Is Mcp Oracle Db safe to install?

SaferSkills independently audited Mcp Oracle Db (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md3.7 KB · Markdown

mcp-oracle-db

An MCP (Model Context Protocol) server for Oracle Database.

Lets AI assistants explore your database schema, run queries, write data, and monitor sessions — all through natural language.

Works with Claude Desktop, Claude Code, Cursor, Windsurf, and any MCP-compatible client.

Features

Explore — list schemas, tables, columns, indexes, constraints
Query — execute SELECT with bind variables
Write — INSERT, UPDATE, DELETE, MERGE, DDL (opt-in)
Monitor — explain plans, active sessions, locks
Safe — read-only by default, write requires explicit opt-in
Zero install — Oracle Thin mode, no Oracle Client needed
Connection pooling — efficient resource usage

Quick Start

npx mcp-oracle-db

Or install globally:

npm install -g mcp-oracle-db

Configuration

Set these environment variables:

Variable	Required	Default	Description
`ORACLE_USER`	Yes	—	Database username
`ORACLE_PASSWORD`	Yes	—	Database password
`ORACLE_CONNECTION_STRING`	Yes	—	`host:port/service` or TNS alias
`ORACLE_MODE`	No	`readonly`	`readonly` or `readwrite`
`ORACLE_MAX_ROWS`	No	`1000`	Max rows per query
`ORACLE_TNS_ADMIN`	No	—	Path to `tnsnames.ora` directory
`ORACLE_WALLET_LOCATION`	No	—	Path to Oracle Wallet (for cloud DBs)

Connection string formats

# Standard
ORACLE_CONNECTION_STRING=myhost:1521/myservice

# TNS alias
ORACLE_CONNECTION_STRING=MY_TNS_ALIAS
ORACLE_TNS_ADMIN=/path/to/tns_admin

# Oracle Cloud / Autonomous DB (wallet)
ORACLE_CONNECTION_STRING=myatp_high
ORACLE_TNS_ADMIN=/path/to/wallet
ORACLE_WALLET_LOCATION=/path/to/wallet

Setup

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "oracle": {
      "command": "npx",
      "args": ["-y", "mcp-oracle-db"],
      "env": {
        "ORACLE_USER": "your_user",
        "ORACLE_PASSWORD": "your_password",
        "ORACLE_CONNECTION_STRING": "your_host:1521/your_service"
      }
    }
  }
}

Claude Code

Add to .claude/settings.json:

{
  "mcpServers": {
    "oracle": {
      "command": "npx",
      "args": ["-y", "mcp-oracle-db"],
      "env": {
        "ORACLE_USER": "your_user",
        "ORACLE_PASSWORD": "your_password",
        "ORACLE_CONNECTION_STRING": "your_host:1521/your_service"
      }
    }
  }
}

Cursor / Windsurf

Same format as Claude Code — add to your MCP settings with the env vars above.

Tools

Exploration

Tool	Description
`list_schemas`	List all accessible schemas
`list_tables`	List tables and views in a schema
`describe_table`	Columns, PKs, FKs, indexes of a table

Query

Tool	Description
`query`	Run SELECT queries (supports bind variables)

Write (requires `ORACLE_MODE=readwrite`)

Tool	Description
`execute`	Run DML — INSERT, UPDATE, DELETE, MERGE
`ddl`	Run DDL — CREATE, ALTER, DROP, TRUNCATE

DBA / Monitoring

Tool	Description
`explain_plan`	Execution plan for a query
`session_info`	Current session details
`active_sessions`	All active database sessions
`locks`	Active locks and blockers

Security

Read-only by default — writes blocked unless ORACLE_MODE=readwrite
SQL validation — query only accepts SELECT/WITH
Bind variables — prevents SQL injection
No credentials in code — everything via environment variables

Requirements

Node.js >= 18
Oracle Database (any version)
No Oracle Client installation needed

License

MIT

Mcp Oracle Db— agent skill

Is Mcp Oracle Db safe to install?

mcp-oracle-db

Features

Quick Start

Configuration

Connection string formats

Setup

Claude Desktop

Claude Code

Cursor / Windsurf

Tools

Exploration

Query

Write (requires `ORACLE_MODE=readwrite`)

DBA / Monitoring

Security

Requirements

License

Audit the pieces. Scan the whole. Decide.