Sqlservermcp.Nuget — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Sqlservermcp.Nuget (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.Nithish1206/SqlServerMcp --> <!-- mcp-description: MCP server for SQL Server — schema inspection, safe read-only queries, and query plan analysis --> <!-- mcp-tags: sql-server, mcp, database, dotnet-tool -->
A Model Context Protocol (MCP) server for SQL Server. Exposes schema inspection, safe read-only queries, and query plan analysis as MCP tools.
How it works: This server does not accept natural-language questions. Instead, the connected AI tool (the MCP client) decides and generates the SQL query based on the user's intent and the schema it inspects via the tools below. The server only executes the SQL the AI produces, under the safety rules described in Safety.
dotnet tool install -g SqlServerMcpConfiguration is done entirely through environment variables in your MCP client config. No need to edit any files — just add your connection strings and query settings directly in the env block.
Add the following to your MCP client configuration (e.g. Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"sqlserver": {
"command": "sqlservermcp",
"env": {
"ConnectionStrings__MyDb": "Server=localhost;Database=MyDatabase;Trusted_Connection=True;TrustServerCertificate=True;",
"Query__DefaultTop": "1000",
"Query__MaxTop": "500000"
}
}
}
}| Variable | Description |
|---|---|
ConnectionStrings__<name> | SQL Server connection string. Add multiple with different names. |
Query__DefaultTop | Default row limit for queries (default: 1000) |
Query__MaxTop | Maximum allowed row limit (default: 500000) |
Note: Use double underscores (__) as the separator — this is the .NET configuration convention for environment variables.You can configure multiple databases by adding multiple connection string variables:
{
"env": {
"ConnectionStrings__Production": "Server=prod-server;Database=ProdDb;...",
"ConnectionStrings__Staging": "Server=staging-server;Database=StagingDb;..."
}
}Then use the ListDatabases tool to see available names, and pass the database name to any query tool.
| Tool | Description |
|---|---|
ListDatabases | List available database names configured in this server |
ListTables | List all user tables in a database |
DescribeTable | Describe columns of a specific table (schema.table format) |
GetDatabaseSchema | Return full database schema: tables, columns, PKs, FKs |
SearchSchema | Search tables and columns by keyword |
RunQuery | Execute a safe read-only SELECT query with auto row-limiting |
ExplainQuery | Explain a SELECT query using estimated execution plan |
Prompt:
"Using the `MyDb` database, show me the top 5 customers by total order amount in 2025."
The AI generates and executes the query by calling SearchSchema / DescribeTable to discover the tables, then passing this SQL to RunQuery:
SELECT TOP 5 c.CustomerId, c.Name, SUM(o.TotalAmount) AS TotalSpent
FROM dbo.Customers c
JOIN dbo.Orders o ON o.CustomerId = c.CustomerId
WHERE YEAR(o.OrderDate) = 2025
GROUP BY c.CustomerId, c.Name
ORDER BY TotalSpent DESC;Expected output:
| CustomerId | Name | TotalSpent |
|---|---|---|
| 1042 | Acme Corp | 184500.00 |
| 778 | Globex Ltd | 162300.50 |
| 2310 | Initech | 149875.25 |
| 915 | Soylent Inc | 138420.00 |
| 604 | Umbrella Co | 121990.75 |
Disclaimer: The accuracy of the generated SQL and the final output depends on the AI model you select in your MCP client. More capable models produce more reliable queries; weaker models may misinterpret the schema or the intent of the prompt.
SELECT queries are allowed — all write operations are blockedMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.