SQL Injection MCP Server
Allows routing scan traffic through Burp Suite to integrate with existing web security testing workflows and proxy analysis.
Provides specialized testing and detection for SQL injection vulnerabilities in MySQL database systems.
Provides specialized testing and detection for SQL injection vulnerabilities in PostgreSQL database systems.
Provides specialized testing and detection for SQL injection vulnerabilities in SQLite database systems.
Utilizes Unicode encoding as a bypass technique to circumvent Web Application Firewalls (WAF) during security testing.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@SQL Injection MCP Serverscan http://testsite.com/products.php?id=10 for SQL injection vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
SQL Injection MCP Server
A Model Context Protocol (MCP) server for discovering SQL injection vulnerabilities in web applications.
Features
Multiple Injection Types: Error-based, Time-based, Boolean-based, Union-based, Blind SQL injection
Database Support: MySQL, MSSQL, PostgreSQL, Oracle, SQLite
HTTP Methods: GET and POST parameter testing
Authentication: Custom headers, cookies, Bearer tokens
Proxy Support: Route traffic through Burp Suite or other proxies
WAF Bypass: URL encoding, Hex encoding, Unicode, Case swapping, Comment injection
Custom Payloads: Load payloads from external files
Related MCP server: operant-mcp
Installation
# Using uv (recommended)
cd SQLinjector_MCP
uv sync
# Using pip
pip install -e .Usage
Running the Server
# Using uv
uv run sqli-mcp
# Or directly
python -m sqli_mcp.serverMCP Client Configuration
Claude Desktop / Claude Code
Add to your MCP configuration:
{
"mcpServers": {
"sqli-scanner": {
"command": "uv",
"args": ["--directory", "C:/path/to/SQLinjector_MCP", "run", "sqli-mcp"]
}
}
}LM Studio / Cursor
Configure the server URL after starting with HTTP transport:
uv run python -c "from sqli_mcp.server import mcp; mcp.run(transport='streamable-http')"Then connect to http://localhost:8000/mcp
Available Tools
Tool | Description |
| Full URL scan for SQLi in all detected parameters |
| Test specific GET parameter |
| Test specific POST parameter |
| Test a single payload against a target |
| List available built-in payloads |
| Load payloads from external file |
| Get WAF bypass variants of a payload |
| Retrieve previous scan results |
Bulk Scanning | |
| Scan multiple URLs (newline-separated, up to 500) |
| Scan URLs from a file (one per line) |
| Retrieve batch scan results |
| Get only vulnerable URLs from batch |
Examples
Basic GET Parameter Scan
Use scan_url with:
- target_url: "http://vulnerable-site.com/page?id=1"Authenticated POST Scan
Use scan_post_parameter with:
- target_url: "http://site.com/login"
- post_data: "username=admin&password=test"
- parameter: "username"
- cookies: "session=abc123"
- bearer_token: "your-jwt-token"Using Burp Suite Proxy
Use scan_url with:
- target_url: "http://target.com/page?id=1"
- proxy_url: "http://127.0.0.1:8080"
- verify_ssl: falseWAF Bypass
Use scan_url with:
- target_url: "http://target.com/page?id=1"
- waf_bypass: "comment_injection"Bulk URL Scanning
Scan multiple URLs from a list:
Use scan_urls_batch with:
- urls: "http://site1.com/page?id=1
http://site2.com/search?q=test
http://site3.com/user?uid=5"
- concurrency: 10
- waf_bypass: "url_encode"Scan URLs from a file:
Use scan_urls_from_file with:
- file_path: "C:/path/to/urls.txt"
- concurrency: 5
- proxy_url: "http://127.0.0.1:8080"Get vulnerable URLs only:
Use get_vulnerable_urls with:
- batch_id: "abc12345"Custom Payloads
Create a text file with one payload per line:
# my_payloads.txt
' OR '1'='1
" OR "1"="1
' UNION SELECT NULL--Then load with:
Use load_custom_payloads_from_file with:
- file_path: "C:/path/to/my_payloads.txt"
- injection_type: "union_based"
- name: "my_custom"Security Notice
⚠️ This tool is intended for authorized security testing only. Always obtain proper authorization before testing any system for vulnerabilities. Unauthorized access to computer systems is illegal.
License
MIT
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- Flicense-qualityDmaintenanceA comprehensive MCP server for automated bug bounty hunting and security reconnaissance, featuring over 28 specialized tools for subdomain discovery, vulnerability scanning, and traffic analysis. It integrates automated scope validation and professional reporting across multiple platforms like HackerOne and Bugcrowd to streamline security testing.Last updated5

operant-mcpofficial
AlicenseAqualityDmaintenanceA comprehensive security testing MCP server providing 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. It enables automated security audits and technical investigations across web applications, cloud environments, and network captures.Last updated516121MIT- Alicense-qualityCmaintenanceA security pentesting MCP server with 89 tools across 10 categories, enabling comprehensive reconnaissance, web security, OSINT, and exploitation tasks. It features a native Windows/WSL bridge for Kali Linux tools and scope-aware permission tiers for safe and efficient scanning.Last updated3MIT
- Flicense-qualityDmaintenanceA secure multi-database MCP server supporting MySQL, PostgreSQL, and SQLite with read-only enforcement, SQL injection prevention, and tools for schema analysis, performance optimization, and visualization.Last updated4
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vivashu27/SQLinjector_MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server