ModelsAtlas
Explore
Atlas / MCP servers / bymcs / mssql-mcp

mssql-mcpSAFE

mcp/bymcs/mssql-mcp
MCP server by bymcs · Audited 2026-10-14
⚑ Report / re-scanSource ↗

MCP server for Microsoft SQL Server — query, schema, and stored-procedure access for Claude Desktop, Cursor, Windsurf, and VS Code.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
14 10r · 4w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
13
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🚀 Model Context Protocol (MCP) server for Microsoft SQL Server - compatible with Claude Desktop, Cursor, Windsurf and VS Code.

[](https://github.com/BYMCS/mssql-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/mssql-mcp) [](LICENSE)

Standards Alignment

🚀 Quick Start

1. Install

npm install -g mssql-mcp

2. Configure IDE

Claude Desktop (claude_desktop_config.json):

{
"mcpServers": {
"mssql": {
"command": "npx",
"args": ["-y", "mssql-mcp@latest"],
"env": {
"DB_SERVER": "your-server.com",
"DB_DATABASE": "your-database",
"DB_USER": "your-username",
"DB_PASSWORD": "your-password",
"DB_ENCRYPT": "true",
"DB_TRUST_SERVER_CERTIFICATE": "true"
}
}
}
}

Cursor/Windsurf/VS Code (.vscode/mcp.json):

{
"servers": {
"mssql": {
"command": "npx",
"args": ["-y", "mssql-mcp@latest"],
"env": {
"DB_SERVER": "your-server.com",
"DB_DATABASE": "your-database",
"DB_USER": "your-username",
"DB_PASSWORD": "your-password",
"DB_ENCRYPT": "true",
"DB_TRUST_SERVER_CERTIFICATE": "true"
}
}
}
}

HTTP transport (remote/

Read from source at commit 886e1715e845OBSERVED · 2026-10-14
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mssql-mcp --env DB_PASSWORD=${DB_PASSWORD} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "mssql-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "DB_PASSWORD": "${DB_PASSWORD}"
      }
    }
  }
}
03

Exposed tools (14)

10 read · 4 write · 0 destructive.

ToolRiskDescription
mssql_connect_databaseread
mssql_connection_statusread
mssql_describe_tableread
mssql_describe_table_columnsread
mssql_disconnect_databaseread
mssql_execute_procedurewrite
mssql_execute_querywrite
mssql_execute_stored_procedurewrite
mssql_get_schemaread
mssql_get_table_dataread
mssql_list_databasesread
mssql_list_schema_objectsread
mssql_read_table_rowsread
mssql_run_sql_querywrite
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (7)

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/integration/mcp-server.test.ts:5
import { createServer } from "../../src/server.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/integration/mcp-server.test.ts:6
import { disconnectPool } from "../../src/db/connection.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/config.test.ts:3
import { ConfigSchema, loadHttpConfig, loadConfigFromEnv } from "../../src/config.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/errors.test.ts:3
import { McpToolError, toActionableError, toolError, formatFatalError } from "../../src/utils/errors.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/format.test.ts:3
import { formatDisplayValue, normalizeOutput } from "../../src/utils/format.js";
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:73
"url": "http://127.0.0.1:3001",
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
dotenv, mssql, zod, @types/mssql, @types/node, cross-env, rimraf, typescript
Why it matters. 8 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha 886e1715e845full audit observations/trust-audit/mcp-server/bymcs__mssql-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-14886e1715e845SAFEB89first audit
06

Questions

What is the mssql-mcp MCP server?

MCP server for Microsoft SQL Server — query, schema, and stored-procedure access for Claude Desktop, Cursor, Windsurf, and VS Code.

What tools does mssql-mcp expose?

14 in total: 10 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mssql-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mssql-mcp need?

It reads DB_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mssql-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mssql-mcp at 3.0.0.

How current is this page?

The grade is for one exact copy of the source (886e1715e845), read on 2026-10-14. The repository is watched and re-audited when it changes.

Advertisement