How to Let AI Query Your Database Safely: MySQL and PostgreSQL

The safest way to let AI query your database is a database MCP server: Claude, ChatGPT or Cursor can explore your tables and answer questions with real queries, inside limits you set. GetMCP’s Database connector turns a MySQL, MariaDB or PostgreSQL database into one in a few minutes, with no API to write first. It starts read-only, and nothing can change a row until you allow it.

It is for teams whose answers already sit in a database: support staff checking an order, founders asking for this month’s signups, developers reading staging data from their editor, and agencies reporting on a client’s store. This guide covers setup, the nine tools, the safety locks and the limits that keep results small.

What is a database MCP server?

An MCP server publishes tools a model can call. A database MCP server publishes tools for a database: list the tables, describe a table, run a query, fetch rows. The model works out which tool to use from your question, calls it, and answers from the rows that come back.

In GetMCP the Database connector is a template, Database (MySQL / PostgreSQL), added in version 1.6.0. Installing it creates a server whose tools talk to your database directly over a normal database connection from your install. The connection details live in that server’s Database settings, and the password is stored encrypted on your install.

How to let AI query your database: setup

1. Install the template. Open Templates and install Database (MySQL / PostgreSQL). GetMCP creates the server and takes you to the Database section of its Settings tab.
2. Create a database user for the AI. In your database, create a user with only the access you want a model to have, for example read access to a reporting schema. This is your first and strongest limit.
3. Enter the connection. Choose the Engine (MySQL / MariaDB or PostgreSQL), then fill in Host, Port, Database name, Username and Password. On PostgreSQL, set the Schema to list tables from (default public).
4. Choose encryption. TLS (don’t verify certificate), TLS, verify certificate or None. When verifying, paste your provider’s CA certificate, or leave it blank for a certificate from a public authority.
5. Set the bounds. Row cap (most rows any tool returns per call, up to 1,000, default 200) and Query timeout (s) (default 30, up to 300).
6. Test connection. The test saves your changes, connects, and lists the first tables it finds. If it fails, the usual causes are the database firewall not allowing your install’s IP address, or the user lacking access to that database.
7. Connect a client. Hand the server to Claude or Cursor with Quick Connect, or add its endpoint to any MCP client.

Hosted services built on these engines, such as Supabase and Neon for PostgreSQL or Amazon RDS, connect the same way: use the host, port, user and password your provider shows, and pick a TLS mode. There is no separate preset for them.

The nine tools

Five tools read and are active from the moment you install. Four change data and install disabled; each is a separate switch on the server’s Tools tab.

Tool	What it does	On install
list_tables	Tables and views, with an estimated row count and any comment.	On
describe_table	Every column with type, nullability, default and comment, plus the primary key, indexes and foreign keys.	On
run_query	One read-only statement (SELECT, WITH, SHOW, EXPLAIN, DESCRIBE) with ? placeholders and values in params.	On
get_rows	Rows from one table without SQL: columns, filters, sort and paging (default 50 rows).	On
count_rows	An exact count, optionally with filters.	On
insert_row	Insert one row from a column-to-value object.	Off
update_rows	Update rows matching a filter. An empty filter is refused.	Off
delete_rows	Delete rows matching a filter. An empty filter is refused.	Off
execute_sql	Any one statement, including CREATE, ALTER and DROP.	Off

Filters (the where argument) on get_rows, count_rows, update_rows and delete_rows are simple objects combined with AND. A key is a column name, optionally followed by an operator (=, !=, <, <=, >, >=, LIKE, NOT LIKE). A value can be a single value, a list (matched with IN) or null (matched with IS NULL). Here is what a client sends for a query:

// run_query
{
  "sql": "SELECT status, COUNT(*) AS orders FROM orders WHERE created_at >= ? GROUP BY status",
  "params": ["2026-09-01"],
  "limit": 50
}

// get_rows
{
  "table": "customers",
  "where": { "country": "DE", "lifetime_value >=": 500 },
  "order_by": "created_at",
  "limit": 20
}

Safety locks and limits

• Read-only connection. On by default. The database session itself is opened read-only (SET SESSION TRANSACTION READ ONLY on MySQL, default_transaction_read_only on PostgreSQL), so this is enforced by the engine, not by matching keywords. The write tools are refused even when enabled.
• Write tools install disabled. To allow writes, you have to turn off the read-only connection and enable the specific tool. Two separate decisions.
• No filter, no update. update_rows and delete_rows refuse an empty filter, so leaving out the WHERE clause cannot clear a table.
• Bound values. Values travel in params and are bound by the driver instead of being pasted into the SQL. Table and column names are validated.
• Bounded results. The row cap applies to every tool, and a request for more says so with limit_clamped. Text longer than 2,000 characters in a cell is trimmed with a note of how much was cut, and binary columns are summarised as [binary, N bytes].
• Statement timeout. Set on the session, so a slow query is cancelled by the database rather than holding the request.
• Safety hints. Each tool tells the client whether it only reads or can destroy data, so clients that honour MCP tool annotations can ask before a delete.

Use cases

Each of these starts the same way: you let AI query your database through read-only tools, then decide whether any write is worth switching on.

Order lookups for a store’s support team

Acme’s support agents ask Claude “where is order 10482 and has it been refunded?” The model reads the orders table with get_rows and answers in plain language, without anyone opening a database tool.

Question → describe_table → get_rows → answer

Ad-hoc reporting for a SaaS founder

Amelia Okafor wants weekly signups by plan and the trial-to-paid rate for September. The model lists tables, describes the relevant ones and writes the aggregate query with run_query, inside a read-only transaction.

Question → list_tables → describe_table → run_query → table in chat

Read staging data while you code

A developer connects Cursor to a Database connector server pointed at staging. Cursor checks the real column types before writing a migration, and counts rows to size a backfill.

Client reporting for an agency

An agency gives each client their own read-only database server. Account managers ask for top products or repeat-customer rates during a call, and every query is in the server’s call log afterwards.

Careful data clean-up with a human in the loop

Northwind’s ops lead needs duplicate leads marked inactive. They turn off the read-only connection and enable only update_rows. The model counts the matches first, shows them, and updates only after the lead confirms.

count_rows → get_rows (review) → user confirms → update_rows

An AI agent that combines data and email

Put the database server and a mailbox server behind the MCP Gateway. An agent can find customers whose renewal is due this week and draft a reminder to each, with sending left off until you review the drafts.

Tips and gotchas

• The database has to be reachable from your install. Allow your server’s IP in the database firewall. Private and local addresses work by default; Settings → Security → Private Network Access controls that, and cloud metadata addresses are always refused.
• PHP needs the PDO driver. MySQL needs pdo_mysql and PostgreSQL needs pdo_pgsql. If it is missing, the test says so.
• MySQL’s timeout covers SELECT only. MySQL applies max_execution_time to SELECT statements; MariaDB and PostgreSQL time out any statement.
• Row estimates are estimates. list_tables reads counts from the catalogue. Ask for count_rows when the number matters.
• Test from the Tool Editor first. The Test panel runs connector tools, so you can try a query before any client connects.
• One database per server. Connect another database by installing the template again. Each server has its own connection, tools and logs.
• Older servers can catch up. A server built before a newer connector tool existed is offered it in place on the Settings tab.

Related features

• MCP server templates: where the Database, Mailbox and File Server connectors are installed.
• The MCP Gateway: publish several databases, or a database and an API, at one endpoint.
• Rate limiting and PII redaction: mask emails and card numbers in query results and logs.
• Connect MySQL to Claude, ChatGPT or Cursor: a MySQL walk-through.
• Connect PostgreSQL or Supabase: the same setup for Postgres.

FAQ

Which databases does the database MCP server support?

MySQL, MariaDB and PostgreSQL, including hosted services built on them such as Supabase, Neon and Amazon RDS. The connection is a normal database connection from your GetMCP install, so the database must be reachable from it.

Can the AI change or delete my data?

Not unless you allow it twice. The connection starts read-only at the database level, and the insert, update, delete and execute tools install disabled. Updates and deletes also refuse to run without a filter.

Does the AI client see my database password?

No. The password is stored encrypted on your install and used only by your server to open the connection. The API reports whether a password is set, never its value.

How does it stop a query returning millions of rows?

Every tool is capped by the connection’s row cap, up to 1,000 rows. The response says when rows were cut, so the model can add a LIMIT or narrow the filter, and long cells are trimmed.

Your data is already in one place; a database MCP server lets your AI client use it safely. See the Database connector page for more, or compare plans on pricing.