Security-first MCP server for PostgreSQL, SQLite, MySQL, DuckDB with SQL injection prevention.
If you already use Universal, the universal mcp server is the piece that lets your assistant work with it directly. Security-first MCP server for PostgreSQL, SQLite, MySQL, DuckDB with SQL injection prevention.
Most database MCP servers give AI agents raw SQL access and hope for the best. This server assumes the LLM is untrusted input and applies 8 layers of injection prevention before any query reaches your database — including blocking UNION attacks, stacked statements, time-based injection, and comment bypasses.
The toolset is worth reading before you wire it up, because it tells you what the integration is really for:
query — Execute SQL — read-only by default, all 8 security layers applyschema — Inspect tables and columns — no config neededexplain — Get query execution plan without running the queryhealth — Check connection status, DB version, and pool metricslist_databases — Show all configured databases and connection statequery_history — Inspect the last 100 executed queriessnapshot_schema — Capture current schema for drift detectionschema_diff — Compare current schema against the last snapshotInstallation goes through your MCP client rather than a global install: point it at universal-db-mcp on PyPI and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Configuration is passed through the environment: SQLITE_PATH, ALLOW_DESTRUCTIVE, DUCKDB_PATH. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Among the database access options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Universal's toolset — query, schema, explain and 5 more — is a fair guide to whether it matches your workflow. It is maintained by Fashad-Ahmed; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| query | Execute SQL — read-only by default, all 8 security layers apply |
| schema | Inspect tables and columns — no config needed |
| explain | Get query execution plan without running the query |
| health | Check connection status, DB version, and pool metrics |
| list_databases | Show all configured databases and connection state |
| query_history | Inspect the last 100 executed queries |
| snapshot_schema | Capture current schema for drift detection |
| schema_diff | Compare current schema against the last snapshot |
{
"mcpServers": {
"universal-db": {
"command": "uvx",
"args": ["universal-db-mcp"],
"env": {
"SQLITE_PATH": "your-value",
"ALLOW_DESTRUCTIVE": "your-value",
"DUCKDB_PATH": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| SQLITE_PATH | Filesystem location the server is allowed to use. | Optional |
| ALLOW_DESTRUCTIVE | Configuration value read at startup. | Optional |
| DUCKDB_PATH | Filesystem location the server is allowed to use. | Optional |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.