D

Dbmcp

ai.haymon/dbmcp · v0.15.2 · MCP server

by ai.haymonScan grade: AcceptableOfficial MCP registry · source scanned

Database MCP server for MySQL, MariaDB, PostgreSQL & SQLite with PII redaction and write-prevention

Install Source Claim this MCP server

Trust ScoreNot rated Security scan76 Components1

Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is Dbmcp a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

MCP

1 MCP server

Before you install

Sign-in: Not declared
Declared access: Not declared
License: Not declared

Check before relying on it

14 high or critical findings from the scan. See the evidence
The publisher has not verified ownership on HOL.
No license declared in the manifest.

What is Dbmcp?

Dbmcp is a published mcp server plugin for AI coding agents in the MCP ecosystem, developed by ai.haymon and distributed through the HOL AI plugin registry. Database MCP server for MySQL, MariaDB, PostgreSQL & SQLite with PII redaction and write-prevention.

Canonical slug: ai.haymon/dbmcp
Version: v0.15.2 · updated Oct 26, 2026
Open data: entity.json (JSON-LD)

Registry snapshot

Repository: https://github.com/haymon-ai/dbmcp
Homepage: https://dbmcp.haymon.ai
Canonical profile: https://hol.org/registry/plugins/ai.haymon%2Fdbmcp
Owner verification: Not verified
Scanner: HOL plugin scanner
Security result: Needs review
Digest verified: No

Trust and security

Provenance

Plugin root: .
Source repo: https://github.com/haymon-ai/dbmcp
Source commit: 5d09a37ed343…
Publisher verified: No
Owner verified: Not owner verified

Security posture

See how the Trust Score is computed

Needs review

Security result

76

Security score

14

High findings

Provider: codex-plugin-scanner
Grade: C · Acceptable
Version: 3.24.2

cisco-mcp-scanner: skipped

Security

9/16

9 checks

Operational Security

12/17

5 checks

Best Practices

6/6

4 checks

Code Quality

10/10

2 checks

Findings

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/pii/benches/corpus/api_key.toml.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/pii/benches/corpus/private_key.toml.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/pii/src/recognizers/generic/api_key.rs.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/pii/src/recognizers/generic/private_key.rs.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/src/key.rs.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/openssh_ecdsa.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/openssh_ed25519.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/openssh_ed25519_enc.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/openssh_rsa.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/pkcs1_rsa_aes128.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/pkcs1_rsa_aes256.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/pkcs8_ed25519.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/sec1_ecdsa.

Remove the secret from source control and load it securely at runtime.

highsecurityHARDCODED_SECRET

Potential secret material was detected in crates/ssh/testdata/sec1_ecdsa_enc.

Remove the secret from source control and load it securely at runtime.

mediumoperational-securityGITHUB_ACTION_UNPINNEDReported 5 times

.github/workflows/ci.yml references "actions/checkout@v7" instead of a full 40-character commit SHA.

Pin third-party GitHub Actions and reusable workflows to a full commit SHA.

mediumoperational-securityGITHUB_ACTION_UNPINNED

.github/workflows/ci.yml references "cocogitto/cocogitto-action@v4" instead of a full 40-character commit SHA.

Pin third-party GitHub Actions and reusable workflows to a full commit SHA.

mediumoperational-securityGITHUB_ACTION_UNPINNEDReported 3 times

.github/workflows/ci.yml references "dtolnay/rust-toolchain@stable" instead of a full 40-character commit SHA.

Pin third-party GitHub Actions and reusable workflows to a full commit SHA.

mediumoperational-securityGITHUB_ACTION_UNPINNED

.github/workflows/ci.yml references "uncenter/setup-taplo@v2" instead of a full 40-character commit SHA.

Pin third-party GitHub Actions and reusable workflows to a full commit SHA.

mediumoperational-securityGITHUB_ACTION_UNPINNED

.github/workflows/ci.yml references "Swatinem/rust-cache@v2" instead of a full 40-character commit SHA.

Pin third-party GitHub Actions and reusable workflows to a full commit SHA.

Install guidance

Install in MCP

Connect the bundled MCP server shipped in the repository .mcp.json file.

1

Clone the repository

shell

2
Register the server in your MCP client
Claude Code reads a project .mcp.json file and asks you to approve its servers when you open the folder. Other clients keep their own MCP configuration, so copy the server entry from .mcp.json into that client. If this repository configures its server differently, follow the MCP setup the publisher documents.
3
Verify the server
Check the MCP server list in your client. The server declared in .mcp.json should report as connected. In Claude Code, run /mcp to see it.

Did setup work in MCP?

No setup reports for MCP yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W43, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "source": "official-mcp-registry",
  "evidenceState": "scanned_source",
  "registryName": "ai.haymon/dbmcp",
  "publishedAt": "2026-10-26T17:29:27.837405Z",
  "packages": [
    {
      "registryType": "oci",
      "identifier": "ghcr.io/haymon-ai/dbmcp:0.15.2",
      "version": null,
      "transport": "stdio",
      "requiredEnvironment": []
    },
    {
      "registryType": "oci",
      "identifier": "ghcr.io/haymon-ai/dbmcp:0.15.2",
      "version": null,
      "transport": "streamable-http",
      "requiredEnvironment": []
    }
  ],
  "remotes": [],
  "sourceScannedAt": "2026-10-31T02:40:28.678Z",
  "sourceScanCommit": "5d09a37ed3436c34a547c8946294d17ae63cd5e5"
}

File inventory

File inventory is unavailable for this plugin right now.

Dbmcp — Frequently asked questions

What is Dbmcp?: Dbmcp is an AI plugin in the HOL registry. Database MCP server for MySQL, MariaDB, PostgreSQL & SQLite with PII redaction and write-prevention.
How do I install Dbmcp?: Install Dbmcp in your harness: MCP — git clone https://github.com/haymon-ai/dbmcp. Full step-by-step guidance is on the HOL plugin page.
How do I install Dbmcp in MCP?: To install Dbmcp in MCP, start with git clone https://github.com/haymon-ai/dbmcp. The complete step-by-step install guide for MCP is on the HOL plugin page.
Who publishes Dbmcp?: Dbmcp is published by ai.haymon and listed on HOL.

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here: <5; HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports: <10; Machines that reported installing it through HOL Guard in week 2026-W43. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces: <5; Workspaces that approved it or include it in an approved-plugin feed, as of today.