DB Access MCP server

db-access-mcp

MCP (Model Context Protocol) stdio server that gives AI agents (Claude Code, Claude Desktop, any MCP client) access to configured databases:

• PostgreSQL (≥ 10)
• MySQL (≥ 5; read-only sessions require ≥ 5.6)
• Amazon Redshift
• Microsoft SQL Server (via tedious)

with SSH / AWS SSM tunnels, pluggable secret providers (env vars, HashiCorp Vault, AWS Secrets Manager) and strict per-instance isolation — many MCP instances can run concurrently on one machine without sharing connections or tunnels, and crashed instances never leave orphaned tunnel processes behind.

Highlights

Tools: connectionlist / connectionfind / connectiontest, query, queryplan (EXPLAIN), querytofile (streamed CSV/JSONL export that bypasses the model context), uptunnel / downtunnel / tunnellist, configreload (pick up new connections/tunnels without a restart).

Security-first design:

hostkeysha256 pin or known_hosts, failing closed on mismatch (MITM defence), not blindly trusted.

• Verified SSH tunnels — the bastion host key is checked against a

SET session read-only off; INSERT … bypass.

• readonly seatbelt** + single-statement-by-default, which also closes the

allowexportpaths root; it cannot clobber ~/.ssh, dotfiles or the config dir.

• Confined file exports — querytofile writes only under the export dir or an

key name and scrub inline user:password@host URIs.

• No secrets leak out — tools never return stacks or credentials; logs redact by

auto-refresh and atomic pool swaps), AWS Secrets Manager, RDS IAM auth tokens and temporary Redshift credentials.

• Pluggable secret providers — env vars, HashiCorp Vault (dynamic leases with

Tunnels & crash-safety: in-process SSH (dies with the process — no orphaned ports) and AWS SSM under a watchdog (killed even on SIGKILL), with AWS SSO bootstrap. Every instance's pools and tunnels are isolated; a crashed instance's tunnels are reaped by the next start.

Quick start

// Claude Code / Claude Desktop MCP config
{
  "mcpServers": {
    "db-access-mcp": {
      "command": "npx",
      "args": ["-y", "@rheopyrin/db-access-mcp"]
    }
  }
}

On first start the server creates the working directory ~/.dbacessmcp (intentional spelling — it is the product contract) with an empty config.json, an empty conf.d/ directory and a full config.example.json covering every dialect, secret provider and tunnel type. The export directory (default /tmp/db-access-mcp/exports) is not created up front — querytofile makes it on demand on the first export. Edit ~/.dbacessmcp/config.json, restart the MCP server, done.

Integrating the MCP

The server speaks MCP over stdio: any client that can spawn npx -y @rheopyrin/db-access-mcp (or node /dist/cli.js for a local build) can use it. Every spawned instance is fully isolated — its own pools, tunnels and idle timers — so it is safe to register it in several clients/sessions at once.

Claude Code

# current project only (writes .mcp.json in the project root)
claude mcp add db-access-mcp -- npx -y @rheopyrin/db-access-mcp

# for all your projects
claude mcp add --scope user db-access-mcp -- npx -y @rheopyrin/db-access-mcp

Shortened. The full README is on GitHub.