Argos-MCP

What it does ​

Argos-MCP connects Claude Code, or any other MCP client, to PostgreSQL, MySQL/MariaDB, SQLite, and SQL Server. Queries pass through validation before reaching the database driver: SELECT-only restrictions, bound parameters, rejection of stacked statements and complexity limits. Each query produces exactly one audit record with the database, statement hash, duration and outcome. Query values are excluded from the record.

You can configure multiple databases at once: behind SSH tunnels with a pinned host key fingerprint, with field redaction so sensitive columns (emails, phone numbers, SSNs) never reach the model, and with a one-way lock (mcp_configurable) that shuts a database off from further changes through MCP once its settings are where you want them.

Quick start ​

Argos-MCP is not yet published to npm, so install it from source. It needs Node.js 22 or newer and the Claude Code CLI, and nothing else. Only an Azure SQL connection using authentication=azure-cli additionally needs the Azure CLI on your PATH and a completed az login.

git clone https://github.com/AraneaDev/Argos-MCP.git
cd Argos-MCP
npm install
npm run build
npm run setup
claude mcp add argos --scope user -- \
  node "$(pwd)/dist/index.js" --config "$HOME/.config/argos/config.ini"

npm run setup runs an interactive wizard for database connections, security settings, and SSH tunnels, and writes them to config.ini.

Examples ​

An sql_query call, run for real against a local SQLite database:

Call:

{
  "database": "demo",
  "query": "SELECT id, name, email FROM users ORDER BY id"
}

Result:

 Query executed successfully on demo
 SELECT-only mode active
 Results: 3 rows

| id | name | email |
|---|---|---|
| 1 | Ada Lovelace | ada@example.com |
| 2 | Alan Turing | alan@example.com |
| 3 | Grace Hopper | grace@example.com |

Capabilities ​

Databases added at runtime through sql_add_database are always select_only: true; granting write access requires editing config.ini by hand, so write access cannot be enabled through MCP.

Configuration ​

Argos-MCP reads config.ini, by default from ~/.config/argos/config.ini; npm run setup writes one for you. This is what a production database behind an SSH tunnel looks like:

[database.production]
type=postgresql
host=internal-db.company.local
port=5432
database=production_app
username=readonly_user
password=secure_random_password
ssl=true
select_only=true

ssh_host=bastion.company.com
ssh_port=22
ssh_username=tunnel_user
ssh_private_key=/secure/path/ssh_key
ssh_host_fingerprint=SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU

[security]
max_joins=5
max_subqueries=3
max_complexity_score=50

SSH tunnels require a pinned ssh_host_fingerprint; a connection cannot be established without host-key verification. select_only is the production default; turn it off only on a database where write access is deliberately wanted.

Azure SQL without a password ​

For SQL Server on Azure, the Azure CLI's own sign-in can be the credential, so no secret is written to config.ini at all:

[database.azure_sql]
type=mssql
host=your-server.database.windows.net
port=1433
database=your_database_name
authentication=azure-cli
select_only=true

# Only when the server's tenant is not the CLI's active context, which is the
# usual case for an account with access to several tenants.
# azure_tenant_id=00000000-0000-0000-0000-000000000000

This mode needs az login beforehand, and the signed-in identity mapped as a database user: CREATE USER [you@company.com] FROM EXTERNAL PROVIDER;. Encryption and certificate verification are forced on in this mode, because an access token is a bearer credential. Without verification, the token could be sent to an unverified endpoint.