DBeaverBLOCK
omnisql-mcp
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Universal database MCP server — give AI assistants read/write access to your databases using connections already saved in your local DB client workspace (DBeaver-compatible).
[](https://www.npmjs.com/package/omnisql-mcp) [](https://opensource.org/licenses/MIT) [](https://nodejs.org/)
Database Support
Natively supported (direct driver, fast):
- PostgreSQL (via
pg) - MySQL / MariaDB (via
mysql2) - SQL Server / MSSQL (via
mssql) - SQLite (via
sqlite3CLI)
Postgres-compatible (routed through pg driver automatically):
- CockroachDB, TimescaleDB, Amazon Redshift, YugabyteDB, AlloyDB, Supabase, Neon, Citus
Other databases: Fall back to an external CLI configured via OMNISQL_CLI_PATH. Results vary by CLI.
Custom drivers wrapping any of the above are detected automatically — see Custom and IAM-Authenticated Drivers.
Features
- Reuses connections already configured in your local DB client workspace — no duplicate setup
- Native query execution for PostgreSQL, MySQL/MariaDB, SQLite, SQL Server
- AWS RDS IAM authentication, including custom drivers built on the AWS Advanced JDBC Wrapper
- Connection pooling with configurable pool size and timeouts
- Transaction support (BEGIN/COMMIT/ROLLBACK)
- Query execution plan analysis (EXPLAIN)
- Schema comparison between connections with migration script generation
- Read-only mode with enforced SELECT-only on
execute_query - Connection whitelist to restrict which databases are accessible
- Tool filtering to disable specific operations
- Query validation to block dangerous operations (DROP DATABASE, TRUNCATE, DELETE/UPDATE without WHERE)
- Data export to CSV/JSON
- Graceful shutdown with connection pool cleanup
Requirements
- Node.js 18+
b443ebf3773dOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add omnisql-mcp --env MYSQL_PASSWORD=${MYSQL_PASSWORD} --env OMNISQL_IAM_TOKEN_TIMEOUT=${OMNISQL_IAM_TOKEN_TIMEOUT} --env OMNISQL_SSH_STRICT_HOST_KEY=${OMNISQL_SSH_STRICT_HOST_KEY} --env PGPASSWORD=${PGPASSWORD} -- npx -y [email protected]{
"mcpServers": {
"omnisql-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MYSQL_PASSWORD": "${MYSQL_PASSWORD}",
"OMNISQL_IAM_TOKEN_TIMEOUT": "${OMNISQL_IAM_TOKEN_TIMEOUT}",
"OMNISQL_SSH_STRICT_HOST_KEY": "${OMNISQL_SSH_STRICT_HOST_KEY}",
"PGPASSWORD": "${PGPASSWORD}"
}
}
}
}Exposed tools (21)
12 read · 7 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
alter_table | write | Modify existing table schema (add columns, rename tables, etc.) |
append_insight | write | Add a business insight or analysis note to the memo |
begin_transaction | write | Start a new database transaction |
commit_transaction | write | Commit an active transaction |
compare_schemas | read | Compare schemas between two database connections |
create_table | write | Create new tables in the database |
drop_table | destructive | Remove a table from the database with safety confirmation |
execute_in_transaction | write | Execute a query within an active transaction |
execute_query | write | Execute a SQL query on a specific database connection (read-only queries) |
explain_query | read | Get the execution plan for a SQL query |
export_data | read | Export query results to various formats (CSV, JSON, etc.) |
get_connection_info | read | Get detailed information about a specific database connection |
get_database_stats | read | Get statistics and information about a database |
get_pool_stats | read | Get connection pool statistics for a connection |
get_table_schema | read | Get schema information for a specific table |
list_connections | read | List all available database connections |
list_insights | read | List all stored business insights and analysis notes |
list_tables | read | List all tables in a database |
rollback_transaction | read | Rollback an active transaction |
test_connection | read | Test connectivity to a database connection |
write_query | destructive | Execute INSERT, UPDATE, or DELETE queries on a specific database connection |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (18)
OMNISQL_SSH_KNOWN_HOSTS known_hosts used to verify SSH tunnel hosts (default: ~/.ssh/known_hosts)
const ssl = resolvedSsl === undefined ? { rejectUnauthorized: false } : resolvedSsl;drop_table, write_query
.prettierignore
.nojekyll
privKeyPath: '~/.ssh/id_ed25519',
expect(tunnel).toMatchObject({ user: 'deploy', privateKeyPath: '~/.ssh/id_ed25519' });expect(expandHome('~/.ssh/id_rsa')).toMatch(/\/\.ssh\/id_rsa$/);expect(expandHome('~/.ssh/id_rsa').startsWith('~')).toBe(false);expect(sanitizeConnectionId('my-conn/../../etc/passwd')).toBe('my-conn/etcpasswd');expect(() => sanitizeConnectionId('../../my-conn')).toThrow(/no valid characters/);expect(ssl).toEqual({ rejectUnauthorized: false });rejectUnauthorized: false,
expect(resolvePostgresSsl(connection({}), true)).toEqual({ rejectUnauthorized: false });expect(ssl).toEqual({ rejectUnauthorized: false });@mdx-js/react, clsx, prism-react-renderer, react, react-dom, typescript
@modelcontextprotocol/sdk, csv-parser, csv-stringify, mssql, mysql2, pg, ssh2, xml2js
- **SSH tunnel support** (#28): connections that DBeaver reaches through an SSH tunnel are now tunneled here too, rather than connecting straight to the target host — which for a tunneled connection i
Gates applied: no_behavioural_pass.
b443ebf3773dfull audit observations/trust-audit/mcp-server/srthkdev__dbeaver.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | b443ebf3773d | BLOCK | D | 69 | first audit |
Questions
What is the DBeaver MCP server?
omnisql-mcp
What tools does DBeaver expose?
21 in total: 12 read-only, 7 that write, and 2 that can delete or overwrite (drop_table, write_query). Every one is listed on this page with its risk.
Is DBeaver safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does DBeaver need?
It reads MYSQL_PASSWORD, OMNISQL_IAM_TOKEN_TIMEOUT, OMNISQL_SSH_STRICT_HOST_KEY, PGPASSWORD and SSH_AUTH_SOCK from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does DBeaver run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as omnisql-mcp at 2.1.0.
How current is this page?
The grade is for one exact copy of the source (b443ebf3773d), read on 2026-10-08. The repository is watched and re-audited when it changes.