MySQL MCP Server: Connect AI Agents to MySQL

What it is: There is no single official MySQL MCP server, but several well-used community options expose MySQL schema introspection and SQL execution over the Model Context Protocol. The most popular are @benborla29/mcp-server-mysql on npm (Node, defaults to read-only) and mysql_mcp_server on PyPI (Python). Either lets Claude Code, Claude Desktop, or Cursor list tables, read column metadata, and run queries against your database.

Which MySQL MCP server should I use?

Both leading community servers work with any MCP client; pick by runtime. If you already have Node, @benborla29/mcp-server-mysql is the common choice — it ships read-only by default with separate ALLOW_INSERT/UPDATE/DELETE flags. If your stack is Python, mysql_mcp_server installs with pip or runs via uvx. Because these are community-maintained, check the repo's recent activity before adopting one for team use.

Install & configure

For Claude Code, one command registers the server:

claude mcp add mysql \
  -e MYSQL_HOST=127.0.0.1 -e MYSQL_PORT=3306 \
  -e MYSQL_USER=claude_ro -e MYSQL_PASS=your_password \
  -e MYSQL_DB=mydb \
  -- npx -y @benborla29/mcp-server-mysql

For Claude Desktop, add to claude_desktop_config.json (Cursor uses the same JSON shape in .cursor/mcp.json):

{
  "mcpServers": {
    "mysql": {
      "command": "npx",
      "args": ["-y", "@benborla29/mcp-server-mysql"],
      "env": {
        "MYSQL_HOST": "127.0.0.1",
        "MYSQL_PORT": "3306",
        "MYSQL_USER": "claude_ro",
        "MYSQL_PASS": "your_password",
        "MYSQL_DB": "mydb",
        "ALLOW_INSERT_OPERATION": "false",
        "ALLOW_UPDATE_OPERATION": "false",
        "ALLOW_DELETE_OPERATION": "false"
      }
    }
  }
}

How do I keep it read-only and secure?

Enforce read-only at two layers: leave the server's write flags disabled, and — more importantly — connect as a MySQL user that cannot write even if the server misbehaves. Application-level flags in a community package are a convenience; database grants are the real boundary:

CREATE USER 'claude_ro'@'%' IDENTIFIED BY 'strong_password';
GRANT SELECT, SHOW VIEW ON mydb.* TO 'claude_ro'@'%';
-- no INSERT/UPDATE/DELETE/DDL grants

Additional hygiene: point the agent at a read replica rather than the primary, exclude schemas containing PII from the grant, and keep credentials in the MCP config's env block rather than pasting them into chat.

Example usage

Ask Claude "which products had declining month-over-month sales in Q2?" — it inspects the schema through the MCP server, writes the join and window function, runs the query, and explains the result. No schema pasting, no copy-pasting result sets.

Troubleshooting

• Server shows "failed" in the client: run the npx command manually in a terminal — missing Node, a bad password, or an unreachable host prints a real error there.
• Access denied for user: verify the user's host pattern ('claude_ro'@'%' vs @'localhost') matches where the server connects from.
• ER_NOT_SUPPORTED_AUTH_MODE: older Node clients don't support caching_sha2_password; either update the package or alter the user to mysql_native_password.
• Agent sees no tables: the grant is missing SELECT on that schema, or MYSQL_DB points at the wrong database.

Author & links

Author: Community-maintained (benborla and contributors; separate Python implementation on PyPI)

Repo: github.com/benborla/mcp-server-mysql

License: MIT

Related skills

For Postgres, the Postgres MCP server is the reference implementation this pattern comes from. Warehouse users should see the BigQuery MCP server or Snowflake MCP server; for zero-setup local analysis try the SQLite MCP server.

← Back to MCP Servers