# Elekto MCP for SQL Server (nuget · Elekto.Mcp.Sql)

Read-only SQL Server introspection and querying: schema, definitions, dependencies and data.

- Trust score: 87/100 (high trust)
- Change this week: +17
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- nuget · `Elekto.Mcp.Sql`: 87/100 (this document), [markdown](https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql.md), [page](https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql)

## Channel facts

- Registry: `nuget`
- Package: `Elekto.Mcp.Sql`
- Version: `2.3.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to elekto-com-br/elekto-mcp-sql).
  - Clear OSI-approved license (GPL-3.0-or-later).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 73/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3503 tokens (~166/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 43/100
  - Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Elekto MCP for SQL Server server?

Elekto MCP for SQL Server runs locally as a NuGet package, launched with dnx Elekto.Mcp.Sql@2.3.4 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add elekto-com-br-elekto-mcp-sql -- dnx Elekto.Mcp.Sql@2.3.4 --yes
```

### Cursor

```json
{
  "mcpServers": {
    "elekto-com-br-elekto-mcp-sql": {
      "command": "dnx",
      "args": [
        "Elekto.Mcp.Sql@2.3.4",
        "--yes"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "elekto-com-br-elekto-mcp-sql": {
      "command": "dnx",
      "args": [
        "Elekto.Mcp.Sql@2.3.4",
        "--yes"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add elekto-com-br-elekto-mcp-sql -- dnx Elekto.Mcp.Sql@2.3.4 --yes
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "elekto-com-br-elekto-mcp-sql": {
      "type": "local",
      "command": [
        "dnx",
        "Elekto.Mcp.Sql@2.3.4",
        "--yes"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  elekto-com-br-elekto-mcp-sql:
    command: "dnx"
    args: ["Elekto.Mcp.Sql@2.3.4", "--yes"]
```

### Netclaw

```json
{
  "McpServers": {
    "elekto-com-br-elekto-mcp-sql": {
      "Transport": "stdio",
      "Command": "dnx",
      "Arguments": [
        "Elekto.Mcp.Sql@2.3.4",
        "--yes"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "elekto-com-br-elekto-mcp-sql": {
      "command": "dnx",
      "args": [
        "Elekto.Mcp.Sql@2.3.4",
        "--yes"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-17 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-16 (score 86, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-15 (score 71, −4)

- [security regression] Malware scan: pass → unverified
- [security improvement] Provenance: unverified → pass
- [security] The attested source repository moved: elekto-com-br/elekto-mcp-sql
- [functional] Package version: 2.3.2 → 2.3.4

### 2026-10-14 (score 75, +5)

- [functional improvement] Stability: unverified → 0.33

### 2026-10-04 (score 70)

First indexed and scored.

## MCP tools (21)

### `list_procedures` (~157 tokens)

List stored procedures

Lists the user stored procedures the login can see, with line count, join count and number of referenced objects as rough complexity metrics. Use it to find procedures and pick the complex ones; for one procedure's text use get_procedure_definition. definition_visible is false, and the metrics null, for a procedure whose text is hidden from the login; referenced_object_count is null when the login cannot read dependencies. SQL Server leaves out procedures the login has no permission on without an error: get_database_overview says whether that happens, check_permissions why.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `generate_dependency_dot` (~186 tokens)

Dependency diagram (DOT)

Generates a Graphviz DOT diagram of the dependencies between database objects: an arrow runs from each table, view, procedure or function to the object it depends on, through a foreign key or a reference in its code. Returns the DOT text in 'dot', ready for 'dot -Tsvg', and the same graph as 'nodes' (with node_kind) and 'edges' (with dependency_kind). Use it to draw the graph; for the edges alone use get_dependency_graph, and for what references a single table use get_table_usage. A whole database makes an unreadable diagram, so narrow it with schema. 'visibility' says when references from code are missing for lack of permission.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `list_schemas` (~71 tokens)

List schemas

Lists the user schemas of a database with their owners, leaving out system schemas. Use it to learn the names the 'schema' filter of the other tools accepts; for object counts and sizes per schema use get_schema_summary instead.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.

### `get_dependency_graph` (~129 tokens)

Dependency graph

Returns the dependency edges between database objects as data: foreign keys between tables, and references among views, procedures and functions. Use it to analyze dependencies programmatically; for a diagram use generate_dependency_dot, and for what references one table use get_table_usage. Fails, saying so, when the login cannot read sys.sql_expression_dependencies; without VIEW DEFINITION the module edges cover only modules the login can read.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `check_permissions` (~156 tokens)

Check login permissions

Reports what the connected login can and cannot see in a database: identity, roles, effective permissions, server version and, for each group of tools, whether it sees everything ('complete'), only part ('partial') or nothing ('unavailable'), with the missing permission and the GRANT that adds it in this server version's syntax. Also reports 'write_access', so an account meant to be read-only can be verified rather than assumed. Call it when a listing looks short, a definition comes back hidden, get_database_overview reports incomplete visibility, or a tool fails with a permission error: SQL Server leaves out what a login cannot see without raising any error.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.

### `list_databases` (~94 tokens)

List configured databases

Lists the logical database names this server is configured to reach, with each one's row limit and command timeout. Call it first: every other tool, starting with get_database_overview, takes one of these names as its 'database' argument. It reads only the server's configuration and never connects to SQL Server; when nothing is configured it answers ok: false with the file to create, where the server looked and an example.

### `get_procedure_definition` (~114 tokens)

Stored procedure definition

Returns the CREATE PROCEDURE text of one stored procedure. Use it to read or review a procedure found with list_procedures; this server never executes procedures. A procedure the login can see but not read comes back with definition null and definition_visible false.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `procedure` (string, required): Stored procedure name, bare, with no schema prefix.
- `schema` (string): Procedure schema. Empty searches every schema. Example: 'Feeder'

### `compare_schemas` (~175 tokens)

Compare two databases

Compares the table and column structure of two configured databases, such as development and production: tables present in only one, columns present in only one, and columns whose type or nullability differ, each with its type_declaration so a difference reads as 'nvarchar(250) vs nvarchar(50)'. Use it to check a migration or detect drift. It compares tables and columns only, not views, code, indexes or data; to see one differing table in full, call get_table_schema on each database.

Input parameters:

- `source_database` (string, required): Source database name as registered in configuration.
- `source_schema` (string): Source schema filter. Empty means every schema.
- `target_database` (string, required): Target database name as registered in configuration.
- `target_schema` (string): Target schema filter. Empty means every schema.

### `get_view_definition` (~129 tokens)

View definition

Returns the CREATE VIEW text of one view together with its columns, in the same detail as get_table_schema. Use it to see how a view derives its data; for the objects it reads from use get_dependency_graph. A view the login can see but not read comes back with definition null and definition_visible false, which check_permissions explains.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): View schema. Empty searches every schema. Example: 'Feeder'
- `view` (string, required): View name, bare, with no schema prefix.

### `list_tables` (~172 tokens)

List tables

Lists user tables with schema, approximate row count, data and index size in MB, and creation and modification dates. Use it to find tables by name or schema and to spot the large ones; to find tables by a column they hold use find_columns, and for one table's columns and keys use get_table_schema. Narrow large databases with schema and name_pattern.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `name_pattern` (string): Filter by table name. A pattern without % matches anywhere in the name, so 'Security' finds GenericSecurity; add % yourself for a prefix or suffix match, as in 'Anbima%'. Empty means every table.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `query_table` (~457 tokens)

Query a table or view

Runs a SELECT on one table or view, with optional column list, filter, ordering, grouping, aggregates (COUNT, SUM, AVG, MIN, MAX), pagination and random sampling, and returns the rows in an object with row_count and a measured 'truncated' flag, so a short result is never mistaken for a complete one. Rows are capped by the database's max_query_rows. Call get_table_schema first for exact column names; for null ratios, distinct counts and frequent values use get_data_profile instead of paging through rows. Reads actual data; never runs INSERT, UPDATE, DELETE or procedures.

Input parameters:

- `aggregates` (string): Aggregates as ONE comma-separated string of FUNC(column) [AS alias], with FUNC one of COUNT, SUM, AVG, MIN, MAX. Only a bare column name is allowed inside the parentheses. Example: 'COUNT(*) AS Total…
- `columns` (string): Columns as ONE comma-separated string, not a JSON array. Example: 'ReferenceDate, Source, Close'. Empty or '*' returns every column. Reserved words need no quoting or brackets.
- `database` (string, required): Name of the database as registered in the configuration.
- `group_by` (string): GROUP BY columns as ONE comma-separated string. Example: 'Source, Name'
- `order_by` (string): ORDER BY clause without the ORDER BY keyword. Example: 'ReferenceDate DESC, Name'
- `sample_percent` (number): Random sampling percentage, from 0.01 to 100. Zero (the default) means no sampling.
- `schema` (string): Table/view schema. Empty means dbo. Example: 'Feeder'
- `skip` (integer): Number of rows to skip before returning results (for pagination, default 0).
- `table` (string, required): Table or view name, bare, with no schema prefix. Example: 'GenericSecurity'
- `top` (integer): Maximum number of rows to return (default 100, capped by the per-database limit).
- `where` (string): WHERE clause without the WHERE keyword, as SQL. Example: "Source = 'BDS' AND ReferenceDate >= '2026-01-01'"

### `find_columns` (~187 tokens)

Find columns by name

Finds every table and, by default, every view holding a column whose name matches a pattern, with each column's type_declaration and nullability. Use it to answer 'which objects have this column?' before a rename, a widening or an impact review; to find objects by their own name use list_tables or list_views.

Input parameters:

- `column_pattern` (string, required): Part of a column name. A pattern without % matches anywhere in the name, so 'Date' finds ReferenceDate and AuxDate; add % yourself for a prefix or suffix match, as in 'Aux%'. Example: 'ReferenceDate'
- `database` (string, required): Name of the database as registered in the configuration.
- `include_views` (boolean): Include views as well as tables. True by default.
- `schema` (string): Restrict to one schema. Empty means every schema. Example: 'Feeder'

### `get_function_definition` (~110 tokens)

User function definition

Returns the CREATE FUNCTION text of one user-defined function. Use it to read or review a function found with list_functions; this server never executes functions. A function the login can see but not read comes back with definition null and definition_visible false.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `function` (string, required): Function name, bare, with no schema prefix.
- `schema` (string): Function schema. Empty searches every schema. Example: 'Feeder'

### `get_table_schema` (~184 tokens)

Table structure

Returns the full structure of one table or view: columns with an unambiguous type_declaration (such as 'nvarchar(250)'), max_length_chars, every extended property, computed-column definitions and whether they are persisted; plus primary key, foreign keys, check and unique constraints, and indexes with key column order and declared key width. Call it before query_table to learn exact column names and types; for a view's SQL text use get_view_definition. max_length is the raw sys.columns value in BYTES, so reason about text length with type_declaration or max_length_chars.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Table schema. Empty searches every schema. Example: 'Feeder'
- `table` (string, required): Table name, bare, with no schema prefix. Example: 'GenericSecurity'

### `get_database_overview` (~118 tokens)

Database overview

Summarizes one database: real name, server and instance, connected login, counts of tables, views, procedures, functions and schemas, and allocated size in MB. Use it after list_databases to size up a database before exploring it; for the same figures per schema use get_schema_summary. Counts cover only what the login can see: 'visibility.complete' is false when SQL Server hides objects, and check_permissions then says which GRANT is missing.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.

### `get_data_profile` (~179 tokens)

Profile column data

Profiles the columns of one table or view: null ratio, distinct count, minimum, maximum and most frequent values. Use it to learn how data is distributed without paging through rows with query_table. It reads actual row values and scans the table, so on a large table it can take a while; limit it to the columns you need.

Input parameters:

- `columns` (string): Columns to profile as ONE comma-separated string, not a JSON array. Example: 'Source, Name'. Empty profiles every column.
- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Table schema. Empty means dbo. Example: 'Feeder'
- `table` (string, required): Table name, bare, with no schema prefix.
- `top_values` (integer): Top frequent values to return per column (default 5).

### `list_views` (~129 tokens)

List views

Lists user views with their schema. Use it to find views by name or schema; for a view's columns and SQL text use get_view_definition, and for tables use list_tables. Narrow large databases with schema and name_pattern.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `name_pattern` (string): Filter by view name. A pattern without % matches anywhere in the name; add % yourself for a prefix or suffix match. Empty means every view.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `get_index_health` (~125 tokens)

Index health

Reports index health by schema: duplicate index candidates, unused indexes and missing-index suggestions. Use it when reviewing indexing or slow queries; for one table's indexes use get_table_schema. Unused and missing indexes come from server DMVs, which reset when SQL Server restarts; without VIEW SERVER STATE they come back null and 'visibility.unavailable' says why, while duplicates are still reported.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `get_schema_summary` (~115 tokens)

Schema summary

Summarizes each schema of a database: counts of tables, views, procedures and functions, approximate rows and estimated data and index size. Use it to see where a database's weight lies before exploring or planning a refactoring; for whole-database totals use get_database_overview, and for the tables of one schema use list_tables.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `list_functions` (~128 tokens)

List user functions

Lists the user-defined functions the login can see (scalar, inline table-valued and multi-statement table-valued), with the same complexity metrics and visibility flags as list_procedures. Use it to find functions; for one function's text use get_function_definition. SQL Server leaves out functions the login has no permission on without an error: get_database_overview says whether that happens, check_permissions why.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Filter by schema name. Empty means every schema. Example: 'Feeder'

### `get_table_usage` (~134 tokens)

Table usage

Lists everything that references one table: foreign keys to and from it, and the views, procedures and functions whose code uses it. Use it for impact analysis before changing a table; for the dependency graph of the whole database use get_dependency_graph. sql_module_usage is null when the login cannot read dependencies, and 'visibility' says when the list may be incomplete.

Input parameters:

- `database` (string, required): Name of the database as registered in the configuration.
- `schema` (string): Table schema. Empty searches every schema. Example: 'Feeder'
- `table` (string, required): Table name, bare, with no schema prefix.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql#diagnostics

## Score history

- 2026-10-17: 87
- 2026-10-16: 86
- 2026-10-15: 71
- 2026-10-14: 75
- 2026-10-13: 70
- 2026-10-12: 70
- 2026-10-07: 70
- 2026-10-05: 70
- 2026-10-04: 70

## Common questions

### What is the Elekto MCP for SQL Server server?

Elekto MCP for SQL Server is listed in the public MCP registry as io.github.elekto-com-br/elekto-mcp-sql. Read-only SQL Server introspection and querying: schema, definitions, dependencies and data. This page covers its NuGet package (Elekto.Mcp.Sql).

### Is the Elekto MCP for SQL Server server safe to use?

Elekto MCP for SQL Server scores 87 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Elekto MCP for SQL Server server expose?

Elekto MCP for SQL Server exposes 21 tools: list_procedures, generate_dependency_dot, list_schemas, get_dependency_graph, check_permissions, and 16 more. Their descriptions and schemas cost roughly 3,249 tokens of context every time the server is loaded.

### Is the Elekto MCP for SQL Server server still maintained?

Elekto MCP for SQL Server is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Elekto MCP for SQL Server server under?

Elekto MCP for SQL Server declares the GPL-3.0-or-later licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- NuGet package: https://www.nuget.org/packages/Elekto.Mcp.Sql
- Socket report: https://socket.dev/nuget/package/Elekto.Mcp.Sql
- Repository: https://github.com/elekto-com-br/elekto-mcp-sql
- Changelog RSS feed: https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql.xml
- Changelog JSON feed: https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql.json
- HTML version of this page: https://verifymcp.io/servers/elekto-com-br-elekto-mcp-sql/elekto-mcp-sql