How is data kept secure?

All queries use parameterized inputs to prevent SQL injection, DDL operations are blocked in custom queries, and connections include validation, health checks, and timeout controls.

Where does the server store configuration?

Database credentials and connection pool settings are stored in a `.env` file or passed as environment variables in the MCP client configuration.

What credentials does it need?

It reads `SQLSERVER_HOST`, `SQLSERVER_USER`, `SQLSERVER_PASSWORD`, `SQLSERVER_DATABASE`, `SQLSERVER_ENCRYPT`, `SQLSERVER_TRUST_CERT` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

MCP Sqlserver MCP Server

# MCP SQL Server [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

Local serverstdioTypeScript

What is the MCP Sqlserver MCP Server?

MCP SQL Server License

What you get

🔒 Read-only operations — Only SELECT queries allowed, with comprehensive security validation
🗄️ Schema discovery — Explore databases, tables, views, relationships, and metadata
📊 Data exploration — Execute safe queries with built-in limits and timeouts
🔐 Enterprise-ready — Encrypted connections with certificate trust for production environments
🛡️ Security-first — Query validation, SQL injection protection, and access controls

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the MCP Sqlserver MCP Server

{
  "mcpServers": {
    "sqlserver": {
      "command": "mcp-sqlserver",
      "env": {
        "SQLSERVER_HOST": "your-server.database.windows.net",
        "SQLSERVER_USER": "your-username",
        "SQLSERVER_PASSWORD": "your-password",
        "SQLSERVER_DATABASE": "your-database",
        "SQLSERVER_ENCRYPT": "true",
        "SQLSERVER_TRUST_CERT": "false"
      }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

Variable	Description	Required
SQLSERVER_HOST	Endpoint or connection string the server talks to.	Optional
SQLSERVER_USER	Configuration value read at startup.	Optional
SQLSERVER_PASSWORD	Configuration value read at startup.	Optional
SQLSERVER_DATABASE	Configuration value read at startup.	Optional
SQLSERVER_ENCRYPT	Configuration value read at startup.	Optional
SQLSERVER_TRUST_CERT	Configuration value read at startup.	Optional