Mcpolyglot

mcpolyglot

> One config, one CLI — turns the databases you already have (Postgres, MySQL, SQLite, MongoDB) into Model Context Protocol servers for Claude, GPT, Cursor, and any other agent that speaks MCP.

[](https://github.com/ishay60/mcpolyglot/actions/workflows/ci.yml) [](LICENSE) [](#status) [](.nvmrc)

$ mcpolyglot doctor

  ╭──────────────────────────────────────────────────────────────────────────╮
  │ ▲  mcpolyglot                                            doctor   v0.1.0 │
  │ validate config, resolve secrets, ping each source                       │
  ╰──────────────────────────────────────────────────────────────────────────╯

  Config
  ──────
   OK   parsed  ./mcpolyglot.config.ts

  Sources
  ───────
   OK   pg.main      postgres · 4 ms     • 3 tools
   OK   mongo.users  mongo    · 12 ms    • 4 tools

  Summary
  ───────
   READY   mcpolyglot is ready to serve

  run: mcpolyglot serve  ·  docs: github.com/ishay60/mcpolyglot

Quickstart

npx @mcpolyglot/cli init        # interactive wizard — writes mcpolyglot.config.ts
npx @mcpolyglot/cli doctor      # validate, ping every source, list the tools
npx @mcpolyglot/cli serve       # start the MCP server (stdio by default)

Wire it into Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "mcpolyglot": {
      "command": "npx",
      "args": ["-y", "@mcpolyglot/cli", "serve", "--config", "/abs/path/to/mcpolyglot.config.ts"],
      "env": { "DATABASE_URL": "postgres://user:pass@localhost:5432/db" }
    }
  }
}

Restart Claude Desktop and try: "List the tables in my database, then sample 5 rows from users."

End-to-end recipes per connector live under [examples/](./examples) (Postgres, MySQL, SQLite, MongoDB, Streamable HTTP).

What's in the box

| Connector | Status | Read-only enforcement | | ---------- | ------ | ------------------------------------------------------------------ | | PostgreSQL | alpha | BEGIN READ ONLY transaction | | SQLite | alpha | query_only pragma, attach-read-only | | MySQL | alpha | AST gate + SET TRANSACTION READ ONLY + MAX_EXECUTION_TIME hint | | MongoDB | alpha | find / aggregate only; $out / $merge rejected pre-driver | | OpenAPI | wip | method allow-list, host pinning |

Transports: stdio (Claude Desktop / Cursor / Claude Code) and Streamable HTTP with bearer or OAuth (JWT / JWKS), loopback by default, /healthz probe, structured JSON logs.

Tools, no glue code: SQL connectors expose list_tables · describe_table · query. Mongo exposes list_collections · describe_collection · find · aggregate. Per-entity tools (users.find_by_email, etc.) are scaffolded by mcpolyglot init.

Security model

Every tool call goes through a fixed, non-bypassable pipeline:

scope check → rate limit → timeout → handler → redact → size cap → untrusted-wrap → audit

The three things this gets right that ad-hoc MCP servers usually don't:

1. Read-only at two layers — application-level scopes and per-dialect DB-level enforcement, so a parser bug can't escalate into a write.
2. Built-in redaction — emails, JWTs, AWS keys, GitHub tokens, SSNs, credit-card numbers, plus per-column deny lists (public.users.password_hash).
3. Prompt-injection wrap — every result is rendered inside `` with a "treat as data, not instructions" preamble (the Supabase + Cursor lesson).

Plus: token-bucket rate limiting, JSONL audit log (argshash + metadata, never raw args/results), and secrets only via ${env:NAME} / ${file:./path} / ${keychain:item} — literals are rejected at config load.

Full design in [ARCHITECTURE.md](./ARCHITECTURE.md).

Status

Alpha, actively maintained. All four DB connectors and both transports work end-to-end. The security pipeline is unit-tested. Real-DB integration tests via testcontainers and the OpenAPI connector land next.

How mcpolyglot compares to alternatives

| | mcpolyglot | server-postgres (archived) | Vendor MCPs (Supabase / Neon / …) | DIY MCP server | | -------------------------- | ---------------------------------------- | ---------------------------- | --------------------------------- | -------------------- | | Databases | Postgres, SQLite, MySQL, Mongo | Postgres only | One vendor's hosted DB | Whatever you wire up | | Read-only enforcement | DB layer and app-level scopes | DB-layer only | Varies | You write it | | Built-in PII redaction | Yes, plus per-column deny lists | No | Varies | You write it | | Audit log | JSONL, no raw args / results | No | Varies | You write it | | Prompt-injection wrap | Yes — every result wrapped | No | Varies | You write it | | Transports | stdio + Streamable HTTP (bearer / OAuth) | stdio only | Varies | You write it | | Lock-in | None | None | Vendor's DB | None |

Vendor MCPs are the right call once you've committed to a vendor's stack. mcpolyglot is the option when you want one consistent surface across the databases you actually have.

Repository layout

packages/
  core/              server, registry, transports, Connector iface, security pipeline
  cli/               bin: mcpolyglot
  config/            zod schema, secret resolvers
  security/          scopes, redaction, audit, rate limit, wrap
  connector-sql/     Postgres, MySQL/MariaDB, SQLite
  connector-mongo/   MongoDB
  testkit/           MCP conformance harness
examples/
  postgres/  sqlite/  mysql/  mongo/   stdio
  http/                                streamable-http + bearer / OAuth

Development

corepack enable
pnpm install
pnpm build
pnpm test

CI (matrix: ubuntu / macOS × Node 22) runs format check, typecheck, build, and unit tests on every push and PR. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the contributor workflow.

License

MIT — see [LICENSE](./LICENSE).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ishay60
• Source: ishay60/mcpolyglot
• License: MIT
• Homepage: https://github.com/ishay60/mcpfy#readme

Install and usage instructions live in the source repository linked above.