GoSQLX

io.github.ajitpratap0Published by GitHub account ajitpratap0v1.17.0Updated Oct 31, 2026

SQL validation, formatting, parsing, metadata extraction, linting, and security analysis.

VerifiedStreamable HTTPWeb executableDatabasesDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that lets an assistant validate, format, parse, lint and security-scan SQL text across eight dialects without touching a database.

What you can do
  • Validate SQL syntax, optionally for a named dialect such as postgresql, mysql or snowflake
  • Format SQL into one clause per line with options for keyword case, indent size and trailing semicolon
  • Parse SQL into an AST summary with statement count and statement types
  • Extract the tables, columns and functions a query references
  • Lint SQL against style rules covering whitespace, indentation, line length, alignment, keyword case and comma placement
  • Scan SQL for injection patterns such as tautologies, UNION attacks and stacked queries, with severity counts
When to use it
Useful when you want an assistant to review, clean up or sanity-check SQL you paste in, without giving it database access. Handy for code review, query formatting, dialect checks and quick injection-pattern screening.
Requirements
A remote Streamable HTTP endpoint; no package, account, API key or environment variable is declared. The client must support HTTP transport, and the interactive report view needs a host with MCP Apps support.
Before you install
The server states its tools are read-only, deterministic and never connect to a database or execute SQL, so it cannot run or verify queries against real data. SQL text you submit is sent to a third-party hosted endpoint, so avoid pasting queries containing secrets or sensitive literals.

Installation

In SourceWeft

  1. Open GoSQLX in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ajitpratap0%2Fgosqlx/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "gosqlx": {
      "type": "http",
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

README

[GoSQLX: a gopher mascot with a magnifying glass, a database and a rising arrow]

GoSQLX

Pure-Go SQL parser, formatter, linter and security scanner for 8 dialects.

[CI] [Go Reference] [Release] [License] [OpenSSF Scorecard]

Playground  ·  Docs  ·  Benchmarks  ·  VS Code  ·  MCP server


~2.8M parses/sec†363 ns parse latency†~80–85% SQL-99 (est.)8 dialects0 race conditions

† Parse stage only (pre-tokenized input to AST), SELECT id, name FROM users, Apple M4, Go 1.27, median of 20 runs of BenchmarkPerformanceBaseline. Complex queries take longer (see performance_baselines.json). Reproduce: go test -run ^$ -bench BenchmarkPerformanceBaseline -benchmem -count=20 ./pkg/sql/parser/.


[Terminal demo: gosqlx validate, format and lint on one query, then the WASM playground]

What is GoSQLX?

GoSQLX is a production-ready SQL parsing SDK for Go. It tokenizes, parses, and generates ASTs from SQL with zero-copy optimizations and intelligent object pooling - parsing a simple SELECT in about 363 ns (~2.8M parses/sec).

Why GoSQLX?

  • Not an ORM - a parser. You get the AST, you decide what to do with it.
  • Not slow - zero-copy tokenization, sync.Pool recycling, no allocations on hot paths.
  • Not limited - PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. CTEs, window functions, MERGE, set operations.
  • Not just a library - CLI, VS Code extension, GitHub Action, MCP server, WASM playground, Python bindings.

Install

Go library

bash
go get github.com/ajitpratap0/GoSQLX

CLI

bash
go install github.com/ajitpratap0/GoSQLX/cmd/gosqlx@latest

VS Code

bash
code --install-extension ajitpratap0.gosqlx

The extension bundles the binary, so there is no extra setup. Learn more.

MCP server

bash
claude mcp add --transport http gosqlx https://mcp.gosqlx.dev/mcp

7 SQL tools in Claude, Cursor, or any MCP client. MCP guide.

Claude Code plugin (skills, slash commands, SQL reviewer agent): /plugin marketplace add ajitpratap0/GoSQLX then /plugin install gosqlx@gosqlx - details.

ChatGPT app: add https://mcp.gosqlx.dev/mcp as a connector in developer mode for an interactive analysis widget - details.

[MCP] [Glama MCP Server]

GitHub Action

yaml
- uses: ajitpratap0/GoSQLX@v1  with:    files: '**/*.sql'    validate: true

Quick start

Source: examples/readme_quickstart/main.go, compiled in CI against HEAD and the latest release.

go
package main
import (	"context"	"errors"	"fmt"	"log"
	"github.com/ajitpratap0/GoSQLX/pkg/gosqlx"	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast")
func main() {	ctx := context.Background()
	// ParseTree is the recommended entry point. It returns an	// opaque handle with built-in helpers.	tree, err := gosqlx.ParseTree(ctx, "SELECT id, name FROM users WHERE active = true",		gosqlx.WithDialect("postgresql"))	if err != nil {		// Sentinel errors work with errors.Is		if errors.Is(err, gosqlx.ErrSyntax) {			log.Fatalf("syntax error: %v", err)		}		log.Fatal(err)	}	fmt.Println("Tables:", tree.Tables())	fmt.Println(tree.Format(gosqlx.WithIndent(2), gosqlx.WithUppercaseKeywords(true)))
	// Walk the AST - typed walkers avoid the type-assertion dance:	tree.WalkSelects(func(s *ast.SelectStatement) bool {		fmt.Printf("  SELECT with %d columns\n", len(s.Columns))		return true	})
	// The legacy Parse/Format/Validate API still works for v1.x code.	// See docs/MIGRATION.md for the Tree migration guide.}

Output:

text
Tables: [users]SELECT id, nameFROM usersWHERE active = true  SELECT with 2 columns

Formatting turns one-line SQL into a readable query:

[Before: one-line lowercase SQL. After gosqlx format: SELECT, FROM, INNER JOIN, WHERE, GROUP BY, HAVING, ORDER BY and LIMIT each on their own line]

Features

[Architecture: SQL bytes go through the tokenizer to TokenWithSpan, the parser builds an AST, and the formatter, linter, security scanner, transpiler and fingerprinter consume it]
  • Parser - zero-copy tokenizer, recursive descent parser and full AST generation.
  • Analysis - SQL injection scanner, 30 lint rules (L001-L030), 20 optimizer rules and metadata extraction.
  • Tooling - AST-based formatter, query transforms API, VS Code extension and GitHub Action.
  • Syntax highlighting - dialect-aware highlighting for terminals (ANSI), HTML/CSS, JSON spans, LSP semantic tokens and WASM; gosqlx highlight query.sql or gosqlx.HighlightANSI(sql).
  • Multi-dialect - 8 dialects with dedicated grammar support: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. The --dialect flag and WithDialect accept 11 names: those 8 (postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, clickhouse) plus generic, bigquery and redshift. BigQuery and Redshift have no dialect-specific keyword set (they use the generic keywords) and only capability-gated grammar, such as BigQuery's QUALIFY, PIVOT/UNPIVOT, UNNEST in FROM and (struct).field access.
  • AI-ready - MCP server with 7 tools, public remote endpoint, Streamable HTTP.
  • Tested - race-detector clean in CI, ~80-85% SQL-99 (estimated).

Documentation


Contributing

GoSQLX is built by contributors like you. Whether it's a bug fix, new feature, documentation improvement, or just a typo - every contribution matters.

bash
git clone https://github.com/ajitpratap0/GoSQLX.git && cd GoSQLXtask check    # fmt → vet → lint → test (with race detection)
  1. Fork & branch from main
  2. Write tests - we use TDD and require race-free code
  3. Run task check - must pass before PR
  4. Open a PR - we review within 24 hours

Contributing Guide · Code of Conduct · Governance


Community

Questions or ideas: Discussions. Found a bug or want a feature: Issues.


License

Apache License 2.0 - see LICENSE for details.


Source: README.md at commit 271e15e

Tools

7

analyze_sql

Analyze SQL

Use this when the user wants a complete review of a SQL query. Runs validate, parse, metadata, security, lint, and format concurrently and returns one composite report; hosts that support MCP Apps render it as an interactive report.

Parameterssqlrequired

extract_metadata

Extract SQL metadata

Use this when the user wants the tables, columns, and functions a SQL query references (e.g. for lineage or impact analysis). Returns {tables, columns, functions}.

Parameterssqlrequired

format_sql

Format SQL

Use this when the user wants SQL pretty-printed or reformatted: one clause per line, optional upper-case keywords and trailing semicolon. Comments are preserved; unplaceable optimizer hints are refused. Returns {formatted_sql, options}.

Parameterssqlrequiredindent_sizeadd_semicolonuppercase_keywords

lint_sql

Lint SQL

Use this when the user wants SQL style feedback. Applies the same 10 rules as `gosqlx lint`: L001 trailing whitespace, L002 mixed indentation, L003 consecutive blank lines, L004 indentation depth, L005 line length (>100), L006 column alignment, L007 keyword case (upper), L008 comma placement (trailing), L009 aliasing consistency, L010 redundant whitespace. Returns {violation_count, violations}.

Parameterssqlrequired

parse_sql

Parse SQL

Use this when the user wants to know how SQL parses: returns an AST summary with the statement count and the type of each statement, optionally for a specific dialect. GO batch separators are excluded from the count.

Parameterssqlrequireddialect

security_scan

Scan SQL for injection

Use this when the user wants SQL checked for injection patterns: tautologies, UNION attacks, stacked queries, comment bypasses, and more. Returns findings with severity counts.

Parameterssqlrequired

validate_sql

Validate SQL

Use this when the user wants to know whether a SQL statement is syntactically valid, optionally for a specific dialect. Returns {valid: bool, error?: string, dialect?: string}.

Parameterssqlrequireddialect

Version history

2
  1. v1.17.0LatestOct 31, 2026
  2. v1.16.0Oct 22, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts