DATABASE DEVELOPMENT / AWS Labs
AWS Labs SQL Server MCP
Pins the AWS Labs SQL Server server, whose default mode blocks mutating keywords and still says that filter is not the security boundary.
“Runs SQL Server queries on RDS, blocks mutating keywords by default, and says a read-only database user is the real boundary.”
01 / THE REASONING
Why this made the selection.
- The catalogue has MySQL and Postgres MCP servers and not this SQL Server server.
- The README says read-only is the default and then lists ways the keyword filter can miss a write.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- src/mssql-mcp-server/README.md
- src/mssql-mcp-server/LICENSE
Our findings
- The tools are run_query, get_table_schema, connect_to_database, is_database_connected, and get_database_connection_info.
- Default mode blocks mutating keywords, looks for injection patterns, sets READ COMMITTED, and rolls back. The README says this is best-effort because a SELECT can still call a procedure that writes.
- Writes require --allow_write_query. The recommended boundary is a SQL login with only read permissions, stored in Secrets Manager.
Not established by this review
- The resource was not executed and its tools were not called.
- No SQL was sent.
- The keyword filter was not tested.
- Secrets Manager was not called.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
- The usage block starts awslabs.mssql-mcp-server with --connection_method MSSQL_PASSWORD and an RDS endpoint. The command is wrapped, so it is not recorded as install.command.
- Leave --allow_write_query off for the default read-only mode.
- Create a read-only SQL login and pass its secret with --secret_arn if the master user should not be used.
Before you start
- An environment that can run awslabs.mssql-mcp-server
- AWS credentials that can read the RDS secret
- A SQL Server login limited to reads
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- SQL Server MCP README ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/README.md
Supports: default read-only mode and its stated limits
- Directory LICENSE ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/LICENSE
Supports: Apache License Version 2.0