Which MCP Servers Connect AI to Databases?

Database MCP servers expose SQL and NoSQL databases to AI assistants through the Model Context Protocol (MCP), the open standard Anthropic created in November 2024. These servers let Claude, Cursor, and VS Code inspect a schema, list tables, and run queries in natural language, so a question in English returns rows from a live database instead of a guess from training data.

Databases are one of the most common MCP use cases, and the category is broad: a dedicated server exists for every major engine. Postgres and Supabase lead by demand, with SQLite, MySQL, MongoDB, Redis, and Snowflake close behind, and managed gateways covering the cloud platforms.

This page covers the two kinds of database MCP server, which servers are available per engine, how to choose, and the one safety rule that applies to every database connection.

Full MCP server directory · What MCP is and how it works

What Do Database MCP Servers Expose?

Database MCP servers expose schema inspection, table listing, and query execution to any MCP-compatible AI application, so the model reads structure and runs queries through tool calls.

Two kinds of server cover this category, and the distinction decides what each one can do. Connection wrappers take a database connection string and expose tools like query and execute directly against the engine. They are the database equivalent of a command-line client with an AI interface, and most per-engine servers are built this way. Managed gateways expose a cloud platform’s own API through MCP, so the server inherits that platform’s authentication and permission model instead of holding a raw connection string. Cloud database providers ship these for their own platforms.

Every database server exposes MCP tools, not resources or prompts; the interaction is tool calls throughout. Each call consumes 500 to 2,000 tokens of context window, so a targeted query beats dumping a full schema. The practical value is direct: the model inspects the schema, writes the SQL, runs it, and explains the result, replacing a hand-written query and a copy-paste back into the chat.

Which Database MCP Servers Are Available?

A dedicated server exists for every major database engine, led by Postgres and Supabase. Each capsule names the engine it serves, its server type, and where to go for the full guide.

Postgres

The Postgres MCP server connects AI assistants to PostgreSQL databases for schema inspection, EXPLAIN plans, and safe SQL execution. It is the highest-demand database server, and the implementation landscape shifted after Anthropic’s reference server was deprecated in July 2025: current setups run Crystal DBA’s Postgres MCP Pro, the Zed Industries security fork, or pgEdge. The full guide covers the connection string, three install methods, and the read-only safety model: Postgres MCP server setup and safe SQL.

Supabase

The Supabase MCP server exposes Supabase projects: the Postgres database, auth, storage, edge functions, and SQL workflows through one server. Supabase maintains it, which makes it a vendor-class server rather than a community wrapper, and the dedicated page covers project-scoped access and its OAuth model: Supabase MCP server guide.

SQLite, MySQL, MongoDB, Redis, Snowflake

Five more engines have dedicated pages, each a single comprehensive guide to that server:

• SQLite: the embedded-database server for local files and prototypes, the lightest database connection in the category.
• MySQL: the relational server for MySQL and MariaDB schemas and queries.
• MongoDB: the document-database server exposing collections and aggregation.
• Redis: the key-value and cache server for fast lookups and state.
• Snowflake: the data-warehouse server for analytical queries at scale.

SQL Server, Oracle, and managed gateways

Two enterprise engines and the cloud gateways earn directory rows, each warranting a commit-history check before install, the recency test every server gets:

• Microsoft SQL Server: Microsoft’s MCP server connects AI agents to SQL Server and Azure SQL.
• Oracle Database: the SQLcl MCP server connects to Oracle Database.
• Cloud gateways: Neon, Google Cloud SQL Toolbox, and Amazon Aurora expose managed Postgres and MySQL through platform-native IAM permissions.

How Do You Choose a Database MCP Server?

Choose the server that matches your database engine. Each server connects to one engine, so the database you run dictates the server you install.

Three questions settle the rest:

1. Which engine? PostgreSQL takes the Postgres server, MySQL the MySQL server, MongoDB the MongoDB server. A team on Supabase takes the Supabase server, which wraps Postgres plus the rest of the platform. The engine is the decision.
2. Self-hosted or cloud-managed? A database on your own infrastructure takes a connection-wrapper server with a connection string. A database on Neon, Supabase, or a cloud platform takes that provider’s managed gateway, which handles auth through the platform.
3. Read-only or read-write? Analytics and exploration take a server configured read-only. Workflows that modify data take read-write, scoped to a dedicated database role, never a superuser account.

Every server above connects an AI model to a live database. One rule applies to all of them before the first query.

What Is the One Safety Rule for Database MCP Servers?

Connect the model through a dedicated read-only database role, never a superuser account. A model that can run arbitrary SQL through a write-capable connection can drop a table, truncate data, or alter a schema, and autonomous agents do exactly what their tools permit.

The risk is not theoretical. Security researchers found a SQL injection in Anthropic’s reference Postgres server that bypassed its read-only transaction wrapper, because the server accepted stacked statements separated by semicolons (Datadog Security Labs, August 2025). Three controls cover the category:

• Dedicated role. Create a database user with CONNECT, USAGE, and SELECT on the schemas the model needs, and nothing else. Read-only at the role level holds even when a server’s own guardrail fails.
• Read-only mode where the server offers it. Servers like Postgres MCP Pro expose an access-mode flag; set it to read-only for any analytics workflow.
• Secrets in environment variables. Connection strings carry passwords. Inject them through environment variables, never hardcoded in a config file in plain text.

The per-engine specifics, including the semicolon-bypass mechanism in full, are on the Postgres server page.

Database MCP Server Questions

Can MCP Connect to a Database?

Yes. MCP connects AI assistants to databases through engine-specific servers that expose schema inspection and query execution. A connection-wrapper server takes a connection string and runs SQL directly; a managed gateway routes through a cloud platform’s API. Both let the model query a live database in natural language. The constraint is access scope, not capability: connect through a read-only role unless the workflow needs writes.

Is There an MCP Server for SQL Server?

Yes. Microsoft maintains an MCP server for SQL Server and Azure SQL that runs queries through natural-language prompts. It is a managed integration rather than a community wrapper, and it sits alongside dedicated servers for PostgreSQL, MySQL, MongoDB, and the other major engines. Each connects to its own engine; there is no single server for all databases at once.

What Is a Database MCP Server?

A database MCP server is a program that exposes one database engine to AI assistants, translating natural-language requests into schema reads and SQL queries. It comes in two forms: a connection wrapper that holds a database connection string, or a managed gateway that routes through a cloud platform’s API. The server runs the query against the engine and returns the rows to the model.

The category started with one question: which engine holds your data. Pick the engine above, and the matching server page carries the connection details and the safety model.