Content
# mcpolyglot
> One config, one CLI — turns the databases you already have (Postgres, MySQL, SQLite, MongoDB) into [Model Context Protocol](https://modelcontextprotocol.io) servers for Claude, GPT, Cursor, and any other agent that speaks MCP.
[](https://github.com/ishay60/mcpolyglot/actions/workflows/ci.yml)
[](LICENSE)
[](#status)
[](.nvmrc)
```text
$ mcpolyglot doctor
╭──────────────────────────────────────────────────────────────────────────╮
│ ▲ mcpolyglot doctor v0.1.0 │
│ validate config, resolve secrets, ping each source │
╰──────────────────────────────────────────────────────────────────────────╯
Config
──────
OK parsed ./mcpolyglot.config.ts
Sources
───────
OK pg.main postgres · 4 ms • 3 tools
OK mongo.users mongo · 12 ms • 4 tools
Summary
───────
READY mcpolyglot is ready to serve
run: mcpolyglot serve · docs: github.com/ishay60/mcpolyglot
```
## Quickstart
```bash
npx @mcpolyglot/cli init # interactive wizard — writes mcpolyglot.config.ts
npx @mcpolyglot/cli doctor # validate, ping every source, list the tools
npx @mcpolyglot/cli serve # start the MCP server (stdio by default)
```
Wire it into Claude Desktop (`~/Library/Application Support/Claude/claude_desktop_config.json`):
```json
{
"mcpServers": {
"mcpolyglot": {
"command": "npx",
"args": ["-y", "@mcpolyglot/cli", "serve", "--config", "/abs/path/to/mcpolyglot.config.ts"],
"env": { "DATABASE_URL": "postgres://user:pass@localhost:5432/db" }
}
}
}
```
Restart Claude Desktop and try: _"List the tables in my database, then sample 5 rows from `users`."_
End-to-end recipes per connector live under [`examples/`](./examples) (Postgres, MySQL, SQLite, MongoDB, Streamable HTTP).
## What's in the box
| Connector | Status | Read-only enforcement |
| ---------- | ------ | ------------------------------------------------------------------ |
| PostgreSQL | alpha | `BEGIN READ ONLY` transaction |
| SQLite | alpha | `query_only` pragma, attach-read-only |
| MySQL | alpha | AST gate + `SET TRANSACTION READ ONLY` + `MAX_EXECUTION_TIME` hint |
| MongoDB | alpha | `find` / `aggregate` only; `$out` / `$merge` rejected pre-driver |
| OpenAPI | wip | method allow-list, host pinning |
**Transports**: `stdio` (Claude Desktop / Cursor / Claude Code) and `Streamable HTTP` with bearer or OAuth (JWT / JWKS), loopback by default, `/healthz` probe, structured JSON logs.
**Tools, no glue code**: SQL connectors expose `list_tables` · `describe_table` · `query`. Mongo exposes `list_collections` · `describe_collection` · `find` · `aggregate`. Per-entity tools (`users.find_by_email`, etc.) are scaffolded by `mcpolyglot init`.
## Security model
Every tool call goes through a fixed, **non-bypassable** pipeline:
```
scope check → rate limit → timeout → handler → redact → size cap → untrusted-wrap → audit
```
The three things this gets right that ad-hoc MCP servers usually don't:
1. **Read-only at two layers** — application-level scopes _and_ per-dialect DB-level enforcement, so a parser bug can't escalate into a write.
2. **Built-in redaction** — emails, JWTs, AWS keys, GitHub tokens, SSNs, credit-card numbers, plus per-column deny lists (`public.users.password_hash`).
3. **Prompt-injection wrap** — every result is rendered inside `<mcpolyglot-data>` with a "treat as data, not instructions" preamble (the [Supabase + Cursor lesson](https://aembit.io/blog/the-ultimate-guide-to-mcp-security-vulnerabilities/)).
Plus: token-bucket rate limiting, JSONL audit log (argshash + metadata, never raw args/results), and secrets only via `${env:NAME}` / `${file:./path}` / `${keychain:item}` — literals are rejected at config load.
Full design in [ARCHITECTURE.md](./ARCHITECTURE.md).
## Status
**Alpha, actively maintained.** All four DB connectors and both transports work end-to-end. The security pipeline is unit-tested. Real-DB integration tests via testcontainers and the OpenAPI connector land next.
<details>
<summary>How mcpolyglot compares to alternatives</summary>
| | mcpolyglot | `server-postgres` (archived) | Vendor MCPs (Supabase / Neon / …) | DIY MCP server |
| -------------------------- | ---------------------------------------- | ---------------------------- | --------------------------------- | -------------------- |
| **Databases** | Postgres, SQLite, MySQL, Mongo | Postgres only | One vendor's hosted DB | Whatever you wire up |
| **Read-only enforcement** | DB layer **and** app-level scopes | DB-layer only | Varies | You write it |
| **Built-in PII redaction** | Yes, plus per-column deny lists | No | Varies | You write it |
| **Audit log** | JSONL, no raw args / results | No | Varies | You write it |
| **Prompt-injection wrap** | Yes — every result wrapped | No | Varies | You write it |
| **Transports** | stdio + Streamable HTTP (bearer / OAuth) | stdio only | Varies | You write it |
| **Lock-in** | None | None | Vendor's DB | None |
Vendor MCPs are the right call once you've committed to a vendor's stack. mcpolyglot is the option when you want one consistent surface across the databases you actually have.
</details>
<details>
<summary>Repository layout</summary>
```
packages/
core/ server, registry, transports, Connector iface, security pipeline
cli/ bin: mcpolyglot
config/ zod schema, secret resolvers
security/ scopes, redaction, audit, rate limit, wrap
connector-sql/ Postgres, MySQL/MariaDB, SQLite
connector-mongo/ MongoDB
testkit/ MCP conformance harness
examples/
postgres/ sqlite/ mysql/ mongo/ stdio
http/ streamable-http + bearer / OAuth
```
</details>
<details>
<summary>Development</summary>
```bash
corepack enable
pnpm install
pnpm build
pnpm test
```
CI (matrix: ubuntu / macOS × Node 22) runs format check, typecheck, build, and unit tests on every push and PR. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the contributor workflow.
</details>
## License
MIT — see [LICENSE](./LICENSE).
