--- title: "AWS Labs SQL Server MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/awslabs-mssql/ description: "Pins the AWS Labs SQL Server server, whose default mode blocks mutating keywords and still says that filter is not the security boundary." --- # AWS Labs SQL Server MCP: review, setup & limitations · Undominated.ai > Pins the AWS Labs SQL Server server, whose default mode blocks mutating keywords and still says that filter is not the security boundary. [← Explore all mcp servers](/mcp-servers/) DATABASE DEVELOPMENT / AWS Labs # AWS Labs SQL Server MCP Pins the AWS Labs SQL Server server, whose default mode blocks mutating keywords and still says that filter is not the security boundary. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/awslabs/mcp/tree/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher AWS Labs Licence [Apache-2.0 ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/LICENSE) Revision 8840003820a7 [Read what was—and wasn’t—checked ↓](#review) “Runs SQL Server queries on RDS, blocks mutating keywords by default, and says a read-only database user is the real boundary.” [AWS Labs · upstream description ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/README.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The catalogue has MySQL and Postgres MCP servers and not this SQL Server server. - The README says read-only is the default and then lists ways the keyword filter can miss a write. ### A good fit for - Reading an RDS SQL Server database with a login that has only read permissions ### Weigh up before choosing - This review did not execute the resource. - The usage command is split across several lines, so install.command is null. - The README never says stdio. A transport was not inferred. - The README does not mention a licence. The directory LICENSE is Apache-2.0. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - src/mssql-mcp-server/README.md - src/mssql-mcp-server/LICENSE ### Our findings - The tools are run_query, get_table_schema, connect_to_database, is_database_connected, and get_database_connection_info. - Default mode blocks mutating keywords, looks for injection patterns, sets READ COMMITTED, and rolls back. The README says this is best-effort because a SELECT can still call a procedure that writes. - Writes require --allow_write_query. The recommended boundary is a SQL login with only read permissions, stored in Secrets Manager. ### Not established by this review - The resource was not executed and its tools were not called. - No SQL was sent. - The keyword filter was not tested. - Secrets Manager was not called. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/README.md) - The usage block starts awslabs.mssql-mcp-server with --connection_method MSSQL_PASSWORD and an RDS endpoint. The command is wrapped, so it is not recorded as install.command. - Leave --allow_write_query off for the default read-only mode. - Create a read-only SQL login and pass its secret with --secret_arn if the master user should not be used. ### Before you start - An environment that can run awslabs.mssql-mcp-server - AWS credentials that can read the RDS secret - A SQL Server login limited to reads ### Compatibility MCP clients that can launch a local command ### Implementation python ### SQL Server reads by default, with a keyword filter the README does not call a boundary - Run queries the database login allows - Block mutating keywords only in the default mode - Use a read-only login as the enforcement the README recommends ### Cost model Apache-2.0; no RDS connection was opened 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [SQL Server MCP README ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/README.md Supports: default read-only mode and its stated limits - [Directory LICENSE ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/mssql-mcp-server/LICENSE Supports: Apache License Version 2.0 KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### AWS Labs Postgres MCP ↗ Pins the AWS Labs Postgres server whose read-only guard parses SQL with pglast and still tells operators to use a least-privilege role.](/mcp-servers/awslabs-postgres/)[### Timestream for InfluxDB MCP ↗ Pins the Timestream for InfluxDB MCP server, which refuses mutating tools unless ALLOW_WRITE is set at startup.](/mcp-servers/awslabs-timestream-influxdb/)[### Aurora DSQL MCP ↗ AWS Labs MCP server that turns questions into Postgres-compatible SQL for Aurora DSQL, read-only unless --allow-writes is passed, and only on the same host as the client.](/mcp-servers/awslabs-aurora-dsql/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)