haymon-ai/database

A single-binary MCP server for SQL databases. Connect your AI assistant to MySQL/MariaDB, PostgreSQL, or SQLite with zero runtime dependencies.
**Website** · **Documentation** · **Releases**
Features ✨
- **Multi-database** — MySQL/MariaDB, PostgreSQL, and SQLite from one binary
- **MCP tools** — schema discovery (listDatabases, listTables, listViews, listTriggers, listFunctions, listProcedures, listMaterializedViews), data access (readQuery, writeQuery), DDL (createDatabase, dropDatabase, dropTable), and explainQuery. Read-only mode hides the write tools (writeQuery, createDatabase, dropDatabase, dropTable). See MCP Tools for per-backend availability.
- **Single binary** — ~7 MB, no Python/Node/Docker needed
- **Multiple transports** — stdio (for Claude Desktop, Cursor) and HTTP (for remote/multi-client)
- **Two-layer config** — CLI flags > environment variables, with sensible defaults per backend
Install 📦
**macOS, Linux, WSL**:
**Windows PowerShell**:
**Windows CMD**:
See the installation docs for Docker, Cargo, and other methods.
Quick Start 🚀
Using .mcp.json (recommended)
Add a .mcp.json file to your project root. MCP clients read this file and configure the server automatically.
**Stdio transport** — the client starts and manages the server process:
**HTTP transport** — you start the server yourself, the client connects to it:
> **Note:** The "type": "http" field is required for HTTP transport. Without it, clients like Claude Code will reject the config.
To require a bearer token, start the server with HTTP_AUTH_TOKEN and send it from the client:
Using CLI flags
> **Warning:** Binding a non-loopback address (e.g. --host 0.0.0.0) exposes the database to anyone who can reach the port. dbmcp refuses to start in that case unless HTTP_AUTH_TOKEN is set. The Host/Origin allowlists protect against browser DNS rebinding only — they are **not** authentication.
Using environment variables
Configuration ⚙️
Configuration is loaded with clear precedence:
**CLI flags > environment variables > defaults**
Environment variables are typically set by your MCP client (via env or envFile in the server config).
Subcommands
| Subcommand | Description |
|------------|-------------|
| stdio | Run in stdio mode |
| http | Run in HTTP/SSE mode |
| version | Print version information and exit |
A subcommand is required — running dbmcp with no subcommand prints usage help and exits with a non-zero status.
Database Options (shared across subcommands)
| Flag | Env Variable | Default | Description |
|------|-------------|---------|-------------|
| --db-backend | DB_BACKEND | *(required)* | mysql, mariadb, postgres, or sqlite |
| --db-host | DB_HOST | localhost | Database host |
| --db-port | DB_PORT | backend default | 3306 (MySQL/MariaDB), 5432 (PostgreSQL) |
| --db-user | DB_USER | backend default | root (MySQL/MariaDB), postgres (PostgreSQL) |
| --db-password | DB_PASSWORD | *(empty)* | Database password |
| --db-name | DB_NAME | *(empty)* | Database name or SQLite file path |
| --db-charset | DB_CHARSET | | Character set (MySQL/MariaDB only) |
SSL/TLS Options
| Flag | Env Variable | Default | Description |
|------|-------------|---------|-------------|
| --db-ssl | DB_SSL | false | Enable SSL |
| --db-ssl-ca | DB_SSL_CA | | CA certificate path |
| --db-ssl-cert | DB_SSL_CERT | | Client certificate path |
| --db-ssl-key | DB_SSL_KEY | | Client key path |
| --db-ssl-verify-cert | DB_SSL_VERIFY_CERT | true | Verify server certificate |
Server Options
| Flag | Env Variable | Default | Description |
|------|-------------|---------|-------------|
| --db-read-only | DB_READ_ONLY | true | Block write queries |
| --db-max-pool-size | DB_MAX_POOL_SIZE | 5 | Max connection pool size (min: 1) |
| --db-connection-timeout | DB_CONNECTION_TIMEOUT | *(unset)* | Connection timeout in seconds (min: 1) |
| --db-query-timeout | DB_QUERY_TIMEOUT | 30 | Query execution timeout in seconds |
| --db-page-size | DB_PAGE_SIZE | 100 | Max items per paginated tool response (range 1–500) |
Logging Options
| Flag | Env Variable | Default | Description |
|------|-------------|---------|-------------|
| --log-level | LOG_LEVEL | info | Log level (trace/debug/info/warn/error) |
HTTP-only Options (only available with http subcommand)