SQL Querystore MCP server

mcp-name: io.github.deepeshd87/mcp-sql-querystore

mcp-sql-querystore

Read-only MCP server exposing SQL Server Query Store diagnostics to LLM agents.

Six read-only diagnostic tools over Query Store, DMVs, and execution plans. The tools have been validated against a live SQL Server instance and are covered by a unit + integration test suite. Still validate against a non-prod instance of your own before pointing it at production, especially on SQL Server versions other than those noted under caveats.

Quickstart

against your instance (edit names first). This login's permissions are the read-only guarantee — see the security model below.

1. Provision a read-only login. Run provisioning/createreadonlylogin.sql

SQL Server must be installed on the host.

1. Install. pip install -e . in a virtual environment. ODBC Driver 18 for

the repo can't reach (not under the project folder):

1. Store the password outside the repo. Put it in a plain-text file somewhere

# Windows PowerShell, UTF-8, password only, no quotes/newline New-Item -ItemType Directory -Force C:\Users\you\secrets | Out-Null Set-Content -NoNewline -Encoding utf8 C:\Users\you\secrets\mcp_sql.pwd 'your-password'

Or skip the password entirely with integrated auth (MCPSQLTRUSTED=yes) — preferred for CJIS/PCI. See Secret handling below for all options.

claudedesktopconfig.example.json into your real Claude Desktop config (Windows: %APPDATA%\Claude\claudedesktopconfig.json), then replace the placeholder paths, server name, and MCPSQLPWDFILE. Set MCPSQLTRUSTCERT=yes only for a self-signed/local cert; leave it no against instances with proper certificates.

1. Configure your MCP client. Copy the sql-querystore block from

1. Restart your MCP client and confirm the server shows as running.

Never commit your real config or your password file. .gitignore already excludes .pwd, .env, and claudedesktop_config.json.

Security model (read this first)

The read-only guarantee comes from the SQL login's permissions, not from any code in this repo:

only if you use server-scoped DMVs) and nothing else — no dbdatareader, no SELECT on user tables. See provisioning/createreadonly_login.sql.

• Provision a dedicated login with VIEW DATABASE STATE (and VIEW SERVER STATE

defense-in-depth, not the primary control.

• The keyword screen in db.py and the fixed SELECT-only query text are

secondary in an availability group. On a standalone instance it does not make the session read-only. Do not rely on it for safety.

• ApplicationIntent=ReadOnly in the connection string only routes to a readable

MCPSQLCONNECTIONSTRING env var, but for CJIS/PCI environments prefer integrated auth or a file/secret-store-sourced password — see the Secret handling** section below.

• Credentials never belong in code. The simplest setup uses the

a regulated environment, route that logger to a durable file or SIEM.

• Every query is recorded via the audit logger — see Audit logging below. In

Setup

ODBC Driver 18 for SQL Server must be installed on the host. Install the package, then configure the connection via environment variables (see Secret handling for all options). The recommended form keeps the password in a file, not inline:

pip install -e .

# PowerShell — connection assembled from parts, password read from a file
$env:MCP_SQL_SERVER      = "yourhost\INSTANCE"
$env:MCP_SQL_DATABASE    = "master"
$env:MCP_SQL_UID         = "mcp_readonly"
$env:MCP_SQL_PWD_FILE    = "C:\path\to\your\secret.pwd"
$env:MCP_SQL_TRUST_CERT  = "no"   # "yes" only for a self-signed/local cert

python -m mcp_sql_querystore.server

Or use integrated auth with no stored password at all (MCPSQLTRUSTED=yes). A full MCPSQLCONNECTIONSTRING is also accepted for simple cases — see Secret handling**.

Shortened. The full README is on GitHub.