
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mcp-oracle-database
Advanced tools
Model Context Protocol (MCP) server for database queries - enables AI assistants like GitHub Copilot to execute read-only SQL queries against Oracle databases
A Model Context Protocol (MCP) server that enables GitHub Copilot and other LLMs to execute read-only SQL queries against Oracle databases.
npm install -g mcp-oracle-database
Or install locally in your project:
npm install mcp-oracle-database
git clone https://github.com/tannerpace/my-mcp.git
cd my-mcp
npm install && npm run build
Create .vscode/mcp.json:
{
"servers": {
"oracleDatabase": {
"type": "stdio",
"command": "mcp-database-server",
"env": {
"ORACLE_CONNECTION_STRING": "localhost:1521/XEPDB1",
"ORACLE_USER": "your_readonly_user",
"ORACLE_PASSWORD": "your_password",
"ORACLE_POOL_MIN": "2",
"ORACLE_POOL_MAX": "10",
"QUERY_TIMEOUT_MS": "30000",
"MAX_ROWS_PER_QUERY": "1000"
}
}
}
}
"What tables are in the database?"
# 1. Build the server
npm install && npm run build
# 2. Configure VS Code
cp .vscode/mcp.json.example .vscode/mcp.json
# 3. Start Oracle database (if using Docker)
docker start oracle-xe
# 4. Reload VS Code and ask Copilot:
"What tables are in the database?"
See Quick Start Guide for detailed setup.
GitHub Copilot
↓ (MCP Protocol)
MCP Client (spawns process)
↓ (JSON-RPC over stdio)
MCP Server (Node.js)
↓ (oracledb)
Oracle DB (read-only user)
Note: This project uses the node-oracledb package in Thin Mode, which means no Oracle Instant Client installation is required! The pure JavaScript driver connects directly to Oracle Database, just like Python's oracledb library.
If you need a local Oracle database for development:
macOS (using Colima):
# Start Colima (Docker runtime for macOS)
colima start
# Pull and run Oracle XE container
docker run -d \
--name oracle-xe \
-p 1521:1521 \
-p 5500:5500 \
-e ORACLE_PWD=OraclePwd123 \
container-registry.oracle.com/database/express:latest
# Wait for database to be ready (takes 1-2 minutes)
docker logs -f oracle-xe
# Start/stop the database later
docker start oracle-xe
docker stop oracle-xe
Linux/Other:
# Same docker commands as above, just ensure Docker is running
docker ps
The database will be available at:
localhost:1521/XEPDB1OraclePwd123git clone <repository-url>
cd my-mcp
npm install
Connect to your Oracle database as a DBA and run:
-- Create read-only user
CREATE USER readonly_user IDENTIFIED BY secure_password;
-- Grant connect and read-only privileges
GRANT CONNECT TO readonly_user;
GRANT SELECT ANY TABLE TO readonly_user;
-- Or grant access to specific tables only:
GRANT SELECT ON schema.table1 TO readonly_user;
GRANT SELECT ON schema.table2 TO readonly_user;
Copy the example environment file:
cp .env.example .env
Edit .env and set your Oracle connection details:
# Oracle Database Connection (READ-ONLY USER)
ORACLE_CONNECTION_STRING=hostname:1521/servicename
ORACLE_USER=readonly_user
ORACLE_PASSWORD=secure_password
# Connection Pool Settings
ORACLE_POOL_MIN=2
ORACLE_POOL_MAX=10
# Query Settings
QUERY_TIMEOUT_MS=30000
MAX_ROWS_PER_QUERY=1000
MAX_QUERY_LENGTH=50000
# Logging
LOG_LEVEL=info
ENABLE_AUDIT_LOGGING=true
npm run build
Create or update your MCP client configuration file:
VS Code (cline_mcp_config.json or similar):
{
"mcpServers": {
"oracle-db": {
"command": "node",
"args": ["/absolute/path/to/my-mcp/dist/server.js"],
"env": {
"ORACLE_CONNECTION_STRING": "hostname:1521/servicename",
"ORACLE_USER": "readonly_user",
"ORACLE_PASSWORD": "secure_password"
}
}
}
}
Or use environment variables from your shell:
{
"mcpServers": {
"oracle-db": {
"command": "node",
"args": ["/absolute/path/to/my-mcp/dist/server.js"]
}
}
}
Once configured, the MCP server provides two tools to GitHub Copilot:
Before integrating with Copilot, you can test the server locally:
# Make sure you have .env configured with valid Oracle credentials
npm run build
npm run test-client
This will:
Edit src/client.ts to customize the test queries.
Once configured, the MCP server provides two tools to GitHub Copilot:
query_databaseExecute read-only SQL queries:
User: "Show me the top 10 customers by revenue"
Copilot: [calls query_database with SQL query]
Parameters:
query (required): SQL SELECT statementmaxRows (optional): Maximum rows to returntimeout (optional): Query timeout in millisecondsExample:
{
"query": "SELECT customer_name, SUM(revenue) as total FROM customers GROUP BY customer_name ORDER BY total DESC",
"maxRows": 10
}
get_database_schemaGet schema information:
User: "What columns are in the CUSTOMERS table?"
Copilot: [calls get_database_schema with tableName="CUSTOMERS"]
Parameters:
tableName (optional): Specific table name, or omit to list all tablesmy-mcp/
├── src/
│ ├── server.ts # Main MCP server entry point
│ ├── client.ts # Test client for local testing
│ ├── config.ts # Configuration with Zod validation
│ ├── database/
│ │ ├── types.ts # TypeScript types
│ │ ├── oracleConnection.ts # Connection pool manager
│ │ └── queryExecutor.ts # Query execution logic
│ ├── tools/
│ │ ├── queryDatabase.ts # query_database tool
│ │ └── getSchema.ts # get_database_schema tool
│ └── logging/
│ └── logger.ts # Winston-based logging
├── dist/ # Compiled JavaScript (generated)
├── .env # Environment variables (git ignored)
├── .env.example # Environment template
└── package.json
npm run build # Compile TypeScript
npm run dev # Watch mode compilation
npm run clean # Remove dist folder
npm run typecheck # Type check without compiling
npm start # Run the server (after building)
npm run test-client # Run test client to verify server works
All queries and events are logged in JSON format. Logs go to stdout/stderr:
{
"level": "info",
"message": "Query executed successfully",
"timestamp": "2025-10-24T10:30:00.000Z",
"audit": true,
"query": "SELECT * FROM customers WHERE...",
"rowCount": 42,
"executionTime": 156
}
Set LOG_LEVEL=debug in .env for more verbose logging.
Docker not running:
# Check if Colima is running
colima status
# Start Colima if needed
colima start
# Verify Docker works
docker ps
Database won't start:
# Check container status
docker ps -a | grep oracle
# View logs
docker logs oracle-xe
# Restart if needed
docker restart oracle-xe
Error: ORA-12545: Connect failed because target host or object does not exist
Solutions:
ORACLE_CONNECTION_STRING format: hostname:port/servicenamelocalhost:1521/XEPDB1docker ps | grep oracleError: ORA-00942: table or view does not exist
Solution: Grant SELECT privileges to your read-only user on the required tables.
If the test client fails immediately after starting the database:
docker ps should show (healthy)docker logs -f oracle-xeThis project uses Thin Mode (pure JavaScript, no Oracle Client needed). If you encounter issues and want to use Thick Mode:
oracledb.initOracleClient() before creating the poolFor most use cases, Thin Mode is simpler and works great!
📚 Integration Guides:
📊 Test Results:
📝 Custom Instructions:
.github/copilot-instructions.md - Project-wide Copilot instructions.github/instructions/ - Language-specific coding guidelinesISC
Contributions welcome! Please open an issue or pull request.
FAQs
Model Context Protocol (MCP) server for database queries - enables AI assistants like GitHub Copilot to execute read-only SQL queries against Oracle databases
We found that mcp-oracle-database demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.