# Top Open Source MySQL MCP Servers in 2026 > Compare the open source MySQL MCP servers in 2026: DBHub, mcp-server-mysql, mysql_mcp_server and PlanetScale MCP, on write posture, host neutrality and maintenance. Adela | 2026-09-23 | Source: https://www.bytebase.com/blog/top-open-source-mysql-mcp-servers/ --- > **Note:** This post is maintained by Bytebase, an open-source database governance platform. We update the post every year. This is part of a series on database MCP servers: 1. [Open Source Postgres MCP Servers](/blog/top-open-source-postgres-mcp-servers/), the single-engine Postgres post 2. Open Source MySQL MCP Servers (this one) 3. [Open Source Multi-Database MCP Servers](/blog/top-open-source-multi-database-mcp-servers/), the multi-engine companion --- Most MySQL MCP servers will run whatever SQL the model writes, if you let it. So the real choice is what the agent is allowed to do on day one, and MySQL raises the stakes: `DELETE` without a `WHERE` is legal, and most deployments connect as one user that owns everything. (New to the protocol? Start with [what a database MCP server is](/blog/what-is-a-database-mcp-server/).) [![MySQL MCP server GitHub star history](/content/blog/top-open-source-mysql-mcp-servers/star-history.svg)](https://star-history.com/#benborla/mcp-server-mysql&designcomputer/mysql_mcp_server&bytebase/dbhub&Date) ## What are the criteria? - **Write posture by default.** Read-only or read-write on install day? Almost nobody changes the default. - **Host neutrality.** Any MySQL, or one vendor's platform only. - **Accountability.** Can you tell which query ran, and for whom? - **Token cost.** Every tool definition is loaded into the model's context before the first query. - **Maintenance.** MCP moved fast in 2026; a server that stopped shipping in 2025 is a liability. ## mcp-server-mysql [mcp-server-mysql](https://github.com/benborla/mcp-server-mysql) by Ben Borla is the most popular MySQL-only server and the one most tutorials use. Node, installed through npx, with the most conservative defaults of the group. **Key Features:** - Read-only out of the box. `ALLOW_INSERT_OPERATION`, `ALLOW_UPDATE_OPERATION` and `ALLOW_DELETE_OPERATION` are separate flags, so you can allow inserts without allowing deletes. - Schema-specific permissions, so `production` can be read-only while `staging` is writable. - Multi-DB mode for querying several databases on the same instance. **GitHub Stats:** 2.1k stars, MIT, JavaScript. v2.0.9 (June 2026), 42 open issues. **Best For:** one MySQL instance, reads today, writes switched on deliberately later. _Verdict:_ coarse but honest. Posture is set per schema, not per caller, so every agent that reaches the server gets the same answer, and a second instance means a second server. ## mysql_mcp_server [mysql_mcp_server](https://github.com/designcomputer/mysql_mcp_server) is the Python option. It ships two prompts, `explore_database` and `analyze_table`, that walk the agent through an unfamiliar schema. **Key Features:** - `SELECT`, `SHOW` and `DESCRIBE`, plus `INSERT`, `UPDATE` and `DELETE`, with the write tools tagged as destructive so good clients ask for confirmation. - Table and database names are checked against a strict whitelist, which blocks injection through identifiers. - A `SECURITY.md` on setting up a least-privilege MySQL user. **GitHub Stats:** 1.4k stars, MIT, Python. v0.4.4 (July 2026), 3 open issues. **Best For:** Python teams doing exploratory work on a schema they don't know yet. _Verdict:_ a destructive hint is advice to the client, not a rule the server enforces. Outside a dev database, give it a MySQL user that cannot write. ## PlanetScale MCP [PlanetScale MCP](https://planetscale.com/docs/mcp-server) is the vendor entry: a hosted server at `mcp.pscale.dev` with about 25 tools covering queries, branches, schema, Insights and billing. You pick the agent's access at OAuth time: none, read-only or full. The local `pscale mcp` command has been removed. **Key Features:** - Short-lived credentials created per query and deleted right after. - `UPDATE` and `DELETE` without `WHERE`, and `TRUNCATE`, are refused server-side. DDL only prompts the model to ask a human. - Every query is tagged `source=planetscale-mcp`, so agent traffic stands out in Insights. **GitHub Stats:** tools at [planetscale/mcp-server](https://github.com/planetscale/mcp-server), Apache-2.0. The server itself is a hosted service. **Best For:** teams already on PlanetScale. _Verdict:_ the strongest safety defaults here, and useless if your MySQL lives anywhere else. The no-`WHERE` block is the guardrail I'd want every server on this list to copy. ## DBHub [DBHub](https://github.com/bytebase/dbhub) is built by us at Bytebase, so weigh this accordingly. It covers MySQL, MariaDB, PostgreSQL, SQL Server, Oracle and SQLite through one interface. **Key Features:** - Two tools by default, `execute_sql` and `search_objects`, about 1.4k tokens of context. `explain_sql` and `health_check` are opt-in. - `readonly` and `max_rows` per source, so one process can be read-only on production and writable on staging, even across instances or engines. - MySQL options for `charset`, `collation`, SSL, `query_timeout` and SSH tunnels, with `${ENV}` interpolation so the config can be committed without secrets. ```toml [[sources]] id = "prod" dsn = "mysql://agent:${PROD_PASSWORD}@mysql-prod:3306/myapp" [[sources]] id = "staging" dsn = "mysql://agent:${STAGING_PASSWORD}@mysql-staging:3306/myapp" [[tools]] name = "execute_sql" source = "prod" readonly = true max_rows = 500 [[tools]] name = "execute_sql" source = "staging" readonly = false ``` **GitHub Stats:** 3.5k stars, MIT, TypeScript. v1.3.1 (September 2026), 1 open issue. **Best For:** MySQL alongside other engines, and teams watching context cost. _Verdict:_ per-source posture is the same idea as mcp-server-mysql's per-schema permissions, extended across instances and engines, but no finer. And the database still sees one user, so who-approved-what has to live in front of the database, as we argue in [governed MCP vs. raw MCP](/blog/governed-mcp-vs-raw-mcp/). ## MySQL MCP Server Comparison | Server | Language | Stars | Host neutrality | Write posture by default | Last release | | --- | --- | --- | --- | --- | --- | | mcp-server-mysql | JavaScript | 2.1k | Any MySQL | Read-only, writes per env flag | v2.0.9, Jun 2026 | | mysql_mcp_server | Python | 1.4k | Any MySQL | Read and write, destructive hints | v0.4.4, Jul 2026 | | PlanetScale MCP | TypeScript | tools repo only | PlanetScale only | Chosen at OAuth; unsafe statements refused | hosted service | | DBHub | TypeScript | 3.5k | Six engines | Writable unless `readonly = true` per source | v1.3.1, Sep 2026 | Star counts are from September 2026. Read them as adoption, not ranking. ## Also on the list, with reservations - [mysql_mcp_server_pro](https://github.com/wenb1n-dev/mysql_mcp_server_pro) (248 stars) adds `readonly`, `writer` and `admin` roles plus OAuth2, but its last commit was August 2025, two MCP spec revisions ago. - [mcp-alchemy](https://github.com/runekaagaard/mcp-alchemy) (420 stars) reaches MySQL through SQLAlchemy. It is actively released, but it is a generic bridge with nothing MySQL-specific. ## What MySQL is missing Postgres has Supabase MCP; MySQL has PlanetScale MCP. Neither engine's steward ships a server for general use. Oracle does publish a `mysql-mcp-server` in [oracle/mcp](https://github.com/oracle/mcp), but it is scoped to MySQL AI and HeatWave and calls itself a proof of concept "not intended for production use". Neither the MySQL Shell 26.7 nor the MySQL AI 26.7 manual mentions it. For MySQL Community Server, every option is community-maintained, each MySQL-only server driven mainly by one person, so choose on maintenance signals (recent releases, low open-issue counts) over feature lists. ## Picking one - **On PlanetScale:** use their server. Its server-side refusals beat anything you'd configure yourself. - **MySQL only, safest default:** mcp-server-mysql. - **MySQL plus other engines, or read-only prod and writable staging in one process:** DBHub. - **Python, exploratory work:** mysql_mcp_server, with a MySQL user that has `SELECT` and nothing else. Whichever you pick, the MCP server is not your last line of defense. It holds one credential, and your audit trail shows one database user doing everything. When an agent's change would need a colleague's approval, the review and the record belong in front of the database. That is what Bytebase's [database MCP server](/database-mcp-server/) does: an agent's change goes through the same review, approval and audit path as a human's.