SequelSAFE
MCP Database servers for Claude, Cursor and Windsuf
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MCP servers for your databases. Query your database from your favourite MCP clients.
Usage
Install the MCP server to your client
npx -y @sequelsh/mcp@latest install
Install a specific database MCP server
npx -y @sequelsh/mcp@latest install -d postgresql
Supported Databases
npx -y @sequelsh/mcp@latest install -d
- [X] PostgreSQL
postgresql - [X] MySQL
mysql - [X] ClickHouse
clickhouse
Supported MCP Clients
npx -y @sequelsh/mcp@latest install -c
- [X] Claude
claude - [X] Cursor
cursor - [X] WindSurf
windsurf
Setting up for development
This project uses Bun, so make sure you have bun installed
Install dependencies
bun install
Build
bun run build
Run MCP Install
bun run mcp:install
234212a16a33OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp -- npx -y @sequelsh/[email protected]
{
"mcpServers": {
"mcp": {
"command": "npx",
"args": [
"-y",
"@sequelsh/[email protected]"
]
}
}
}Exposed tools (5)
4 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Claude | read | Claude is a powerful AI assistant that can help you with various tasks. |
Cursor | read | Cursor is a powerful AI assistant that can help you with various tasks. |
WindSurf | read | WindSurf is a powerful AI assistant that can help you with various tasks. |
query | write | Run an SQL query on the connected ${database} database |
schema | read | Get the schema of the connected ${database} database. Use this tool to understand the database structure. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
@clickhouse/client, @modelcontextprotocol/sdk, chalk, commander, inquirer, mysql2, ora, postgres
Gates applied: no_behavioural_pass, no_license.
234212a16a33full audit observations/trust-audit/mcp-server/haxzie__sequel.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 234212a16a33 | SAFE | B | 89 | first audit |
Questions
What is the Sequel MCP server?
MCP Database servers for Claude, Cursor and Windsuf
What tools does Sequel expose?
5 in total: 4 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Sequel safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Sequel need?
No credential environment variables were found in its source, so it appears to need none.
How does Sequel run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @sequelsh/mcp at 0.1.2.
How current is this page?
The grade is for one exact copy of the source (234212a16a33), read on 2026-10-08. The repository is watched and re-audited when it changes.