Introduction | hs-sql-agent

hs-sql-agent is an HTTP MCP server for governed SQL access. It connects MCP clients to PostgreSQL, MySQL, SQL Server, Oracle, SQLite, and Firebird while keeping authentication, access policy, SQL validation, and mutation approval on the server side.

01 MCP client

02 MCP key scope

03 SQL compiler

04 Policy & capability checks

05 Database

What the server owns

Identity & scope Bind a client to one managed database and restrict its allowed tools, tables, and runtime limits.

SQL semantics Parse supported SQL into structured definitions, validate source semantics, prove target capability, then compile provider-specific SQL.

Mutation approval Treat write operations as a separate risk class with preview, one-time approval, revalidation, and exact commit.

Operations & audit Keep rate/concurrency controls, audit records, health, telemetry, and outbound operational delivery outside the model.

The compiler boundary

Generated SQL is parsed and validated before execution. hs-sql-agent checks the capabilities needed to preserve the statement’s semantics and compiles provider-specific SQL only after the request has passed its source, target, and policy boundaries.

Unsupported syntax or semantics are rejected instead of being silently rewritten into something that merely looks equivalent.

Where to go next

Quick Start Run the default Compose setup and issue your first MCP key.

MCP Client Onboarding Connect a remote Streamable HTTP MCP client correctly.

SQL Execution Model Understand parse, validation, capability proof, compile, and execution boundaries.

Safe DML Understand the human-approved mutation protocol.