Skip to main content

yooztech_mcp_mysql —— 基于 MCP 的 MySQL 工具(只读、安全、支持库推断)

该 MCP 服务器在 MCP 客户端中提供安全的 MySQL 读取能力:

  • connect_project_database(project_root):识别项目类型,直接读取项目数据库配置并建立连接;凭据不会返回给 AI
  • list_databases():列出当前账号可访问的非系统库
  • infer_database(project_root=None, include_evidence=false):根据项目内容推断库名(默认仅返回 { db },可选返回最小化证据统计,不含文件路径/内容)
  • list_tables(db=None):列出库内表(未传 db 时使用已推断库或自动选择)
  • get_table_schema(table, db=None):获取表结构(列定义、主键、索引、表注释)
  • select_rows(table, db=None, columns=None, where=None, order_by=None, limit=100):从库表安全查询

安全设计

  • 表/列白名单:从 information_schema 动态获取并校验
  • 参数化查询:拒绝拼接与多语句
  • 限流:默认 LIMIT 100,最大 LIMIT 1000
  • 隐私:推断时不回传文件路径/内容;如需证据仅返回脱敏统计
  • 凭据隔离:项目配置只在 MCP 进程内部读取,工具响应仅包含连接状态、项目类型和数据库名

在 Cursor 中配置

在 Cursor 的设置中添加 MCP Server,示例(仅示意,不包含本地路径):

{
  "mcpServers": {
    "yooztech_mcp_mysql": {
      "command": "yooztech_mcp_mysql",
      "args": [],
      "env": {
        "DB_HOST": "127.0.0.1",
        "DB_PORT": "3306",
        "DB_USER": "mcp_tool",
        "DB_PASS": "<your-strong-pass>"
      }
    }
  }
}

说明:

  • 以上配置假设你已通过包管理器安装本工具(例如 pip install yooztech_mcp_mysql),从而可直接使用控制台脚本 yooztech_mcp_mysql。
  • 若使用其他运行方式(如 uvx/容器),仅需将 command 与 args 改为相应启动方式即可,但不要在 README 中暴露你的本地路径。

使用 uvx 方式(推荐,免安装)

如希望在不全局安装包的情况下运行,可在 Cursor 中使用 uvx:

{
  "mcpServers": {
    "yooztech_mcp_mysql": {
      "command": "uvx",
      "args": ["yooztech_mcp_mysql"],
      "env": {
        "DB_HOST": "127.0.0.1",
        "DB_PORT": "3306",
        "DB_USER": "mcp_tool",
        "DB_PASS": "<your-strong-pass>"
      }
    }
  }
}

提示:确保系统已安装 uv/uvx。企业私有镜像可通过 UV_INDEX/--index-url 进行加速配置。

环境变量

  • DB_HOST:数据库地址
  • DB_PORT:数据库端口
  • DB_USER:数据库只读账号(最小权限)
  • DB_PASS:数据库密码

推荐在数据库中为该工具创建最小权限账号(示例):

CREATE USER 'mcp_tool'@'10.0.%' IDENTIFIED BY '<your-strong-pass>';
GRANT SELECT ON *.* TO 'mcp_tool'@'10.0.%';
FLUSH PRIVILEGES;

如需进一步收紧权限,可按库或表粒度授予 SELECT。

使用建议(在 MCP 客户端中调用)

  • 如项目自带数据库配置,先调用 connect_project_database(project_root);支持常见 Laravel、Spring、Django、Rails、Node 和通用 .env 配置
  • 先调用 list_databases 查看可访问库
  • 再调用 infer_database 自动推断当前项目使用的库(默认仅返回 { db })
  • 随后调用 list_tables / select_rows(不传 db 时将使用推断库;如有歧义请显式传入 db)

版本与许可证

  • 版本遵循语义化版本(SemVer)
  • 许可证:MIT(详见包内 LICENSE)

Metadata

Release files for yooztech-mcp-mysql 0.1.4

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for yooztech-mcp-mysql 0.1.4
File Size Uploaded Provenance
yooztech_mcp_mysql-0.1.4.tar.gz 13.5 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for yooztech-mcp-mysql 0.1.4
File Interpreter ABI Platform
yooztech_mcp_mysql-0.1.4-py3-none-any.whl Python 3 none any Details

Total release size: 24.8 kB

Release files / yooztech_mcp_mysql-0.1.4.tar.gz

Download URL yooztech_mcp_mysql-0.1.4.tar.gz
Size 13.5 kB
Tags Source
SHA-256 checksum
How to use checksums
582f118532321a1bed068941ac5c3221060d74192deadb4ba6fb26a66f060f36
BLAKE2b-256 checksum
How to use checksums
1b66959816c9e6ffc3910bc33a7f024e60e4c1efcb1027f7deed5ee797de0864
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.1.0 CPython/3.10.7

Release files / yooztech_mcp_mysql-0.1.4-py3-none-any.whl

Download URL yooztech_mcp_mysql-0.1.4-py3-none-any.whl
Size 11.3 kB
Tags Python 3
SHA-256 checksum
How to use checksums
b8f0ebdf9e03d0301f0791be77ae128561f17c6fe7338f0333547e6e11f88dad
BLAKE2b-256 checksum
How to use checksums
0088b89896b704d22e6d76c5d1dc0fea28d56bcc8a3335168e46e1fc11921125
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.1.0 CPython/3.10.7

Security for yooztech-mcp-mysql 0.1.4

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page