Microsoft SQL Server

Setup

1. Create a login and a database user with only db_datareader:

   CREATE LOGIN amcp_reader WITH PASSWORD = 'change-me';
   USE sales;
   CREATE USER amcp_reader FOR LOGIN amcp_reader;
   ALTER ROLE db_datareader ADD MEMBER amcp_reader;
   

2. Set MSSQL_HOST, MSSQL_PORT (1433), MSSQL_DATABASE, MSSQL_USER and MSSQL_PASSWORD.

Windows authentication: set MSSQL_DOMAIN as well and the engine switches to NTLM instead of SQL Server auth. Leave it blank for a SQL login.

Named instances: a host of the SERVER\\INSTANCE form does not fit a URL. Give the instance's TCP port in MSSQL_PORT and the plain hostname in MSSQL_HOST — the SQL Browser resolves the name to that port anyway, and naming the port directly removes a moving part.

The default schema is dbo, so an unqualified name resolves there. Qualify (sales.orders) when the database uses more than one schema.

How a database connector behaves

• It installs read-only. The engine rejects anything that is not a read until you flip the switch in the connector's settings. That is a guard rail, not a security boundary: give the connection a database role that is itself read-only, and the guard rail never has to matter.
• Credentials live in the encrypted authConfig, not in the connection string. MSSQL_USER and MSSQL_PASSWORD are stored encrypted and spliced into the DSN at call time; the host and database name are stored in the plaintext baseUrl column.
• Results are capped at 1000 rows. A query that would return more comes back truncated with a flag. Aggregate in SQL rather than in the agent.
• A statement runs exactly as written. There is no query rewriting and no automatic LIMIT — an unbounded scan on a large table is a real unbounded scan on your production database. Say LIMIT.

Reachable from where?

• On AnythingMCP Cloud the server must accept connections from the public internet, which for a production database usually means it should not. Point the connector at a read replica, or self-host AnythingMCP inside the network.
• Self-hosted, add the host to SSRF_ALLOWED_HOSTS: the outbound guard blocks private address space by default, and 10.0.0.5 is exactly the shape it is there to block.