MCP DB Wizard

An MCP server for Oracle that won't get you fired

The config is the whole security model

Reachable by the agent

• synuser_activity_log_get_by_pk table — one row by primary key, as a JSON object
• synuser_activity_log_insert table — with _update and _delete, from the same selection
• synuser_js_admin_getadmintoolinfo PL/SQL routine — records, collections and every OUT parameter
• synuser_job_id_nextval sequence — the next value, and nothing else

Not reachable, by construction

• SQL text from the caller — arguments are bind values
• DDL — create, alter, drop
• Any object you did not select
• Any schema the config does not name
• The Oracle password — it lives in the environment

An agent that can write SQL can write DROP TABLE. An agent holding a tool called check_flight_availability can check availability on a flight, because that's all the code in front of it does.

Curation happens before the code exists

Least privilege is easy to claim and hard to verify. Here the config decides what is emitted: an object nobody selected has no tool, no method and no class. It is absent from the binary rather than guarded by a running process, so no prompt can reach it.

Your business rules are already in PL/SQL

Decades of validation, referential logic and audit behaviour live inside packages. MCPDBWizard calls those routines as they are — records, collections, ref cursors, and every OUT parameter returned — instead of asking a language model to reinvent the rules in a SELECT.

Every call is a named tool, not a query

Requests arrive as synuser_activity_log_get_by_pk(entry_id) against a strict schema — a misspelled argument is rejected before the database is touched. Far easier to log, rate-limit, review after the fact, and explain to an auditor.

Two audiences, two records

The proxy writes who called which tool and whether it was allowed; each server writes what the tool did and how it ended. Argument names always; values only if you turned that on, because a model chose them.

Oracle 12c through 26ai

Including the types added since: native JSON, BOOLEAN and VECTOR, and document CRUD over JSON-relational duality views. Anything that cannot cross JSON honestly — SDO_GEOMETRY, BFILE — is skipped whole, and the log says which and why.

Accounts, tokens and a grant matrix

Many accounts, many configs, one tick per grant. Two teams needing different tools over the same schema is two configs, not one config and a rule — which keeps the guarantee in the first panel intact.

1. 01

   Select the objects

   Connect the Design pages to Oracle and tick the PL/SQL packages you are willing to expose, plus any SQL statements you have written and tested yourself, plus the tables and sequences you want reachable directly. That selection is saved as a config file — properties or JSON, versionable, and containing no password. PL/SQL first, because it is the point: tick the packages and procedures you are willing to expose, and each becomes one tool with its parameters typed. Then your own SQL — statements you wrote and tested, with bind parameters typed inline. The agent runs these; it does not compose its own. Finally tables, curated per operation rather than per table — a newly selected one is read-only, and create, update and delete are yours to tick.
2. 02

   Generate, compile, run

   The Runtime page emits Java for exactly those objects, compiles it, and launches it as its own server on loopback. Anything you did not select has no tool, no method and no class — it is absent from the binary rather than merely refused.

   docker run -d --name mcpdbwizard \
     -p 8080:8080 \
     -e MCPDBWIZARD_ORACLE_HOST=db.example.com \
     -e MCPDBWIZARD_ORACLE_PORT=1521 \
     -e MCPDBWIZARD_ORACLE_SID=/PDB1 \
     -e MCPDBWIZARD_ORACLE_USER=appuser \
     -e DB_PASS_FILE=/run/secrets/oracle \
     -v mcpdbwizard-demo:/data \
     ghcr.io/srmadscience/mcpdbwizard:2.0.4
   

3. 03

   Point your MCP client at the proxy

   Agents connect on 8080, over Streamable HTTP, with a token issued to their account. The proxy is the only component that knows who is calling — it checks the account, the grant and the rate limit, then forwards.

   {
     "mcpServers": {
       "payroll": {
         "url": "http://localhost:8080/mcp/alice/payroll",
         "headers": {
           "Authorization": "Bearer <id>.<secret>"
         }
       }
     }
   }
   

The quickstart has the whole path, including issuing the token and granting the config.