$ show benborla/mcp-server-mysql
This is an MCP (Model Context Protocol) server implementation that provides LLMs with MySQL database access. The server exposes a single `mysql_query` tool for executing SQL queries and resources for listing tables and column metadata. It supports both stdio and HTTP transport modes, the latter with bearer token authentication. Key features include multi-database mode (querying across schemas without reconnection), schema-specific write permissions (INSERT/UPDATE/DELETE/DDL per database), SSL/TLS with mTLS, Unix socket connections, and a sophisticated PII redaction system that combines column-name heuristics with regex value scanning and Luhn-verified credit card detection. The architecture is monolithic: a single Express server (or stdio process) manages a mysql2 connection pool and routes all MCP protocol requests through zod-validated schemas. The codebase is well-tested with unit, integration, and end-to-end test suites, and demonstrates careful engineering in areas like query parsing (using node-sql-parser), permission enforcement, and secure defaults (write operations disabled by default).
The LLM identified 3 files worth highlighting for reuse:
A self-contained PII detection and masking module that recursively walks query result structures and replaces sensitive values with shape-preserving partial masks. Detection combines a built-in column-name substring heuristic (email, ssn, phone, first_name, address, credit_card, password, etc.) with regex scanning of actual values (email, US phone, SSN, IPv4, Luhn-valid credit card numbers). Configuration supports operator-defined column names and custom regex patterns. Masks are context-aware: e.g., email columns produce 'j***@e***.com', while phone columns become '***-***-0134'. Also handles JSON strings inside audit columns like `new_value` by recursively parsing and redacting. The module is importable with minimal dependencies (only a logging utility) and could be extracted into its own npm package for use in any data redaction pipeline.
A standalone function `parseMySQLConnectionString` that parses MySQL CLI-format connection strings (e.g., `mysql --default-auth=mysql_native_password -A -hHOST -PPORT -uUSER -pPASS database_name`) into a structured config object. Handles both short options (`-h`, `-P`, `-u`, `-p`, `-S`) and long options (`--host=`, `--port=`, `--user=`, `--password=`, `--socket=`), including attached and detached argument forms. Properly manages quoted arguments and positional database name detection. Also includes `parseSchemaPermissions` for parsing schema-specific permission environment variables. These utilities are completely isolated, with no internal imports beyond local types, making them directly reusable in any Node.js MySQL tool or connection management system.
A collection of SQL analysis utilities built on node-sql-parser that powers the server's permission checks and PII guards. `getQueryTypes` classifies SQL statements (SELECT, INSERT, UPDATE, DELETE, EXPLAIN, DDL) with special handling for MySQL EXPLAIN modifiers (ANALYZE, FORMAT=JSON, EXTENDED, PARTITIONS). `containsSelectStar` walks the AST to detect `SELECT *` and `t.*` projections while correctly passing through aggregates like `COUNT(*)`. `findPIIColumnReferences` recursively walks the entire AST (projection, WHERE, JOIN, ORDER BY, subqueries, CTEs) to find any reference to PII-tagged columns, closing alias-bypass attacks. `isIntrospectionQuery` classifies queries as row-filterable introspection (SHOW COLUMNS, DESCRIBE, SHOW INDEX) vs. blockable (SHOW CREATE TABLE, information_schema SELECTs). These utilities solve recurring SQL analysis problems and could be extracted into a standalone package for any application needing AST-based SQL introspection.