dbmcp-sql

SQL validation, identifier quoting, pagination, and timeout helpers powering dbmcp — the single-binary MCP server for MySQL, MariaDB, PostgreSQL, and SQLite.

What you get

• Read-only enforcement: only SELECT, SHOW, DESC, DESCRIBE, USE allowed
• AST-based validation via sqlparser (comments + string contents stripped first)
• Blocks file-exfiltration patterns (LOAD_FILE, SELECT INTO OUTFILE/DUMPFILE)
• Identifier validation + per-backend quoting — no string interpolation
• Server-controlled LIMIT / OFFSET rewriting for paginated SELECTs
• Query-level timeout wrapper shared across backends

See the main crate: dbmcp · Website · Docs