Model Context Protocol moderate risk

Sqlalchemy

MCP server for ODBC databases using SQLAlchemy, enabling schema exploration, data querying, and stored procedure execution with various output formats.

Connections & Capabilities

Connects To

GitHubPostgreSQLMySQLSQLite

Capabilities

readwriteexec

Quickstart

Install

pip install uv

Config

{
  "mcpServers": {
    "my_database": {
      "command": "uv",
      "args": ["--directory", "/path/to/mcp-sqlalchemy-server", "run", "mcp-sqlalchemy-server"],
      "env": {
        "ODBC_DSN": "dsn_name",
        "ODBC_USER": "username",
        "ODBC_PASSWORD": "password",
        "API_KEY": "sk-xxx"
      }
    }
  }
}

Exposed MCP Tools (10)

safe

podbc_get_schemas

Retrieves a list of available database schemas.

Read-only operation, no data modification.

safe

podbc_get_tables

Lists tables within a specified database schema.

Read-only operation, no data modification.

safe

podbc_describe_table

Provides details about the structure of a specified table.

Read-only operation, no data modification.

safe

podbc_filter_table_names

Lists tables based on a substring pattern.

Read-only operation, no data modification.

moderate

podbc_query_database

Executes a SQL query and returns results in JSON format.

Potential SQL injection if the query is not properly sanitized.

moderate

podbc_execute_query

Executes a SQL query and returns results in JSONL format.

Potential SQL injection if the query is not properly sanitized.

moderate

podbc_execute_query_md

Executes a SQL query and returns results in Markdown table format.

Potential SQL injection if the query is not properly sanitized.

moderate

podbc_spasql_query

Executes a SPASQL query (Virtuoso-specific).

SPASQL queries can modify data or execute SPARQL queries with potential side effects.

moderate

podbc_sparql_query

Executes a SPARQL query (Virtuoso-specific).

SPARQL queries can potentially have side effects depending on the endpoint configuration.

moderate

podbc_virtuoso_support_ai

Interacts with the Virtuoso Support Assistant/Agent using a prompt.

Interaction with AI assistant might lead to unintended actions based on the prompt.

Safety Assessment

This server offers both read and write capabilities to a database. It's safe for read-only operations like schema exploration and table description. However, executing arbitrary SQL queries and stored procedures poses a moderate risk due to potential SQL injection and unintended side effects.

Read-only operations available (schemas, table descriptions)
Authentication via username/password and API Key
Limited write operations through stored procedures (Virtuoso)
SQL query execution is parameterized, reducing injection risk

Direct SQL query execution exposes potential SQL injection vulnerabilities
Stored procedure execution can have arbitrary effects depending on the procedure
Improperly configured ODBC DSN can expose sensitive database credentials
No built-in rate limiting or resource controls
API Key is passed as an environment variable, which can be insecure if not managed properly