mcp-server-mysql
A security-first MySQL MCP server that uses AST validation via the TiDB parser to enforce strict security boundaries. It supports independent connection profiles, statement-class gating (defaulting to read-only), a default-deny table whitelist, and built-in observability with structured audit logs. It prevents common injection attacks by rejecting statements that cannot be parsed or fall outside whitelisted operations.
Package and access
Local package with source-attributed installation metadata. Koskamo does not execute packages during review.
What you can do with it
- Query MySQL databases safely using AI agents
- Enforce read-only access with AST-based validation
- Manage multiple MySQL connection profiles
- Audit SQL queries with structured JSONL logs
Source and maintenance
- Maintenance checked
Packages and installation
Source-provided package data. Koskamo has not executed or live-probed this package.
ghcr.io/kurok1/mcp-server-mysql:2.1.0
{
"transport": "stdio",
"identifier": "ghcr.io/kurok1/mcp-server-mysql:2.1.0",
"runtimeHint": "docker",
"registryType": "oci",
"packageArguments": [
{
"name": "--config",
"type": "named",
"value": "/data/config.yaml"
}
],
"runtimeArguments": [
{
"name": "-v",
"type": "named",
"value": "{config_dir}:/data",
"variables": {
"config_dir": {
"format": "filepath",
"default": "~/.mcp-server-mysql",
"isRequired": true,
"description": "Host directory containing config.yaml (see config.example.yaml in the repository)"
}
},
"isRequired": true
}
],
"environmentVariables": [
{
"name": "MYSQL_MCP_PASSWORD",
"format": "string",
"description": "MySQL password, referenced from config.yaml as ${MYSQL_MCP_PASSWORD}"
}
]
}Tools
Reported by the attributed source; not independently observed by Koskamo.
Connect from your client
Each snippet configures the same source-provided package; replace placeholders before use.
Cursor
{
"mcpServers": {
"mcp-server-mysql": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"MYSQL_MCP_PASSWORD=<YOUR_MYSQL_MCP_PASSWORD>",
"ghcr.io/kurok1/mcp-server-mysql:2.1.0",
"--config=/data/config.yaml"
],
"env": {
"MYSQL_MCP_PASSWORD": "<YOUR_MYSQL_MCP_PASSWORD>"
}
}
}
}Cline
{
"mcpServers": {
"mcp-server-mysql": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"MYSQL_MCP_PASSWORD=<YOUR_MYSQL_MCP_PASSWORD>",
"ghcr.io/kurok1/mcp-server-mysql:2.1.0",
"--config=/data/config.yaml"
],
"env": {
"MYSQL_MCP_PASSWORD": "<YOUR_MYSQL_MCP_PASSWORD>"
}
}
}
}VS Code
{
"servers": {
"mcp-server-mysql": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"MYSQL_MCP_PASSWORD=<YOUR_MYSQL_MCP_PASSWORD>",
"ghcr.io/kurok1/mcp-server-mysql:2.1.0",
"--config=/data/config.yaml"
],
"env": {
"MYSQL_MCP_PASSWORD": "<YOUR_MYSQL_MCP_PASSWORD>"
}
}
}
}Claude Desktop
{
"mcpServers": {
"mcp-server-mysql": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"MYSQL_MCP_PASSWORD=<YOUR_MYSQL_MCP_PASSWORD>",
"ghcr.io/kurok1/mcp-server-mysql:2.1.0",
"--config=/data/config.yaml"
],
"env": {
"MYSQL_MCP_PASSWORD": "<YOUR_MYSQL_MCP_PASSWORD>"
}
}
}
}Let your agent find its tools
Find servers like mcp-server-mysql from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.