View Categories

How to Connect Microsoft SQL Server to Claude / Cursor via MCP (SQL Server MCP Server Setup)

27 min read

MCP SERVER SQL SERVER

Query Microsoft SQL Server with Claude or Cursor via MCP.

Connect Microsoft SQL Server — on-premise, Azure SQL Database, Azure SQL Managed Instance, or AWS RDS for SQL Server — to Claude or Cursor with one MCP key. Schema Intelligence handles T-SQL idioms (TOP, ISNULL, DATEADD, bracketed [reserved] identifiers) so the AI writes valid T-SQL on its first try.

No firewall holes One key, every connector Live data, no cache lag Bring your own AI tool
Start Free Browse all MCP guides
See everything Query Streams can do beyond this guide Get Started Free
Supports
SQL Server PostgreSQL MySQL MariaDB SQLite MS Access Oracle BigQuery DuckDB
+more
Excel Sheets
Live Data

Replace exports with on-demand SQL

Excel Sheets
Nova
BI & AI Analytics

Ask Nova, get SQL + charts

Meet Nova
REST API
Database REST API

One key per partner. No credentials shared.

Build an API
Airtable Smartsheet Baserow SeaTable +more
Automation

Scheduled sync to 6+ platforms

Explore
Stripe HubSpot Shopify GA +more
API to SQL

Query APIs with SQL, no code

Explore
MCP Claude Cursor ChatGPT Grok +more
AI Database MCP

Claude, Cursor, ChatGPT & Grok talk to your data

Connect AI

Query Streams is a secure, real-time data integration platform that brings every database and SaaS API in your account into Claude, Cursor, ChatGPT, and Grok — through a single MCP key with no firewall changes. This guide walks through wiring up the Microsoft SQL Server MCP connector specifically, so your AI tool can answer plain-English questions about customers, orders, products, employees, and any other SQL Server data — joins, aggregations, schema exploration, ad-hoc reporting — without you copy-pasting CSV exports out of SQL Server Management Studio, Azure Data Studio, or DBeaver. Learn more at QueryStreams.com and sign up for free to start asking your AI tool real SQL Server questions.

What Query Streams MCP gives you for SQL Server

Other “SQL Server MCP” servers on the open-source landscape connect the AI tool directly to a Microsoft SQL Server connection string. That works, but it pushes a SQL Server login or service-account password into your AI client’s config, scopes the AI tool to only that one SQL Server endpoint, and gives you no audit trail of what the AI actually asked. The Query Streams MCP server for Microsoft SQL Server solves a wider problem: one key, every connector, full audit trail, and the AI tool never holds your SQL Server credentials.

Zero inbound firewall holes

The Network Agent opens a single outbound encrypted cloud link to Query Streams. Your AI client connects to the cloud, never to your SQL Server host. No port to open, no IP to allowlist, no VPN, no TCP 1433 listener exposed to the public internet.

One key, every connector

The same MCP key reaches every database and SaaS API your account has connected. Add a Stripe or PostgreSQL connector tomorrow and the AI tool sees it next to your SQL Server tables without re-keying.

Schema Intelligence baked in

The AI sees AI-curated descriptions, semantic types, enum value lists, and discovered foreign keys for every SQL Server column — not just bare sys.columns / INFORMATION_SCHEMA output. It writes accurate T-SQL on the first try, even on legacy enterprise schemas with cryptic column names.

Read-only enforced at the agent

Even a hallucinating LLM can’t issue DELETE, UPDATE, TRUNCATE, or EXEC sp_ stored procedures through Query Streams MCP. The Network Agent rejects anything that isn’t SELECT, WITH, or EXPLAIN before SQL Server ever sees the T-SQL.

Per-key rate limits

Default 60 requests per minute and 10 execute calls per minute, configurable per key. A runaway AI tool-call loop hits a token bucket, not your SQL Server connection pool, your tempdb, or your Azure SQL DTU bill.

How it works without opening firewall ports

The Query Streams Network Agent installs once on a machine that can reach your SQL Server instance and dials one outbound TLS link to the cloud over the standard Tabular Data Stream (TDS) wire protocol — nothing inbound is ever exposed, and the AI tool never sees your SQL Server connection string. how the outbound-only connection works →

AI Client

Cursor, Claude,
ChatGPT, Grok

QS MCP Server

Streamable HTTP
X-MCP-Key auth

Network Agent

On your network
Cloud link out

Microsoft SQL Server

Connection string
held by the agent

No inbound port required — the agent dials out, never the other way around

The MCP key you give Cursor or Claude is scoped (read / analyze / execute), revocable at any time, and rate-limited per-key. The AI tool calls these MCP tools to do its work:

querystreams-mcp · tool catalog
qs_list_organizationsread
Returns the org bound to the calling key.
qs_list_agentsread
Lists Network Agents and online state.
qs_list_connectorsread
Lists data connectors (one entry per database server or API).
qs_get_connector_schemaread
Returns the SQL Server databases, schemas, tables, and columns the AI can query, with Schema Intelligence enrichment when available.
qs_profile_tableanalyze
Sample values, distributions, enum detection, semantic types — on demand.
qs_list_saved_queriesread
Pre-built parameterized SQL templates the team trusts. The AI runs them without ever seeing the SQL.
qs_run_saved_queryexecute
Executes a saved query by pattern_key with optional parameter overrides.
qs_run_queryexecute
Executes a SELECT against a connector. Read-only validator runs at the agent, before SQL Server sees the T-SQL.

Why Schema Intelligence makes Query Streams MCP different

Most “MCP for SQL Server” servers in the open-source landscape hand your AI tool the same INFORMATION_SCHEMA SQL Server hands a stranger. Column names. Data types. Maybe a primary key. The LLM is left to guess what OrderStatus = 3 means, what cust_eml stores, or whether OrderDetails.OrderID actually joins to Orders.OrderID (no foreign key was ever declared either way — common on legacy enterprise schemas that pre-date FK enforcement, or on databases ported from sysname columns). That’s why the first T-SQL most LLMs write against a bare schema is wrong — not because the LLM is bad, but because it doesn’t have the data it needs to be right.

Query Streams MCP returns that same schema enriched with what we call Schema Intelligence (SI) — AI-curated metadata that’s generated by running profiling queries against your actual SQL Server data before the AI client ever asks. When SI is enabled on a connector and database, every schema tool the AI calls (qs_get_connector_schema, qs_get_table_schema, qs_profile_table, qs_get_relationships) returns the bare schema plus six layers of curated knowledge. The LLM stops guessing.

To make this concrete, here is what the AI client gets back from a single qs_get_table_schema call against a typical SQL Server enterprise OLTP database (Customers, Orders, OrderDetails, Products, Categories, Employees — the canonical AdventureWorks-style schema) — first without Schema Intelligence, then with it.

Without Schema Intelligence data_source: captured_schema
// what the LLM sees == TABLE: dbo.Customers == – CustomerID INT [PK, NOT NULL] – CustomerName NVARCHAR(200) NOT NULL – CustomerEmail NVARCHAR(255) – CreatedAt DATETIME2 NOT NULL == TABLE: dbo.Orders == – OrderID INT [PK, NOT NULL] – CustomerID INT NOT NULL – OrderDate DATETIME2 NOT NULL – TotalAmount DECIMAL(19,4) NOT NULL – OrderStatus NVARCHAR(20) NOT NULL – ShippedDate DATETIME2 == TABLE: dbo.OrderDetails == – OrderDetailID INT [PK] – OrderID INT NOT NULL – ProductID INT NOT NULL – Quantity INT NOT NULL – UnitPrice MONEY NOT NULL == TABLE: dbo.Products == – ProductID INT [PK] – ProductName NVARCHAR(200) – CategoryID INT – UnitPrice MONEY == TABLE: dbo.Categories == – CategoryID INT [PK] – CategoryName NVARCHAR(100) == TABLE: dbo.Employees == – EmployeeID INT [PK] – FullName NVARCHAR(200) – HireDate DATE Foreign Keys: (none declared) si_recommendation: state: “not_run” what_youre_missing_for_this_call: – AI-discovered foreign keys – Per-column sample values + enum detection – Table and column descriptions – Semantic type classifications – Business domain tagging note: “types only, no semantic context”
With Schema Intelligence data_source: schema_intelligence
// what the LLM sees == TABLE: dbo.Orders [FACT, domain:sales] == “Customer order header rows; one per checkout. TotalAmount is the order grand total in USD.” – OrderID INT [PK] identifier – CustomerID INT identifier FK -> Customers.CustomerID (100% overlap, conf 0.99) – OrderDate DATETIME2 date_iso Sample: 2026-04-28 14:02:11 – TotalAmount DECIMAL(19,4) currency Range: 0.00 – 9,420.00 · mean 286.50 – OrderStatus NVARCHAR(20) status_code (enum) Shipped (58%) | Pending (24%) | Delivered (14%) | Cancelled (4%) – ShippedDate DATETIME2 date_iso (nullable) == TABLE: dbo.OrderDetails [FACT, domain:sales] == “One row per product per order. Revenue = SUM(Quantity * UnitPrice).” – OrderID INT identifier FK -> Orders.OrderID (98% overlap, conf 0.95) – ProductID INT identifier FK -> Products.ProductID (100% overlap, conf 0.99) – Quantity INT counter – UnitPrice MONEY currency == TABLE: dbo.Customers [DIM, domain:customers] == – CustomerEmail NVARCHAR(255) email Sample: [email protected], [email protected] – CustomerName NVARCHAR(200) person_name == TABLE: dbo.Products [DIM, domain:products] == – ProductName NVARCHAR(200) text_content – CategoryID INT identifier FK -> Categories.CategoryID (100% overlap, conf 0.99) == TABLE: dbo.Categories [DIM, domain:products] == – CategoryName NVARCHAR(100) text_content Sample: [‘Beverages’,’Confections’,’Hardware’,’Tools’]

The six layers Schema Intelligence adds

Each layer addresses a class of question the LLM would otherwise guess at, and the opt-in SI profiling pass runs against your SQL Server data without changing your schema or writing to your database. what Schema Intelligence adds and how it stays current →

AI-curated descriptions

Plain-English purpose for every database, schema, table, and column — generated once, refreshed when your schema changes. Confidence-scored; user-authored descriptions always win.

Orders: “Customer order headers;
one row per checkout.”

Table classifications

Each table tagged FACT (transactional events), DIM (descriptive reference), or LOOKUP (small code maps), plus a business domain — sales, hr, seo, finance, support, and 14 more.

Orders [FACT, domain:sales]
Customers [DIM, domain:customers]

Semantic types per column

Eighteen types — currency, email, date_iso, status_code, percentage, ranking_position, identifier, url, person_name, and more. The AI generates dialect-correct T-SQL appropriate to each type.

TotalAmount: currency
CustomerEmail: email

Sample values from real data

Random rows surfaced to the LLM so it recognises patterns no schema can show — formatting conventions, encoded values, abbreviation styles, and the actual shape of your strings.

CategoryName: [‘Beverages’,
‘Confections’,’Hardware’,’Tools’]

Enum detection with distributions

Low-cardinality columns (50 or fewer distinct values, at most 5% of rows unique) mapped to their full value list with row counts. The AI never guesses casing or spelling.

OrderStatus: Shipped (58%)
| Pending (24%) | Delivered (14%)

Implicit foreign-key discovery

Cross-table data overlap analysis finds joins that aren’t declared as DDL constraints. Stored alongside formal FKs with confidence scores, returned by qs_get_relationships.

OrderDetails.OrderID -> Orders.OrderID
(98% overlap, conf 0.95)

Same prompt, different SQL

The proof is in the T-SQL the AI tool actually writes. Same Cursor session, same Claude model, same prompt — “What are our top 20 revenue-generating customers, and which product categories do they buy most?” Without Schema Intelligence the LLM has to guess at T-SQL syntax. With it, the LLM knows.

Without Schema Intelligence
— LLM’s first attempt against bare schema: SELECT CustomerID, SUM(UnitPrice) AS Revenue FROM OrderDetails WHERE OrderDate >= NOW() GROUP BY CustomerID ORDER BY Revenue DESC LIMIT 20 ✕ ERROR: ‘NOW’ is not a recognized built-in function ✕ ‘LIMIT’ is not valid T-SQL syntax (use TOP) ✕ CustomerID isn’t on OrderDetails (needs JOIN to Orders) ✕ SUM(UnitPrice) ignores Quantity — wrong revenue ✕ no Categories join — can’t answer “which categories” ✕ missing OrderStatus filter — includes cancelled orders
With Schema Intelligence
— LLM’s first attempt with SI enabled: SELECT TOP 20 c.CustomerID, c.CustomerName, cat.CategoryName, SUM(od.Quantity * od.UnitPrice) AS Revenue FROM dbo.Customers c INNER JOIN dbo.Orders o ON o.CustomerID = c.CustomerID INNER JOIN dbo.OrderDetails od ON od.OrderID = o.OrderID INNER JOIN dbo.Products p ON p.ProductID = od.ProductID INNER JOIN dbo.Categories cat ON cat.CategoryID = p.CategoryID WHERE o.OrderDate >= DATEADD(DAY, –365, GETDATE()) AND o.OrderStatus IN (‘Shipped’, ‘Delivered’) GROUP BY c.CustomerID, c.CustomerName, cat.CategoryName ORDER BY Revenue DESC; ✓ 20 rows. Correct first try. ✓ FACT/DIM tags guided the join structure ✓ FK discovery surfaced OrderID + ProductID joins ✓ OrderStatus enum ruled out cancelled orders ✓ T-SQL TOP 20 + DATEADD/GETDATE used correctly
Don’t want to run Schema Intelligence? MCP still works — schema tools return bare metadata (types, primary keys, formal foreign keys, indexes) and every degraded response carries an si_recommendation block telling the AI what it’s missing, including a one-call option to enable SI mid-conversation via qs_request_si_analysis. how Schema Intelligence runs and how long it takes →

Connect Azure SQL or AWS RDS for SQL Server to Claude

Microsoft SQL Server runs in three common cloud-hosted shapes today — Azure SQL (Database / Managed Instance), AWS RDS for SQL Server, and self-managed SQL Server on EC2 / Amazon FSx for Windows. The Query Streams Network Agent works identically against all three because it dials out over a single TLS cloud link — you do not have to open inbound TCP 1433 to the public internet, expose a SQL Server endpoint via NSG / security group rules, or stand up a VPN. Pick your hosting shape below.

Azure SQL Database / Managed Instance

*.database.windows.net

Install the Network Agent on an Azure VM in the same VNet as your Azure SQL endpoint and reach the database through a private endpoint or service endpoint — the database host never has to expose a public listener. Authenticate using SQL authentication (login + password) or Microsoft Entra ID (formerly Azure Active Directory), with managed identity strongly preferred for production. Minimum tier we’ve validated is the vCore General Purpose Gen5 2vCPU shape; the agent itself comfortably runs on a Standard_B2s Azure VM. The connection string requires Encrypt=True;TrustServerCertificate=False; — the agent enforces this by default for any *.database.windows.net hostname.

  • Single Database, Elastic Pool, and Hyperscale all supported
  • Managed Instance treated as full SQL Server (broad T-SQL surface)
  • Geo-replicated read replicas reachable as separate connectors

AWS RDS for SQL Server

*.rds.amazonaws.com

Install the Network Agent on an EC2 instance in the same VPC as your RDS for SQL Server endpoint — or in a peered VPC with the security group rules already open for the agent host. Authenticate using SQL authentication (master user + password) or Windows Authentication via an AD-joined Windows Server EC2 with AWS Managed Microsoft AD. Minimum spec is db.t3.medium, with db.r5.large recommended for production workloads where the LLM might run aggregations against multi-million-row fact tables. Multi-AZ deployments are fully supported — the agent connects to the cluster endpoint and RDS handles the failover.

  • Standard, Web, Enterprise, and Developer editions all supported
  • License-included and BYOL pricing both work
  • Read replicas registerable as their own connectors

Amazon FSx for SQL Server / SQL Server on EC2 (self-managed)

EC2 Windows / FSx for Windows File Server

Treat self-managed SQL Server on EC2 (or SQL Server using Amazon FSx for Windows File Server shared storage for cluster-style high availability) the same way you’d treat an on-premise SQL Server instance — install the Network Agent on a peer EC2 instance in the same VPC, authenticate with SQL authentication or Kerberos via your existing Active Directory, and let the agent reach SQL Server over the standard TDS protocol on the private subnet. The cloud link from the agent up to Query Streams is identical — outbound TLS on port 443 — whether the database lives in Azure, AWS, or your own datacenter rack.

  • Always On Availability Groups supported (point at the listener)
  • Failover Cluster Instances on FSx for Windows Server
  • Bring-your-own-license retains your existing Software Assurance
One pattern, three clouds. Per Microsoft’s recommendation, use Microsoft Entra ID / IAM-DB authentication for production whenever possible — avoid long-lived SQL logins. The agent’s outbound-only cloud link to Query Streams works identically across Azure SQL, AWS RDS, and self-managed SQL Server: no inbound firewall changes on any cloud, no SQL Server listener exposed to the public internet, no static IP allowlists to maintain. Register each SQL Server endpoint — Azure SQL Database, RDS for SQL Server, EC2 self-managed — as its own connector on the same MCP key, and the LLM picks the right one based on the question.
Nova AI

MCP not for you? Try Nova AI instead.

Skip the JSON config entirely: Nova AI is built into the Query Streams web portal and asks the same plain-English questions against the same SQL Server connector — same agent, same read-only enforcement, same Schema Intelligence powering the T-SQL, no MCP plumbing.

Meet Nova AI

Prerequisites

Before you start, make sure you have:

  1. A free Query Streams account at my.querystreams.com.
  2. The Query Streams Network Agent installed on a machine that can reach your SQL Server instance — see Download the Query Streams Agent.
  3. A Microsoft SQL Server connector configured against the agent — see the existing connector setup guides for the connection string. The agent holds the SQL Server login password (or Windows / Azure AD credentials); the AI tool never touches them.
  4. Any MCP-capable AI client. We’ll show Cursor, Claude Desktop, ChatGPT, and Grok in this guide; if you use Windsurf, Zed, Continue, Cline, VS Code Copilot, Codex, or Goose, the config block is essentially the same.
  5. Five minutes.
You only set up the agent once. The same agent that powers Query Streams’ Excel and Google Sheets add-ons, the web Query Builder, and Nova AI also serves MCP. Adding MCP to an existing Query Streams account is just generating a key — the agent and SQL Server connector are already running.
1

Generate an MCP key

From the /mcp page in Query Streams, mint a key with the scopes you want.

2

Drop it into your AI client

One JSON snippet for Cursor, Claude, ChatGPT, or Grok. Same key everywhere.

3

Ask a question

“What were our top 10 customers by lifetime value?” — the AI calls the right tools, you get the answer.

Step 1: Generate an MCP key in Query Streams

Sign in to Query Streams and open the MCP page (or sign in first at my.querystreams.com and click MCP in the left navigation). Click Generate key, give the key a recognizable name (something like cursor-laptop or claude-desktop), and pick the scopes you want this key to have:

  • read — the AI can browse connectors and read schema. Required for everything else.
  • analyze — the AI can profile tables and discover relationships (sample values, distributions, semantic types). Optional but strongly recommended for SQL Server work, where understanding the shape of your data matters when the LLM is generating joins across enterprise schemas with bracketed identifiers and inconsistent naming.
  • execute — the AI can actually run SQL. Without this, the AI is read-only against schema metadata only.

For a typical “let Claude analyse my SQL Server data” workflow, all three scopes are appropriate. For a key you’re handing to a teammate or a less-trusted client, drop execute and let them browse only. You can revoke any key at any time from the same page; the AI client will see MCP_KEY_REVOKED on its next call and stop working immediately. There’s no propagation delay.

Copy the key now — Query Streams shows it once, then stores only a hash. If you lose it, generate a new one. The key looks like qsmcp_ followed by 48 random characters and is what your AI client sends in the X-MCP-Key request header.

Step 2: Add Query Streams MCP to your AI client

The configuration is the same shape across every MCP-capable client — an MCP server entry pointing at https://mcp.querystreams.com with your key in the X-MCP-Key header. Pick your client below.

Cursor
Cursor ~/.cursor/mcp.json 
// Edit ~/.cursor/mcp.json
{
  "mcpServers": {
    "querystreams": {
      "url": "https://mcp.querystreams.com",
      "headers": {
        "X-MCP-Key": "qsmcp_PASTE_KEY_HERE"
      }
    }
  }
}
Claude Desktop
Claude Desktop claude_desktop_config.json 
// Settings → Developer → Edit Config
{
  "mcpServers": {
    "querystreams": {
      "url": "https://mcp.querystreams.com",
      "headers": {
        "X-MCP-Key": "qsmcp_PASTE_KEY_HERE"
      }
    }
  }
}
ChatGPT
ChatGPT Apps & Connectors 
// Settings → Apps & Connectors → Add MCP
Server URL  https://mcp.querystreams.com
Auth header X-MCP-Key
Header value qsmcp_PASTE_KEY_HERE

// Requires a paid ChatGPT plan
// (Plus / Pro / Team / Enterprise).
Grok
Grok Remote MCP Tools 
// Grok → Settings → Tools
{
  "mcp_servers": [{
    "name": "querystreams",
    "url": "https://mcp.querystreams.com",
    "auth_header": "X-MCP-Key",
    "auth_value": "qsmcp_..."
  }]
}

Restart your AI client. On its next start it will discover the eight Query Streams MCP tools listed above and surface them in its tool palette. In Cursor and Claude Desktop you can verify by typing “list connectors” — the AI should call qs_list_connectors and return your SQL Server connector along with anything else you have configured.

Step 3: Ask the AI a SQL Server question

You don’t write T-SQL — the AI does. You ask a question, the AI picks the right MCP tool, the agent runs the query against your SQL Server database, and the answer comes back as text plus tables. Three example prompts to try first:

“What’s our quarterly revenue trend, and which months are seasonal peaks?”
Revenue
The AI will call qs_get_connector_schema to discover the Orders, OrderDetails, and Products tables, then qs_run_query with a SELECT that buckets by DATEPART(QUARTER, OrderDate) and DATEPART(MONTH, OrderDate), aggregates SUM(od.Quantity * od.UnitPrice) by quarter, and surfaces the seasonal peaks via window functions like AVG(...) OVER (PARTITION BY DATEPART(MONTH, OrderDate)). You’ll see a ranked monthly chart inline, plus a written interpretation — quarter-on-quarter growth, which months consistently outperform, and any anomalies the AI inferred from the SQL Server data.
“Which products have inventory below reorder point?”
Inventory
The AI uses Schema Intelligence’s column descriptions to recognize the Products.UnitsInStock and Products.ReorderLevel columns, joins to Categories for human-readable category names, and writes a T-SQL filter like WHERE p.UnitsInStock < ISNULL(p.ReorderLevel, 10). The result is a focused list with product name, category, units in stock, reorder level, and units-on-order — ordered by stockout-risk first. The AI typically flags critical-shortage rows in red and notes which categories have the most pending shortages.
“Show me orders that haven’t shipped in 5+ days, ordered by priority.”
Operations
The AI uses Schema Intelligence’s enum-detection on Orders.OrderStatus to filter to 'Pending' orders with a NULL ShippedDate and an OrderDate older than DATEADD(DAY, -5, GETDATE()). The result is a focused list with OrderID, CustomerName, TotalAmount, and days-since-ordered — usually the AI sorts by total descending so the highest-value backlog floats to the top, and flags the most concerning rows as fulfilment-team escalations. You can drill in by asking “why is order 4821 still pending?” and the AI will pull the relevant rows.

The first time the AI calls a tool, your client may pop up a confirmation prompt asking you to approve the tool call — that’s MCP’s standard consent flow, not anything Query Streams adds. Approve once and the AI proceeds with the rest of the conversation freely. You can revisit the consent at any time in your client’s settings.

Honest billing notice: MCP usage is charged on uncompressed bytes

MCP’s Streamable HTTP transport can’t compress reliably end-to-end, so it bills uncompressedBytes rather than the compressedBytes the Excel / Sheets / Nova / Query Builder clients use: a 4 MB SQL Server aggregate costs ~4 MB via MCP vs. ~600–900 KB on the compressed clients, since SQL Server data with repeated NVARCHAR enum values, status codes, and category names compresses ~5–7x via LZ4. For very large recurring exports prefer the Excel / Sheets / Nova path; for interactive 100–5,000 row tool calls MCP is the right choice and the cost difference is in cents. how data-realm billing works across transports →

Frequently asked questions

Do I need to open ports or run a VPN to use this? +
No inbound firewall rule, port-forwarding, NAT punchthrough, or VPN — the Network Agent makes one outbound TLS connection (port 443) to agent.querystreams.com and your AI client reaches https://mcp.querystreams.com from the public internet, so if outbound HTTPS works on the agent host, MCP works. See how the outbound-only connection works →
Which AI tools can I use with Query Streams MCP? +
Any client that speaks the open Model Context Protocol — Claude Desktop, Claude Code, Cursor, ChatGPT (paid), Grok, Gemini CLI, Windsurf, Zed, and 500+ more. Bring your own AI tool; you don’t have to switch. Full list of supported AI clients →
Can I revoke an MCP key? +
Yes — three independent kill-switches (per-key from the /mcp page, per-org via plan settings, and platform-level), none of which need a database password rotation or agent restart. More on MCP key security →
How is MCP usage billed against my data realm? +
MCP execute calls deduct from the same data-realm budget your Excel, Google Sheets, web Query Builder, and Nova AI usage already draws on — one consumption budget across every access method. The size measured for MCP differs. The other clients run over our compressed cloud link (we bill compressedBytes); MCP runs over Streamable HTTP, which doesn’t reliably support compression end-to-end through every client and proxy, so we bill uncompressedBytes. A 4 MB SQL Server result returned to Excel typically costs ~600–900 KB of your data realm; the same 4 MB result returned to Cursor over MCP costs ~4 MB. SQL Server data with repeated NVARCHAR values compresses ~5–7x via LZ4. We’re transparent about it because we’d rather you know up front than be surprised at the end of the billing cycle.
Does Query Streams MCP work with SQL Server 2016 / 2019 / 2022, SQL Server Express, SQL Server on Linux, and Always Encrypted columns? +
Yes. The Network Agent uses the official Microsoft.Data.SqlClient driver. SQL Server 2016+ on Windows or Linux, Azure SQL Managed Instance (which is full SQL Server compatibility on PaaS), AWS RDS for SQL Server, and SQL Server Express (free tier, with the 10 GB database size limit) are all supported — including Standard, Web, Enterprise, and Developer editions. Always Encrypted columns are passed through transparently — the agent doesn’t decrypt them at the agent layer; your application’s column-encryption key remains private and the LLM sees the encrypted ciphertext for those columns (Schema Intelligence flags them as such, so the LLM knows not to filter on the encrypted values). For SQL Server on Linux, no special config is needed; the TDS wire protocol is identical and the same driver path works against either operating system. For older 2014 / 2012 instances, contact support — there’s a fallback driver path. Each SQL Server instance you register is a separate connector, so the LLM can select “production OLTP SQL Server” vs “warehouse SQL Server” by name. The MCP server doesn’t see the credentials; only the agent does.
How does this differ from running an open-source Microsoft SQL Server MCP server myself? +
A direct Microsoft SQL Server MCP server (community projects on GitHub do exist) is one MCP per data source. To get Claude reading from your SQL Server + Google Search Console + your Stripe account + your Snowflake warehouse you’d need four MCP servers configured separately in every AI client, each with its own credentials, each with its own scope model, each with its own audit story. Query Streams MCP is one key reaching every connector your account has paired. You also pick up Schema Intelligence, agent-layer read-only enforcement, per-key rate limits, audit trail in event_logs, and the same data-realm billing pipeline you already use — none of which a direct SQL Server MCP gives you.
What happens if the AI tries to write or delete data? +
It’s rejected at the agent before the data source sees the T-SQL. Every qs_run_query call is parsed by a hardcoded read-only validator that allows only SELECT, WITH, and EXPLAIN statements; anything else (INSERT, UPDATE, DELETE, TRUNCATE, EXEC sp_, MERGE, BULK INSERT, etc.) returns READONLY_VIOLATION and never reaches SQL Server. The validator runs in the agent process on your network, not in the cloud, so a compromised cloud surface couldn’t bypass it. (You can layer a SQL-Server-side read-only login — e.g. add the principal to db_datareader and explicitly deny db_datawriter on the relevant databases — on top if you want belt-and-suspenders — the agent’s validator is independent of whatever SQL Server grants you’ve configured.)
Can I see what the AI actually asked? +
Yes. Every MCP tool call writes a row to event_logs with the org, user, key, scope, latency, and result code. The org-admin can answer “who used MCP last week, which connector, and what did they ask?” with a single query. Note that we log the tool name and metadata, not the SQL text or returned rows — those flow through the cloud link and never land in cloud logs. If you want full T-SQL audit, enable database-side audit on the underlying engine; for SQL Server specifically that’s SQL Server Audit (server-level or database-level, with audit specifications targeting SELECT events on the schemas exposed via Query Streams), or for Azure SQL the equivalent Azure SQL Auditing output to a Log Analytics workspace or storage account.
Do I have to run Schema Intelligence to use Query Streams MCP? +
No — Schema Intelligence is opt-in per (connector, database) pair, and MCP works fine without it. The AI gets bare schema (types, primary keys, formal foreign keys, indexes) and writes basic queries. With SI enabled, the AI gets six additional layers of curated metadata: (1) AI-curated descriptions on every database, table, and column; (2) table classifications (FACT for transactional events, DIM for descriptive reference, LOOKUP for small code maps) plus a business domain tag (sales, hr, seo, finance, support, and 14 more); (3) a semantic type on every column (currency, email, date_iso, status_code, percentage, ranking_position, identifier, url, person_name, and 9 more) that drives dialect-correct T-SQL generation; (4) sample values from your real data so the LLM recognises patterns no schema can show; (5) enum detection with full value distributions for low-cardinality columns; and (6) AI-discovered foreign keys based on cross-table data overlap, surfaced through qs_get_relationships. Without SI, every schema-tool response also carries an si_recommendation block listing exactly what’s missing for the call — the AI can read this and offer to trigger SI mid-conversation via qs_request_si_analysis. Run time scales with table count: a small database under 100 tables completes in around 10 minutes; a typical mid-size database (a few hundred tables) finishes in 15–25 minutes; a large enterprise SQL Server database with 1,500+ tables can take 45–60 minutes for a full scan. SI runs through your Network Agent against your data (never in the cloud), never writes to your database, never changes your schema, and refreshes incrementally when your schema changes — so subsequent runs after you add or alter tables are much faster than the first one. The end-to-end effect: with SI enabled, your AI client writes correct T-SQL on the first try far more often than it does against any “MCP for X” server that just hands the LLM INFORMATION_SCHEMA.
What if I add another connector later, like Stripe or PostgreSQL? +
Nothing changes client-side — the same key reaches the new connector the moment the agent pairs it (qs_list_connectors picks it up automatically). One config block buys your whole account, present and future. Why one key covers every connector →
Do I have to set up MCP just to chat with my data? +
No — Nova AI is built into the Query Streams portal and works against every connector (Microsoft SQL Server included) with no MCP setup or config files. Use Nova to chat with your data inside Query Streams; use MCP when you want your own AI client (Claude, Cursor, ChatGPT, …) to reach the same data — same agent, same connectors, same Schema Intelligence underneath. Learn more about Nova AI →
Does Query Streams MCP work with my Azure SQL Database, Azure SQL Managed Instance, or AWS RDS for SQL Server? +
Yes — Azure SQL Database (single database, elastic pool, hyperscale), Azure SQL Managed Instance (full SQL Server compatibility on PaaS), AWS RDS for SQL Server (Standard / Web / Enterprise editions on RDS-managed EC2 instances), and Amazon FSx for Windows-hosted SQL Server are all supported. Install the Network Agent in the same VNet (Azure) or VPC (AWS) for low-latency. For Azure SQL, use SQL authentication (login + password) or Microsoft Entra ID (formerly Azure Active Directory) authentication, with managed identity preferred for production. For RDS, use SQL authentication or Windows Authentication via AD-joined Windows Server VMs with AWS Managed Microsoft AD. Important for Azure SQL: the connection string requires Encrypt=True;TrustServerCertificate=False; — the agent enforces this by default for any *.database.windows.net hostname. The cloud link from the agent to Query Streams is identical regardless of which Microsoft cloud or AWS region hosts your SQL Server; everything below the agent is your existing infrastructure. Per Microsoft’s recommendation, use Microsoft Entra ID / IAM-DB auth for production whenever possible — avoid long-lived SQL logins.

Get started

Connect your AI tool to your Microsoft SQL Server data in five minutes.

One MCP key reaches SQL Server, every other database, and every API connector in your Query Streams account — with full audit trail, per-key rate limits, and zero firewall changes. Claude, Cursor, ChatGPT, and Grok all work out of the box.

Sign Up Free Download Agent

Related guides: Download the Query Streams Agent | Database Connector Setup | All MCP Server guides | Nova AI text-to-SQL

Category: MCP Server

Tags: mcp, claude, cursor, sql-server, mssql, database, enterprise, azure-sql, aws-rds, tsql

Meta Description: Connect Microsoft SQL Server to Claude or Cursor via Query Streams MCP. T-SQL-aware, outbound-only, read-only, 5-min setup.

Updated on June 16, 2026
aws-rds azure-sql claude cursor database enterprise mcp mssql sql-server tsql

What are your Feelings

  • Happy
  • Normal
  • Sad

Powered by BetterDocs