Overview
How do you use an MCP server to access your existing Oracle databases when you cannot trust any model to be 100% sane 100% of the time? You could grant read only access, but that severely limits what you do with your MCP server. And it will not solve the core, fundamental problem that has existed for three decades: It is almost unheard of for a real world, production database to be so clean, so well maintained and so perfectly correct that you can simply point AI at it and have it produce correct answers by reading table names, column names and foreign key names and then miraculously understanding your schema. So if a SQL prompt, read only or otherwise, is not the answer, then what is? Instead of handling blanket access out provide three things: 1. Tools that allow you to call select PL/SQL procedures and functions. A lot of corporate business logic is encoded in PL/SQL, and if you could selectively expose it as an MCP server making changes to the database is no longer terrifying, as you can add all the sanity checking logic you need. 2. Tools that allow you to access tables by known and safe paths, such as PK, UKs, Foreign Keys and some indexed columns. In some cases it may be OK to insert, update or delete, but that is something you would need granular control over. 3. SQL statements. In real world environments a lot of important business functions are encoded and implemented as SQL statements. Some statements are complicated. You need a way of access trusted, same statements from your MCP server. Enter MCP DB Wizard. MCP DB Wizard allows you to do all three of these things. It runs in docker, has a web UI, and spawns an MCP server that allows agents to access Oracle, but only to the exact extent you permit.
Highlights
- Controlled MCP access to Oracle - if you don't permit it, it can't be done. The agent doesn't know where the Oracle database is, never mind how to log into it.
- Built in logging and auditing - Nothing happens without a paper trail. Zero Hassle operations - Runs in docker.
- Zero charge for one server.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Vendor refund policy
This product is offered at no charge through AWS Marketplace, so no refunds apply. Premium feature licences are purchased separately from ATB Consultancy Services and are governed by the terms of that purchase. For questions about this listing, contact mcpsupport@mcpdbwizard.com
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
MCPDBWizard on Amazon ECS or EKS
- Amazon ECS
- Amazon EKS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
2.0.28
A TIMESTAMP column inside a PL/SQL ref cursor came back to the client as Oracle's internal 11-byte form, base64-encoded, instead of a time. Any routine whose OUT or returned cursor selected a TIMESTAMP was affected. The same column read through that table's own tools was correct, so one configuration answered two ways for one column depending on which tool was called, and only the cursor answer was wrong. DATE columns were unaffected, which is why it went unnoticed.
Cursors now return the same text the table tools return, so both surfaces agree and a timestamp read from a cursor can be passed straight back to an index-lookup tool.
WHAT YOU HAVE TO DO: regenerate any configuration whose routines return a ref cursor. The fix is in generated code, so an existing generated server keeps the old behaviour until it is regenerated. No database, configuration or client change is needed.
Still not converted: TIMESTAMP WITH TIME ZONE and TIMESTAMP WITH LOCAL TIME ZONE inside a ref cursor. Rendering either needs a database connection the generated helper does not have, so it was not changed without a way to test it. Plain TIMESTAMP, the common case, is fixed.
Verified against Oracle 12.1, 18c, 19c, 21c and two 26ai instances.
Additional details
Usage instructions
- Create an ECS cluster or EKS cluster in a VPC that can reach your Oracle database.
- Deploy the CloudFormation template supplied with this listing, setting ImageSource to Marketplace. It creates one EC2-backed ECS service running a single task.
- Supply OracleHost, OraclePort, OracleSid and OracleUser as parameters, and put the database password in AWS Secrets Manager, passing its ARN as DbPasswordSecretArn. The password is never a stack parameter.
- Reach the console on port 8080 of the instance, restricted to AllowedCidr. THERE IS NO DEFAULT PASSWORD: the container generates one for this deployment and writes it to /data/initial-admin-password, and the sign-in page names that path. Read it from the running task using AWS Systems Manager Session Manager to the instance, then 'docker exec <container> cat /data/initial-admin-password', sign in as AdminUsername, and choose your own password - you are required to before the console will do anything else.
- In the console, point a configuration at your schema, choose the tables, PL/SQL routines and SQL statements you want exposed, and start the server.
- MCP clients connect through /mcp/<owner>/<config> with a bearer token issued on the Users page. A configuration is named owner/config - you type the name, and the owner is the account you saved it under. The Runtime page shows each running server's full URL.
The container needs no inbound access other than 8080, and holds its state on the /data volume. See the deployment guide for TLS, auditing and the access matrix.
Support
Vendor support
For support contact mcpsupport@mcpdbwizard.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.