SqlAugur

-

AST-level query validation— Most MCP database servers use keyword blocking or no validation at all. This project parses every query into a full syntax tree using Microsoft's officialTSql180Parser. Comment injection, string literal tricks, and encoding bypasses are blocked at the syntax level, not with fragile regex patterns.

Rate limiting— Token bucket throughput limiting and concurrency control prevent runaway AI query loops from overwhelming production SQL Servers. No other MCP database server offers this.

DBA diagnostic tooling— Integrated support for First Responder Kit, DarlingData, and sp_WhoIsActive with parameter blocking that prevents write operations. This is an entirely new MCP capability category.

Response size optimisation— DBA tools exclude verbose columns (XML query plans, deadlock graphs, metric breakdowns) and truncate long strings by default, reducing response sizes by 90–99%. UseverboseandincludeQueryPlansparameters to get full untruncated output when needed.

Progressive discovery— Up to 31 tools organized into toolsets that load on demand. Only 6 core tools are exposed initially, keeping the AI's context window small and reducing token usage. Additional toolsets are discovered and enabled as needed.

All methods produce the same MCP server. Follow this order: install, save config, wire client, verify.

# Linux/macOS mkdir -p ~/.config/sqlaugur # Edit ~/.config/sqlaugur/appsettings.json with your server connections # Windows (PowerShell) mkdir "$env:APPDATA\sqlaugur" -Force # Edit %APPDATA%\sqlaugur\appsettings.json with your server connections

Exampleappsettings.jsonto save at that location:

{ "SqlAugur": { "Servers": { "production": { "ConnectionString": "Server=myserver;Database=master;Integrated Security=True;TrustServerCertificate=False;Encrypt=True;" } } } }

{ "mcpServers": { "sqlaugur": { "command": "sqlaugur" } } }

To update:dotnet tool update -g SqlAugur

# Volume-mount a config file docker run -i --rm \ -v /path/to/appsettings.json:/app/appsettings.json:ro,Z \ ghcr.io/mbentham/sqlaugur:latest # Or use environment variables (no config file needed) docker run -i --rm \ -e SqlAugur__Servers__production__ConnectionString="Server=host.docker.internal;Database=master;..." \ ghcr.io/mbentham/sqlaugur:latest

Note:To reach a SQL Server on the host machine, usehost.docker.internal(Docker Desktop) or--network=host(Linux). Replacedockerwithpodman— all commands are identical. The:Zflag on volume mounts is required for SELinux-enabled systems (Fedora, RHEL); Docker Desktop users on macOS/Windows can omit it.

If you mount a config file, save it as/path/to/appsettings.jsonand mount it to/app/appsettings.json.

The server provides 31 tools organized into toolsets. Six core tools are always available. Additional toolsets are loaded at startup (static mode) or on demand (dynamic mode).

Each toolkit is enabled independently via config flags and requires the corresponding stored procedures installed on the target SQL Server.

All DBA tools apply response size optimisation by default — XML query plan columns are excluded and long string values are truncated to keep responses within AI context window limits. Every tool supports these optional parameters:

Some tools have additional parameters:includeXmlReports(BlitzLock, HealthParser, HumanEventsBlockViewer),compact(sp_WhoIsActive),verboseMetrics(QuickieStore).

WhenEnableDynamicToolsetsis true, only core tools load at startup. Three meta-tools let the AI discover and enable additional toolsets on demand, reducing initial context window usage:
- AI callslist_toolsets— seesfirst_responder_kitis "available" (configured but not yet enabled)
- AI callsget_toolset_tools("first_responder_kit")— reviews the 7 tools and their parameters
- AI callsenable_toolset("first_responder_kit")— the 7 tools are now registered and usable
- AI callssp_blitz— runs the health check as normal

In static mode (EnableDynamicToolsets: false), all enabled toolsets load at startup and the discovery tools are not registered. Schema Exploration and Diagrams toolsets are always loaded regardless of mode.

- Single statement only— multiple statements are rejected
- SELECT only— INSERT, UPDATE, DELETE, DROP, EXEC, CREATE, ALTER, and all other statement types are blocked
- No SELECT INTO— prevents table creation via SELECT
- No external data access— OPENROWSET (all variants including BULK, Cosmos DB, and internal), OPENQUERY, OPENDATASOURCE, OPENXML blocked
- No linked servers— four-part name references are rejected
- No MAXRECURSION hint— prevents overriding the default recursion limit
- Cross-database queries are allowed— three-part names work by design; the security boundary is the server, not the database. To restrict to a single database, limit the login's permissions.

Because validation operates on the parsed AST, it correctly handles edge cases that defeat string-based approaches: keywords inside comments, string literals, nested block comments, and encoding tricks.

Diagnostic stored procedures execute via whitelisted procedure names with blocked parameters that prevent writes:

- First Responder Kit— all@Output*parameters blocked (prevents writing results to server tables)
- DarlingData— logging and output parameters blocked (prevents table creation and data retention)
- sp_WhoIsActive—@destination_table,@return_schema,@schema,@helpblocked

All tool executions are subject to concurrency limiting (MaxConcurrentQueries, default 5) and throughput limiting (MaxQueriesPerMinute, default 60). Excess requests are rejected with a retry message.

Official MCP server for dbt (data build tool) providing integration with dbt Core/Cloud CLI, project metadata discovery, model information, and semantic layer querying capabilities.

Query and analyze data with MotherDuck and local DuckDB

A collection of tools for managing the platform, addressing data quality and reading and writing to Teradata Database.

A read-only MCP server for Avro data sources, powered by the CData JDBC Driver.

Run SQL queries on data in Amazon S3 using AWS Athena.

Interact with Bauplan data tables and run queries.

Production-grade MCP server for Databricks: SQL Warehouses, Jobs API, multi-workspace support.

Visual no-code generator that turns any database into multiple scoped MCP servers — one per access group, with PII masking and fail-closed query scoping built in.

A read-only MCP server by CData that enables LLMs to query live data from EnterpriseDB databases.