Top Open Source MySQL MCP Servers in 2026

This is part of a series on database MCP servers:

1. Open Source Postgres MCP Servers, the single-engine Postgres post
2. Open Source MySQL MCP Servers (this one)
3. Open Source Multi-Database MCP Servers, the multi-engine companion

Most MySQL MCP servers will run whatever SQL the model writes, if you let it. So the real choice is what the agent is allowed to do on day one, and MySQL raises the stakes: DELETE without a WHERE is legal, and most deployments connect as one user that owns everything. (New to the protocol? Start with what a database MCP server is.)

MySQL MCP server GitHub star history

What are the criteria?#

• Write posture by default. Read-only or read-write on install day? Almost nobody changes the default.
• Host neutrality. Any MySQL, or one vendor's platform only.
• Accountability. Can you tell which query ran, and for whom?
• Token cost. Every tool definition is loaded into the model's context before the first query.
• Maintenance. MCP moved fast in 2026; a server that stopped shipping in 2025 is a liability.

mcp-server-mysql#

mcp-server-mysql by Ben Borla is the most popular MySQL-only server and the one most tutorials use. Node, installed through npx, with the most conservative defaults of the group.

Key Features:

• Read-only out of the box. ALLOW_INSERT_OPERATION, ALLOW_UPDATE_OPERATION and ALLOW_DELETE_OPERATION are separate flags, so you can allow inserts without allowing deletes.
• Schema-specific permissions, so production can be read-only while staging is writable.
• Multi-DB mode for querying several databases on the same instance.

GitHub Stats: 2.1k stars, MIT, JavaScript. v2.0.9 (June 2026), 42 open issues.

Best For: one MySQL instance, reads today, writes switched on deliberately later.

Verdict: coarse but honest. Posture is set per schema, not per caller, so every agent that reaches the server gets the same answer, and a second instance means a second server.

mysql_mcp_server#

mysql_mcp_server is the Python option. It ships two prompts, explore_database and analyze_table, that walk the agent through an unfamiliar schema.

Key Features:

• SELECT, SHOW and DESCRIBE, plus INSERT, UPDATE and DELETE, with the write tools tagged as destructive so good clients ask for confirmation.
• Table and database names are checked against a strict whitelist, which blocks injection through identifiers.
• A SECURITY.md on setting up a least-privilege MySQL user.

GitHub Stats: 1.4k stars, MIT, Python. v0.4.4 (July 2026), 3 open issues.

Best For: Python teams doing exploratory work on a schema they don't know yet.

Verdict: a destructive hint is advice to the client, not a rule the server enforces. Outside a dev database, give it a MySQL user that cannot write.

PlanetScale MCP#

PlanetScale MCP is the vendor entry: a hosted server at mcp.pscale.dev with about 25 tools covering queries, branches, schema, Insights and billing. You pick the agent's access at OAuth time: none, read-only or full. The local pscale mcp command has been removed.

Key Features:

• Short-lived credentials created per query and deleted right after.
• UPDATE and DELETE without WHERE, and TRUNCATE, are refused server-side. DDL only prompts the model to ask a human.
• Every query is tagged source=planetscale-mcp, so agent traffic stands out in Insights.

GitHub Stats: tools at planetscale/mcp-server, Apache-2.0. The server itself is a hosted service.

Best For: teams already on PlanetScale.

Verdict: the strongest safety defaults here, and useless if your MySQL lives anywhere else. The no-WHERE block is the guardrail I'd want every server on this list to copy.

DBHub#

DBHub is built by us at Bytebase, so weigh this accordingly. It covers MySQL, MariaDB, PostgreSQL, SQL Server, Oracle and SQLite through one interface.

Key Features:

• Two tools by default, execute_sql and search_objects, about 1.4k tokens of context. explain_sql and health_check are opt-in.
• readonly and max_rows per source, so one process can be read-only on production and writable on staging, even across instances or engines.
• MySQL options for charset, collation, SSL, query_timeout and SSH tunnels, with ${ENV} interpolation so the config can be committed without secrets.

[[sources]]
id = "prod"
dsn = "mysql://agent:${PROD_PASSWORD}@mysql-prod:3306/myapp"

[[sources]]
id = "staging"
dsn = "mysql://agent:${STAGING_PASSWORD}@mysql-staging:3306/myapp"

[[tools]]
name = "execute_sql"
source = "prod"
readonly = true
max_rows = 500

[[tools]]
name = "execute_sql"
source = "staging"
readonly = false

GitHub Stats: 3.5k stars, MIT, TypeScript. v1.3.1 (September 2026), 1 open issue.

Best For: MySQL alongside other engines, and teams watching context cost.

Verdict: per-source posture is the same idea as mcp-server-mysql's per-schema permissions, extended across instances and engines, but no finer. And the database still sees one user, so who-approved-what has to live in front of the database, as we argue in governed MCP vs. raw MCP.

MySQL MCP Server Comparison#

Star counts are from September 2026. Read them as adoption, not ranking.

Also on the list, with reservations#

• mysql_mcp_server_pro (248 stars) adds readonly, writer and admin roles plus OAuth2, but its last commit was August 2025, two MCP spec revisions ago.
• mcp-alchemy (420 stars) reaches MySQL through SQLAlchemy. It is actively released, but it is a generic bridge with nothing MySQL-specific.

What MySQL is missing#

Postgres has Supabase MCP; MySQL has PlanetScale MCP. Neither engine's steward ships a server for general use.

Oracle does publish a mysql-mcp-server in oracle/mcp, but it is scoped to MySQL AI and HeatWave and calls itself a proof of concept "not intended for production use". Neither the MySQL Shell 26.7 nor the MySQL AI 26.7 manual mentions it. For MySQL Community Server, every option is community-maintained, each MySQL-only server driven mainly by one person, so choose on maintenance signals (recent releases, low open-issue counts) over feature lists.

Picking one#

• On PlanetScale: use their server. Its server-side refusals beat anything you'd configure yourself.
• MySQL only, safest default: mcp-server-mysql.
• MySQL plus other engines, or read-only prod and writable staging in one process: DBHub.
• Python, exploratory work: mysql_mcp_server, with a MySQL user that has SELECT and nothing else.

Whichever you pick, the MCP server is not your last line of defense. It holds one credential, and your audit trail shows one database user doing everything. When an agent's change would need a colleague's approval, the review and the record belong in front of the database. That is what Bytebase's database MCP server does: an agent's change goes through the same review, approval and audit path as a human's.