To let Claude Code and Cursor query a database more safely, connect each client to a reviewed MCP server and give that server a dedicated database identity with only the read permissions it needs. If the server offers a read-only mode, enable it too. These are separate controls: a client showing that an MCP server is connected does not prove that the database account cannot write.
How do I let Claude Code and Cursor query my database?
- Choose an MCP server. Confirm that it supports your database engine and the operations you need. Review its source, maintainer and installation instructions; there is no universal database-server command or configuration that works for every implementation.
- Create a restricted database identity. Grant it only the read access required for the intended questions. Use the selected database engine’s current documentation for grant syntax rather than copying commands meant for another engine.
- Enable server-side read-only controls. If the MCP server provides a read-only mode, turn it on as well as restricting the database account. A server setting is an additional safeguard, not a replacement for database permissions.
- Configure each client separately. Add the server using the configuration location and format documented for Cursor or Claude Code. Keep credentials out of checked-in project files; use supported environment-variable references where possible.
- Start or reload the client as its documentation directs. Confirm that the server connects and that the expected tools are visible, then inspect the database account’s grants independently.
- Review exposure and data handling. Check what data and network access the server needs, and review its code and provenance for sensitive use cases. Read-only access can still disclose every record the account is allowed to read.
Where should the MCP configuration go?
Cursor and Claude Code use different configuration locations. A configuration for Claude Desktop chat is not the Claude Code configuration.
As an Amazon Associate I earn from qualifying purchases.
Cursor
Cursor documents project-level MCP configuration in .cursor/mcp.json and user-level configuration in ~/.cursor/mcp.json. It supports local servers launched with a command as well as remote server configurations. Its documented configuration values—including command, arguments, environment, URL and headers—support environment-variable interpolation. For example, a server configuration can refer to a credential supplied in the environment instead of putting its literal value in a project file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Cursor’s example configuration shape is shown below for orientation only. It is not a working database setup: the executable, arguments, connection details and read-only option depend on the particular MCP server.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
{
"mcpServers": {
"database": {
"command": "<server executable>",
"args": ["<server arguments>"],
"env": {
"DATABASE_URL": "${env:DATABASE_URL}"
}
}
}
}Cursor configuration details: Cursor MCP documentation.
Claude Code
Claude Code documents MCP configuration in ~/.claude.json or a project-level .mcp.json. Its CLI can add MCP servers with claude mcp add; the exact arguments depend on the server you selected. Claude Code’s configuration is distinct from Claude Desktop chat’s claude_desktop_config.json, so editing the Desktop file does not configure Claude Code.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Claude Code MCP setup details: Claude Code MCP documentation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How can I check that the connection works?
In a Claude Code session, run /mcp to check whether the configured server is connected and see its available tools. This verifies host discovery and connection, not database permissions, query safety or the provider’s data-handling policy. Check the database grants directly as a separate step. Cursor likewise lets you inspect MCP servers through its MCP settings.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The MCP Python SDK walkthrough demonstrates registering a server with the Claude CLI and checking it from Claude Code: MCP server quickstart.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What makes an MCP database connection safer?
Use two read-only boundaries
Restrict the database identity itself to the minimum read access needed, and enable the MCP server’s read-only mode when available. MongoDB’s MCP security guidance explicitly recommends both a read-only database user and read-only server mode. For another database engine, use its own current permissions documentation and the chosen server’s documented controls.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Database permission boundaries matter even if the server has a read-only switch: if a server option is absent, misunderstood or misconfigured, the database should still reject unauthorized writes. MongoDB guidance: MongoDB MCP Server security.
Recommended Free Tools
Review what the server can reach
An MCP server is a separate component between the client and the database. Its implementation and credentials determine what it can access or do; connecting through an AI client does not itself impose a read-only policy. Cursor cautions that MCP servers may access external services and execute code on the user’s behalf. Verify the server’s provenance, source, data access and network access before supplying credentials, and audit its code for high-impact use cases. Cursor security guidance: Cursor security documentation.
Do not equate local execution with privacy
A server process running locally describes where that process runs; it does not establish what information is sent to an AI service or how that service handles it. The privacy and retention terms depend on the particular client, provider and deployment arrangement. Review the applicable policies rather than assuming that local execution keeps queried data local.
What this setup does—and does not—establish
A visible MCP connection and tool list show that the client can reach a server and discover its tools. They do not prove that credentials are least-privileged, that write attempts will fail, that returned data is appropriate to disclose, or that the client/provider’s data-handling practices meet your requirements. Validate those boundaries independently before connecting sensitive databases.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
