StackQL MCP Server: Setup for Claude, Cursor and Other Apps

• Runs a SQL SELECT against a cloud or SaaS provider

  Executes a SELECT written in StackQL's SQL dialect and returns the rows. It reads live data from the provider using your credentials.

  Try: “List the names of all Google Compute networks in project stackql-demo.”

  Network · run_select_query

• Lists the cloud and SaaS providers available

  Returns the providers you can query, at the top of the provider, service, resource hierarchy.

  Try: “Which providers can StackQL query?”

  Read · list_providers

• Lists the services under a provider

  Returns the services for one provider, such as compute or storage.

  Try: “What services does the google provider have?”

  Read · list_services

• Lists the resources under a service

  Returns the resources for a provider and service, such as networks or instances.

  Try: “List the resources in google compute.”

  Read · list_resources

• Lists the ways to read or change a resource

  Returns each access method for a resource with its SQL verb and required parameters. The tool text says to call it before writing a query.

  Try: “Show the methods for google.compute.networks.”

  Read · list_methods

• Describes the inputs and output fields of one method

  Returns the inputs and the output fields a SELECT can use for a single method.

  Try: “Describe the get method on google.compute.networks.”

  Read · describe_method

• Checks a SELECT without running it

  Parses and plans the query and returns whether it is valid, with any errors.

  Try: “Validate this query before you run it.”

  Read · validate_select_query

• Runs INSERT, UPDATE, REPLACE or DELETE on real resources

  Executes a change statement against the provider. It has real side effects. The default mode asks you to approve each one, and refuses if your app cannot show the prompt.

  Try: “Delete the network returning-test-03 in project stackql-demo.”

  Delete · run_mutation_query

• Runs an EXEC action such as starting an instance

  Executes a StackQL EXEC statement, for example starting a virtual machine. It follows the same approval rules as changes.

  Try: “Start the instance demo in us-central1-a.”

  Write · run_lifecycle_operation

• Lists providers and versions in the registry

  Returns the providers and versions available to install, or the versions of one provider.

  Try: “Which versions of the aws provider can I pull?”

  Network · list_registry

• Installs a provider into the local cache

  Downloads a provider from the registry into the local StackQL folder. It writes only to that local cache.

  Try: “Pull the github provider.”

  Write · pull_provider

• Reloads credentials from the env file

  Reads the credentials file again, clears cached sign-ins and reports which providers now resolve. It never returns secret values.

  Try: “Reload my credentials and tell me which providers work.”

  Files · reload_credentials

• Searches a library of ready-made queries

  Finds curated example queries from a plain-language intent, optionally filtered by provider, service or tag.

  Try: “Find a query that lists public storage buckets.”

  Read · query_library_search

• Gets one library query, filled in with your values

  Returns a library entry and, given parameters, the SQL to run and the tool to run it with.

  Try: “Get the library query for open security groups.”

  Read · query_library_get

• Shows server version, mode and settings

  Returns the StackQL version, backing engine, registry location, mode and read-only flag. The docs say to call it once at session start.

  Try: “What mode is the StackQL server in?”

  Read · server_info

Watch out for

• It can change and delete cloud resources

  run_mutation_query and run_lifecycle_operation can create, update and delete resources and run EXEC actions with your credentials. The default safe mode asks you to approve each one, but only in apps that can show that prompt. github.com

• It acts with your cloud permissions

  The server uses whatever access the credentials you provide have. Use credentials that are limited to what you want it to reach. github.com

• Approval depends on the app being honest

  The docs say safe mode trusts the client to show the prompt to a person and report the answer faithfully. A client that approves its own prompt defeats it. github.com

• full_access mode removes approvals

  This opt-in mode runs every change and EXEC with no prompt. The docs say to use it only when the client and operator are trusted. It is not the default. github.com

• First run downloads a binary

  The npm launcher downloads the StackQL binary from the project's GitHub release and checks its SHA-256 against values built into the package. It caches it under ~/.stackql/mcp-server-bin. registry.npmjs.org

• The launcher turns the audit log off

  The npm launcher passes a setting that disables the audit file the server writes by default, so there is no record of what the agent ran. Turn it back on in the config if you want one. registry.npmjs.org

Security advisories