MCP Alchemy exposes database table discovery, schema inspection, relationship mapping, and SQL execution., The execute_query tool can run arbitrary SQL text against the configured SQLAlchemy database., The source creates SQLAlchemy connections with AUTOCOMMIT, so successful write, DDL, or administrative statements can commit immediately., The server does not enforce read-only SQL; use database permissions, read-only users, and human review to constrain writes., Query results are truncated by EXECUTE_QUERY_MAX_CHARS unless Claude Local Files output is configured., When CLAUDE_LOCAL_FILES_PATH is set, full result sets can be written to local files for artifact access.
Privacy notes
DB_URL can contain database hostnames, usernames, passwords, database names, driver names, and connection options., Schemas, table names, column names, foreign keys, SQL text, query results, errors, row counts, and generated local result files may be visible to the MCP client and model provider., SQLAlchemy-compatible databases can contain customer records, credentials, analytics, payment data, healthcare data, source-code metadata, or other regulated information., DB_URL, DB_ENGINE_OPTIONS, CLAUDE_LOCAL_FILES_PATH, result files, and database credentials should stay out of prompts, issues, logs, screenshots, and committed files.
Author
Rune Kaagaard
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
SafetyExecution & processesThe execute_query tool can run arbitrary SQL text against the configured SQLAlchemy database.
SafetyPermissions & scopesThe source creates SQLAlchemy connections with AUTOCOMMIT, so successful write, DDL, or administrative statements can commit immediately.
SafetyPermissions & scopesThe server does not enforce read-only SQL; use database permissions, read-only users, and human review to constrain writes.
SafetyLocal filesQuery results are truncated by EXECUTE_QUERY_MAX_CHARS unless Claude Local Files output is configured.
SafetyLocal filesWhen CLAUDE_LOCAL_FILES_PATH is set, full result sets can be written to local files for artifact access.
PrivacyCredentials & tokensDB_URL can contain database hostnames, usernames, passwords, database names, driver names, and connection options.
PrivacyThird-party handlingSchemas, table names, column names, foreign keys, SQL text, query results, errors, row counts, and generated local result files may be visible to the MCP client and model provider.
PrivacyCredentials & tokensSQLAlchemy-compatible databases can contain customer records, credentials, analytics, payment data, healthcare data, source-code metadata, or other regulated information.
PrivacyCredentials & tokensDB_URL, DB_ENGINE_OPTIONS, CLAUDE_LOCAL_FILES_PATH, result files, and database credentials should stay out of prompts, issues, logs, screenshots, and committed files.
The execute_query tool can run arbitrary SQL text against the configured SQLAlchemy database.
The source creates SQLAlchemy connections with AUTOCOMMIT, so successful write, DDL, or administrative statements can commit immediately.
The server does not enforce read-only SQL; use database permissions, read-only users, and human review to constrain writes.
Query results are truncated by EXECUTE_QUERY_MAX_CHARS unless Claude Local Files output is configured.
When CLAUDE_LOCAL_FILES_PATH is set, full result sets can be written to local files for artifact access.
Privacy notes
DB_URL can contain database hostnames, usernames, passwords, database names, driver names, and connection options.
Schemas, table names, column names, foreign keys, SQL text, query results, errors, row counts, and generated local result files may be visible to the MCP client and model provider.
SQLAlchemy-compatible databases can contain customer records, credentials, analytics, payment data, healthcare data, source-code metadata, or other regulated information.
DB_URL, DB_ENGINE_OPTIONS, CLAUDE_LOCAL_FILES_PATH, result files, and database credentials should stay out of prompts, issues, logs, screenshots, and committed files.
Prerequisites
Python 3.10 and uvx available to the MCP client runtime.
SQLAlchemy-compatible database URL for an approved database.
Database driver selected with uvx `--with` when the target database requires one.
Least-privilege database user with only the schemas and operations Claude should access.
Explicit policy for whether Claude may run write SQL, DDL, or other state-changing statements.
Optional Claude Local Files setup only when full result export is approved.
MCP Alchemy is a SQLAlchemy-backed Model Context Protocol server that connects
Claude to relational databases. It can list table names, filter tables, inspect
schemas and foreign-key relationships, and execute SQL queries against a
configured database URL.
The project supports SQLAlchemy-compatible databases, including PostgreSQL,
MySQL, MariaDB, SQLite, Oracle, Microsoft SQL Server, CrateDB, Vertica, and
other dialects when the matching Python driver is installed.
These sources were reviewed on 2026-06-06. Prefer the live repository,
README, PyPI metadata, package metadata, server implementation, and license for
current install commands, package versions, supported databases, environment
variables, tool behavior, and licensing.
Features
PyPI package mcp-alchemy.
SQLAlchemy-based database connectivity.
Support for PostgreSQL, MySQL, MariaDB, SQLite, Oracle, MS SQL Server, CrateDB, Vertica, and other SQLAlchemy dialects.
all_table_names tool for listing database tables.
filter_table_names tool for matching tables by substring.
schema_definitions tool for columns, primary keys, nullable flags, and foreign-key relationships.
execute_query tool for SQL execution with optional parameters.
EXECUTE_QUERY_MAX_CHARS output truncation.
Optional DB_ENGINE_OPTIONS for SQLAlchemy engine settings.
Optional CLAUDE_LOCAL_FILES_PATH integration for full result sets.
Mozilla Public License 2.0 licensing.
Installation
Configure MCP Alchemy with the database driver required by the target database.
For example, start with the generic package and add the appropriate --with
driver from the README when needed:
Use a dedicated read-only database user for exploration workflows. Add write
privileges only when the workflow is reviewed and intended to modify data.
Use Cases
Ask Claude to list tables before exploring an unfamiliar relational database.
Inspect schemas and foreign-key relationships before drafting SQL.
Run reviewed SQL queries against a development or analytics database.
Generate reports from query results with controlled truncation.
Connect to different database engines using SQLAlchemy dialects.
Use Claude Local Files for full result sets only when local result export is approved.
Safety and Privacy
MCP Alchemy gives Claude a generic SQL execution surface. It does not enforce
read-only behavior, and the source configures AUTOCOMMIT, so database
permissions are the real guardrail. Use least-privilege credentials, prefer
read-only users, and review every query before execution.
Connection URLs and query results can expose sensitive database details. Avoid
production credentials, regulated datasets, broad admin users, and exported
full-result files unless the model session and storage location are approved for
that data.
Duplicate Check
Existing content includes DBHub, MariaDB MCP Server, DuckDB MCP Server,
StarRocks MCP Server, and other database-specific MCP entries. This entry is
distinct because it covers runekaagaard/mcp-alchemy, a SQLAlchemy-compatible
multi-database MCP server with schema relationship inspection, vertical query
output, and optional Claude Local Files integration. No matching source URL or
dedicated MCP Alchemy entry was found in content/mcp.
MCP server for connecting Claude to MySQL databases with schema inspection, SQL query execution, SSH tunnel support, multi-database mode, and configurable write-operation controls.
Official Neon MCP server that connects Claude and other MCP clients to Neon Postgres projects, branches, schemas, SQL queries, migrations, performance tuning, Neon Auth, Data API setup, and Neon documentation through a hosted Streamable HTTP endpoint.
✓MCP Alchemy exposes database table discovery, schema inspection, relationship mapping, and SQL execution.
The execute_query tool can run arbitrary SQL text against the configured SQLAlchemy database.
The source creates SQLAlchemy connections with AUTOCOMMIT, so successful write, DDL, or administrative statements can commit immediately.
The server does not enforce read-only SQL; use database permissions, read-only users, and human review to constrain writes.
Query results are truncated by EXECUTE_QUERY_MAX_CHARS unless Claude Local Files output is configured.
When CLAUDE_LOCAL_FILES_PATH is set, full result sets can be written to local files for artifact access.
✓DBHub can execute SQL queries against configured databases.
SQL execution can read, create, update, delete, or otherwise modify data depending on database permissions and requested queries.
Configure read-only mode, row limits, query timeouts, least-privilege credentials, and human review before using DBHub with production or sensitive databases.
Custom tools can wrap reusable parameterized SQL, so review their definitions before allowing agents to call them.
✓MySQL MCP Server can inspect schemas and run SQL queries against configured databases.
Write and DDL operations can be enabled through environment variables, so keep insert, update, delete, and DDL permissions disabled unless explicitly required.
Use a least-privilege MySQL user and avoid connecting the server to production databases with broad grants.
Multi-database mode can expose every database visible to the configured MySQL user.
SSH tunnel settings, query timeouts, cache settings, logging, and rate limits should be reviewed before connecting an MCP client.
✓Neon documents the MCP server as intended for development and testing only, and warns users to review and authorize LLM-requested actions before execution.
Full-access mode can create and delete projects, create and delete branches, reset branches from parents, run SQL, run SQL transactions, prepare and complete migrations, tune queries, provision Neon Auth, and provision the Neon Data API.
Prefer OAuth read-only mode or `readonly=true` for exploration. In read-only mode, write tools are unavailable and SQL execution is constrained to read-only queries.
Use `projectId` scoping and tool category filters when an agent should work inside one project or only use schema, querying, docs, or branch tools.
API keys created by `neonctl init` or stored in MCP headers grant Neon account or organization access. Revoke unused keys, avoid committing bearer tokens, and do not expose API keys in prompts, logs, screenshots, or shared config files.
Database rows, docs pages, migration output, SQL errors, and query plans are model-visible context. Treat returned data as untrusted input that may contain prompt injection, stale assumptions, secrets, or customer records.
Migration and query-tuning workflows use temporary branches before applying changes, but the final complete actions can affect the original branch and should require explicit human review.
The deprecated SSE endpoint exists for clients without Streamable HTTP support; prefer the documented `https://mcp.neon.tech/mcp` endpoint when the client supports it.
Privacy notes
✓DB_URL can contain database hostnames, usernames, passwords, database names, driver names, and connection options.
Schemas, table names, column names, foreign keys, SQL text, query results, errors, row counts, and generated local result files may be visible to the MCP client and model provider.
SQLAlchemy-compatible databases can contain customer records, credentials, analytics, payment data, healthcare data, source-code metadata, or other regulated information.
DB_URL, DB_ENGINE_OPTIONS, CLAUDE_LOCAL_FILES_PATH, result files, and database credentials should stay out of prompts, issues, logs, screenshots, and committed files.
✓Database connection strings, hostnames, schemas, table names, column names, row data, query text, query results, traces, and errors may be visible to the MCP client and model provider.
Databases can contain personal data, customer records, credentials, business metrics, audit logs, payment data, healthcare data, and proprietary operational state.
Avoid exposing production databases or regulated data unless the database, MCP client, and model session are approved for that access.
✓Database hostnames, schema names, table names, column names, query text, query results, credentials, prompts, logs, and tool outputs may be visible to the MCP client and model provider.
Query results may contain customer data, credentials, tokens, personal data, financial data, internal IDs, or regulated records.
MCP client configs, shell history, logs, screenshots, and shared project files can leak MySQL credentials if not handled carefully.
Prefer local or user-scoped MCP configuration for database credentials instead of committing project-scoped configs.
✓Tool results can expose Neon organization IDs, project IDs, branch IDs, compute endpoints, database names, table names, schemas, SQL text, query results, query plans, slow query details, connection strings, documentation content, and Neon Console links.
OAuth authorization can disclose the Neon account identity and grants the connected MCP client access according to the approved scopes and URL parameters.
API-key setup stores bearer credentials in MCP client configuration or process arguments when configured that way; protect local config files, shell history, CI variables, and agent transcripts.
Generated migrations, SQL errors, query tuning suggestions, logs, client debug output, and AI chat transcripts can retain database schema and sample data outside Neon.
ChatGPT connectors, hosted IDEs, remote agents, MCP proxies, and other clients may have separate logging, retention, connector trust, and data-use policies from Neon.
Connection string tools may return credentials or connection details for a Neon database. Avoid exposing those values to untrusted clients or shared conversations.
Prerequisites
Python 3.10 and uvx available to the MCP client runtime.
SQLAlchemy-compatible database URL for an approved database.
Database driver selected with uvx `--with` when the target database requires one.
Least-privilege database user with only the schemas and operations Claude should access.
Node.js and npx available to the MCP client runtime.
A PostgreSQL, MySQL, MariaDB, SQL Server, or SQLite database connection.
Database credentials with the minimum privileges needed for the workflow.
Read-only permissions or DBHub guardrails configured before connecting production data.
Node.js 20 or newer available to the MCP client runtime.
MySQL 5.7 or newer, with MySQL 8.0 or newer recommended upstream.
Dedicated MySQL user with only the database grants required for the intended workflow.
MySQL host, port, credentials, database name, SSL, and optional SSH tunnel settings prepared.
Neon account with access to the projects, branches, databases, organizations, or shared projects Claude should inspect or manage.
MCP-capable client that supports remote Streamable HTTP MCP servers, OAuth, `mcp-remote`, or Neon-supported configuration through `add-mcp`.
Authentication plan using Neon OAuth for local clients, an API key for remote or headless agents, or `neonctl init` when intentionally creating a local API key and editor configuration.
Access-control plan for OAuth scopes, `readonly=true`, project scoping with `projectId`, tool categories, organization access, and API key ownership.