Wie installiere ich Mysql?

Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.

Benötigt Mysql einen API-Schlüssel?

In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.

Welchen Transport verwendet Mysql?

Mysql läuft lokal über stdio.

Mysql MCP-Server | PlugMCP

brew install askdba/tap/mysql-mcp-server

brew update && brew upgrade mysql-mcp-server

docker pull ghcr.io/askdba/mysql-mcp-server:latest

git clone https://github.com/askdba/mysql-mcp-server.git
cd mysql-mcp-server
make build

brew install askdba/tap/mysql-mcp-server
mysql-mcp-server --version

git clone https://github.com/askdba/mysql-mcp-server.git
cd mysql-mcp-server
make build

./scripts/quickstart.sh

Variable	Required	Default	Description
MYSQL_DSN	Yes	–	MySQL DSN
MYSQL_MAX_ROWS	No	200	Max rows returned per query
MYSQL_QUERY_TIMEOUT_SECONDS	No	30	Query timeout (seconds); wins over `MYSQL_QUERY_TIMEOUT` when both are set
MYSQL_QUERY_TIMEOUT	No	–	Query timeout in milliseconds (e.g. `30000`); used only if `MYSQL_QUERY_TIMEOUT_SECONDS` is unset
MYSQL_POOL_SIZE	No	–	Alias for `MYSQL_MAX_OPEN_CONNS` (pool size); `MYSQL_MAX_OPEN_CONNS` overrides when both are set
MYSQL_MCP_EXTENDED	No	0	Enable extended tools (set to 1)
MYSQL_MCP_ENABLE_ADD_CONNECTION	No	0	Set `1` to expose the MCP tool `add_connection` (runtime DSN registration; see add_connection). Requires `MYSQL_MCP_EXTENDED=1`. Not available over the HTTP REST API.
MYSQL_MCP_JSON_LOGS	No	0	Enable JSON structured logging (set to 1)
MYSQL_MCP_TOKEN_TRACKING	No	0	Enable estimated token usage tracking (set to 1)
MYSQL_MCP_TOKEN_MODEL	No	cl100k_base	Tokenizer encoding to use for estimation
MYSQL_MCP_TOKEN_CARD	No	on when `MYSQL_MCP_HTTP` is set	`/status` live token dashboard + listing in `GET /api`; omit to use default on; set to 0 to disable
MYSQL_MCP_AUDIT_LOG	No	–	Path to audit log file
MYSQL_MCP_ALLOWED_DATABASES	No	–	Comma-separated schema allowlist (empty = all allowed). With an allowlist, `run_query` rejects `SHOW DATABASES` / `SHOW DATABASES LIKE`—use `list_databases`.
MYSQL_MCP_STRICT_READ_ONLY	No	0	Set `1` to enable `transaction_read_only=ON` on new connections
MYSQL_MCP_ALLOW_SYSTEM_SCHEMAS	No	0	Set `1` to allow read-only access to `information_schema`, `performance_schema`, and `sys` (for diagnostics: index cardinality, index usage, redundant/unused indexes). `mysql` stays blocked regardless.
MYSQL_MCP_PROCESS_ADMIN	No	0	Set `1` to enable `process_list` / `kill_query` (extended); `kill_query` issues `KILL QUERY` (cancels the running statement only, not the connection)
MYSQL_MCP_READ_AUDIT_TOOL	No	0	Set `1` to enable `read_audit_log` when audit path is set
MYSQL_MCP_SLOW_QUERY_TOOL	No	0	Set `1` to enable `slow_query_log` tool (extended)
MYSQL_MCP_VECTOR	No	0	Enable vector tools for MySQL 9.0+ (set to 1)
MYSQL_MCP_HTTP	No	0	Enable REST API mode (set to 1); mutually exclusive with stdio MCP
MYSQL_MCP_METRICS_HTTP	No	0	With stdio MCP only: expose `/status` + `/api/metrics/tokens` on `MYSQL_HTTP_PORT` (same process as Claude/Cursor)
MYSQL_HTTP_PORT	No	9306	Port for REST API, MCP HTTP transport, or metrics sidecar
MYSQL_MCP_TRANSPORT	No	stdio	MCP transport: `stdio` or `http` (MCP Streamable HTTP). `http` cannot be combined with `MYSQL_MCP_HTTP=1`
MYSQL_MCP_HTTP_BIND	No	127.0.0.1	Listen address (host or IP, no port; `[::1]` is accepted) for the MCP HTTP transport. Any non-loopback address requires a token and TLS
MYSQL_MCP_HTTP_PATH	No	/mcp	MCP endpoint path: a literal path without trailing `/` or wildcards, not `/health`, `/status` or `/api/metrics/tokens`
MYSQL_MCP_HTTP_TOKEN	No	–	Bearer token clients must send (`Authorization: Bearer …`). Required for non-loopback binds
MYSQL_MCP_HTTP_TOKEN_FILE	No	–	File containing the bearer token (keeps it out of the environment)
MYSQL_MCP_HTTP_TLS_CERT / MYSQL_MCP_HTTP_TLS_KEY	No	–	Serve HTTPS. Required for non-loopback binds
MYSQL_MCP_HTTP_ALLOW_INSECURE	No	0	Set `1` to allow a non-loopback bind without TLS when a reverse proxy terminates TLS in front. The token is still required
MYSQL_MCP_HTTP_STATELESS	No	0	Set `1` for stateless sessions (no `Mcp-Session-Id`); `use_connection` then only lasts one request
MYSQL_MCP_HTTP_SESSION_TIMEOUT_MINUTES	No	30	Close idle MCP HTTP sessions after this many minutes
MYSQL_MCP_HTTP_ALLOWED_ORIGINS	No	–	Comma-separated browser origins, each `scheme://host[:port]` with no path (e.g. `https://app.example.com`), allowed to call the endpoint: they get CORS headers and pass cross-origin protection. Other origins get no CORS headers, and their state-changing requests (`POST`, `DELETE`) to the MCP endpoint are rejected
MYSQL_MCP_HTTP_ALLOWED_HOSTS	No	–	Comma-separated public host names a reverse proxy on the same machine forwards to the loopback listener (e.g. `mcp.example.com`). Without it, such requests fail the DNS-rebinding check with 403. Setting it requires a token, because the proxy makes the server reachable from outside
MYSQL_HTTP_RATE_LIMIT	No	0	Enable rate limiting for HTTP mode (set to 1)
MYSQL_HTTP_RATE_LIMIT_RPS	No	100	Rate limit: requests per second
MYSQL_HTTP_RATE_LIMIT_BURST	No	200	Rate limit: burst size
MYSQL_MAX_OPEN_CONNS	No	10	Max open database connections (overrides `MYSQL_POOL_SIZE` when both are set)
MYSQL_MAX_IDLE_CONNS	No	5	Max idle database connections
MYSQL_CONN_MAX_LIFETIME_MINUTES	No	30	Connection max lifetime in minutes
MYSQL_CONN_MAX_IDLE_TIME_MINUTES	No	5	Max idle time before connection is closed
MYSQL_PING_TIMEOUT_SECONDS	No	5	Database ping/health check timeout
MYSQL_MCP_DB_RETRY_MAX	No	3	Retries for transient errors on `run_query` and `ping` (0 disables retries)
MYSQL_MCP_DB_RETRY_MAX_INTERVAL_MS	No	10000	Max exponential-backoff interval between retries (milliseconds)
MYSQL_HTTP_REQUEST_TIMEOUT_SECONDS	No	60	HTTP request timeout in REST API mode
MYSQL_SSL	No	–	Enable SSL/TLS for connections (true, false, skip-verify, preferred)

SSL Value	Description
`true`	Enable TLS with certificate verification
`false`	Disable TLS (default)
`skip-verify`	Enable TLS without certificate verification (self-signed certs)
`preferred`	Maps to `skip-verify` (Go MySQL driver limitation)

# Enable SSL for all connections
export MYSQL_SSL="true"

# Or per-connection SSL
export MYSQL_DSN_1_SSL="skip-verify"

connections:
  production:
    dsn: "user:pass@tcp(prod:3306)/db?parseTime=true"
    ssl: "true"

Variable	Description
`MYSQL_SSH_HOST`	Bastion hostname
`MYSQL_SSH_USER`	SSH username
`MYSQL_SSH_KEY_PATH`	Path to private key file (`~` expanded)
`MYSQL_SSH_PORT`	SSH port (default 22)
`MYSQL_SSH_KNOWN_HOSTS`	Path to OpenSSH `known_hosts` file (optional; default `~/.ssh/known_hosts` when verifying)
`MYSQL_SSH_HOST_KEY_FINGERPRINT`	Pin server key, e.g. `SHA256:...` or legacy `MD5:...` / `aa:bb:...` (optional; overrides file lookup for the callback)
`MYSQL_SSH_STRICT_HOST_KEY_CHECKING`	Default strict. Set to `false` / `0` / `no` / `off` to disable host key verification (insecure)

export MYSQL_SSH_HOST="bastion.example.com"
export MYSQL_SSH_USER="deploy"
export MYSQL_SSH_KEY_PATH="$HOME/.ssh/id_rsa"
export MYSQL_SSH_KNOWN_HOSTS="$HOME/.ssh/known_hosts"
# Optional: instead of a file, pin the bastion key (from ssh-keygen -lf):
# export MYSQL_SSH_HOST_KEY_FINGERPRINT="SHA256:...."
export MYSQL_DSN="user:pass@tcp(mysql.internal:3306)/mydb?parseTime=true"

connections:
  production:
    dsn: "user:pass@tcp(mysql.internal:3306)/mydb?parseTime=true"
    ssh:
      host: "bastion.example.com"
      user: "deploy"
      key_path: "~/.ssh/id_rsa"
      port: 22  # optional, default 22
      strict_host_key_checking: true   # default when omitted; false = insecure, opt-in only
      known_hosts: "~/.ssh/known_hosts"  # optional
      host_key_fingerprint: "SHA256:...."  # optional alternative to known_hosts

# Default connection
export MYSQL_DSN="user:pass@tcp(localhost:3306)/db1?parseTime=true"

# Additional connections
export MYSQL_DSN_1="user:pass@tcp(prod-server:3306)/production?parseTime=true"
export MYSQL_DSN_1_NAME="production"
export MYSQL_DSN_1_DESC="Production database"
export MYSQL_DSN_1_SSL="true"  # Enable SSL for this connection

export MYSQL_DSN_2="user:pass@tcp(staging:3306)/staging?parseTime=true"
export MYSQL_DSN_2_NAME="staging"
export MYSQL_DSN_2_DESC="Staging database"

export MYSQL_CONNECTIONS='[
  {"name": "production", "dsn": "user:pass@tcp(prod:3306)/db?parseTime=true", "description": "Production", "ssl": "true"},
  {"name": "staging", "dsn": "user:pass@tcp(staging:3306)/db?parseTime=true", "description": "Staging"}
]'

# Database connections
connections:
  default:
    dsn: "user:pass@tcp(localhost:3306)/mydb?parseTime=true"
    description: "Local development database"
  production:
    dsn: "readonly:pass@tcp(prod:3306)/prod?parseTime=true"
    description: "Production (read-only)"
    ssl: "true"  # Enable TLS with certificate verification

# Query settings
query:
  max_rows: 200
  timeout_seconds: 30

# Connection pool
pool:
  max_open_conns: 10
  max_idle_conns: 5
  conn_max_lifetime_minutes: 30

# Features
features:
  extended_tools: true
  vector_tools: false

# HTTP/REST API (optional)
http:
  enabled: false
  port: 9306

# Use specific config file
mysql-mcp-server --config /path/to/config.yaml

# Validate config file
mysql-mcp-server --validate-config /path/to/config.yaml

# Print current configuration as YAML
mysql-mcp-server --print-config

# Silent mode: suppress INFO/WARN logs (only errors to stderr)
mysql-mcp-server --silent --config /path/to/config.yaml

# Daemon mode: run HTTP server in background (Unix; use with MYSQL_MCP_HTTP=1)
MYSQL_MCP_HTTP=1 mysql-mcp-server --daemon --config /path/to/config.yaml

export MYSQL_DSN="root:password@tcp(127.0.0.1:3306)/mysql?parseTime=true"
export MYSQL_MAX_ROWS=200
export MYSQL_QUERY_TIMEOUT_SECONDS=30

make run

mysql-mcp-server --version

mysql-mcp-server <version>
  Build time: <build time>
  Git commit: <git sha>

~/Library/Application Support/Claude/claude_desktop_config.json

%APPDATA%\Claude\claude_desktop_config.json

~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mysql": {
      "command": "mysql-mcp-server",
      "env": {
        "MYSQL_DSN": "user:password@tcp(127.0.0.1:3306)/mydb?parseTime=true",
        "MYSQL_MAX_ROWS": "200",
        "MYSQL_MCP_EXTENDED": "1"
      }
    }
  }
}

"env": {
  "MYSQL_DSN": "user:password@tcp(127.0.0.1:3306)/mydb?parseTime=true",
  "MYSQL_MCP_TOKEN_TRACKING": "1",
  "MYSQL_MCP_METRICS_HTTP": "1",
  "MYSQL_HTTP_PORT": "9306"
}

~/.cursor/mcp.json

%APPDATA%\Cursor\mcp.json

~/.config/Cursor/mcp.json

{
  "mcpServers": {
    "mysql": {
      "command": "mysql-mcp-server",
      "env": {
        "MYSQL_DSN": "root:password@tcp(127.0.0.1:3306)/mydb?parseTime=true",
        "MYSQL_MAX_ROWS": "200",
        "MYSQL_MCP_EXTENDED": "1"
      }
    }
  }
}

"env": {
  "MYSQL_DSN": "root:password@tcp(127.0.0.1:3306)/mydb?parseTime=true",
  "MYSQL_MAX_ROWS": "200",
  "MYSQL_MCP_EXTENDED": "1",
  "MYSQL_MCP_TOKEN_TRACKING": "1",
  "MYSQL_MCP_METRICS_HTTP": "1",
  "MYSQL_HTTP_PORT": "9306"
}

{
  "mcpServers": {
    "mysql": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MYSQL_DSN=root:password@tcp(host.docker.internal:3306)/mydb?parseTime=true",
        "-e", "MYSQL_MCP_EXTENDED=1",
        "ghcr.io/askdba/mysql-mcp-server:latest"
      ]
    }
  }
}

claude mcp add --transport stdio \
  --env MYSQL_DSN="user:password@tcp(127.0.0.1:3306)/mydb?parseTime=true" \
  --env MYSQL_MCP_EXTENDED=1 \
  mysql -- mysql-mcp-server

export MYSQL_DSN="user:password@tcp(127.0.0.1:3306)/mydb?parseTime=true"
claude  # start Claude Code — MySQL tools will be available automatically

export MYSQL_DSN="user:password@tcp(127.0.0.1:3306)/mydb?parseTime=true"
export MYSQL_MCP_TRANSPORT=http          # MCP at http://127.0.0.1:9306/mcp
mysql-mcp-server

claude mcp add --transport http mysql http://127.0.0.1:9306/mcp

openssl rand -hex 32 > /etc/mysql-mcp/token && chmod 600 /etc/mysql-mcp/token
export MYSQL_MCP_TRANSPORT=http
export MYSQL_MCP_HTTP_BIND=0.0.0.0
export MYSQL_MCP_HTTP_TOKEN_FILE=/etc/mysql-mcp/token
export MYSQL_MCP_HTTP_TLS_CERT=/etc/mysql-mcp/cert.pem
export MYSQL_MCP_HTTP_TLS_KEY=/etc/mysql-mcp/key.pem
mysql-mcp-server --daemon   # optional: run in background (Unix)

claude mcp add --transport http mysql https://db-tools.example.com:9306/mcp \
  --header "Authorization: Bearer $(cat /etc/mysql-mcp/token)"

Refuses to start unsafely: a non-loopback bind without a token, or without TLS, is a startup error. --validate-config runs the same checks, with the same environment overrides. With --daemon, the TLS key pair and the listen address are checked before the process detaches, so a bad certificate or a busy port is reported instead of exiting silently.
Behind a reverse proxy (nginx, Caddy, …) that terminates TLS:
- If the proxy forwards to the loopback listener (default bind), list its public names in MYSQL_MCP_HTTP_ALLOWED_HOSTS. Otherwise the DNS-rebinding check rejects its Host header. A token is then required, as for any non-loopback bind.
- If it forwards to a non-loopback bind, also set MYSQL_MCP_HTTP_ALLOW_INSECURE=1; the token is still required.
Browser protections:
- On the MCP endpoint, cross-origin requests that can change state (POST, DELETE) are rejected unless the origin is listed in MYSQL_MCP_HTTP_ALLOWED_ORIGINS.
- Listed origins get CORS headers on the MCP endpoint, /health and /api/metrics/tokens, including answers to preflight requests, so browser-based clients work. (/status is a page to open directly, not to fetch cross-origin.) Other origins get no CORS headers anywhere on the port, so their pages cannot read the responses. /health and /api/metrics/tokens never send Access-Control-Allow-Origin: * here, unlike on the REST API.
- On localhost, requests on any route whose Host header is not a localhost name (or an allowed host) are rejected (DNS-rebinding protection).
Per-session connections: use_connection and add_connection switch the active connection for that MCP session only; other HTTP clients keep theirs. If a session's connection is removed, its tools fail with "connection '…' no longer exists" instead of silently running on another server. In stateless mode (MYSQL_MCP_HTTP_STATELESS=1) a switch lasts only for the request that made it. A session's choice also ends with the session (idle timeout or DELETE): a client that starts a new session is back on the default connection. So when the session can see more than one connection, every tool result names the connection it ran on, both as a final text line connection: <name> and in _meta["mysql-mcp-server/connection"]. Each tool call stays on one connection from start to finish, even if use_connection runs concurrently in the same session. Configured connection names cannot start with mcp-session/, which is reserved for these session connections.
add_connection over HTTP belongs to the session (MYSQL_MCP_ENABLE_ADD_CONNECTION=1; off by default):
- The new connection is visible only to the session that added it, in list_connections and use_connection. Other sessions cannot see or use it, or its credentials.
- Names are per session: two sessions can each add staging. A name that is already a configured, process-wide connection is refused.
- It is closed (pool and SSH tunnel) when the session ends: when the client sends DELETE with its Mcp-Session-Id, or after MYSQL_MCP_HTTP_SESSION_TIMEOUT_MINUTES without requests. A dropped connection or a crashed client does not end the session, so its connections stay open until the idle timeout. Lower the timeout if clients often go away without ending their session.
- Each session can register at most 5 connections, and all sessions together at most 20. Each of these connections has a pool of at most 2, so add_connection over HTTP can open at most 40 MySQL connections.
- It is refused in stateless mode, where the connection would close as soon as the request ends.
- It still lets any token holder make the server connect to any host the server can reach, so enable it for remote deployments only when every token holder is trusted.
Other endpoints on the same port: GET /health (no auth) and GET /api/metrics/tokens (same token). /status is served only when no token is configured, because a browser cannot send the bearer token.
MYSQL_HTTP_RATE_LIMIT applies to this transport too. Behind a reverse proxy on the same host, limits are per client only if the proxy sets or appends X-Forwarded-For (nginx: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;): the server uses the rightmost entry, the one the proxy adds. A proxy that passes the client's header through unchanged lets clients choose their own bucket. Request headers must arrive within 10s and bodies within 30s, so slow clients cannot hold connections open. Long tool calls and event streams are not affected. On SIGINT/SIGTERM, in-flight requests get 5s, then open event streams are closed, and a second later any connection still open (for example a client stalled mid-body) is closed, so shutdown takes about 6s at most.
It cannot run in the same process as the REST API (MYSQL_MCP_HTTP=1); run two processes if you need both.

transport: http
http:
  port: 9306
  mcp:
    bind: 0.0.0.0
    path: /mcp
    token_file: /etc/mysql-mcp/token   # the token itself is never stored in the config file
    tls_cert: /etc/mysql-mcp/cert.pem
    tls_key: /etc/mysql-mcp/key.pem
    session_timeout_minutes: 30
    # stateless: false
    # allowed_origins: ["https://app.example.com"]   # browser clients (CORS)
    # allowed_hosts: ["mcp.example.com"]             # reverse proxy forwarding to loopback
    # allow_insecure: false

{ "database": "employees" }

{ "database": "employees", "table": "salaries" }

{ "sql": "SELECT id, name FROM users LIMIT 5" }

{ "sql": "SELECT * FROM users LIMIT 5", "database": "myapp" }

{ "success": true, "latency_ms": 2, "message": "pong" }

{
  "version": "8.0.36",
  "version_comment": "MySQL Community Server - GPL",
  "uptime_seconds": 86400,
  "current_database": "myapp",
  "current_user": "mcp@localhost",
  "character_set": "utf8mb4",
  "collation": "utf8mb4_0900_ai_ci",
  "max_connections": 151,
  "threads_connected": 5
}

{
  "connections": [
    {"name": "production", "dsn": "user:****@tcp(prod:3306)/db", "active": true},
    {"name": "staging", "dsn": "user:****@tcp(staging:3306)/db", "active": false}
  ],
  "active": "production"
}

{ "name": "staging" }

{
  "success": true,
  "active": "staging",
  "message": "Switched to connection 'staging'",
  "database": "staging_db"
}

export MYSQL_MCP_EXTENDED=1
export MYSQL_MCP_ENABLE_ADD_CONNECTION=1

{
  "name": "analytics",
  "dsn": "appuser:secret@tcp(db.example.com:3306)/warehouse?parseTime=true",
  "description": "Optional label"
}

Field	Required	Rules
`name`	Yes	Non-empty; must not match an existing connection name (atomic check in `ConnectionManager`).
`dsn`	Yes	Non-empty; must parse as a valid MySQL DSN. `root` as the MySQL user is rejected at registration time.
`description`	No	Stored with the connection metadata.

{
  "success": true,
  "active": "analytics",
  "message": "Added and switched to connection 'analytics'"
}

export MYSQL_MCP_VECTOR=1

{
  "database": "myapp",
  "table": "embeddings",
  "column": "embedding",
  "query": [0.1, 0.2, 0.3, ...],
  "limit": 10,
  "select": "id, title, content",
  "distance_func": "cosine"
}

{
  "results": [
    {"distance": 0.123, "data": {"id": 1, "title": "Doc 1", "content": "..."}},
    {"distance": 0.456, "data": {"id": 2, "title": "Doc 2", "content": "..."}}
  ],
  "count": 2
}

{ "database": "myapp" }

{
  "columns": [
    {"table": "embeddings", "column": "embedding", "dimensions": 768, "index_name": "vec_idx"}
  ],
  "vector_support": true,
  "mysql_version": "9.0.0"
}

export MYSQL_MCP_EXTENDED=1

{ "database": "myapp", "table": "users" }

{ "database": "myapp", "table": "users" }

{ "sql": "SELECT * FROM users WHERE id = 1", "database": "myapp" }

{ "database": "myapp" }

{ "database": "myapp" }

{ "database": "myapp" }

{ "database": "myapp" }

{ "database": "myapp", "table": "events" }

{ "database": "myapp" }

{}

{ "database": "myapp" }

{ "database": "myapp", "table": "orders" }

{ "pattern": "Threads%" }

{ "pattern": "%buffer%" }

CREATE USER 'mcp'@'localhost' IDENTIFIED BY 'strongpass';
GRANT SELECT ON *.* TO 'mcp'@'localhost';

export MYSQL_MCP_JSON_LOGS=1

{"timestamp":"2025-01-15T10:30:00.123Z","level":"INFO","message":"query executed","fields":{"tool":"run_query","duration_ms":15,"row_count":42}}

export MYSQL_MCP_AUDIT_LOG=/var/log/mysql-mcp-audit.jsonl

export MYSQL_MCP_TOKEN_TRACKING=1
export MYSQL_MCP_TOKEN_MODEL=cl100k_base  # default, used by GPT-4/Claude

logging:
  token_tracking: true
  token_model: "cl100k_base"

{
  "level": "INFO",
  "msg": "query executed",
  "tool": "run_query",
  "duration_ms": 45,
  "row_count": 10,
  "tokens": {
    "input_estimated": 25,
    "output_estimated": 150,
    "total_estimated": 175,
    "model": "cl100k_base"
  }
}

export MYSQL_MAX_OPEN_CONNS=20      # Max open connections (or use MYSQL_POOL_SIZE as an alias)
export MYSQL_MAX_IDLE_CONNS=10      # Max idle connections
export MYSQL_CONN_MAX_LIFETIME_MINUTES=60  # Connection lifetime
export MYSQL_QUERY_TIMEOUT=30000    # Optional: timeout in ms (30 s) if you do not use MYSQL_QUERY_TIMEOUT_SECONDS

Variable	Purpose
`MYSQL_MCP_ALLOWED_DATABASES`	Comma-separated schema allowlist. When set, tools that take a `database` argument must use an allowed name; `list_databases` / `database_size` only expose allowed schemas; `run_query` requires `database` and cannot be used to hop schemas via omission. `run_query` rejects `SHOW DATABASES` and `SHOW DATABASES LIKE` (use `list_databases`). Qualified names in SQL, `EXPLAIN` (including `FORMAT=` / `EXTENDED`), and inner DML in `EXPLAIN` are checked against the allowlist. `slow_query_log` (table mode) only returns `mysql.slow_log` rows whose `db` column matches an allowed schema (case-insensitive); rows with null/empty `db` are omitted.
`MYSQL_MCP_STRICT_READ_ONLY`	When `1`, new driver connections run with `transaction_read_only=ON` (harder to accidentally issue writes if grants allow them).
`MYSQL_MCP_ALLOW_SYSTEM_SCHEMAS`	When `1`, lifts the default block on the read-only diagnostic schemas `information_schema`, `performance_schema`, and `sys` so `run_query` / `explain_query` may reference them (e.g. `information_schema.STATISTICS` for index cardinality, `sys.schema_redundant_indexes` / `sys.schema_unused_indexes`, `performance_schema.table_io_waits_summary_by_index_usage`). The `mysql` schema remains blocked unconditionally. Off by default; reads still require the connection's MySQL grants. This flag and `MYSQL_MCP_ALLOWED_DATABASES` are orthogonal and both enforced: the flag lifts the hardcoded system-schema guard, while the allowlist (when set) independently rejects any schema not on it. So if you run with an allowlist, you must also add `information_schema` / `performance_schema` / `sys` to `MYSQL_MCP_ALLOWED_DATABASES` for these queries to pass; with no allowlist (the default), the flag alone is sufficient. The flag never unlocks `mysql`.
`MYSQL_MCP_PROCESS_ADMIN`	Enables `process_list` and `kill_query` (issues `KILL QUERY`, not connection kill; plus HTTP `/api/processlist`, `/api/kill`). Requires appropriate MySQL privileges (`CONNECTION_ADMIN` / `PROCESS`, etc.).
`MYSQL_MCP_READ_AUDIT_TOOL`	Enables `read_audit_log` when `MYSQL_MCP_AUDIT_LOG` is set (tail of the audit JSON file).
`MYSQL_MCP_SLOW_QUERY_TOOL`	Enables `slow_query_log` (reads `mysql.slow_log` when `log_output` includes `TABLE`, otherwise returns file settings).

make test

make test-integration-80

make test-integration-84

make test-integration-90
make test-integration-97
make test-integration-2610

make smoke-http                            # MySQL 8.0
make smoke-http SMOKE_MYSQL_VERSION=26.10  # or scripts/smoke-mcp-http.sh 26.10
make smoke-http SMOKE_MYSQL_VERSION=mariadb:11.4

make test-integration-all

make test-integration-mariadb-11
make test-integration-mariadb-12

# Against MySQL 8.0
make test-sakila

# Against MySQL 8.4
make test-sakila-84

# Against MySQL 9.0
make test-sakila-90

make test-security

# Start MySQL 8.0 container
make test-mysql-up

# Start all MySQL and MariaDB versions
make test-mysql-all-up

# Stop all test containers
make test-mysql-down

# View container logs
make test-mysql-logs

# MySQL 8.0 (host port 13306 in docker-compose.test.yml — avoids local MySQL on 3306)
export MYSQL_TEST_DSN="mcpuser:mcppass00@tcp(127.0.0.1:13306)/testdb?parseTime=true"

# MySQL 8.4 (port 3307)
export MYSQL_TEST_DSN="mcpuser:mcppass00@tcp(127.0.0.1:3307)/testdb?parseTime=true"

# MySQL 9.0 (port 3308)
export MYSQL_TEST_DSN="mcpuser:mcppass00@tcp(127.0.0.1:3308)/testdb?parseTime=true"

# MySQL 9.7 (13309), MySQL 26.10 (13311), MariaDB 11.4 (3310), MariaDB 12.3 (13312)
export MYSQL_TEST_DSN="mcpuser:mcppass00@tcp(127.0.0.1:13309)/testdb?parseTime=true"

# Sakila tests read MYSQL_SAKILA_DSN (falls back to MYSQL_TEST_DSN)
export MYSQL_SAKILA_DSN="mcpuser:mcppass00@tcp(127.0.0.1:13309)/sakila?parseTime=true"

go test -v -tags=integration ./tests/integration/...

docker run -e MYSQL_DSN="user:password@tcp(host.docker.internal:3306)/mydb" \
  ghcr.io/askdba/mysql-mcp-server:latest

docker run \
  -e MYSQL_DSN="user:password@tcp(host.docker.internal:3306)/mydb" \
  -e MYSQL_MCP_EXTENDED=1 \
  ghcr.io/askdba/mysql-mcp-server:latest

docker run \
  -e MYSQL_DSN="user:password@tcp(host.docker.internal:3306)/mydb" \
  -e MYSQL_MCP_EXTENDED=1 \
  -e MYSQL_MCP_VECTOR=1 \
  -e MYSQL_MAX_ROWS=500 \
  -e MYSQL_QUERY_TIMEOUT_SECONDS=60 \
  ghcr.io/askdba/mysql-mcp-server:latest

{
  "mcpServers": {
    "mysql": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MYSQL_DSN=user:password@tcp(host.docker.internal:3306)/mydb",
        "ghcr.io/askdba/mysql-mcp-server:latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "mysql": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MYSQL_DSN=user:password@tcp(host.docker.internal:3306)/mydb",
        "-e", "MYSQL_MCP_EXTENDED=1",
        "ghcr.io/askdba/mysql-mcp-server:latest"
      ]
    }
  }
}

services:
  mysql:
    image: mysql:8.4
    environment:
      MYSQL_ROOT_PASSWORD: rootpass
      MYSQL_DATABASE: testdb
    ports:
      - "3306:3306"

  mcp:
    image: ghcr.io/askdba/mysql-mcp-server:latest
    depends_on:
      - mysql
    environment:
      MYSQL_DSN: "root:rootpass@tcp(mysql:3306)/testdb?parseTime=true"
      MYSQL_MCP_EXTENDED: "1"

docker compose up

docker build -t mysql-mcp-server .

export MYSQL_DSN="user:password@tcp(localhost:3306)/mydb"
export MYSQL_MCP_HTTP=1
export MYSQL_HTTP_PORT=9306  # Optional, defaults to 9306
mysql-mcp-server

export MYSQL_HTTP_RATE_LIMIT=1
export MYSQL_HTTP_RATE_LIMIT_RPS=100    # 100 requests/second
export MYSQL_HTTP_RATE_LIMIT_BURST=200  # Allow bursts up to 200

Method	Endpoint	Description
GET	`/health`	Health check
GET	`/api`	API index: registered endpoints + `modes` (see Discovery above)
GET	`/api/databases`	List databases
GET	`/api/tables?database=`	List tables
GET	`/api/describe?database=&table=`	Describe table
POST	`/api/query`	Run SQL query
GET	`/api/ping`	Ping database
GET	`/api/server-info`	Server info
GET	`/api/connections`	List connections (masked DSNs) known to this HTTP server process (config-loaded; no MCP `add_connection` in REST mode)
POST	`/api/connections/use`	Switch active connection: JSON body `{"name": "<connection_name>"}`. Invalid JSON or missing `name` → `400`. Unknown connection name → `200` with `success: false` in the JSON body (same semantics as MCP `use_connection`).

Method	Endpoint	Description
GET	`/api/indexes?database=&table=`	List indexes
GET	`/api/create-table?database=&table=`	Show CREATE TABLE
POST	`/api/explain`	Explain query
GET	`/api/views?database=`	List views
GET	`/api/triggers?database=`	List triggers
GET	`/api/procedures?database=`	List procedures
GET	`/api/functions?database=`	List functions
GET	`/api/partitions?database=&table=`	List table partitions
GET	`/api/size/database?database=`	Database size
GET	`/api/size/tables?database=`	Table sizes
GET	`/api/foreign-keys?database=`	Foreign keys
GET	`/api/status?pattern=`	Server status
GET	`/api/variables?pattern=`	Server variables
GET	`/api/audit-log?lines=`	Tail lines from the MCP audit log (JSON). Listed only when extended and `MYSQL_MCP_READ_AUDIT_TOOL=1` with `MYSQL_MCP_AUDIT_LOG` configured.
GET	`/api/slow-log?limit=`	Slow query log rows or file/table settings. Listed only when extended and `MYSQL_MCP_SLOW_QUERY_TOOL=1`.
GET	`/api/processlist`	Active MySQL threads (`SHOW FULL PROCESSLIST`). Listed only when extended and `MYSQL_MCP_PROCESS_ADMIN=1`. Requires MySQL `PROCESS` (or equivalent) to succeed.
POST	`/api/kill`	Cancel the current statement on a connection: JSON body `{"id": <positive integer>}` (same id as `/api/processlist`). Executes `KILL QUERY`—the client connection stays open. Listed only when extended and `MYSQL_MCP_PROCESS_ADMIN=1`. Requires privilege to run `KILL QUERY` for that thread (e.g. `CONNECTION_ADMIN` or `PROCESS` as applicable).

Method	Endpoint	Description
POST	`/api/vector/search`	Vector similarity search
GET	`/api/vector/info?database=`	Vector column info

Method	Endpoint	Description
GET	`/api/metrics/tokens`	Cumulative token usage, cost estimate, recent queries (always registered; zeros when tracking off)
GET	`/status`	Live HTML dashboard (auto-refresh); listed in `GET /api` when the feature is enabled

curl http://localhost:9306/api/databases

curl -X POST http://localhost:9306/api/query \
  -H "Content-Type: application/json" \
  -d '{"sql": "SELECT * FROM users LIMIT 5", "database": "myapp"}'

curl http://localhost:9306/api/server-info

curl http://localhost:9306/api/connections
curl -X POST http://localhost:9306/api/connections/use \
  -H "Content-Type: application/json" \
  -d '{"name": "staging"}'

{
  "success": true,
  "data": { ... }
}

{
  "success": false,
  "error": "error message"
}

docker run -p 9306:9306 \
  -e MYSQL_DSN="user:password@tcp(host.docker.internal:3306)/mydb" \
  -e MYSQL_MCP_HTTP=1 \
  -e MYSQL_MCP_EXTENDED=1 \
  ghcr.io/askdba/mysql-mcp-server:latest

cmd/mysql-mcp-server/
├── main.go             -> Server entrypoint and tool registration
├── types.go            -> Input/output struct types for tools
├── tools.go            -> Core MCP tool handlers
├── tools_extended.go   -> Extended MCP tool handlers
├── http.go             -> HTTP REST API handlers and server
├── connection.go       -> Multi-DSN connection manager
└── logging.go          -> Structured and audit logging

internal/
├── api/                -> HTTP middleware and response utilities
├── config/             -> Configuration loader from environment
├── mysql/              -> MySQL client wrapper + tests
└── util/               -> Shared utilities (SQL validation, identifiers)

examples/               -> Example configs and test data
scripts/                -> Quickstart and utility scripts
bin/                    -> Built binaries

mysql -u root -p < examples/test-dataset.sql

make fmt       # Format code
make lint      # Run linter
make test      # Run unit tests
make build     # Build binary
make release   # Build release binaries