DBHub MCP Server: Setup, Read-Only Mode and the MySQL Advisory (Nov 2026)

DBHub is Bytebase's free, open-source MCP server that lets an AI client query Postgres, MySQL, MariaDB, SQL Server, Oracle or SQLite. Add it with npx @bytebase/dbhub@latest --transport stdio --dsn "<connection string>". It can write to your database unless you set it read-only. TrustedMCP grades it C.

The C isn't about neglect or open bugs. DBHub is very active, and its three 2026 advisories were all fixed. The grade comes from its HTTP mode, which has no login and listens on every network interface unless you change it. Over stdio, the default, that doesn't apply.

If you're here because of the MySQL and MariaDB read-only advisory, jump to who it affects and what to do.

How we checked: on 2026-11-07 we read the README, the docs in the repo (installation, command-line options, execute_sql, the MCP Bundle and the Claude Code plugin), the source for the HTTP server, the SQL parser and the MySQL connector, the release notes, npm metadata, the MCP Registry entry, and the repo's three security advisories. We didn't install or run it.

What DBHub is and what it can do

The npm package is @bytebase/dbhub, MIT licensed, version 1.6.0 at the time of writing (released 2026-11-07). It needs Node.js 22.5 or later. One process can connect to several databases at once through a dbhub.toml file. The Claude Code docs use it as their example for querying a PostgreSQL database.

Tool	What it does	On by default?
execute_sql	Runs any SQL you (or the model) send, including writes and DDL unless set read-only	Yes
search_objects	Lists schemas, tables, columns, indexes and procedures, a little at a time	Yes
explain_sql	Shows a query plan without running the query	No, opt in
health_check	Reports connection pool state and cache hit ratio	No, opt in
Custom tools	Fixed, parameterized SQL you define in dbhub.toml	Only if you define them

Bytebase says the two default tools cost about 1.4k tokens of context, against 19.0k for MCP Toolbox and 19.3k for Supabase MCP. That's their measurement, not ours, but a small tool list does leave more room. See why MCP servers eat your context window.

DBHub has two transports. stdio (the default) runs as a subprocess of your AI client. HTTP runs as a standalone server with the MCP endpoint at /mcp, a web "workbench" at / for running queries by hand, and /healthz.

How to set up the DBHub MCP server

Pick the path that matches how much control you need. The first two are read-only out of the box. The manual setups are not.

Claude Code plugin (read-only)

Inside Claude Code:

/plugin marketplace add bytebase/dbhub
/plugin install dbhub@dbhub

Claude Code asks for your connection string and keeps it in secure storage, not a config file. The plugin sets readonly = true and max_rows = 1000, and adds /dbhub:setup and /dbhub:explore skills.

Claude Desktop: the MCP Bundle (read-only)

Download dbhub-<version>.mcpb from the latest release, double-click it (or drag it into Settings → Extensions), and enter your connection string. It's stored in the OS keychain. Same read-only policy as the plugin.

Claude Code by hand

From the DBHub installation docs:

claude mcp add --transport stdio dbhub -- npx @bytebase/dbhub@latest --transport stdio --dsn "postgres://user:password@localhost:5432/dbname"

This setup can write. Use a database user that can only read (see step 3 below), or switch to a dbhub.toml with readonly = true. More on adding servers in Claude Code MCP setup.

Cursor and VS Code

Cursor, in ~/.cursor/mcp.json:

{
  "mcpServers": {
    "dbhub": {
      "command": "npx",
      "args": [
        "@bytebase/dbhub@latest",
        "--transport",
        "stdio",
        "--dsn",
        "postgres://user:password@localhost:5432/dbname"
      ]
    }
  }
}

VS Code, in .vscode/mcp.json, with the connection string asked for at start-up instead of saved in the file:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "db-dsn",
      "description": "Database connection string",
      "password": true
    }
  ],
  "servers": {
    "dbhub": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "@bytebase/dbhub@latest",
        "--transport",
        "stdio",
        "--dsn",
        "${input:db-dsn}"
      ]
    }
  }
}

A password in a project config file ends up in git sooner or later. The VS Code prompt above, or a ${DATABASE_URL} variable in Claude Code's .mcp.json, avoids that. See where to keep MCP API keys.

How to make DBHub read-only

The old --readonly flag is gone. DBHub now exits with an error if you pass it. Read-only is set per tool in a dbhub.toml:

[[sources]]
id = "production"
dsn = "postgres://..."

[[tools]]
name = "execute_sql"
source = "production"
readonly = true
max_rows = 100

[[tools]]
name = "search_objects"
source = "production"

Start DBHub with --config /path/to/dbhub.toml instead of --dsn. If a source has no [[tools]] entries, both default tools are on and execute_sql can write.

Since 0.22.6, readonly = true works in two layers:

1. A keyword check. Each statement must start with a read-only keyword such as SELECT, SHOW, DESCRIBE or EXPLAIN.
2. The database's own read-only mode. Postgres runs the query in BEGIN READ ONLY, SQLite with PRAGMA query_only = ON, and MySQL and MariaDB in START TRANSACTION READ ONLY. From 1.6.0, MySQL and MariaDB also set the whole session read-only, because DDL like DROP TABLE ends a read-only transaction by committing first. Before 1.6.0, only the keyword check stopped DDL on those two.

Neither layer stops a powerful database role. DBHub's own docs warn that on Postgres a superuser can still read or write server files and run commands through functions like pg_read_file, lo_export, dblink and COPY ... TO PROGRAM, even in a read-only transaction. The flag is a guard rail. The database user is the wall. Limit what MCP tools can do covers this for other servers too.

The MySQL and MariaDB read-only advisory

GHSA-j656-3hf2-fvjc showed that DBHub's read-only check could be bypassed on MySQL and MariaDB. The fix shipped in 0.22.6 on 2026-06-24, the day the advisory was published. GitHub reviewed and added it to its advisory database on 2026-11-02, which is why it is showing up in security feeds now. The repo rates it high; GitHub's review rates it medium.

What happened. DBHub treated -- as the start of a comment in every case. MySQL and MariaDB only do that when a space or line end follows the dashes. Otherwise -- is two minus signs and the SQL carries on. So a query could look like one harmless SELECT to DBHub, with a second statement such as DROP TABLE hidden in what DBHub thought was a comment. The database then ran both, because the MySQL and MariaDB connections accept several statements at once and DBHub sent the original text. The advisory says Postgres isn't affected by this path.

Who is affected. All of these have to be true:

• You ran DBHub before 0.22.6.
• It was connected to MySQL or MariaDB.
• You relied on readonly = true to stop writes.
• Someone other than you could shape the SQL. In practice that means prompt injection: text in a table, ticket or web page that the agent reads and follows.

If you never set readonly = true, this advisory changes nothing for you: the tool could write anyway.

What to do.

1. Upgrade. 0.22.6 fixes the advisory. We'd go to 1.6.0 or later, because it also closes the DDL gap on MySQL and MariaDB described above. Configs that say @bytebase/dbhub@latest get the new version when the server restarts; check the version DBHub prints at start-up in your client's MCP log.
2. Connect as a user that can only SELECT. Then a bypass like this one has nothing to write with. This is the step that would have made the advisory a non-event.
3. Check, if you were exposed. If an agent with a read-only DBHub on MySQL or MariaDB read untrusted content before you upgraded, look at your database logs for unexpected writes or DDL.

All three DBHub advisories

All three were published on 2026-06-24 with the fix already on npm.

Advisory	What it was	Fixed in
GHSA-fm8p-53ww-hf6w (CVE-2026-61742)	HTTP mode: a malicious web page could reach a local DBHub through DNS rebinding and run SQL from your browser	0.22.5
GHSA-mwwr-p57h-56pf (CVE-2026-61788)	Read-only mode relied on the keyword check alone; a SELECT that calls a writing function got through on Postgres and SQLite	0.22.6
GHSA-j656-3hf2-fvjc	The -- comment mismatch on MySQL and MariaDB, above	0.22.6

Running DBHub over HTTP safely

Use stdio unless you need a shared server, a web client, or the workbench. If you need HTTP, change three defaults:

• Bind to loopback. --host defaults to 0.0.0.0, every network interface. Use --host 127.0.0.1. With Docker, publish the port as 127.0.0.1:8080:8080.
• Add a token. --auth-token is off by default. Set it and clients must send Authorization: Bearer <token>. DBHub's docs call it "a flat shared-secret check, not OAuth": no per-user scopes, no audit trail. You can list several tokens to rotate them or give each client its own.
• Put TLS in front. DBHub serves plain HTTP. For anything beyond your own machine, put it behind a reverse proxy (nginx, Caddy) that adds HTTPS, or an MCP gateway that adds real sign-in.

The DNS-rebinding fix is on by default: --allowed-hosts accepts loopback and this machine's own names and refuses other Host headers. Add your proxy's hostname if you use one. Don't set it to "*" unless something in front of DBHub checks who's calling.

How DBHub compares with other database MCP servers

Server	Databases	Grade	Main difference
DBHub	Postgres, MySQL, MariaDB, SQL Server, Oracle, SQLite	C	Small tool list, one process for many databases; HTTP mode has no login by default
MCP Toolbox for Databases	About 20, incl. Postgres, MySQL, BigQuery, Spanner	B	Google's; more prebuilt tools; its HTTP mode also has no login by default
Supabase MCP	Supabase Postgres	A	Hosted with OAuth; read_only and project scoping in the URL. See the guide
Neon MCP	Neon Postgres	A	Hosted OAuth with read and write scopes
MongoDB MCP	MongoDB	A	Read-only flag; not SQL. See the guide

If your database is hosted on Supabase or Neon, their own servers grade higher because they sign you in with scoped OAuth. DBHub fits when you have your own database, or several engines you want behind one process. Everything we've graded is in databases.

Need an MCP server for a database that none of these cover, with the guard rails built in? We build custom MCP servers.

Why DBHub grades C

We graded the open-source server as published on npm. Bytebase's commercial product isn't part of this grade.

Check	Points	Why
Authentication	18 of 30	stdio uses whatever database user you give it; HTTP has an optional shared token, off by default, with no scopes.
Maintenance	18 of 25	Releases on 2026-11-03 and 2026-11-07 and many outside contributors, but nearly all commits come from one maintainer.
Known CVEs	25 of 25	Three advisories in 2026, each fixed in a release before it was published.
Transport	6 of 20	stdio is fine, but HTTP mode is plain HTTP on every interface by default, with no login unless you add a token.

Over stdio on your own machine, the transport deduction doesn't bite. If DBHub adds TLS or a loopback default for HTTP, the transport points go up and so likely does the grade. See the DBHub listing and how TrustedMCP scores servers.

Frequently asked questions

What is DBHub?

An open-source MCP server from Bytebase, MIT licensed, published on npm as @bytebase/dbhub. It lets an AI client such as Claude Code, Cursor or VS Code run SQL against Postgres, MySQL, MariaDB, SQL Server, Oracle or SQLite through two default tools, execute_sql and search_objects.

How do I add DBHub to Claude Code?

The quickest read-only route is the plugin: /plugin marketplace add bytebase/dbhub, then /plugin install dbhub@dbhub. By hand, run claude mcp add --transport stdio dbhub -- npx @bytebase/dbhub@latest --transport stdio --dsn "<connection string>", but that setup can write until you add a dbhub.toml with readonly = true or use a read-only database user.

Is DBHub safe to use?

Yes, if you set it up for it: version 1.6.0 or later, stdio or HTTP on 127.0.0.1 with a token, a database user that can only read, and readonly = true. Its past advisories are fixed. The risk left is the one every database server has: an agent that reads untrusted text can be talked into running SQL you didn't want.

Is DBHub read-only by default?

No. With --dsn alone, execute_sql can insert, update and drop. The Claude Code plugin and the MCP Bundle are read-only. Everywhere else, set readonly = true in a dbhub.toml and connect as a read-only user.

Does the DBHub advisory affect PostgreSQL?

Not GHSA-j656-3hf2-fvjc: the advisory says Postgres treats -- as a comment the same way DBHub does. A separate advisory, GHSA-mwwr-p57h-56pf, did affect Postgres and SQLite read-only mode. Both were fixed in 0.22.6.

Is DBHub free?

Yes. It's MIT licensed and runs on your machine. Bytebase, the company behind it, sells a separate product with approval flows, data masking and audit logs.

Which databases does DBHub support?

PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite. SQLite needs no extra driver. It also supports SSH tunnels and SSL/TLS to the database.

DBHub vs MCP Toolbox: which should I use?

DBHub has fewer tools and is lighter on context. MCP Toolbox covers more databases, including BigQuery and Spanner, and grades B. Both have an HTTP mode with no login by default, so both are best over stdio.

What is the DBHub workbench?

A web page DBHub serves at / in HTTP mode, for running queries and custom tools by hand and viewing request traces. It's only there in HTTP mode, so it carries the same advice: bind to 127.0.0.1 and set a token.