yooztech_mcp_mysql —— 基于 MCP 的 MySQL 工具(只读、安全、支持库推断)
该 MCP 服务器在 MCP 客户端中提供安全的 MySQL 读取能力:
connect_project_database(project_root):识别项目类型,直接读取项目数据库配置并建立连接;凭据不会返回给 AIlist_databases():列出当前账号可访问的非系统库infer_database(project_root=None, include_evidence=false):根据项目内容推断库名(默认仅返回{ db },可选返回最小化证据统计,不含文件路径/内容)list_tables(db=None):列出库内表(未传db时使用已推断库或自动选择)get_table_schema(table, db=None):获取表结构(列定义、主键、索引、表注释)select_rows(table, db=None, columns=None, where=None, order_by=None, limit=100):从库表安全查询
安全设计
- 表/列白名单:从
information_schema动态获取并校验 - 参数化查询:拒绝拼接与多语句
- 限流:默认
LIMIT 100,最大LIMIT 1000 - 隐私:推断时不回传文件路径/内容;如需证据仅返回脱敏统计
- 凭据隔离:项目配置只在 MCP 进程内部读取,工具响应仅包含连接状态、项目类型和数据库名
在 Cursor 中配置
在 Cursor 的设置中添加 MCP Server,示例(仅示意,不包含本地路径):
{
"mcpServers": {
"yooztech_mcp_mysql": {
"command": "yooztech_mcp_mysql",
"args": [],
"env": {
"DB_HOST": "127.0.0.1",
"DB_PORT": "3306",
"DB_USER": "mcp_tool",
"DB_PASS": "<your-strong-pass>"
}
}
}
}
说明:
- 以上配置假设你已通过包管理器安装本工具(例如
pip install yooztech_mcp_mysql),从而可直接使用控制台脚本yooztech_mcp_mysql。 - 若使用其他运行方式(如 uvx/容器),仅需将
command与args改为相应启动方式即可,但不要在 README 中暴露你的本地路径。
使用 uvx 方式(推荐,免安装)
如希望在不全局安装包的情况下运行,可在 Cursor 中使用 uvx:
{
"mcpServers": {
"yooztech_mcp_mysql": {
"command": "uvx",
"args": ["yooztech_mcp_mysql"],
"env": {
"DB_HOST": "127.0.0.1",
"DB_PORT": "3306",
"DB_USER": "mcp_tool",
"DB_PASS": "<your-strong-pass>"
}
}
}
}
提示:确保系统已安装 uv/uvx。企业私有镜像可通过 UV_INDEX/--index-url 进行加速配置。
环境变量
DB_HOST:数据库地址DB_PORT:数据库端口DB_USER:数据库只读账号(最小权限)DB_PASS:数据库密码
推荐在数据库中为该工具创建最小权限账号(示例):
CREATE USER 'mcp_tool'@'10.0.%' IDENTIFIED BY '<your-strong-pass>';
GRANT SELECT ON *.* TO 'mcp_tool'@'10.0.%';
FLUSH PRIVILEGES;
如需进一步收紧权限,可按库或表粒度授予 SELECT。
使用建议(在 MCP 客户端中调用)
- 如项目自带数据库配置,先调用
connect_project_database(project_root);支持常见 Laravel、Spring、Django、Rails、Node 和通用.env配置 - 先调用
list_databases查看可访问库 - 再调用
infer_database自动推断当前项目使用的库(默认仅返回{ db }) - 随后调用
list_tables/select_rows(不传db时将使用推断库;如有歧义请显式传入db)
版本与许可证
- 版本遵循语义化版本(SemVer)
- 许可证:MIT(详见包内 LICENSE)
Metadata
Release files for yooztech-mcp-mysql 0.1.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| yooztech_mcp_mysql-0.1.4.tar.gz | 13.5 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| yooztech_mcp_mysql-0.1.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 24.8 kB
Release files / yooztech_mcp_mysql-0.1.4.tar.gz
| Download URL | yooztech_mcp_mysql-0.1.4.tar.gz |
|---|---|
| Size | 13.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
582f118532321a1bed068941ac5c3221060d74192deadb4ba6fb26a66f060f36
|
|
BLAKE2b-256 checksum How to use checksums |
1b66959816c9e6ffc3910bc33a7f024e60e4c1efcb1027f7deed5ee797de0864
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.10.7
|
Release files / yooztech_mcp_mysql-0.1.4-py3-none-any.whl
| Download URL | yooztech_mcp_mysql-0.1.4-py3-none-any.whl |
|---|---|
| Size | 11.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b8f0ebdf9e03d0301f0791be77ae128561f17c6fe7338f0333547e6e11f88dad
|
|
BLAKE2b-256 checksum How to use checksums |
0088b89896b704d22e6d76c5d1dc0fea28d56bcc8a3335168e46e1fc11921125
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.10.7
|
Security for yooztech-mcp-mysql 0.1.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.