Purpose: db-access-mcp is a Model Context Protocol (MCP) stdio server that provides MCP clients such as Claude Code and Claude Desktop with access to configured databases, supporting PostgreSQL (≥10), MySQL (≥5, read-only sessions require ≥5.6), Amazon Redshift, and Microsoft SQL Server (via tedious).
Main capabilities: provides tools such as connection_list, connection_find, connection_test, query, query_plan (EXPLAIN), query_to_file (streaming CSV/JSONL export, bypassing the model context), up_tunnel, down_tunnel, tunnel_list, and config_reload. Supports SSH and AWS SSM tunnels; secret providers can optionally be environment variables, HashiCorp Vault, AWS Secrets Manager, RDS IAM authentication tokens, and temporary Redshift credentials. Each instance's connection pool and tunnel are isolated from one another, can run concurrently, and no orphaned tunnel processes are left behind after a crash.
Security design: SSH tunnels verify the bastion host key (host_key_sha256 pinned value or known_hosts) and fail on mismatch; read_only and the default single-statement restriction can be turned off to bypass SET session read-only off; query_to_file can only write to the export directory or the roots of allow_export_paths, and cannot overwrite ~/.ssh, dotfiles, or configuration directories; tools do not return stack traces or credentials, and logs are redacted by key name and scrub inline user:password@host URIs.
Usage: on first startup it creates ~/.db_acess_mcp (spelled as a product convention), containing an empty config.json, conf.d/, and a complete config.example.json. After editing the configuration, restart the MCP server. Clients can run npx -y @rheopyrin/db-access-mcp, or for a local build use node <path>/dist/cli.js. In Claude Code, use /mcp to view status and reconnect; you can also declare mcpServers in .mcp.json or the Claude Desktop configuration file. stdio clients such as Cursor use the same format. CLI options are passed via args, such as --workdir and --log-level. For local development you can run the web UI to try it out.
Use cases: teams that need to let AI agents safely query multiple databases, access internal databases through a jump host or SSM, export query results to files without consuming model context, and require dynamic secret rotation and read-only constraints.
Limitations: the host requires Node.js ≥20.19; SSM tunnels require the AWS CLI and session-manager-plugin, and SSO bootstrap requires a browser; SSH tunnels have no additional dependencies. read_only and single-statement are only a safety belt; real guarantees should use a read-only database user; mssql cannot enforce single-statement at the protocol layer. The configuration schema is strict, and unknown keys cause an error at startup; config_reload is non-destructive, and already-open connection pools and tunnels are not rebuilt. Export files are only created, not read or appended; overwriting requires an explicit overwrite: true, and beware of CSV injection risk. RDS IAM authentication does not support SQL Server.
