What is database-mcp (cocaxcode)?
database-mcp, published on npm as @cocaxcode/database-mcp by the GitHub user cocaxcode, turns an MCP client into a small database workbench for PostgreSQL, MySQL and SQLite. Connections are saved once and grouped by project directory, so an agent working in one repo sees only that project's databases. Around the query tools it adds three-level schema search, EXPLAIN, a per-project query history, pre-mutation snapshots that generate reverse SQL for undo, SQL dumps and restore, and result compression that truncates wide cells to save context.
The code registers 34 tools and 2 schema resources (the README says 33, the MCP registry listing 19). It runs over stdio only and loads the postgres, mysql2 or sql.js driver you install globally. The repo was created in March 2026, has 3 GitHub stars and 41 commits, last changed on 26 August 2026; npm's latest is 0.3.4 from 21 April 2026, and the package was downloaded 330 times in the month to 10 November.
How to install database-mcp (cocaxcode)
npx -y @cocaxcode/database-mcp@latestIs database-mcp (cocaxcode) worth it?
The features are well chosen for a developer's own machine. Connections persist between sessions and follow the project directory, read queries get LIMIT 100 added, cells over 500 bytes are cut down with a marker, and a 20-slot cache lets the agent fetch the full result later without re-running the query. Every INSERT, UPDATE or DELETE first captures the affected rows so rollback_apply can reverse it; DDL is logged but cannot be undone.
The safety model is weaker than the README says. The README promises that destructive operations need an explicit confirm: true, but in our reading of the source execute_mutation takes no such parameter and runs a DELETE or DROP at once; only conn_delete, rollback_apply and db_restore ask for confirmation, and that flag is one the model sets itself. New connections do default to read-only, which is the right call, but conn_set lets the agent switch a connection to read-write in one tool call.
Read-only itself rests on a classifier that looks only at the first keyword of the statement. The PostgreSQL driver sends parameter-free SQL through postgres.js's simple protocol and the SQLite driver uses sql.js exec, both of which run several statements in one call, so a string that starts with SELECT can carry a DELETE after a semicolon. explain_query with analyze set to true skips the read-only check altogether, and on PostgreSQL EXPLAIN ANALYZE executes the statement it explains. A prompt injection hidden in a row the agent has just read could exploit either path. The MySQL driver uses prepared statements and does not accept stacked queries.
Credentials stay local, in owner-only JSON files under ~/.database-mcp, and conn_get masks passwords; conn_export with include_secrets returns them in plain text into the model's context. History, rollback snapshots holding old row values and full dumps are written inside the project's .database-mcp folder, which needs to stay out of version control. Tool descriptions and server instructions are written in Spanish, which models handle but English-speaking reviewers of agent logs may not.
Our take: for a SQLite file or a disposable local Postgres, the rollback and history tools are a pleasant upgrade on a bare SQL runner. For anything that matters, DBHub or Microsoft's Postgres server behind a SELECT-only database user is the safer arrangement, because there the database, not a keyword check, says no.
Where it earns its place
A solo developer building a side project on SQLite
Seed test data, try schema changes and undo mistakes from Claude Code
Create a read-write connection to the local .db file, let the agent insert and update rows, and call rollback_apply when a change goes wrong. Free; run db_dump before any DDL, since schema changes cannot be rolled back.
A freelance backend developer juggling several client projects
Have the agent pick the right local database for each repo without reconfiguring
Make one connection group per client with that project's directory as its scope and a development database as the default. The agent sees only that client's connections; production connections are better left out of the tool entirely.
Before you commit
- Setup
- claude mcp add --scope user database -- npx -y @cocaxcode/database-mcp@latest, plus npm install -g postgres, mysql2 or sql.js for the engine you use; Node 20 or later. Documented configs for Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex CLI and Gemini CLI. Connections are created by asking the agent, so a first query takes a few minutes.
- Integrations
- 34 tools in code: 13 for connections, 7 for groups, search_schema, execute_query, execute_mutation, explain_query, inspect_last_query, three for dumps, two for rollback, two for history and two for config, plus db://schema and db://tables/{tableName}/schema resources. stdio only; no HTTP transport, so no network port.
- Data and privacy
- Everything runs locally; query results go to your model provider. Credentials are stored unencrypted in JSON files under ~/.database-mcp/connections with owner-only permissions; conn_export can return them in plain text. Per-project .database-mcp holds history (up to 5,000 entries), rollback snapshots with row data (up to 1,000) and full SQL dumps; recent results are cached on disk for an hour. Rows the agent reads can carry prompt injection, and read-only mode does not reliably stop a resulting write on PostgreSQL or SQLite.
- Cost at scale
- Free; the costs are database load and context. The default LIMIT 100 and 500-byte cell cap keep typical results small; EXPLAIN ANALYZE and unbounded UNION queries, which skip the limit, do not.
- Limits
- No SSH tunnelling or certificate settings of its own, no query timeout, and only three engines. The repo's version 0.3.5 is not on npm. Read-only and confirmation rely on the model's cooperation rather than database permissions.
What ’s good
- Saved connections grouped by project directory
- Pre-mutation snapshots with reverse-SQL rollback
- Auto LIMIT 100 and cell truncation to save context
- Connections default to read-only
What’s not
- No confirmation on execute_mutation despite the README
- Read-only bypassable by stacked statements and EXPLAIN ANALYZE
- Agent can switch a connection to read-write itself
- Three stars, one developer, no npm release since April 2026
Best for
Solo developers who want an agent to explore and edit a local SQLite or development Postgres database with undo and history.
database-mcp (cocaxcode) alternatives
database-mcp (cocaxcode): common questions
- Is database-mcp (cocaxcode) worth it?
- Thoughtful workbench features sit on safety claims the code does not keep, so it belongs on a laptop database and nowhere near production. We rate it 2.9 out of 5.
- How much does database-mcp (cocaxcode) cost?
- Free and open source (MIT).
- What are the downsides of database-mcp (cocaxcode)?
- No confirmation on execute_mutation despite the README; read-only bypassable by stacked statements and EXPLAIN ANALYZE; agent can switch a connection to read-write itself; three stars, one developer, no npm release since April 2026.
- Who is database-mcp (cocaxcode) best for?
- Solo developers who want an agent to explore and edit a local SQLite or development Postgres database with undo and history.
- How much does database-mcp (cocaxcode) cost for a team or in production?
- Free; the costs are database load and context. The default LIMIT 100 and 500-byte cell cap keep typical results small; EXPLAIN ANALYZE and unbounded UNION queries, which skip the limit, do not.
- Is database-mcp (cocaxcode) safe for company data?
- Everything runs locally; query results go to your model provider. Credentials are stored unencrypted in JSON files under ~/.database-mcp/connections with owner-only permissions; conn_export can return them in plain text. Per-project .database-mcp holds history (up to 5,000 entries), rollback snapshots with row data (up to 1,000) and full SQL dumps; recent results are cached on disk for an hour. Rows the agent reads can carry prompt injection, and read-only mode does not reliably stop a resulting write on PostgreSQL or SQLite.
- What are the best database-mcp (cocaxcode) alternatives?
- The closest alternatives we have reviewed are DBHub, Postgres MCP Server (Microsoft), Faucet and MCP Toolbox for Databases.
Answers checked Nov 11, 2026.