
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@dbconvert/stream-mcp
Advanced tools
Read-only SQL across PostgreSQL, MySQL, S3 buckets and local data files — one query can join across all of them. MCP server.
Read-only SQL across your PostgreSQL, MySQL, S3-compatible buckets and folders of Parquet, CSV and JSON files — and one query can join across all of them, federated in-process by DuckDB.
npx @dbconvert/stream-mcp "shop=postgres://user:password@host:5432/shop"
Several sources at once, each optionally named:
npx @dbconvert/stream-mcp \
shop=postgres://user:password@host:5432/shop \
orders=mysql://user:password@host:3306/orders \
lake=s3://analytics/exports?region=eu-central-1 \
/home/you/data
Ask which customers sit in the PostgreSQL database but are missing from the MySQL one, or whether the CSV someone sent last week still matches the live table — it answers with a single query. No copying, no staging table, no pipeline.
{
"mcpServers": {
"dbconvert": {
"command": "npx",
"args": ["-y", "@dbconvert/stream-mcp",
"shop=postgres://user:password@host:5432/shop",
"orders=mysql://user:password@host:3306/orders",
"/home/you/data"]
}
}
}
Sources can also arrive in one DBCONVERT_MCP_SOURCES environment variable,
separated by spaces — that is what VS Code's install prompt fills in, and what
docker run -e takes. Arguments win if you use both.
There is no tool here that updates a row, drops a table or alters a schema —
absent, not disabled. Every tool declares readOnlyHint, so a client can check
rather than trust. Connection details are given once, at startup, and never
travel through a tool call into the conversation or the logs.
Kilobytes. The server itself is a native binary with DuckDB linked in, so it is
downloaded from the GitHub release
on first use, checked against a SHA-256 that ships inside this package, and
cached under ~/.cache/dbconvert-streams/ (%LOCALAPPDATA% on Windows).
| Your machine | npx @dbconvert/stream-mcp | Docker image |
|---|---|---|
| Linux x64 | yes | yes |
| Windows x64 | yes | yes, through Docker Desktop |
| macOS (Intel or Apple silicon) | not yet | yes, through Docker Desktop |
| Linux or Windows on ARM | not yet | not yet |
A native macOS build is planned. Until it exists, macOS users run the same server as a container — it behaves identically, because it is the same binary built for Linux:
docker run -i --rm slotix/stream-mcp "postgres://user:password@host:5432/db"
On an unsupported platform this launcher says so and points at that command rather than failing with a download error.
S3 credentials come from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, never
from the URL. LOG_FILE defaults to the cache directory — stdout carries the
MCP protocol, so the server will not start without somewhere to log.
Documentation: https://streams.dbconvert.com/docs/mcp/standalone
The server is proprietary software, distributed under the DBConvert Streams licence; this launcher is part of the same distribution.
FAQs
Read-only SQL across PostgreSQL, MySQL, S3 buckets and local data files — one query can join across all of them. MCP server.
The npm package @dbconvert/stream-mcp receives a total of 29 weekly downloads. As such, @dbconvert/stream-mcp popularity was classified as not popular.
We found that @dbconvert/stream-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.