Koskamo

GoSQLX MCP

An MCP server providing 7 SQL tools for parsing, formatting, transpiling, validating, linting, analyzing, and detecting injection vulnerabilities across 8 SQL dialects.

Visit GoSQLX

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

GoSQLX MCP logo, by GoSQLXCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by GoSQLX
MCP endpoint (Streamable HTTP)
https://mcp.gosqlx.dev/mcp
Vendor documentation

What you can do with it

  • Parse SQL into an AST
  • Format and transpile SQL between dialects
  • Validate and lint SQL queries
  • Detect SQL injection vulnerabilities

Source and maintenance

Community listingRegistry 1.17.0
mcp-registry: io.github.ajitpratap0/gosqlx@1.17.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
gosqlx-mcp 1.17.0
MCP protocol
2025-06-18
Tools
7 advertised
Resources
1 advertised
Resource templates
0 advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {},
  "resources": {}
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

GoSQLX parses, validates, formats, lints, and security-scans SQL locally. All tools are read-only, deterministic, and never connect to a database or execute SQL. Pick the narrowest tool for the request: - analyze_sql: one-shot review of a query (validity, statement types, tables/columns/functions, security findings, lint violations, formatted SQL). Prefer it when the user asks to "review", "check", or "analyze" SQL; hosts that support MCP Apps render it as an interactive report. - validate_sql: is the SQL syntactically valid, optionally for a specific dialect (postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, clickhouse). - format_sql: pretty-print SQL, one clause per line. Options: uppercase_keywords=true upper-cases all keywords, but not data type names (default false: clause keywords upper-case, other keywords such as like may keep their input case); indent_size=0 puts each statement on one line, larger values only indent nested blocks such as CREATE TABLE columns; add_semicolon appends ";". - parse_sql: statement count and AST statement types. - extract_metadata: tables, columns, and functions referenced. - security_scan: SQL-injection pattern detection (tautologies, UNION-based, stacked queries, comment bypass, ...), with severities. - lint_sql: style rules L001-L010 (whitespace, indentation, line length, alignment, keyword case, comma placement, aliasing). Pass the SQL text exactly as the user wrote it. Results are JSON; summarise them for the user rather than repeating them verbatim.

Tools

7 advertised

analyze_sql
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants a complete review of a SQL query. Runs validate, parse, metadata, security, lint, and format concurrently and returns one composite report; hosts that support MCP Apps render it as an interactive report.

analyze_sql input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to analyze"
    }
  }
}
analyze_sql annotations
{
  "title": "Analyze SQL",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
extract_metadata
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants the tables, columns, and functions a SQL query references (e.g. for lineage or impact analysis). Returns {tables, columns, functions}.

extract_metadata input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to analyze"
    }
  }
}
extract_metadata annotations
{
  "title": "Extract SQL metadata",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
format_sql
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants SQL pretty-printed or reformatted: one clause per line, optional upper-case keywords and trailing semicolon. Comments are preserved; unplaceable optimizer hints are refused. Returns {formatted_sql, options}.

format_sql input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to format"
    },
    "indent_size": {
      "type": "number",
      "description": "Spaces per indent level for nested blocks such as CREATE TABLE columns; clauses always start at column 0. 0 puts each statement on one line (default: 2)"
    },
    "add_semicolon": {
      "type": "boolean",
      "description": "Append a trailing semicolon (default: false)"
    },
    "uppercase_keywords": {
      "type": "boolean",
      "description": "true upper-cases all SQL keywords (AND, IN, CASE, ...), but not data type names. false keeps the formatter's casing: clause keywords (SELECT, FROM, WHERE, ...) upper-case, other keywords (e.g. like) may keep their input case (default: false)"
    }
  }
}
format_sql annotations
{
  "title": "Format SQL",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
lint_sql
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants SQL style feedback. Applies the same 10 rules as `gosqlx lint`: L001 trailing whitespace, L002 mixed indentation, L003 consecutive blank lines, L004 indentation depth, L005 line length (>100), L006 column alignment, L007 keyword case (upper), L008 comma placement (trailing), L009 aliasing consistency, L010 redundant whitespace. Returns {violation_count, violations}.

lint_sql input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to lint"
    }
  }
}
lint_sql annotations
{
  "title": "Lint SQL",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
parse_sql
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants to know how SQL parses: returns an AST summary with the statement count and the type of each statement, optionally for a specific dialect. GO batch separators are excluded from the count.

parse_sql input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to parse"
    },
    "dialect": {
      "enum": [
        "generic",
        "postgresql",
        "mysql",
        "mariadb",
        "sqlserver",
        "oracle",
        "sqlite",
        "snowflake",
        "bigquery",
        "redshift",
        "clickhouse"
      ],
      "type": "string",
      "description": "SQL dialect: generic, postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, bigquery, redshift, clickhouse"
    }
  }
}
parse_sql annotations
{
  "title": "Parse SQL",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
security_scan
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants SQL checked for injection patterns: tautologies, UNION attacks, stacked queries, comment bypasses, and more. Returns findings with severity counts.

security_scan input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to scan"
    }
  }
}
security_scan annotations
{
  "title": "Scan SQL for injection",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
validate_sql
Advertised by the server during the last successful anonymous check.
Advertised read-only

Use this when the user wants to know whether a SQL statement is syntactically valid, optionally for a specific dialect. Returns {valid: bool, error?: string, dialect?: string}.

validate_sql input schema
{
  "type": "object",
  "required": [
    "sql"
  ],
  "properties": {
    "sql": {
      "type": "string",
      "description": "The SQL string to validate"
    },
    "dialect": {
      "enum": [
        "generic",
        "postgresql",
        "mysql",
        "mariadb",
        "sqlserver",
        "oracle",
        "sqlite",
        "snowflake",
        "bigquery",
        "redshift",
        "clickhouse"
      ],
      "type": "string",
      "description": "SQL dialect: generic, postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, bigquery, redshift, clickhouse"
    }
  }
}
validate_sql annotations
{
  "title": "Validate SQL",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

1 advertised

gosqlx_analysis_report

Advertised by the server during the last successful anonymous check.

Interactive GoSQLX analysis report: validity, statement types, referenced tables/columns/functions, security findings by severity, lint violations, and the formatted SQL with a copy button.

gosqlx_analysis_report URI
ui://gosqlx/analysis-v1.html

MIME type: text/html;profile=mcp-app

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
680 ms
95th percentile latency
680 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 680 ms · metadata changed · 7 tool(s), 1 resource(s), 0 resource template(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http gosqlx-mcp https://mcp.gosqlx.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add gosqlx-mcp --url https://mcp.gosqlx.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable gosqlx-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "gosqlx-mcp": {
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "gosqlx-mcp": {
      "type": "streamableHttp",
      "url": "https://mcp.gosqlx.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start gosqlx-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "gosqlx-mcp": {
      "type": "http",
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http gosqlx-mcp https://mcp.gosqlx.dev/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "gosqlx-mcp": {
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "gosqlx-mcp": {
      "serverUrl": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like GoSQLX MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 6,829