English Français العربية

MySQL Audit

Official registry Data and databases

MySQL migration and query safety review for AI agents: locks, table copies, data loss, injection.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package mysql-audit-ai-agent
Claude Code 
claude mcp add mysql-audit -- uvx mysql-audit-ai-agent==0.1.0
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "mysql-audit": {
            "command": "uvx",
            "args": [
                "mysql-audit-ai-agent==0.1.0"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. mysql_audit_ai_agent
  2. Rules
  3. Use with an AI agent (MCP)
  4. Command line
  5. Development
  6. 中文說明
  7. License

mysql_audit_ai_agent

MySQL schema-change safety review for AI coding agents.

Before Claude Code, Cursor or another agent runs a migration, it sends the SQL to review_migration and gets back a verdict (safe / review / block) plus, for every risk, the line, what will happen in production, and a safe way to write it. The checks are deterministic rules written from DBA experience, not another LLM guess.

Status: early development (v0.1). All twelve planned rules are in.

Rules

IDChecksDefaultNeeds
L01DDL without explicit ALGORITHM / LOCK; ALGORITHM=COPY, LOCK=SHARED/EXCLUSIVEwarn / block
L02Column changes that force a table copy: type change, VARCHAR shrink or crossing 255 bytes, ENUM reorder, charset conversion, dropping the PKblockschema for exact answers
L03Row-touching DDL on a large table: use gh-ost / pt-online-schema-changewarnstats
L04DDL without a short SET SESSION lock_wait_timeout (metadata-lock pile-up)warn
L05ADD FOREIGN KEY while foreign_key_checks=1 (COPY only)block
L06UPDATE / DELETE / INSERT ... SELECT over a large table in one transaction (replication lag)warnstats
L07DROP / TRUNCATE / RENAME of columns, tables, databasesblock
L08UPDATE / DELETE without WHERE; LIMIT without ORDER BYblock / warn
L09Backfill not limited to a key range or batch sizewarn / info
L10Auto-increment column smaller than BIGINT; utf8 / utf8mb3warn
L11WHERE / JOIN on a column that no index starts withwarnschema
L12SQL built by f-strings, template literals, concatenation, % / .format / Sprintf (SQL injection)blocksource code

Tables created earlier in the same script are treated as empty, so DDL on them is not flagged.

  • schema: the current CREATE TABLE statements (SHOW CREATE TABLE).
  • stats: approximate row counts, {"orders": 25000000}, from SELECT table_name, table_rows FROM information_schema.tables WHERE table_schema = DATABASE(). Tables of 1,000,000 rows or more count as large; under 10,000 as small.

Use with an AI agent (MCP)

Requires uv. The server runs locally over stdio; your SQL never leaves your machine.

Claude Code

claude mcp add mysql-audit -- uvx mysql-audit-ai-agent

Cursor, Windsurf, Claude Desktop and other MCP clients (mcp.json / claude_desktop_config.json):

{
  "mcpServers": {
    "mysql-audit": { "command": "uvx", "args": ["mysql-audit-ai-agent"] }
  }
}

Claude Desktop, one click: download mysql-audit.mcpb from the latest release and open it.

Tools: review_migration(sql, schema?, stats?), review_query(sql, schema?, stats?), review_code(code), explain_rule(rule_id), list_rules().

In our agent evaluation Claude Code called the tool on its own in 10 of 10 migration tasks, with no extra prompt.

Command line

pip install mysql-audit-ai-agent
mysql-audit migrations/20261027_add_index.sql --schema schema.sql
mysql-audit migration.sql --stats rows.json --format json
mysql-audit --code app/models/user.py      # SQL injection check

Exit code: 0 safe, 1 review, 2 block, so it can gate CI.

Development

pip install -e ".[dev]"
pytest

Every rule has positive and negative test cases under tests/.

tests/test_mysql_oracle.py checks the rules against a real server: each ALTER is run with ALGORITHM=INPLACE, LOCK=NONE, and MySQL's refusal (or not) must match the rule's verdict. CI runs it on MySQL 8.0 and 8.4. Locally:

docker run -d -e MYSQL_ROOT_PASSWORD=root -p 3306:3306 mysql:8.4
MYSQL_HOST=127.0.0.1 MYSQL_PASSWORD=root pytest tests/test_mysql_oracle.py

中文說明

給 AI 編碼代理用的 MySQL 變更安全審查。代理在執行 migration 前呼叫 review_migration， 取得 safe / review / block 判定，以及每個風險的行號、線上影響與安全寫法。 規則由 DBA 經驗寫成，結果可重複驗證。

License

Apache-2.0

Frequently asked questions

What is MySQL Audit?

MySQL migration and query safety review for AI agents: locks, table copies, data loss, injection.

How do I install MySQL Audit?

It runs on your machine. In Claude Code: claude mcp add mysql-audit -- uvx mysql-audit-ai-agent==0.1.0. For other clients, paste the JSON configuration from this page into their MCP settings.

Does MySQL Audit need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is MySQL Audit open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains MySQL Audit?

It is published by jimmyjan0824. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.