This MySQL MCP server has 7 tools with basic schemas and descriptions, but exhibits multiple quality gaps. Naming is mostly verb-noun compliant (connect_db, query, execute, list_tables, describe_table, show_statement, explain), but descriptions are inconsistent in depth and quality. Schemas are present but incomplete, most parameters lack detailed descriptions of constraints, formats, and valid ranges. Critical issue: the connect_db tool accepts credentials as parameters, violating secret-injection patterns. Parameter descriptions are sparse (e.g., 'Query parameters (optional)' for the 'params' field in query/execute tools lacks format guidance). Output schemas are not documented, LLMs cannot know what fields to expect in responses. Error handling is minimal; no actionable recovery guidance is provided. The server loads credentials from environment variables at startup, but the connect_db tool still exposes them as parameters, creating a footgun. This is below the 'production-grade' bar but functional for basic use.

• Remove credentials from connect_db parameters. Delete host, user, password, database, port from the tool. Use environment variables (MYSQL_HOST, MYSQL_USER, etc.) or server-side configuration only. If dynamic connections are needed, accept a connection_name string and resolve it server-side.
• Document output schemas for all tools. Add a 'Returns' section to each tool description describing the response structure. Example for query: 'Returns {rows: [{col1: value, col2: value, ...}], rowCount: number}'. This enables LLMs to extract needed data.
• Expand 'params' parameter descriptions. Specify that it is an optional array of values (strings, numbers, booleans, null) matching SQL placeholders in order. Example: 'Optional array of parameter values to bind to SQL placeholders (?). Types: string, number, boolean, null. Example: ["active", 100].'
• Add error handling with actionable recovery guidance. For execute, if a PRIMARY KEY violation occurs, suggest 'Use UPDATE instead or check for duplicate keys.' For query, if a table is not found, respond 'Table not found. Call list_tables() to see available tables.'
• Add dry-run mode to execute tool. Accept an optional 'dry_run' parameter (boolean, default false). If true, return the affected row count without committing. This prevents accidental data loss.
• Clarify tool overlap and selection. In show_statement description, state: 'Use for SHOW STATUS, SHOW VARIABLES, SHOW DATABASES, SHOW TABLES. For SELECT queries, use query() instead.'
• Add permission declarations. Each tool should declare what database permissions it requires (e.g., execute requires INSERT/UPDATE/DELETE). This enables audit trails and least-privilege agent configuration.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry