Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

MCP Toolbox for Databases

by googleapis/genai-toolboxApache-2.0 licenceAudited 20 Sep 2026 · source 1b38aa044a32

npm @toolbox-sdk/server 1.12.0streamable-http★ 16,460
✕BLOCKGrade F · 40/100 · 20 Sep 2026 · 1b38aa0
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (40/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 57 findings (0 critical, 6 high, 6 medium, 43 low). Maintainer's description: MCP Toolbox for Databases is an open source MCP server for databases.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “MCP Toolbox for Databases (googleapis/genai-toolbox)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/googleapis/genai-toolbox

Why this is BLOCK. The audit found 0 critical and 6 high findings; the most severe is Network egress at internal/sources/clickhouse/clickhouse.go:203. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score40/100✕BLOCK F
0 critical6 high6 medium43 low2 info

57 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared3 observations
  • NetworkDeclared10 observations
  • ShellDeclared5 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (57)

Sorted by severity · the 25 most severe of 57 are listed

HIGHNetwork egressnet.tls_off · internal/sources/clickhouse/clickhouse.go:203
F-04 Network egressCWE-200 · CWE-319Layer L1
dsn += "?secure=true&skip_verify=false"
Why
certificate verification is disabled
Fix
leave verification on
HIGHPrompt injectionprompt.override · docs/en/documentation/configuration/pre-post-processing/_index.md:59
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **Prompt Injection Defense**: Use pre-processing hooks to scan user inputs for known jailbreak patterns or malicious directives before they reach the model or tools.
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · docs/en/documentation/configuration/security/model-armor.md:23
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
back in. This catches prompt injection and jailbreak attempts.
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · docs/en/documentation/configuration/security/model-armor.md:74
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
injection / jailbreak detection](https://docs.cloud.google.com/model-armor/overview#ma-prompt-injection):
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · docs/en/documentation/configuration/security/model-armor.md:80
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
3. Under **Prompt injection and jailbreak detection**, enable the filter and set
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
HIGHPrompt injectionprompt.override · docs/en/documentation/configuration/security/model-armor.md:192
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
# Prompt injection / jailbreak: blocked at ingress.
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMHard-coded secretssecret.db_uri · internal/sources/postgres/postgres_test.go:258
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · docs/en/documentation/connect-to/toolbox-sdks/python-sdk/adk/index.md:169
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · internal/auth/generic/generic_test.go:345
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · internal/auth/generic/generic_test.go:378
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · internal/auth/generic/generic_test.go:404
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · internal/auth/generic/generic_test.go:606
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .gitmodules
F-13 Inventory / provenanceCWE-1104Layer L0
.gitmodules
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .golangci.yaml
F-13 Inventory / provenanceCWE-1104Layer L0
.golangci.yaml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .hugo/.browserslistrc
F-13 Inventory / provenanceCWE-1104Layer L0
.browserslistrc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .lycheeignore
F-13 Inventory / provenanceCWE-1104Layer L0
.lycheeignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.dynamic_import · docs/en/documentation/configuration/pre-post-processing/python/agent_test.py:24
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
agent = importlib.import_module(module_path)
Why
No further detail recorded for this rule.
Fix
—
LOWCode injectioncode.dynamic_import · docs/en/documentation/getting-started/quickstart/python/quickstart_test.py:24
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
quickstart = importlib.import_module(module_path)
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · cmd/internal/skills/generator.go:139
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const envPath = path.resolve(__dirname, '../../../.env');
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · cmd/internal/skills/generator.go:202
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const localPath = path.resolve(__dirname, '../../../toolbox' + ext);
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive
ToolWhat it doesRisk
basicfoo barread
my-skillflag fallbackread

Safer alternatives

All databases servers →
mcp-clickhousex✓SAFE

alyiox/mcp-clickhousex

Read-only MCP server for ClickHouse: SELECT queries, EXPLAIN plan/pipeline/syntax analysis, and a snapshot mode that spills large results to a CSV resource. Read-only is enforced by the engine — every client carries readonly=1, so writes, external table functions and query-level SETTINGS are refused

1 readGrade B
Neo4j✓SAFE

neo4j-contrib/mcp-neo4j

Neo4j Labs Model Context Protocol servers

Grade B
IoTDB✓SAFE

apache/iotdb-mcp-server

Apache IoTDB MCP Server

6 destructiveGrade B

Audit history

  1. ✕BLOCK F 40 / 100

    Source changed, verdict held · 1b38aa044a32

  2. ✕BLOCK F 40 / 100

    First audit · a7ab56d3105a

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about MCP Toolbox for Databases

What is the MCP Toolbox for Databases MCP server?
MCP Toolbox for Databases is an open source MCP server for databases.
What tools does MCP Toolbox for Databases expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is MCP Toolbox for Databases safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (40/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does MCP Toolbox for Databases need?
It reads ANTHROPIC_API_KEY, DB_PASS, GEMINI_API_KEY, GOOGLE_API_KEY and GOOGLE_GENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MCP Toolbox for Databases run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @toolbox-sdk/server at 1.12.0.
How current is this page?
The grade is for one exact copy of the source (1b38aa044a32), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed MCP Toolbox for Databases. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • googleapis/genai-toolbox on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 1b38aa044a32Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.