MySQL (security-first) MCP Server

A security-first MySQL MCP server. Every SQL statement must survive a full AST parse by an industrial-grade SQL parser (TiDB parser) before it can touch your database - backed by a read-only transaction fallback and a driver-level multi-statement lockout. Three independent layers of defense-in-depth: let AI query your database, without letting it walk off with your database. Its 8 documented tools cluster into mysql, read & search.

People who work with mysql and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in HTML.

VERIFIED ACTIVE

LAST COMMIT 2026-09-15 · ★ 2 · #150 OF 168 MAINTAINED DATABASE · VERIFIED 2026-09-18

Apache-2.0 · HTML · how we verify → /methodology

01 · Install MySQL (security-first)

before you install - you'll need

Set MYSQL_MCP_PASSWORD before connecting.

Docker

docker run -i --rm ghcr.io/kurok1/mcp-server-mysql:2.1.0

Claude Desktop - add to config

{
  "mcpServers": {
    "kurok1-mcp-server-mysql": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/kurok1/mcp-server-mysql:2.1.0"
      ]
    }
  }
}

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as container (OCI image) - can be sandboxed away from your filesystem

license Apache-2.0 - declared in the repository

registry namespace io.github.Kurok1 is GitHub-verified and matches the repo owner

03 · What MySQL (security-first) can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can run one read-only statement (SELECT / SHOW / DESCRIBE / EXPLAIN), run one write statement (INSERT / UPDATE / DELETE / DDL - each type must be enabled in config), and list the base tables visible through the whitelist.

Capability map

Tools grouped from the project's README - what MySQL (security-first) lets an agent do.

Mysql

7 tools - e.g. Run one read-only statement (SELECT / SHOW / DESCRIBE / EXPLAIN); Run one write statement (INSERT / UPDATE / DELETE / DDL - each type must be enabled in config); returns affected rows; Run a ;-separated…

mysql_query · mysql_execute · mysql_script · mysql_explain · mysql_list_tables · mysql_describe_table…

read & search

1 tool - e.g. No arguments; return names and descriptions sorted by name as text and structured {profiles: [{name, description}]}; no connection probe or credentials

list_profile

Latest releases

v2.1.0 · 2026-09-15

add isolated MySQL connection profiles

v2.0.1 · 2026-09-15

make MCP resources configurable

v2.0.0 · 2026-08-20

add interactive MCP query results app

04 · Who maintains MySQL (security-first)

MySQL (security-first) is maintained by kurok1. It's the only MCP server we track from this author; the repo dates to Jul 2026.

05 · Facts

repository: github.com/kurok1/mcp-server-mysql
website: https://github.com/Kurok1/mcp-server-mysql
category: database - ranked #150 of 168 actively-maintained database servers as of 2026-09-18.
release cadence: 10+ releases in the last 90 days (latest 2026-09-15)
registry: io.github.Kurok1/mcp-server-mysql (active, first published 2026-07-10 · 5 versions)
packages: oci:ghcr.io/kurok1/mcp-server-mysql:2.1.0

06 · MySQL (security-first) FAQ

Is MySQL (security-first) still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-15 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can MySQL (security-first) do?

How do I install MySQL (security-first)?

Run `docker run -i --rm ghcr.io/kurok1/mcp-server-mysql:2.1.0`. The README documents one environment variable (MYSQL_MCP_PASSWORD) to set first. Set MYSQL_MCP_PASSWORD before connecting. You can also paste the ready-made client config above.

07 · Alternatives to MySQL (security-first)

Alternatives to MySQL (security-first)

Maintained database servers if MySQL (security-first) isn't the fit.

Pairs well with

Servers that cover what MySQL (security-first) doesn't - only shown when the pairing reason fits the companion.

More database MCP servers · Run402 · Share HTML · Light Ship · Lintbase MCP