CoreMCP Server

CoreMCP

Model Context Protocol (MCP) server for database operations

CoreMCP by CoreBaseHQ provides a secure, extensible bridge between AI assistants (like Claude Desktop) and your databases through the Model Context Protocol.

🚀 Features

⚠️ Safety First: CoreMCP is designed to be Read-Only by default. We strongly recommend creating a specific database user with SELECT permissions only.

• 🔌 Multiple Database Support: MSSQL, Firebird (coming soon), and extensible adapter system
• 🧠 Automatic Schema Discovery: CoreMCP automatically scans your database tables, columns, foreign keys, and descriptions to provide AI context
• 📝 Column Comments Support: Extracts and presents database column comments/descriptions to the AI for better query understanding
• 🛠️ Dynamic Tool Generation: Built-in tools for common operations (list tables, describe schema) plus custom tool support
• 🎯 Custom Query Tools: Define reusable SQL queries as MCP tools in your config file
• 🛡️ NOLOCK / Read Uncommitted: Per-source option to run all SELECT queries under READ UNCOMMITTED isolation (MSSQL WITH (NOLOCK) equivalent) for zero-locking reads on busy OLTP databases
• 🛡️ Secure: Read-only mode support, connection string isolation
• 🎯 MCP Native: Built specifically for Model Context Protocol
• 🔧 Easy Configuration: Simple YAML-based setup
• 📦 Lightweight: Single binary, no runtime dependencies

📋 Requirements

• Go 1.23 or higher (for building from source)
• Database drivers are embedded in the binary

🔧 Installation

From Source

git clone https://github.com/corebasehq/coremcp.git
cd coremcp
go build -o coremcp ./cmd/coremcp

Binary Release

Download the latest release from the Releases page.

⚙️ Configuration

Create a coremcp.yaml file in your working directory:

server:
  name: "coremcp-agent"
  version: "0.1.0"
  transport: "stdio"
  port: 8080

logging:
  level: "info"
  format: "json"

sources:
  - name: "my_database"
    type: "mssql"
    dsn: "sqlserver://username:password@localhost:1433?database=mydb&encrypt=disable"
    readonly: true
    no_lock: true            # Optional: READ UNCOMMITTED isolation (WITH (NOLOCK) equivalent)
    normalize_turkish: true  # Optional: Turkish character normalization for legacy ERP databases

See coremcp.example.yaml for more examples.

DSN Format

Microsoft SQL Server:

sqlserver://username:password@host:port?database=dbname&encrypt=disable

Dummy (for testing):

dummy://test

Security Configuration

CoreMCP includes enterprise-grade security features:

security:
  # Maximum rows to return (prevents DB overload)
  max_row_limit: 1000
  
  # Enable PII masking
  enable_pii_masking: true
  
  # PII patterns to mask
  pii_patterns:
    - name: "credit_card"
      pattern: '\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
      replacement: "****-****-****-****"
      enabled: true
    - name: "email"
      pattern: '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
      replacement: "***@***.***"
      enabled: true
    - name: "turkish_id"
      pattern: '\b[1-9]\d{10}\b'
      replacement: "***********"
      enabled: true

Security Features:

• AST-Based Query Validation: Uses sqlparser to analyze SQL queries and block dangerous operations (DROP, ALTER, UPDATE, DELETE, TRUNCATE, EXEC, etc.)
• Automatic Row Limiting: Adds LIMIT clause to prevent accidentally returning millions of rows
• PII Data Masking: Automatically masks sensitive data like credit cards, emails, SSNs, Turkish IDs, IBANs
• Configurable Patterns: Define custom regex patterns for your specific PII requirements

Source Options