observed 2026-08-17T09:02:25.986Z using mcpSecurity-inventory. Status: succeeded. Negotiated protocol: 2025-06-18.

Server capabilities
{
  "tools": {
    "listChanged": true
  },
  "resources": {
    "listChanged": true
  }
}

Tools 14

ToolCategoryAnnotationsRisk
mssql_connect_databaseConnects to MS SQL Server using environment variables (DB_SERVER, DB_DATABASE, DB_USER, DB_PASSWORD, DB_PORT, DB_ENCRYPT, DB_TRUST_SERVER_CERTIFICATE). No credentials accepted as parameters — all connection settings come from the server environment only. Idempotent: calling again reconnects.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Writes · ——
mssql_connection_statusReturns the current connection status, server address, database name, and connection pool metrics. Read-only. Safe to call at any time.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_describe_tableDeprecated alias for mssql_describe_table_columns.
Input schema
{
  "type": "object",
  "properties": {
    "tableName": {
      "type": "string",
      "minLength": 1
    },
    "schemaName": {
      "type": "string",
      "default": "dbo"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json"
    }
  },
  "required": [
    "tableName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_describe_table_columnsReturns column definitions for a table: name, data type, length, nullability, default, and ordinal position. Read-only. Uses parameterized queries to prevent injection.
Input schema
{
  "type": "object",
  "properties": {
    "tableName": {
      "type": "string",
      "minLength": 1,
      "description": "Table name"
    },
    "schemaName": {
      "type": "string",
      "default": "dbo",
      "description": "Schema name (default: dbo)"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable table"
    }
  },
  "required": [
    "tableName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_disconnect_databaseCloses the current database connection and releases the connection pool. Safe to call even if not connected. Idempotent.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Writes · ——
mssql_execute_procedureDeprecated alias for mssql_execute_stored_procedure.
Input schema
{
  "type": "object",
  "properties": {
    "procedureName": {
      "type": "string",
      "description": "Name of the stored procedure"
    },
    "schemaName": {
      "type": "string",
      "default": "dbo"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      }
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json"
    }
  },
  "required": [
    "procedureName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · ——
mssql_execute_queryDeprecated alias for mssql_run_sql_query. Use mssql_run_sql_query instead. ⚠️ This tool can read AND modify data.
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "description": "SQL query to execute"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      },
      "description": "Query parameters"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json"
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · ——
mssql_execute_stored_procedureExecutes a stored procedure by name. ⚠️ May modify data — use only when an action is intended. Schema and procedure names are validated as safe identifiers. Pass all value parameters via 'parameters'.
Input schema
{
  "type": "object",
  "properties": {
    "procedureName": {
      "type": "string",
      "minLength": 1,
      "description": "Stored procedure name"
    },
    "schemaName": {
      "type": "string",
      "default": "dbo",
      "description": "Schema name (default: dbo)"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      },
      "description": "Procedure input parameters (key-value pairs)"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable tables"
    }
  },
  "required": [
    "procedureName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · ——
mssql_get_schemaDeprecated alias for mssql_list_schema_objects. Use mssql_list_schema_objects instead.
Input schema
{
  "type": "object",
  "properties": {
    "objectType": {
      "type": "string",
      "enum": [
        "tables",
        "views",
        "procedures",
        "functions",
        "all"
      ],
      "default": "tables"
    },
    "schemaName": {
      "type": "string"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_get_table_dataDeprecated alias for mssql_read_table_rows. Use mssql_read_table_rows instead. ⚠️ whereClause must use @paramName placeholders for all values.
Input schema
{
  "type": "object",
  "properties": {
    "tableName": {
      "type": "string",
      "minLength": 1,
      "pattern": "^[a-zA-Z_][a-zA-Z0-9_$#@]{0,127}$"
    },
    "schemaName": {
      "type": "string",
      "pattern": "^[a-zA-Z_][a-zA-Z0-9_$#@]{0,127}$",
      "default": "dbo"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "default": 20
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "default": 0
    },
    "whereClause": {
      "type": "string"
    },
    "orderBy": {
      "type": "string"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      }
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json"
    }
  },
  "required": [
    "tableName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_list_databasesLists all databases visible on the connected SQL Server instance with state and recovery information. Read-only. Supports pagination.
Input schema
{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "default": 20,
      "description": "Max databases (default 20)"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "default": 0,
      "description": "Skip N databases"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable table"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_list_schema_objectsLists tables, views, stored procedures, or functions in the connected database. Read-only. Supports filtering by schema name and pagination. Example: objectType='tables', schemaName='dbo', limit=20
Input schema
{
  "type": "object",
  "properties": {
    "objectType": {
      "type": "string",
      "enum": [
        "tables",
        "views",
        "procedures",
        "functions",
        "all"
      ],
      "default": "tables",
      "description": "Type of objects to list (default: tables)"
    },
    "schemaName": {
      "type": "string",
      "description": "Filter to a specific schema (e.g. 'dbo')"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "default": 20,
      "description": "Max objects (default 20)"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "default": 0,
      "description": "Skip N objects"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable table"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_read_table_rowsReturns rows from a table with optional column projection, WHERE filtering, ORDER BY, and pagination. Read-only. Table and schema names are validated as safe identifiers. WHERE clause values MUST be passed via 'parameters' using @paramName placeholders. Pagination: limit (1-200, default 20) and offset. Example: tableName='Orders', schemaName='dbo', columns=['OrderId','Total'], limit=50
Input schema
{
  "type": "object",
  "properties": {
    "tableName": {
      "type": "string",
      "minLength": 1,
      "pattern": "^[a-zA-Z_][a-zA-Z0-9_$#@]{0,127}$",
      "description": "Table name"
    },
    "schemaName": {
      "type": "string",
      "pattern": "^[a-zA-Z_][a-zA-Z0-9_$#@]{0,127}$",
      "default": "dbo",
      "description": "Schema name (default: dbo)"
    },
    "columns": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^[a-zA-Z_][a-zA-Z0-9_$#@]{0,127}$"
      },
      "description": "Columns to return (default: all)"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "default": 20,
      "description": "Max rows (1-200)"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "default": 0,
      "description": "Rows to skip"
    },
    "whereClause": {
      "type": "string",
      "description": "WHERE predicate without WHERE keyword. Use @paramName for all values. Example: 'Status = @status AND Amount > @minAmount'"
    },
    "orderBy": {
      "type": "string",
      "description": "ORDER BY expression. Example: 'CreatedAt DESC, Id ASC'"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      },
      "description": "Values for WHERE clause @paramName placeholders"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable table"
    }
  },
  "required": [
    "tableName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · ——
mssql_run_sql_queryExecutes an arbitrary SQL statement against the connected database. ⚠️ WARNING: This tool can read AND modify data (INSERT, UPDATE, DELETE, DDL). Always prefer parameterized inputs via the 'parameters' field — never embed user-supplied values directly in the query string. Example: query='SELECT * FROM dbo.Users WHERE Id = @id', parameters={id: 42}
Input schema
{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "minLength": 1,
      "description": "SQL statement to execute"
    },
    "parameters": {
      "type": "object",
      "additionalProperties": {
        "type": [
          "string",
          "number",
          "boolean",
          "null"
        ]
      },
      "description": "Named parameters referenced in the query via @paramName"
    },
    "response_format": {
      "type": "string",
      "enum": [
        "json",
        "markdown"
      ],
      "default": "json",
      "description": "Output format: 'json' for structured data, 'markdown' for human-readable table"
    }
  },
  "required": [
    "query"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · ——

Resources 3

Resource templates 0

Prompts 0

Let’s talk about MCP security.

Share your details and our security team will contact you.