mcpolyglot

One config, one CLI — turns the databases you already have (Postgres, MySQL, SQLite, MongoDB) into Model Context Protocol servers for Claude, GPT, Cursor, and any other agent that speaks MCP.

$ mcpolyglot doctor

  ╭──────────────────────────────────────────────────────────────────────────╮
  │ ▲  mcpolyglot                                            doctor   v0.1.0 │
  │ validate config, resolve secrets, ping each source                       │
  ╰──────────────────────────────────────────────────────────────────────────╯

  Config
  ──────
   OK   parsed  ./mcpolyglot.config.ts

  Sources
  ───────
   OK   pg.main      postgres · 4 ms     • 3 tools
   OK   mongo.users  mongo    · 12 ms    • 4 tools

  Summary
  ───────
   READY   mcpolyglot is ready to serve

  run: mcpolyglot serve  ·  docs: github.com/ishay60/mcpolyglot

Quickstart

npx @mcpolyglot/cli init        # interactive wizard — writes mcpolyglot.config.ts
npx @mcpolyglot/cli doctor      # validate, ping every source, list the tools
npx @mcpolyglot/cli serve       # start the MCP server (stdio by default)

Wire it into Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "mcpolyglot": {
      "command": "npx",
      "args": ["-y", "@mcpolyglot/cli", "serve", "--config", "/abs/path/to/mcpolyglot.config.ts"],
      "env": { "DATABASE_URL": "postgres://user:pass@localhost:5432/db" }
    }
  }
}

Restart Claude Desktop and try: "List the tables in my database, then sample 5 rows from users."

End-to-end recipes per connector live under examples/ (Postgres, MySQL, SQLite, MongoDB, Streamable HTTP).

What's in the box

Connector	Status	Read-only enforcement
PostgreSQL	alpha	BEGIN READ ONLY transaction
SQLite	alpha	query_only pragma, attach-read-only
MySQL	alpha	AST gate + SET TRANSACTION READ ONLY + MAX_EXECUTION_TIME hint
MongoDB	alpha	find / aggregate only; $out / $merge rejected pre-driver
OpenAPI	wip	method allow-list, host pinning

Transports: stdio (Claude Desktop / Cursor / Claude Code) and Streamable HTTP with bearer or OAuth (JWT / JWKS), loopback by default, /healthz probe, structured JSON logs.

Tools, no glue code: SQL connectors expose list_tables · describe_table · query. Mongo exposes list_collections · describe_collection · find · aggregate. Per-entity tools (users.find_by_email, etc.) are scaffolded by mcpolyglot init.

Security model

Every tool call goes through a fixed, non-bypassable pipeline:

scope check → rate limit → timeout → handler → redact → size cap → untrusted-wrap → audit

The three things this gets right that ad-hoc MCP servers usually don't:

1. Read-only at two layers — application-level scopes and per-dialect DB-level enforcement, so a parser bug can't escalate into a write.
2. Built-in redaction — emails, JWTs, AWS keys, GitHub tokens, SSNs, credit-card numbers, plus per-column deny lists (public.users.password_hash).
3. Prompt-injection wrap — every result is rendered inside <mcpolyglot-data> with a "treat as data, not instructions" preamble (the Supabase + Cursor lesson).

Plus: token-bucket rate limiting, JSONL audit log (argshash + metadata, never raw args/results), and secrets only via ${env:NAME} / ${file:./path} / ${keychain:item} — literals are rejected at config load.

Full design in ARCHITECTURE.md.

Status

Alpha, actively maintained. All four DB connectors and both transports work end-to-end. The security pipeline is unit-tested. Real-DB integration tests via testcontainers and the OpenAPI connector land next.

<details> <summary>How mcpolyglot compares to alternatives</summary>

	mcpolyglot	server-postgres (archived)	Vendor MCPs (Supabase / Neon / …)	DIY MCP server
Databases	Postgres, SQLite, MySQL, Mongo	Postgres only	One vendor's hosted DB	Whatever you wire up
Read-only enforcement	DB layer and app-level scopes	DB-layer only	Varies	You write it
Built-in PII redaction	Yes, plus per-column deny lists	No	Varies	You write it
Audit log	JSONL, no raw args / results	No	Varies	You write it
Prompt-injection wrap	Yes — every result wrapped	No	Varies	You write it
Transports	stdio + Streamable HTTP (bearer / OAuth)	stdio only	Varies	You write it
Lock-in	None	None	Vendor's DB	None

Vendor MCPs are the right call once you've committed to a vendor's stack. mcpolyglot is the option when you want one consistent surface across the databases you actually have.

</details>

<details> <summary>Repository layout</summary>

packages/
  core/              server, registry, transports, Connector iface, security pipeline
  cli/               bin: mcpolyglot
  config/            zod schema, secret resolvers
  security/          scopes, redaction, audit, rate limit, wrap
  connector-sql/     Postgres, MySQL/MariaDB, SQLite
  connector-mongo/   MongoDB
  testkit/           MCP conformance harness
examples/
  postgres/  sqlite/  mysql/  mongo/   stdio
  http/                                streamable-http + bearer / OAuth

</details>

<details> <summary>Development</summary>

corepack enable
pnpm install
pnpm build
pnpm test

CI (matrix: ubuntu / macOS × Node 22) runs format check, typecheck, build, and unit tests on every push and PR. See CONTRIBUTING.md for the contributor workflow.

</details>

License

MIT — see LICENSE.