Preview
Read the affected rows without executing the mutation.
Open-source SQL MCP server · fail-closed · six SQL dialects
A secure SQL MCP server for AI agents.
Let MCP clients use raw SQL without handing them unrestricted database access. hs-sql-agent validates generated SQL, enforces server-side policy, and gates DML before execution.
docker compose up -d SELECT customer_id, total
FROM orders
WHERE status = 'ready'
FROM orders
WHERE status = 'ready'
01ParseRaw SQL → AST
02ValidateSource semantics
03ProveCapability boundary
04CompileProvider SQL
✓ Provider-safe SQL ready
Choose how you run it
One product, three consumption paths.
Deploy the official service, embed the complete first-party host, or compose a custom ASP.NET Core integration. The SQL safety model stays the same.
01 / DOCKER
Deploy standalone
Docker — Run the official image as its own service with the standard UI, MCP endpoint, identity, telemetry, and approval configuration.
02 / HOSTINGEmbed the complete product
HsSqlAgent.Hosting — Add the same batteries-included first-party composition used by the official Docker host to an ASP.NET Core application.
03 / SERVERBuild a custom integration
HsSqlAgent.Server — Select runtime, persistence, MCP, Admin API, identity, telemetry, and approval capabilities explicitly inside your host.
Compiler boundary
Validate AI-generated SQL before it reaches your database.
Keep raw SQL flexibility without blindly executing model output. The compiler rejects statements that fall outside the supported dialect, capability, or server-side policy boundary.
01 / COMPILER
Fail-closed SQL compiler
Unsupported syntax is rejected instead of being silently rewritten into something with different semantics.
02 / DMLHuman-approved DML
Preview impact, bind approval to the validated plan, then revalidate the row set inside the commit transaction.
03 / DIALECTSSix database dialects
PostgreSQL, MySQL, SQL Server, Oracle, SQLite, and Firebird behind one MCP surface.
04 / POLICYGoverned by default
Per-key database scope, table allowlists, tool restrictions, rate limits, security policy, and auditability stay outside the LLM.
Safe mutation path
DML approval is a protocol, not a confirmation dialog.
UPDATE and DELETE are previewed without mutation, approval is bound to the validated compiled plan and row-set fingerprint, and the matched rows are checked again before commit.
Approve
Require explicit approval through MCP form Elicitation.
Revalidate
Re-query inside the commit transaction and compare the bound row set.
Commit
Execute only when the plan, policy, challenge, row count, and row set still match.
One surface, six dialects
One SQL MCP server for six database dialects.
Connect PostgreSQL, MySQL, SQL Server, Oracle, SQLite, or Firebird while keeping provider-specific SQL semantics behind one governed MCP interface.
MCP and .NET integrations
Meet agents where they already work.
Connect remote MCP clients such as Claude Desktop and Cursor, or embed the same governed server boundary inside an ASP.NET Core application.
Documentation
From first MCP key to production governance.
The documentation is organized around the way operators actually adopt hs-sql-agent: setup, MCP, compiler guarantees, administration, integrations, operations, and development.