{"id":6837,"date":"2026-04-08T09:01:37","date_gmt":"2026-04-08T16:01:37","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/azure-sql\/?p=6837"},"modified":"2026-04-07T18:11:37","modified_gmt":"2026-04-08T01:11:37","slug":"introducing-sql-mcp-server","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/azure-sql\/introducing-sql-mcp-server\/","title":{"rendered":"Introducing SQL MCP Server"},"content":{"rendered":"<p><strong>SQL MCP Server<\/strong> gives enterprises a secure, feature-rich way to enable agents to access data. This is accomplished without exposing the schema, risking consistency, or relying on fragile natural language parsing. SQL MCP Server is a feature of Data API builder, so deployments have a proven entity abstraction system, RBAC security at the API layer with Azure Key Vault integration, custom OAuth and Microsoft Entra support, first-level and second-level caching with integration with Redis and Azure Managed Redis, and complete instrumentation and telemetry with integration with Azure Log Analytics, Application Insights, and OpenTelemetry.<\/p>\n<p style=\"padding-left: 40px;\">Learn more: <a href=\"https:\/\/aka.ms\/dab\/mcp\/260407_blog\">https:\/\/aka.ms\/sql\/mcp<\/a><\/p>\n<h3>Like an elite guard dog at your SQL door<\/h3>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/sql-mcp-architecture.svg\"><img decoding=\"async\" width=\"537\" height=\"187\" class=\"alignnone size-full wp-image-6892\" style=\"width: 100%; height: auto;\" role=\"img\" src=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/sql-mcp-architecture.svg\" alt=\"SQL MCP Server Topology\" \/><\/a><\/p>\n<p>It supports hybrid queries and multiple data sources across Microsoft SQL, PostgreSQL, Azure Cosmos DB, and MySQL. Data API builder (DAB) 2.0 provides a production-ready surface for REST, GraphQL, and MCP with automatic configuration, native integration with Microsoft Foundry, a first-class query builder, and developer tooling like dedicated VS Code extensions, built-in REST and GraphQL tools, and a cross-platform CLI.<\/p>\n<p>SQL MCP Server is a simple MCR container that requires a JSON configuration file. It is a zero-code solution that reduces friction, dependencies, and entire blocks of repetitive, error-prone CRUD code from line-of-business applications, custom websites, tailored mobile apps, and AI agents.<\/p>\n<h3>Fine print worth reading<\/h3>\n<p>Best of all, SQL MCP Server is open source and free. It runs in any cloud, including on-premises. It was built, managed, and is maintained by Microsoft as the prescriptive approach to expose enterprise databases to applications and agents in a secure, feature-rich way, with no language or framework requirements and no drivers or libraries to install.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo.png\"><img decoding=\"async\" class=\"alignnone wp-image-2563 size-thumbnail\" src=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-150x150.png\" alt=\"Data API builder (DAB) Logo\" width=\"150\" height=\"150\" srcset=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-150x150.png 150w, https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-300x300.png 300w, https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-24x24.png 24w, https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-48x48.png 48w, https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo-96x96.png 96w, https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2023\/10\/dab-logo.png 336w\" sizes=\"(max-width: 150px) 100vw, 150px\" \/><\/a><\/p>\n<h2>Model Context Protocol (MCP)<\/h2>\n<p>Model Context Protocol (MCP) is a standard that defines how AI agents discover and call external tools. A tool is a single operation, such as creating a record or reading data. Each tool describes its inputs, outputs, and behavior. MCP provides a predictable way for agents to discover and use capabilities.<\/p>\n<p><div class=\"alert alert-success\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Lightbulb\"><\/i><strong>Standards-based<\/strong><\/p>SQL MCP Server implements MCP protocol version 2025-06-18 as a fixed default. It supports two transports: streamable HTTP for standard hosting scenarios and <code>stdio<\/code> for local or CLI scenarios. During initialization, the server advertises tool and logging capabilities and returns server metadata so agents can understand the server&#8217;s intent.<\/div><\/p>\n<h3>Agentic use cases<\/h3>\n<p>Enterprises are looking for agentic solutions that take security, performance, scale, and exposure seriously. SQL MCP Server was built to solve the problems in the gap between AI agents and production data. It has a considerable breadth of potential applications. Here are a few:<\/p>\n<ul>\n<li>Allow copilots or chatbots to perform safe CRUD operations<\/li>\n<li>Build internal automations without writing SQL<\/li>\n<li>Add agent capabilities without exposing the database directly<\/li>\n<li>Interoperate with multiple databases, one on-premises and one in the cloud<\/li>\n<li>Integrate an agent into a REST-based line-of-business application<\/li>\n<\/ul>\n<p>The multimodal use case for Data API builder is one of its key differentiators. Combined with its multi-data-source capabilities and broad suite of integrations, the engine stands out as a cornerstone of the Azure Data developer story.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/complex-sql-mcp-server.svg\"><img decoding=\"async\" width=\"633\" height=\"291\" class=\"alignnone size-full wp-image-6894\" style=\"width: 100%; height: auto;\" role=\"img\" src=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/complex-sql-mcp-server.svg\" alt=\"Complex SQL MCP Server\" \/><\/a><\/p>\n<p><div class=\"alert alert-primary\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Endpoints<\/strong><\/p>Data API builder (DAB) supports REST, GraphQL, and MCP endpoints in any combination. In the diagram above, DAB exposes both REST and MCP at the same time, exposing the same rich data access through both protocols.<\/div><\/p>\n<h2>MCP for Microsoft SQL<\/h2>\n<p>SQL MCP Server is Microsoft&#8217;s dynamic, open-source engine for agentic apps accessing SQL. It exposes data operations as a small family of MCP tools so agents can interact with database entities through a controlled contract. The server is self-hosted but, for developers, it can also run locally through the DAB command line. You configure it with a JSON file that defines:<\/p>\n<ol>\n<li>How to connect to your database<\/li>\n<li>Which tables, views, or stored procedures to expose<\/li>\n<li>The permissions that apply to each object<\/li>\n<\/ol>\n<h3>Configuration snapshot<\/h3>\n<p>The DAB CLI can create, configure, and run SQL MCP Server in three easy commands: <code>init<\/code>, <code>add<\/code>, and <code>start<\/code>. Here&#8217;s a simplified example to illustrate how you can get started.<\/p>\n<pre><code class=\"sh\">dab init \r\n    --database-type mssql \r\n    --connection-string \"@env('sql_connection_string')\"\r\n\r\ndab add Customers\r\n    --source dbo.Customers\r\n    --permissions \"anonymous:*\"\r\n\r\ndab start <\/code><\/pre>\n<p style=\"padding-left: 40px;\">Read the docs: <a href=\"https:\/\/aka.ms\/sql\/mcp\">SQL MCP Server<\/a><\/p>\n<div>\n<div><div class=\"alert alert-primary\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Configuration secrets<\/strong><\/p>Configuration property values can use literal strings, environment variables, or Azure Key Vault secrets.<\/div><\/div>\n<\/div>\n<h2>Secure your schema<\/h2>\n<p>Data API builder uses a well-defined entity abstraction layer that lists all tables, views, and stored procedures exposed through the API in the configuration. This layer lets you alias names and columns, describe objects and parameters, and limit which fields are available to different roles.<\/p>\n<p><div class=\"alert alert-info\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Role-based security<\/strong><\/p>Data API builder (DAB) is role-aware and only exposes the entities and operations that the current role is permitted to access.<\/div><\/p>\n<p>Because SQL MCP Server is a feature of Data API builder, it also uses this abstraction layer. This approach prevents the internal schema from being exposed to external consumers and allows you to define complex, and even cross-data-source, families of objects and relationships at the API layer.<\/p>\n<h3>Automatic configuration<\/h3>\n<p>In some cases, a schema-driven API is enough. It simplifies getting started and reduces configuration complexity. Auto-config, introduced in 2.0, allows enterprises that are comfortable with limited abstraction to run without a static config file. Instead, the system inspects the database each time the stateless container starts and builds the configuration dynamically.<\/p>\n<p>This gives flexibility for rapid setup and changing schemas, while still allowing other enterprises to define a more controlled, abstracted configuration when they need stronger boundaries and protection.<\/p>\n<p style=\"padding-left: 40px;\">Read the docs: <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/data-api-builder\/command-line\/dab-auto-config?tabs=bash-cli\">DAB auto-configuration<\/a><\/p>\n<h2>Support for DDL<\/h2>\n<p>DDL (Data Definition Language) is the database language used to create and alter objects such as tables and views. SQL MCP Server is built around <a href=\".\/data-manipulation-language-tools.md\">DML (Data Manipulation Language)<\/a>, the database language used to create, read, update, and delete data in existing tables and views. DML also covers the execution of stored procedures. As a result, SQL MCP Server is designed to work with data, not schema. This design aligns with production MCP use cases where AI agents interact with mission-critical or business-sensitive systems.<\/p>\n<p><div class=\"alert alert-success\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Lightbulb\"><\/i><strong>Visual Studio Code<\/strong><\/p>To modify schema during local development, you can use the Microsoft SQL Server (MSSQL) extension in Visual Studio Code, which provides comprehensive DDL support.<\/div><\/p>\n<h3>Support for DML<\/h3>\n<div>\n<p>SQL Model Context Protocol (MCP) Server exposes seven Data Manipulation Language (DML) tools to AI agents. These tools provide a typed CRUD surface for database operations, creating, reading, updating, and deleting records, aggregating data, and executing stored procedures. All tools respect role-based access control (RBAC), entity permissions, and policies defined in your configuration.<\/p>\n<p>DML (Data Manipulation Language) tools handle data operations, creating, reading, updating, and deleting records, aggregating data, and executing stored procedures. Unlike DDL (Data Definition Language), which modifies schema, DML works exclusively on the data plane in existing tables and views.<\/p>\n<div>\n<ul>\n<li><strong>describe_entities<\/strong> &#8211; Discovers available entities and operations<\/li>\n<li><strong>create_record<\/strong> &#8211; Inserts new rows from a table or view<\/li>\n<li><strong>read_records<\/strong> &#8211; Queries tables and views<\/li>\n<li><strong>update_record<\/strong> &#8211; Modifies existing rows from a table or view<\/li>\n<li><strong>delete_record<\/strong> &#8211; Removes rows from a table or view<\/li>\n<li><strong>execute_entity<\/strong> &#8211; Runs stored procedures<\/li>\n<li><strong>aggregate_records<\/strong> &#8211; Performs aggregation queries<\/li>\n<\/ul>\n<p>The context window is the agent\u2019s thinking space. When too many tools are exposed, that space fills with tool definitions instead of reasoning. <strong>SQL MCP Server avoids this<\/strong> by using a fixed, small set of tools, regardless of database size. This keeps the context focused so the agent can think first and access data second. Each tool can still be configured independently in the configuration file, letting you control behavior without expanding the surface area.<\/p>\n<\/div>\n<\/div>\n<pre class=\"prettyprint language-json\"><code class=\"language-json\">\"runtime\": {\r\n  \"mcp\": {\r\n    \"enabled\": true,              \/\/ default: true\r\n    \"path\": \"\/mcp\",               \/\/ default: \/mcp\r\n    \"dml-tools\": {\r\n      \"describe-entities\": true,  \/\/ default: true\r\n      \"create-record\": true,      \/\/ default: true\r\n      \"read-records\": true,       \/\/ default: true\r\n      \"update-record\": true,      \/\/ default: true\r\n      \"delete-record\": true,      \/\/ default: true\r\n      \"execute-entity\": true,     \/\/ default: true\r\n      \"aggregate-records\": true   \/\/ default: true\r\n    }\r\n  }\r\n}<\/code><\/pre>\n<p>Set <code>dml-tools<\/code> to <code>true<\/code> or <code>false<\/code> to enable or disable all tools, or use an object with per-tool toggles.<\/p>\n<h3>Custom tools<\/h3>\n<p>Some enterprises will want to create a specific MCP experience with tailored tools instead of a generic family. Turning off built-in DML tools is available to every customer. SQL MCP Server supports this scenario, too. Promoting stored procedures in your database as custom tools lets you fine-tune the agentic experience through routines that encapsulate business processes, workflows, and specialized validation. Custom tools allow you to configure and create a bespoke MCP surface area, helping guide agents toward real success.<\/p>\n<h2>Solving NL2SQL<\/h2>\n<p>SQL MCP Server takes a different approach from many of the short-sighted database MCP servers available today. A key example is that <strong>SQL MCP Server intentionally doesn&#8217;t support NL2SQL<\/strong>.<\/p>\n<p>Why? Models aren&#8217;t deterministic, and complex queries are the most likely to produce subtle errors. These complex queries are often the ones users hope AI can generate, yet they are also the ones that require the most scrutiny when produced in a nondeterministic way.<\/p>\n<p><div class=\"alert alert-warning\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Warning\"><\/i><strong>Determinism<\/strong><\/p>Deterministic means the same input always produces the same output. There is no randomness or variation across calls, which makes results predictable, testable, and safe to automate.<\/div><\/p>\n<p>Instead, SQL MCP Server supports what might be called an NL2DAB model. This approach uses the secure Data API builder entity abstraction layer and the built-in DAB Query Builder. Together, they produce accurate, well-formed Transact-SQL (T-SQL) in a fully deterministic way. This approach removes the risk, overhead, and nuisance associated with NL2SQL while preserving safety and reliability for agent-generated queries.<\/p>\n<div>\n<h2>Support for RBAC<\/h2>\n<div><div class=\"alert alert-info\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Authorization scope<\/strong><\/p>Role-based constraints apply at every step of agent interaction.<\/div><\/div>\n<p>SQL MCP Server benefits from the same proven role-based access control (RBAC) system used throughout Data API builder. Each entity in your configuration defines which roles may read, create, update, or delete data, and which fields are included or excluded for those roles. These rules apply automatically to every MCP tool, ensuring security remains consistent across REST, GraphQL, and MCP with no extra configuration required.<\/p>\n<h2>Support for caching<\/h2>\n<p>SQL MCP Server automatically caches results from the <code>read_records<\/code> tool. Caching in Data API builder is enabled globally, and you can configure it per entity. Both level 1 and level 2 caching help reduce database load, prevent request stampedes, and support warm-start scenarios in horizontally scaled environments.<\/p>\n<\/div>\n<div>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/redis-sql-mcp-server.svg\"><img decoding=\"async\" width=\"537\" height=\"300\" class=\"alignnone size-full wp-image-6890\" style=\"width: 100%; height: auto;\" role=\"img\" src=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/redis-sql-mcp-server.svg\" alt=\"Caching SQL MCP Server\" \/><\/a><\/p>\n<h2>Support for monitoring<\/h2>\n<div>SQL MCP Server emits logs and telemetry that let enterprises monitor and validate activity from a single pane of glass. This capability includes Azure Log Analytics, Application Insights, and local file logs inside a container.<\/div>\n<div><a href=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/monitor-sql-mcp-server.svg\"><img decoding=\"async\" width=\"568\" height=\"308\" class=\"alignnone size-full wp-image-6887\" style=\"width: 100%; height: auto;\" role=\"img\" src=\"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-content\/uploads\/sites\/56\/2026\/04\/monitor-sql-mcp-server.svg\" alt=\"SQL MCP Server Monitoring\" \/><\/a><\/div>\n<h3>Health checks<\/h3>\n<div>\n<div>SQL MCP Server provides a detailed health report and entity health checks across REST, GraphQL, and MCP endpoints. Data API builder Health lets developers define performance expectations, set thresholds, and verify that each endpoint is functioning as expected.<\/div>\n<\/div>\n<\/div>\n<h2>Semantic Guidance<\/h2>\n<div>\n<p>Descriptions are semantic metadata that help AI agents understand your SQL Model Context Protocol (MCP) Server database schema. When you add descriptions to entities, fields, and parameters, language models make better decisions about which data to query and how to use it. This article shows how to add descriptions at every level using the Data API builder CLI, improving AI agent accuracy and tool discovery.<\/p>\n<p><div class=\"alert alert-success\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Lightbulb\"><\/i><strong>Agentic consumption<\/strong><\/p>AI agents rely on context to understand your data. Without descriptions, an agent only sees technical names like <code>ProductID<\/code> or <code>dbo.Orders<\/code>. With descriptions, the agent understands that <code>ProductID<\/code> is &#8220;Unique identifier for each product in the catalog&#8221; and <code>dbo.Orders<\/code> contains &#8220;Customer purchase orders with line items and shipping details.&#8221;<\/div><\/p>\n<div>\n<h3>Why descriptions?<\/h3>\n<div>\n<ul>\n<li><strong>Tool discovery<\/strong> &#8211; Agents find the right entities faster<\/li>\n<li><strong>Query accuracy<\/strong> &#8211; Agents build better queries with proper context<\/li>\n<li><strong>Parameter usage<\/strong> &#8211; Agents supply correct values to stored procedures<\/li>\n<li><strong>Field selection<\/strong> &#8211; Agents return only relevant fields<\/li>\n<\/ul>\n<h2>Start here<\/h2>\n<p>Over and over, you can see how SQL MCP Server elevates how agents work with data. Replacing fragile queries and unpredictable results, it establishes a controlled, deterministic surface built on proven patterns. Defining the contract once, every agent interaction follows it with precision. This means safer systems, simpler architecture, and a clear path to scaling agentic solutions without compromising your data.<\/p>\n<p><div  class=\"d-flex justify-content-left\"><a class=\"cta_button_link btn-primary mb-24\" href=\"https:\/\/aka.ms\/dab\/mcp\/260407_blog\" target=\"_blank\">Get Started with SQL MCP Server<\/a><\/div><\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>SQL MCP Server gives enterprises a secure, feature-rich way to enable agents to access data. This is accomplished without exposing the schema, risking consistency, or relying on fragile natural language parsing. SQL MCP Server is a feature of Data API builder, so deployments have a proven entity abstraction system, RBAC security at the API layer [&hellip;]<\/p>\n","protected":false},"author":96788,"featured_media":81,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,597,720],"tags":[],"class_list":["post-6837","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure-sql","category-data-api-builder-2","category-sql-mcp-server-2"],"acf":[],"blog_post_summary":"<p>SQL MCP Server gives enterprises a secure, feature-rich way to enable agents to access data. This is accomplished without exposing the schema, risking consistency, or relying on fragile natural language parsing. SQL MCP Server is a feature of Data API builder, so deployments have a proven entity abstraction system, RBAC security at the API layer [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/posts\/6837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/users\/96788"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/comments?post=6837"}],"version-history":[{"count":2,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/posts\/6837\/revisions"}],"predecessor-version":[{"id":6915,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/posts\/6837\/revisions\/6915"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/media\/81"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/media?parent=6837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/categories?post=6837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/azure-sql\/wp-json\/wp\/v2\/tags?post=6837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}