Atlas / MCP servers / aliyun / Alibaba Cloud RDS OpenAPI

Alibaba Cloud RDS OpenAPICAUTION

Name: Alibaba Cloud RDS OpenAPI
Author: aliyun

mcp/aliyun/alibaba-cloud-rds-openapi

MCP server by aliyun · ai · mcp · rds · Audited 2026-10-08

⚑ Report / re-scan Source ↗

MCP server for RDS Services via OPENAPI.

Verdict

CAUTION

Grade

Trust score

87 /100

Exposed tools

35 26r · 9w · 0d

Transport

streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 中文

MCP server for RDS Services via OPENAPI

Prerequisites

Install uv from Astral or the GitHub README
Install Python using uv python install 3.12
Alibaba Cloud credentials with access to Alibaba Cloud RDS services

Quick Start

Using cherry-studio (Recommended)

Download and install cherry-studio
Follow the documentation to install uv, which is required for the MCP environment
Configure and use RDS MCP according to the documentation. You can quickly import the RDS MCP configuration using the JSON below. Please set ALIBABACLOUDACCESSKEYID and ALIBABACLOUDACCESSKEYSECRET to your Alibaba Cloud AK/SK.

The following error may appear during import, which can be ignored: xxx settings.mcp.addServer.importFrom.connectionFailed

{
"mcpServers": {
"rds-openapi": {
"name": "rds-openapi",
"type": "stdio",
"description": "",
"isActive": true,
"registryUrl": "",
"command": "uvx",
"args": [
"alibabacloud-rds-openapi-mcp-server@latest"
],
"env": {
"ALIBABA_CLOUD_ACCESS_KEY_ID": "$you_access_id",
"ALIBABA_CLOUD_ACCESS_KEY_SECRET": "$you_access_key"
}
}
}
}

Finally, click to turn on MCP

You can use the prompt template provided below to enhance your experience.

Using Cline

Set you env and run mcp server.

# set env
export SERVER_TRANSPORT=sse;
export SERVER_HOST=127.0.0.1; # Default: 127.0.0.1. API_KEY is required when binding to a non-loopb

Read from source at commit 155563892decOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add alibabacloud-rds-openapi-mcp-server --env ACCESS_KEY_ID=${ACCESS_KEY_ID} --env ACCESS_SECRET=${ACCESS_SECRET} --env ALIBABA_CLOUD_ACCESS_KEY_ID=${ALIBABA_CLOUD_ACCESS_KEY_ID} --env ALIBABA_CLOUD_ACCESS_KEY_SECRET=${ALIBABA_CLOUD_ACCESS_KEY_SECRET} -- uvx alibabacloud-rds-openapi-mcp-server

claude-desktop

{
  "mcpServers": {
    "alibabacloud-rds-openapi-mcp-server": {
      "command": "uvx",
      "args": [
        "alibabacloud-rds-openapi-mcp-server"
      ],
      "env": {
        "ACCESS_KEY_ID": "${ACCESS_KEY_ID}",
        "ACCESS_SECRET": "${ACCESS_SECRET}",
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "${ALIBABA_CLOUD_ACCESS_KEY_ID}",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "${ALIBABA_CLOUD_ACCESS_KEY_SECRET}"
      }
    }
  }
}

Exposed tools (35)

26 read · 9 write · 0 destructive.

Tool	Risk	Description
`add_tags_to_db_instance`	write
`allocate_instance_public_connection`	read
`attach_whitelist_template_to_instance`	read
`create_db_instance`	write	Create an RDS instance.
`create_db_instance_account`	write
`decorator`	read	item = _RegistrableItem(
`describe_all_whitelist_template`	read
`describe_available_classes`	read	Query the RDS instance class_code and storage space that can be purchased in the inventory.
`describe_available_zones`	read	Query available zones for RDS instances.
`describe_bills`	read
`describe_db_instance_accounts`	read
`describe_db_instance_attribute`	read
`describe_db_instance_databases`	read
`describe_db_instance_ip_allowlist`	read
`describe_db_instance_net_info`	read
`describe_db_instance_parameters`	read
`describe_db_instance_performance`	read
`describe_db_instances`	read
`describe_error_logs`	read
`describe_instance_linked_whitelist_template`	read
`describe_monitor_metrics`	read
`describe_slow_log_records`	read	Query slow log records for an RDS instance.
`describe_sql_insight_statistic`	read
`describe_vpcs`	read	Query VPC list.
`describe_vswitches`	read	Query VSwitch list.
`explain_sql`	read
`get_current_time`	read	Get the current time.
`modify_db_instance_description`	write
`modify_db_instance_spec`	write	Modify RDS instance specifications.
`modify_parameter`	write	Modify RDS instance parameters.
`modify_security_ips`	write	modify security ips。
`query_sql`	read
`restart_db_instance`	write	Restart an RDS instance.
`show_create_table`	write
`show_engine_innodb_status`	read

Trust audit

CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (6 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (21)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/alibabacloud_rds_openapi_mcp_server/prompts/__init__.py:17

importlib.import_module(module_name)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/alibabacloud_rds_openapi_mcp_server/tools/__init__.py:17

importlib.import_module(module_name)

LOWInventory / provenance · inv.hidden_file · CWE-1104

rds-copilot-bot-gateway/.coveragerc

.coveragerc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

skill/alibabacloud-rds-instances-manage/scripts/run_tool.sh:6

REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README.md:70

INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README.md:74

remote_server = "http://127.0.0.1:8000/sse";

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README_CN.md:70

INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

README_CN.md:74

remote_server = "http://127.0.0.1:8000/sse";

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

assets/README_WIN_CN.md:131

INFO: Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

rds-copilot-bot-gateway/requirements.txt

dingtalk-stream, dashscope, loguru, python-dotenv, alibabacloud-tea-openapi, alibabacloud-tea-util, alibabacloud-dingtalk, lark-oapi

Why it matters. 10 requirement(s) not pinned with ==

Fix. pin exact versions

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

skill/alibabacloud-rds-copilot/requirements.txt

alibabacloud_rdsai20250507, alibabacloud_tea_openapi, alibabacloud_tea_util

Why it matters. 3 requirement(s) not pinned with ==

Fix. pin exact versions