Skip to Content
dbmcp

Configuration

Every dbmcp setting with its YAML key, environment variable, type, and default

reads its settings from DBMCP_* environment variables, optional env files, and optional YAML config files. The command line only names those files (--config-file, --env-file); there is no per-setting flag. The table below lists every setting; each key links to the page that explains it, with its type and full description. For the file formats, ${} interpolation, and path rules, see Config files.

The config file has a JSON Schema for editor completion and validation. Editors backed by the YAML language server (VS Code's YAML extension, JetBrains IDEs, Neovim, Zed) pick it up from this modeline on the first line of the file:

# yaml-language-server: $schema=https://raw.githubusercontent.com/haymon-ai/dbmcp/master/crates/config/assets/dbmcp.schema.json

The master URL tracks the latest schema; replace master with a release tag such as vX.Y.Z to match an older binary. At startup dbmcp checks the file's keys and sections against the same schema and every value by its setting's type, so every value in the file must be valid even when a DBMCP_* variable overrides it.

All settings

YAML keyEnv varDefault
transportDBMCP_TRANSPORTstdio
http.hostDBMCP_HTTP_HOST127.0.0.1
http.portDBMCP_HTTP_PORT9001
http.allowed_originsDBMCP_HTTP_ALLOWED_ORIGINSLoopback origins, any port
http.allowed_hostsDBMCP_HTTP_ALLOWED_HOSTSlocalhost, 127.0.0.1, ::1
http.auth_tokenDBMCP_HTTP_AUTH_TOKEN(unset)
http.allow_unauthenticatedDBMCP_HTTP_DANGEROUSLY_ALLOW_UNAUTHENTICATEDfalse
database.backendDBMCP_DB_BACKENDmysql
database.hostDBMCP_DB_HOSTlocalhost
database.portDBMCP_DB_PORTBackend-dependent
database.userDBMCP_DB_USERBackend-dependent
database.passwordDBMCP_DB_PASSWORD—
database.nameDBMCP_DB_NAME—
database.charsetDBMCP_DB_CHARSET—
database.sslDBMCP_DB_SSLfalse
database.ssl_caDBMCP_DB_SSL_CA—
database.ssl_certDBMCP_DB_SSL_CERT—
database.ssl_keyDBMCP_DB_SSL_KEY—
database.ssl_verify_certDBMCP_DB_SSL_VERIFY_CERTtrue
database.read_onlyDBMCP_DB_READ_ONLYtrue
database.max_pool_sizeDBMCP_DB_MAX_POOL_SIZE5
database.connection_timeoutDBMCP_DB_CONNECTION_TIMEOUT—
database.query_timeoutDBMCP_DB_QUERY_TIMEOUT30
database.max_query_timeoutDBMCP_DB_MAX_QUERY_TIMEOUTquery_timeout
database.page_sizeDBMCP_DB_PAGE_SIZE100
database.max_cell_charsDBMCP_DB_MAX_CELL_CHARS4096
database.max_response_charsDBMCP_DB_MAX_RESPONSE_CHARS32000
log_levelDBMCP_LOG_LEVELinfo
pii.enabledDBMCP_PII_ENABLEfalse
pii.operatorDBMCP_PII_OPERATORreplace
pii.categoriesDBMCP_PII_CATEGORIESunset (all built-ins)
pii.ner_enabledDBMCP_PII_NER_ENABLEfalse
pii.ner_modelDBMCP_PII_NER_MODELunset
ssh.hostDBMCP_SSH_HOST—
ssh.portDBMCP_SSH_PORT22
ssh.userDBMCP_SSH_USER—
ssh.passwordDBMCP_SSH_PASSWORD—
ssh.keyDBMCP_SSH_KEY—
ssh.key_passphraseDBMCP_SSH_KEY_PASSPHRASE—
ssh.known_hostsDBMCP_SSH_KNOWN_HOSTS~/.ssh/known_hosts
ssh.strict_host_key_checkingDBMCP_SSH_STRICT_HOST_KEY_CHECKINGyes
ssh.keepalive_intervalDBMCP_SSH_KEEPALIVE_INTERVAL30
ssh.local_portDBMCP_SSH_LOCAL_PORTephemeral

For where these values come from and which source wins, see Precedence.

Value Formats

The Type column in the settings tables determines how a value is written:

TypeEnvironment variable / env fileYAML
stringText as-isAny scalar; quote values YAML would read as another type (password: "12345")
integerDecimal digitsInteger (quoted digits also work)
secondsWhole seconds as an integerInteger
booleantrue/false, 1/0, t/f, TRUE/FALSE, True/Falsetrue / false (or a quoted string from the env set)
enumOne of the listed values, lowercase kebab-case, case-sensitiveSame
listComma-separated; items are trimmed, empty items are rejectedYAML sequence ([a, b] or one - item per line), or a comma-separated string as in the env var; replaces the default wholesale
pathProcess env: relative paths resolve against the working directory. Env file: against the env file's directory; leading ~ expandsRelative paths resolve against the YAML file's directory; leading ~ expands

yes/no/on/off are not booleans and are rejected. A default of — or unset means the setting is absent until you set it.

Logging

YAML keyEnv varTypeDefaultDescription
log_levelDBMCP_LOG_LEVELenuminfoLog level: error, warn, info, debug, trace. Logs go to stderr.

Migrating from CLI flags

Earlier releases accepted one CLI flag per setting. Those flags are gone: passing one now fails with clap's error: unexpected argument '--db-backend' found (exit code 2). The only flags left are --config-file, --env-file, -h/--help, and -V/--version. --transport and --log-level moved too: use DBMCP_TRANSPORT / transport and DBMCP_LOG_LEVEL / log_level.

Every DBMCP_* environment variable name is unchanged, so each removed flag maps to the variable that already backed it:

Removed flagEnv varYAML key
--transportDBMCP_TRANSPORTtransport
--log-levelDBMCP_LOG_LEVELlog_level
--hostDBMCP_HTTP_HOSThttp.host
--portDBMCP_HTTP_PORThttp.port
--allowed-originsDBMCP_HTTP_ALLOWED_ORIGINShttp.allowed_origins
--allowed-hostsDBMCP_HTTP_ALLOWED_HOSTShttp.allowed_hosts
--auth-tokenDBMCP_HTTP_AUTH_TOKENhttp.auth_token
--dangerously-allow-unauthenticatedDBMCP_HTTP_DANGEROUSLY_ALLOW_UNAUTHENTICATEDhttp.allow_unauthenticated
--db-backendDBMCP_DB_BACKENDdatabase.backend
--db-hostDBMCP_DB_HOSTdatabase.host
--db-portDBMCP_DB_PORTdatabase.port
--db-userDBMCP_DB_USERdatabase.user
--db-passwordDBMCP_DB_PASSWORDdatabase.password
--db-nameDBMCP_DB_NAMEdatabase.name
--db-charsetDBMCP_DB_CHARSETdatabase.charset
--db-sslDBMCP_DB_SSLdatabase.ssl
--db-ssl-caDBMCP_DB_SSL_CAdatabase.ssl_ca
--db-ssl-certDBMCP_DB_SSL_CERTdatabase.ssl_cert
--db-ssl-keyDBMCP_DB_SSL_KEYdatabase.ssl_key
--db-ssl-verify-certDBMCP_DB_SSL_VERIFY_CERTdatabase.ssl_verify_cert
--db-read-onlyDBMCP_DB_READ_ONLYdatabase.read_only
--db-max-pool-sizeDBMCP_DB_MAX_POOL_SIZEdatabase.max_pool_size
--db-connection-timeoutDBMCP_DB_CONNECTION_TIMEOUTdatabase.connection_timeout
--db-query-timeoutDBMCP_DB_QUERY_TIMEOUTdatabase.query_timeout
--db-page-sizeDBMCP_DB_PAGE_SIZEdatabase.page_size
--piiDBMCP_PII_ENABLEpii.enabled
--pii-operatorDBMCP_PII_OPERATORpii.operator
--pii-categoriesDBMCP_PII_CATEGORIESpii.categories
--pii-nerDBMCP_PII_NER_ENABLEpii.ner_enabled
--pii-ner-modelDBMCP_PII_NER_MODELpii.ner_model
--ssh-hostDBMCP_SSH_HOSTssh.host
--ssh-portDBMCP_SSH_PORTssh.port
--ssh-userDBMCP_SSH_USERssh.user
--ssh-passwordDBMCP_SSH_PASSWORDssh.password
--ssh-keyDBMCP_SSH_KEYssh.key
--ssh-key-passphraseDBMCP_SSH_KEY_PASSPHRASEssh.key_passphrase
--ssh-known-hostsDBMCP_SSH_KNOWN_HOSTSssh.known_hosts
--ssh-strict-host-key-checkingDBMCP_SSH_STRICT_HOST_KEY_CHECKINGssh.strict_host_key_checking
--ssh-keepalive-intervalDBMCP_SSH_KEEPALIVE_INTERVALssh.keepalive_interval
--ssh-local-portDBMCP_SSH_LOCAL_PORTssh.local_port

Other behaviour changes to check while migrating:

  • Booleans are stricter. Boolean env vars used to accept yes/no and on/off in any case. They now accept only true/false, 1/0, t/f, TRUE/FALSE, and True/False; anything else fails startup. A bare boolean flag such as --pii becomes DBMCP_PII_ENABLE=true.
  • Empty values mean unset. An empty DBMCP_* value counts as unset and falls through to the next source. In particular, --allowed-origins "" used to disable Origin validation; that is now only possible with allowed_origins: [] under http in the config file.
  • Lists keep the comma-separated env format; in the config file, write them as YAML sequences.

Before — settings passed as arguments in .mcp.json:

{
  "mcpServers": {
    "dbmcp": {
      "command": "dbmcp",
      "args": [
        "--db-backend", "postgres",
        "--db-host", "localhost",
        "--db-user", "postgres",
        "--db-name", "myapp",
        "--pii",
        "--log-level", "debug"
      ]
    }
  }
}

After — the same settings as environment variables:

{
  "mcpServers": {
    "dbmcp": {
      "command": "dbmcp",
      "env": {
        "DBMCP_DB_BACKEND": "postgres",
        "DBMCP_DB_HOST": "localhost",
        "DBMCP_DB_USER": "postgres",
        "DBMCP_DB_NAME": "myapp",
        "DBMCP_PII_ENABLE": "true",
        "DBMCP_LOG_LEVEL": "debug"
      }
    }
  }
}

To keep the settings in a file instead, move them into a YAML file and point at it with "args": ["--config-file", "/abs/path/dbmcp.yaml"]; see Config files.

On this page