Oracle Database

Setup

1. Create a user with only CREATE SESSION and the SELECTs it needs:

   CREATE USER amcp_reader IDENTIFIED BY "change-me";
   GRANT CREATE SESSION TO amcp_reader;
   GRANT SELECT ON sales.orders TO amcp_reader;
   -- or, for a whole schema, a read-only role you maintain
   

2. Set ORACLE_HOST, ORACLE_PORT (1521), ORACLE_DATABASE — the service name (e.g. ORCLPDB1), not the SID — plus ORACLE_USER and ORACLE_PASSWORD.

The node-oracledb driver needs to be in thin mode or have Instant Client available. Thin mode covers Oracle 12.1 and newer with no client install; an older server needs Instant Client on the AnythingMCP host.

Oracle folds unquoted identifiers to UPPER CASE. A table created as Orders without quotes is ORDERS, and WHERE table_name = 'Orders' matches nothing. The describe tool compares against the value you pass verbatim, so pass it upper-cased unless the table was created with quotes.

Oracle has no LIMIT. Use FETCH FIRST 100 ROWS ONLY (12c and newer) or WHERE ROWNUM <= 100.

How a database connector behaves

• It installs read-only. The engine rejects anything that is not a read until you flip the switch in the connector's settings. That is a guard rail, not a security boundary: give the connection a database role that is itself read-only, and the guard rail never has to matter.
• Credentials live in the encrypted authConfig, not in the connection string. ORACLE_USER and ORACLE_PASSWORD are stored encrypted and spliced into the DSN at call time; the host and database name are stored in the plaintext baseUrl column.
• Results are capped at 1000 rows. A query that would return more comes back truncated with a flag. Aggregate in SQL rather than in the agent.
• A statement runs exactly as written. There is no query rewriting and no automatic LIMIT — an unbounded scan on a large table is a real unbounded scan on your production database. Say LIMIT.

Reachable from where?

• On AnythingMCP Cloud the server must accept connections from the public internet, which for a production database usually means it should not. Point the connector at a read replica, or self-host AnythingMCP inside the network.
• Self-hosted, add the host to SSRF_ALLOWED_HOSTS: the outbound guard blocks private address space by default, and 10.0.0.5 is exactly the shape it is there to block.