Mcp Xamp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Xamp (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that gives Claude Code and OpenCode direct access to your XAMPP MariaDB/MySQL databases. Five tools: list databases, list tables, describe table, read query, write query.
list_databases, read_query, etc.No global install needed — runs directly with uv run.
localhost:3306git clone https://github.com/<user>/mcp-xamp.git
cd mcp-xamp
uv syncVerify it works:
uv run mcp-xampIf you prefer mcp-xamp available as a command anywhere:
uv tool install --python 3.13 .Then use "command": "mcp-xamp" instead of uv run --directory ... in the configs below.
Instala mcp-xamp como comando global y registralo en Claude Code:
uv tool install --python 3.13 .Luego agregá el server MCP. Elegí el scope que prefieras:
# Scope project (crea .mcp.json en el directorio actual)
claude mcp add xamp \
-e MCP_XAMP_HOST=localhost \
-e MCP_XAMP_PORT=3306 \
-e MCP_XAMP_USER=root \
-e MCP_XAMP_PASSWORD= \
-e MCP_XAMP_ALLOW_WRITE=true \
-- mcp-xamp
# Scope user (disponible en todos tus proyectos)
claude mcp add --scope user xamp \
-e MCP_XAMP_HOST=localhost \
-e MCP_XAMP_PORT=3306 \
-e MCP_XAMP_USER=root \
-e MCP_XAMP_PASSWORD= \
-e MCP_XAMP_ALLOW_WRITE=true \
-- mcp-xampAjusta los valores de las variables según tu instalacion de XAMPP.
Si preferis no instalar globalmente, apunta al directorio del repo:
claude mcp add xamp \
-e MCP_XAMP_HOST=localhost \
-e MCP_XAMP_PORT=3306 \
-e MCP_XAMP_USER=root \
-e MCP_XAMP_PASSWORD= \
-e MCP_XAMP_ALLOW_WRITE=true \
-- uv run --directory /ruta/a/mcp-xamp mcp-xampReemplaza /ruta/a/mcp-xamp con la ruta real donde clonaste el repo.
Si preferis editar el archivo a mano, tambien funciona:
{
"mcpServers": {
"xamp": {
"command": "mcp-xamp",
"args": [],
"env": {
"MCP_XAMP_HOST": "localhost",
"MCP_XAMP_PORT": "3306",
"MCP_XAMP_USER": "root",
"MCP_XAMP_PASSWORD": "",
"MCP_XAMP_ALLOW_WRITE": "true"
}
}
}
}Si no instalaste globalmente, usa "command": "uv" con los args correspondientes (ver el .mcp.json de este repo como referencia).
Dentro de Claude Code, corre /mcp para confirmar que xamp aparece como conectado. Despues proba:
List all databases on my XAMPP server.OpenCode reads MCP config from opencode.json or opencode.jsonc. The file can be in:
| Location | Scope |
|---|---|
<project-root>/opencode.json | Project-specific |
<project-root>/.opencode/opencode.json | Project-specific (alt) |
~/.config/opencode/opencode.json | Global (all projects) |
Add this block to your opencode.json or opencode.jsonc:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xamp": {
"type": "local",
"command": ["uv", "run", "--directory", "/path/to/mcp-xamp", "mcp-xamp"],
"enabled": true,
"environment": {
"MCP_XAMP_ALLOW_WRITE": "true"
}
}
}
}Replace /path/to/mcp-xamp with your actual clone path.
If you used uv tool install, simplify to:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xamp": {
"type": "local",
"command": ["mcp-xamp"],
"enabled": true,
"environment": {
"MCP_XAMP_ALLOW_WRITE": "true"
}
}
}
}Restart OpenCode, then try:
Show me all databases on the xamp server. use xamp toolsAll configuration goes through environment variables. Sensible defaults for a standard XAMPP installation.
| Variable | Default | Description |
|---|---|---|
MCP_XAMP_HOST | 127.0.0.1 | MariaDB/MySQL host |
MCP_XAMP_PORT | 3306 | MariaDB/MySQL port |
MCP_XAMP_USER | root | Database user |
MCP_XAMP_PASSWORD | (empty) | Database password |
MCP_XAMP_ALLOW_WRITE | false | Set to true to enable INSERT/UPDATE/DELETE/DDL |
Credentials are read from environment variables only. They never appear in tool arguments, log output, or error messages.
| Tool | Description | Requires |
|---|---|---|
list_databases | Show all accessible databases | — |
list_tables | Show tables in a database | database |
describe_table | Show columns, types, and keys | database, table |
read_query | Execute SELECT / SHOW / DESCRIBE / EXPLAIN | database, query |
write_query | Execute INSERT / UPDATE / DELETE / DDL | database, query, MCP_XAMP_ALLOW_WRITE=true |
MCP_XAMP_ALLOW_WRITE=true.error messages.
no CLI args.
connection — no shared state, no stale connections.
production use:
CREATE USER 'mcp_agent'@'127.0.0.1' IDENTIFIED BY 'secure_password';
GRANT SELECT ON *.* TO 'mcp_agent'@'127.0.0.1';# Install dev dependencies
uv sync --group dev
# Run tests
uv run pytest -v --cov=src/mcp_xamp
# Lint
uv run ruff check src/ tests/
# Format
uv run ruff format src/ tests/MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.