# SqlAugur > MCP server providing AI assistants with safe, read-only access to SQL Server databases. AST-based query validation, rate limiting, and DBA diagnostic tooling. - **Type:** MCP server - **Install:** `agentstack add mcp-mbentham-sqlaugur` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [mbentham](https://agentstack.voostack.com/s/mbentham) - **Installs:** 0 - **Category:** [Databases](https://agentstack.voostack.com/c/databases) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [mbentham](https://github.com/mbentham) - **Source:** https://github.com/mbentham/SqlAugur ## Install ```sh agentstack add mcp-mbentham-sqlaugur ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # SqlAugur [](https://www.nuget.org/packages/SqlAugur) [](https://www.nuget.org/packages/SqlAugur) [](LICENSE) **An MCP server that gives AI assistants safe, read-only access to SQL Server databases. Every query is parsed into a full AST using Microsoft's official T-SQL parser — not regex — so comment injection, string literal tricks, and encoding bypasses are blocked at the syntax level.** ``` ┌──────────────┐ ┌───────────────────────────────────────────┐ ┌──────────────┐ │ │ stdio │ SqlAugur │ │ │ │ AI Client │◄────────►│ │───────►│ SQL Server │ │ │ │ ┌────────────┐ ┌──────────────────────┐ │ │ │ └──────────────┘ │ │ Query │ │ Schema / Diagram / │ │ └──────────────┘ │ │ Validator │ │ DBA Services │ │ │ └────────────┘ └──────────────────────┘ │ │ ┌────────────────────────────────────┐ │ │ │ Rate Limiter │ │ │ └────────────────────────────────────┘ │ └───────────────────────────────────────────┘ ``` ## Quick Start Use this order for all install methods: 1. Install SqlAugur 2. Save `appsettings.json` in the correct location 3. Add SqlAugur to your MCP client config 4. Verify by asking your assistant to call `list_servers` Start with [Installation](#installation) for exact commands and file paths. ## Why This Approach - **AST-level query validation** — Most MCP database servers use keyword blocking or no validation at all. This project parses every query into a full syntax tree using Microsoft's official `TSql180Parser`. Comment injection, string literal tricks, and encoding bypasses are blocked at the syntax level, not with fragile regex patterns. - **Rate limiting** — Token bucket throughput limiting and concurrency control prevent runaway AI query loops from overwhelming production SQL Servers. No other MCP database server offers this. - **DBA diagnostic tooling** — Integrated support for First Responder Kit, DarlingData, and sp_WhoIsActive with parameter blocking that prevents write operations. This is an entirely new MCP capability category. - **Response size optimisation** — DBA tools exclude verbose columns (XML query plans, deadlock graphs, metric breakdowns) and truncate long strings by default, reducing response sizes by 90–99%. Use `verbose` and `includeQueryPlans` parameters to get full untruncated output when needed. - **Progressive discovery** — Up to 31 tools organized into toolsets that load on demand. Only 6 core tools are exposed initially, keeping the AI's context window small and reducing token usage. Additional toolsets are discovered and enabled as needed. ## Features **Security** - Read-only by design — only SELECT and CTE queries are permitted - AST-based query validation using [ScriptDom](https://www.nuget.org/packages/Microsoft.SqlServer.TransactSql.ScriptDom) (not regex) - Parameter blocking on all diagnostic stored procedures to prevent writes - Concurrency and throughput rate limiting **Database Tooling** - Multi-server support — named connections to multiple SQL Server instances - Schema overview — concise Markdown schema maps with PKs, FKs, constraints, and defaults - Table documentation — Markdown descriptions of columns, indexes, foreign keys, and constraints - ER diagram generation — PlantUML and Mermaid diagrams with smart cardinality detection - Schema exploration — list programmable objects, view definitions, extended properties, dependency graphs - Query plan analysis — estimated or actual XML execution plans - DBA diagnostics — optional integration with [First Responder Kit](https://github.com/BrentOzarULTD/SQL-Server-First-Responder-Kit), [DarlingData](https://github.com/erikdarlingdata/DarlingData), and [sp_WhoIsActive](https://github.com/amachanic/sp_whoisactive/) with automatic response size optimisation - Progressive discovery — dynamic toolset mode reduces initial context window usage by exposing tools on demand ## Installation All methods produce the same MCP server. Follow this order: install, save config, wire client, verify. ### NuGet Global Tool (recommended) **1. Install** (prerequisite: [.NET 10.0 runtime](https://dotnet.microsoft.com/download)) ```bash dotnet tool install -g SqlAugur ``` **2. Save config file** ```bash # Linux/macOS mkdir -p ~/.config/sqlaugur # Edit ~/.config/sqlaugur/appsettings.json with your server connections # Windows (PowerShell) mkdir "$env:APPDATA\sqlaugur" -Force # Edit %APPDATA%\sqlaugur\appsettings.json with your server connections ``` Example `appsettings.json` to save at that location: ```json { "SqlAugur": { "Servers": { "production": { "ConnectionString": "Server=myserver;Database=master;Integrated Security=True;TrustServerCertificate=False;Encrypt=True;" } } } } ``` **3. Add to MCP client** ```json { "mcpServers": { "sqlaugur": { "command": "sqlaugur" } } } ``` To update: `dotnet tool update -g SqlAugur` ### Docker / Podman **1. Run SqlAugur container** ```bash # Volume-mount a config file docker run -i --rm \ -v /path/to/appsettings.json:/app/appsettings.json:ro,Z \ ghcr.io/mbentham/sqlaugur:latest # Or use environment variables (no config file needed) docker run -i --rm \ -e SqlAugur__Servers__production__ConnectionString="Server=host.docker.internal;Database=master;..." \ ghcr.io/mbentham/sqlaugur:latest ``` > **Note:** To reach a SQL Server on the host machine, use `host.docker.internal` (Docker Desktop) or `--network=host` (Linux). Replace `docker` with `podman` — all commands are identical. The `:Z` flag on volume mounts is required for SELinux-enabled systems (Fedora, RHEL); Docker Desktop users on macOS/Windows can omit it. If you mount a config file, save it as `/path/to/appsettings.json` and mount it to `/app/appsettings.json`. **2. Add to MCP client** ```json { "mcpServers": { "sqlaugur": { "command": "docker", "args": ["run", "-i", "--rm", "-v", "/path/to/appsettings.json:/app/appsettings.json:ro,Z", "ghcr.io/mbentham/sqlaugur:latest"] } } } ``` Docker Compose ```yaml services: sqlaugur: image: ghcr.io/mbentham/sqlaugur:latest stdin_open: true volumes: - ./appsettings.json:/app/appsettings.json:ro,Z ``` MCP client configuration: ```json { "mcpServers": { "sqlaugur": { "command": "docker", "args": ["compose", "run", "-i", "--rm", "sqlaugur"] } } } ``` ### Build from Source **1. Build** (prerequisite: [.NET 10.0 SDK](https://dotnet.microsoft.com/download)) ```bash git clone git@github.com:mbentham/SqlAugur.git cd SqlAugur dotnet publish SqlAugur -c Release -o SqlAugur/publish ``` **2. Save config file** ```bash # Linux/macOS cp SqlAugur/appsettings.example.json SqlAugur/publish/appsettings.json # Edit SqlAugur/publish/appsettings.json with your server connections # Windows (PowerShell) Copy-Item SqlAugur\appsettings.example.json SqlAugur\publish\appsettings.json # Edit SqlAugur\publish\appsettings.json with your server connections ``` **3. Add to MCP client** ```json { "mcpServers": { "sqlaugur": { "command": "dotnet", "args": ["/absolute/path/to/SqlAugur/publish/SqlAugur.dll"] } } } ``` ### Verify the MCP connection (LLM-first) After restarting your MCP client, ask the assistant: - `Call list_servers` - `Call list_databases for server "production"` Expected result: - `list_servers` returns your configured server name (for example `production`) - `list_databases` returns a JSON array of databases, not a connection or authentication error If verification fails: 1. Confirm MCP config runs the expected command (`sqlaugur`, `docker run ...`, or `dotnet /path/to/SqlAugur.dll`) 2. Confirm `appsettings.json` is saved where your install method expects it: - Local tool: `~/.config/sqlaugur/appsettings.json` (Linux/macOS) or `%APPDATA%\sqlaugur\appsettings.json` (Windows) - Container: mounted to `/app/appsettings.json` - Source build: next to the published DLL (`SqlAugur/publish/appsettings.json`) 3. Confirm the tool call uses a configured server key (for example `production`) 4. Confirm SQL connectivity and authentication in the connection string ## Configuration The server loads configuration from multiple sources. Higher-priority sources override lower ones: 1. **Command-line arguments** 2. **Environment variables** — using `__` as section delimiter (e.g., `SqlAugur__Servers__production__ConnectionString=...`) 3. **Current working directory** — `appsettings.json` in the directory you run the command from 4. **User config directory** — `~/.config/sqlaugur/appsettings.json` on Linux, `%APPDATA%\sqlaugur\appsettings.json` on Windows 5. **Azure Key Vault** — when `AzureKeyVaultUri` is set (see below) 6. **App directory** — `appsettings.json` next to the DLL **Example configuration (Windows Authentication — recommended):** ```json { "SqlAugur": { "Servers": { "production": { "ConnectionString": "Server=myserver;Database=master;Integrated Security=True;TrustServerCertificate=False;Encrypt=True;" } }, "MaxRows": 1000, "CommandTimeoutSeconds": 30, "MaxConcurrentQueries": 5, "MaxQueriesPerMinute": 60, "EnableFirstResponderKit": false, "EnableDarlingData": false, "EnableWhoIsActive": false, "EnableDynamicToolsets": false } } ``` | Option | Default | Description | |--------|---------|-------------| | `Servers` | — | Named SQL Server connections (name → connection string) | | `MaxRows` | 1000 | Maximum rows returned per query | | `CommandTimeoutSeconds` | 30 | SQL command timeout for all queries and procedures | | `MaxConcurrentQueries` | 5 | Maximum number of SQL queries that can execute concurrently | | `MaxQueriesPerMinute` | 60 | Maximum queries allowed per minute (token bucket rate limit) | | `EnableFirstResponderKit` | false | Enable First Responder Kit diagnostic tools (sp_Blitz, sp_BlitzFirst, sp_BlitzCache, sp_BlitzIndex, sp_BlitzWho, sp_BlitzLock, sp_BlitzPlanCompare) | | `EnableDarlingData` | false | Enable DarlingData diagnostic tools (sp_PressureDetector, sp_QuickieStore, sp_QuickieCache, sp_HealthParser, sp_LogHunter, sp_HumanEventsBlockViewer, sp_IndexCleanup, sp_QueryReproBuilder) | | `EnableWhoIsActive` | false | Enable sp_WhoIsActive session monitoring | | `EnableDynamicToolsets` | false | Enable progressive tool discovery — DBA tools load on demand via 3 meta-tools instead of at startup. Reduces initial context window usage. The `Enable*` flags still control which toolsets are allowed. | | `AzureKeyVaultUri` | — | Azure Key Vault URI (e.g., `https://myvault.vault.azure.net/`). When set, secrets from the vault are added as a configuration source using [`DefaultAzureCredential`](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential). Key Vault secret names use `--` as a section separator (e.g., a secret named `SqlAugur--Servers--prod--ConnectionString` maps to `SqlAugur:Servers:prod:ConnectionString`). | > **Security Note:** `appsettings.json` is gitignored to prevent accidental credential commits. See [SECURITY.md](SECURITY.md) for recommended authentication methods including Windows Authentication, Azure Managed Identity, and secure credential storage options. ## Tools The server provides 31 tools organized into toolsets. Six core tools are always available. Additional toolsets are loaded at startup (static mode) or on demand (dynamic mode). ### Core Tools | Tool | Description | |------|-------------| | `list_servers` | Lists available SQL Server instances configured in `appsettings.json`. | | `list_databases` | Lists all databases on a named server with names, IDs, states, and creation dates. | | `read_data` | Executes a read-only SQL SELECT query. Only `SELECT` and `WITH` (CTE) queries are allowed. Results returned as JSON with a configurable row limit. | | `get_query_plan` | Returns the estimated or actual XML execution plan for a SELECT query. | | `get_schema_overview` | Concise Markdown schema overview: tables, columns, PKs, FKs, unique/check constraints, defaults. Supports `compact` mode, schema and table filtering. | | `describe_table` | Comprehensive table metadata in Markdown: columns, data types, nullability, defaults, identity, computed expressions, indexes, FKs, constraints. | Schema Exploration (4 tools) | Tool | Description | |------|-------------| | `list_programmable_objects` | Lists views, stored procedures, functions, and triggers. Filterable by type and schema. | | `get_object_definition` | Returns the source definition (CREATE statement) of a programmable object. | | `get_extended_properties` | Reads extended properties (descriptions, metadata) on tables, columns, and other objects. | | `get_object_dependencies` | Shows what an object references and what references it — upstream and downstream dependency graphs. | Diagrams (2 tools) | Tool | Description | |------|-------------| | `get_plantuml_diagram` | Generates a PlantUML ER diagram with tables, columns, PKs, and FK relationships. Saves to a `.puml` file. Supports `compact` mode, schema/table filtering, and a configurable table limit (max 200). | | `get_mermaid_diagram` | Generates a Mermaid ER diagram with tables, columns, PKs, and FK relationships. Saves to a `.mmd` file. Supports `compact` mode, schema/table filtering, and a configurable table limit (max 200). | ### DBA Diagnostic Tools Each toolkit is enabled independently via config flags and requires the corresponding stored procedures installed on the target SQL Server. All DBA tools apply response size optimisation by default — XML query plan columns are excluded and long string values are truncated to keep responses within AI context window limits. Every tool supports these optional parameters: | Parameter | Description | |-----------|-------------| | `verbose` | Return all columns with no truncation. | | `includeQueryPlans` | Include XML execution plan columns in the output. | | `maxRows` | Maximum rows to return per result set. Available on tools with variable-length output: BlitzIndex, BlitzLock, HealthParser, LogHunter (default 200), IndexCleanup, QueryReproBuilder. | Some tools have additional parameters: `includeXmlReports` (BlitzLock, HealthParser, HumanEventsBlockViewer), `compact` (sp_WhoIsActive), `verboseMetrics` (QuickieStore). First Responder Kit (7 tools) — requires EnableFirstResponderKit: true Install from: [github.com/BrentOzarULTD/SQL-Server-First-Responder-Kit](https://github.com/BrentOzarULTD/SQL-Server-First-Responder-Kit) | Tool | Description | |------|-------------| | `sp_blitz` | Overall SQL Server health check — prioritized findings for performance, configuration, and security. | | `sp_blitz_first` | Real-time performance diagnostics — samples DMVs over an interval for waits, file latency, and perfmon counters. | | `sp_blitz_cache` | Plan cache analysis — top queries by CPU, reads, duration, executions, or memory grants. | | `sp_blitz_index` | Index analysis — missing, unused, and duplicate indexes with usage patterns. | | `sp_blitz_who` | Active query monitor — what's running, blocking info, tempdb usage, query plans. | | `sp_blitz_lock` | Deadlock analysis from the `system_health` extended event session. | | `sp_blitz_plan_compare` | Cross-server query plan comparison — captures a plan snapshot on one server and compares it to the cached plan on a second server without using linked servers. Requires the [demon_hunters branch](https://github.com/BrentOzarULTD/SQL-Server-First-Responder-Kit/tree/demon_hunters) until merged to main. | DarlingData (8 tools) — requires EnableDarlingData: true Install from: [g … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [mbentham](https://github.com/mbentham) - **Source:** [mbentham/SqlAugur](https://github.com/mbentham/SqlAugur) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-mbentham-sqlaugur - Seller: https://agentstack.voostack.com/s/mbentham - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.