What it is
DBHub, from database tooling company Bytebase, connects MCP clients to PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite through one server. A TOML file can define several connections at once, with SSH tunnelling, SSL/TLS client certificates and AWS RDS IAM authentication. The repo has about 3,700 GitHub stars; version 1.5.0 shipped on 9 October 2026, and the npm package was downloaded about 166,000 times in the month to 18 October.
By default it loads two tools, execute_sql and search_objects, which the README puts at 1.4k tokens of context. explain_sql and health_check are opt-in, and you can define your own parameterised SQL tools in the config file. On the HTTP transport it also serves a web workbench for running queries and viewing request traces without an MCP client.
Run it with npx @bytebase/dbhub@latest and a database connection string (DSN); Docker, an MCP Bundle and a Claude Code plugin are also offered. Claude Code's own docs use it as the example for connecting to PostgreSQL.
Install
npx @bytebase/dbhub@latest --dsn "postgres://user:password@localhost:5432/dbname"Our review
DBHub's appeal is restraint. Two default tools and progressive schema discovery keep context use low; the README puts the default load at 1.4k tokens against about 19k for Google's MCP Toolbox and Supabase's server. That is Bytebase's own comparison, but the design makes it believable. Covering six database engines in one process, with SSH tunnels, client certificates and RDS IAM authentication, is the other draw.
The guardrails need configuring and have needed fixing. Read-only mode is opt-in per tool in the TOML file. In June 2026 three high-severity advisories were published: read-only could be bypassed on MySQL and MariaDB through a comment-parsing mismatch (CVE-2026-61789), the PostgreSQL read-only transaction never actually switched on, leaving only a keyword check (CVE-2026-61788), and the HTTP transport was open to DNS rebinding from a malicious web page (CVE-2026-61742). All were fixed by 0.22.6, and 1.5.0 added a block on set_config() in read-only mode. The fixes are reassuring; the pattern is a reason not to rely on the tool's checks alone.
The docs say as much. A privileged PostgreSQL role can still read or write server files and run commands through pg_read_file, lo_export or COPY ... TO PROGRAM inside a read-only transaction, and on MySQL, DDL is stopped only by the classifier. Bytebase advises connecting with a least-privilege, read-only user, and that should be treated as a rule. HTTP mode deserves the same care: it binds 0.0.0.0 by default and asks for no token unless --auth-token is set.
What it leaves out is deliberate. There is no approval flow, data masking or audit log, which Bytebase sells in its main product, and the team chose not to build write confirmations into the server, arguing that hosts such as Claude Code already gate tools marked destructive. Vendor servers from Supabase or Neon also manage the platform itself, such as branches and projects, which DBHub does not attempt.
Where it earns its place
A backend developer on a team running Postgres and SQL Server side by side
Explore an unfamiliar schema and draft queries from Claude Code or Cursor
One dbhub.toml defines both sources; search_objects walks tables and indexes step by step, and execute_sql runs drafts with max_rows set to 1,000. Free and MIT-licensed; the only cost is creating a read-only role on each database.
An operations analyst with no SQL background
Answer questions from a reporting database through Claude Desktop
Install the read-only MCP Bundle, or define custom parameterised tools in TOML so the model calls named queries rather than writing SQL. That limits what can go wrong to the views those tools touch.
An SRE investigating a slow production MySQL replica
Check query plans and connection health without risking writes
Enable explain_sql and health_check, set readonly = true and a query_timeout, and connect with a SELECT-only user on 0.22.6 or later, the release that closed the MySQL read-only bypass.
Before you commit
- Setup
- Add npx @bytebase/dbhub@latest --transport stdio --dsn "postgres://..." to any MCP client, or use Docker, the MCP Bundle or the Claude Code plugin; Node 22.5 or later is required. First query in minutes; several databases need a dbhub.toml.
- Integrations
- Two default tools (execute_sql, search_objects), two opt-in tools (explain_sql, health_check) and custom TOML-defined SQL tools. The HTTP transport adds a web workbench, a /healthz endpoint and stateless serving behind a load balancer.
- Data and privacy
- It can do anything the DSN's database user can, including DDL unless readonly = true. Everything runs on your machine, and results go to whichever model the client uses. On a shared network, HTTP mode needs --auth-token and --host 127.0.0.1.
- Cost at scale
- Free; the real cost is database load. Per-tool max_rows and query_timeout stop runaway agent queries, and the stateless HTTP transport lets several replicas share traffic.
- Limits
- No approval, masking or audit logging, and no platform management such as branching. On MySQL and MariaDB, DDL in read-only mode is blocked only by the keyword classifier.
What's good
- Six database engines from one server
- Two default tools at about 1.4k tokens of context
- Read-only enforced by keyword check and database transaction
- SSH tunnels, SSL client certificates and RDS IAM auth
What's not
- Read-only is opt-in; default execute_sql can DROP tables
- Three high-severity advisories in June 2026
- HTTP mode binds 0.0.0.0 with no token by default
- No approval flow, masking or audit log
Best for
Developers who want an agent to explore and query several SQL databases with one small, configurable server.
Alternatives
DBHub: common questions
- Is DBHub worth it?
- A small, well-designed SQL gateway for agents, provided it connects as a read-only database user, since its own read-only mode has already been bypassed twice. We rate it 4.3 out of 5.
- How much does DBHub cost?
- Free and open source (MIT). Bytebase sells a separate enterprise product with approval flows, masking and audit logs.
- What are the downsides of DBHub?
- Read-only is opt-in; default execute_sql can DROP tables; three high-severity advisories in June 2026; hTTP mode binds 0.0.0.0 with no token by default; no approval flow, masking or audit log.
- Who is DBHub best for?
- Developers who want an agent to explore and query several SQL databases with one small, configurable server.
- How much does DBHub cost for a team or in production?
- Free; the real cost is database load. Per-tool max_rows and query_timeout stop runaway agent queries, and the stateless HTTP transport lets several replicas share traffic.
- Is DBHub safe for company data?
- It can do anything the DSN's database user can, including DDL unless readonly = true. Everything runs on your machine, and results go to whichever model the client uses. On a shared network, HTTP mode needs --auth-token and --host 127.0.0.1.
- What are the best DBHub alternatives?
- The closest alternatives we have reviewed are MCP Toolbox for Databases, Supabase MCP Server, Neon MCP Server and ClickHouse MCP Server.
Answers checked Oct 22, 2026.
Make DBHub? Show this rating on your site
