Universal DB MCP
by Anarkh-Lee通用数据库 MCP 连接器：支持 MySQL、PostgreSQL、Oracle、MongoDB 等 17 种数据库，支持 Claude Desktop、Cursor、Windsurf、VS Code、ChatGPT 等 50+ 平台，用自然语言查询和分析数据
Universal DB MCP is an open-source mcp server by Anarkh-Lee, written mainly in TypeScript, with 940 GitHub stars and the MIT license. Its code was last updated Mar 17, 2026.
Scan summary: scanned Nov 5, 2026 at commit dc338cd. Seen able to run shell commands, connect to databases. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
dc338cd · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine. BootsIt started, and MCP servers answered the protocol handshake. No undeclared egressWhile running it only contacted the domains it declared. ReproducibleEarned in this scan.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Secrets scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Dependency audit132 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Boot & handshake9 toolspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Network egresspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Reproducible (×3)passPassed. This check ran and found nothing it flags.
Findings (42)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@hono/node-server@1.19.9: 3 known vulnerabilitiesGHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-wc8c-qw6v-h7f6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.26.0: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.2: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.express-rate-limit@8.2.1: 1 known vulnerabilityGHSA-46wh-pxpv-q5gq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@2.4.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fastify@4.29.1: 9 known vulnerabilitiesGHSA-444r-cwp2-x5xf, GHSA-4mh8-r7rc-xpvc, GHSA-667r-xxjv-c9mm, GHSA-9q9j-q6p8-xq58, GHSA-hwr6-493r-vm6h +4 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fflate@0.8.2: 1 known vulnerabilityGHSA-px8p-9vwx-vf98
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.find-my-way@8.2.2: 1 known vulnerabilityGHSA-c96f-x56v-gq3h
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.flatted@3.3.3: 2 known vulnerabilitiesGHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.hono@4.11.7: 34 known vulnerabilitiesGHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-5pq2-9x2x-5p6w +29 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.0.1: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.1.0: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mysql2@3.16.1: 2 known vulnerabilitiesGHSA-3f6p-5ww8-9rcr, GHSA-rgwj-5xj2-c3m3
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.11: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@5.1.6: 2 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-xwg4-73v4-xw9w
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.3.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.6: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.rollup@4.57.0: 1 known vulnerabilityGHSA-mw96-cpmx-2vgc
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@5.4.21: 8 known vulnerabilitiesGHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header2 matches in this file
docs/development/implementation.zh-CN.md:381 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header2 matches in this file
docs/getting-started/quick-start.md:82 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header14 matches in this file
docs/http-api/API_REFERENCE.md:125 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header2 matches in this file
docs/development/implementation.md:383 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header20 matches in this file
docs/http-api/API_REFERENCE.zh-CN.md:125 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header
docs/http-api/DEPLOYMENT.md:328 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header
docs/http-api/DEPLOYMENT.zh-CN.md:328 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header
docs/databases/oracle.md:84 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header2 matches in this file
docs/operations/guide.md:168 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
tests/unit/data-masking.test.ts:38 - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.esbuild@0.21.5: 1 known vulnerabilityGHSA-67mh-4wv8-2f99
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.1: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.package.json has a prepare scriptnpm run build
package.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
github.comregistry.npmjs.orgrelease-assets.githubusercontent.com
While running
No connections
Tools exposed (9)
execute_query执行 SQL 查询或数据库命令。支持 SELECT、JOIN、聚合等查询操作。如果启用了写入模式，也可以执行 INSERT、UPDATE、DELETE 等操作。
get_schema获取数据库结构信息，包括所有 Schema 中用户可访问的表名、列名、数据类型、主键、索引等元数据。在执行查询前调用此工具可以帮助理解数据库结构。结果会被缓存以提高性能。
get_table_info获取指定表的详细信息，包括列定义、索引、预估行数等。用于深入了解某个表的结构。
clear_cache清除 Schema 缓存。当数据库结构发生变化（如新增表、修改列）时，可以调用此工具清除缓存。
get_enum_values获取指定列的所有唯一值。用于了解 status、type、category 等枚举类型列的所有可能值，帮助生成准确的 WHERE 条件。例如：获取 orders.status 列的所有状态值（pending, shipped, delivered 等）。
get_sample_data获取表的示例数据（已自动脱敏）。用于了解数据格式，如日期格式（2024-01-01 vs 20240101）、ID格式（UUID vs 自增）、金额精度等。敏感数据（手机号、邮箱、身份证等）会自动脱敏保护隐私。
connect_database连接到数据库。支持动态指定数据库类型和连接参数，无需重启服务。如果当前已有连接，会自动断开旧连接再建立新连接。支持的数据库类型：mysql, postgres, redis, oracle, dm, sqlserver, mongodb, sqlite, kingbase, gaussdb, oceanbase, tidb, clickhouse, polardb, vastbase, highgo, goldendb。
disconnect_database断开当前数据库连接。断开后需要重新调用 connect_database 才能执行查询。
get_connection_status获取当前数据库连接状态。返回是否已连接、数据库类型、地址、数据库名、权限模式等信息。
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Universal DB MCP alternatives
View more →Similar mcp servers in Database Management, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Universal DB MCP (this page) Anarkh-Lee | 940 | MIT | Mar 17, 2026 | Scanned, no flagged issues |
| Codebase Memory MCP DeusData | 48k | MIT | Nov 1, 2026 | Scanned, see report |
| Xerj xerj-org | 19k | Apache-2.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP Toolbox googleapis | 17k | Apache-2.0 | Nov 1, 2026 | Scanned, no flagged issues |
| Nightingale ccfos | 13k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Dbhub bytebase | 3.8k | MIT | Oct 26, 2026 | Scanned, no flagged issues |