SQLMap

You set up and run a FastMCP-based SQLMap MCP Server to automate SQL injection testing and database reconnaissance. This server exposes SQLMap capabilities through a standardized MCP interface, enabling you to orchestrate security tests from MCP clients and AI assistants with consistent, scriptable inputs.

How to use

Use an MCP client to connect to the SQLMap MCP Server and invoke its tools to perform automated scanning, enumeration, data retrieval, and system information queries against target databases. You will send requests for actions like scanning a URL, enumerating databases, dumping table data, or reading files from the database server’s filesystem. Start with basic URL scans to learn the workflow, then progressively use more advanced tools such as table/column enumeration and data dumping. Respect security and legal considerations, ensure you have explicit authorization, and monitor activity with proper auditing.

How to install

Prerequisites: You need Python 3.13 or newer and a Python environment with access to install packages. FastMCP is included as a dependency in the project so you do not install it separately.

Install SQLMap MCP Server dependencies and run the server locally. Follow these steps exactly:

Install SQLMap and set up the MCP server in a Python environment:

# Install SQLMap using your preferred method
# Using Homebrew (macOS)
brew install sqlmap

# Using pip
pip install sqlmap

# Or clone from GitHub
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

# Install the MCP server in a Python environment
# From the project root where server.py resides
uvx sync
# Or, if you prefer pip installation in editable mode
pip install -e .
```} ,{

Running the server

Start the MCP server locally by running the Python script that exposes the functions. This launches the FastMCP server so you can connect with an MCP client.

python server.py

MCP Client Configuration

Configure your MCP client to connect to the local SQLMap MCP Server. The client can run the server using Python and the server script path.

{
  "mcpServers": {
    "sqlmap": {
      "command": "python",
      "args": ["/path/to/sqlmap-mcp/server.py"],
      "env": {}
    }
  }
}

Available tools

sqlmap_help

Show SQLMap help information with optional advanced help to reveal additional parameters.

sqlmap_scan_url

Scan a target URL for SQL injection vulnerabilities with configurable level and risk.

sqlmap_enumerate_databases

Enumerate databases present on the target URL.

sqlmap_enumerate_tables

Enumerate tables within a specified database on the target URL.

sqlmap_enumerate_columns

Enumerate columns within a specified table.

sqlmap_dump_table

Dump data from a specified table with optional column filtering and WHERE clause.

sqlmap_get_banner

Retrieve the database banner information from the target URL.

sqlmap_get_current_user

Retrieve the current database user for the target URL.

sqlmap_get_current_db

Retrieve the current database name for the target URL.

sqlmap_read_file

Read a file from the database server filesystem via SQLMap capabilities.

sqlmap_execute_command

Execute an operating system command on the database server through SQLMap features.

sqlmap_advanced_scan

Perform an advanced SQLMap scan with custom options like proxy, user agent, timeout, and threads.