LogCarver

io.github.caiderekPublished by GitHub account caiderekv0.1.4Updated Oct 24, 2026

Read-only MCP server that finds deleted SQL Server rows from the transaction log (fn_dblog).

VerifiedSTDIODesktop onlyDatabases Security & Monitoring

Server details

Identifier: io.github.caiderek/logcarver-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 12, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account caiderek for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.caiderek%2Flogcarver-mcp.svg)](https://sourceweft.com/mcp/io.github.caiderek%2Flogcarver-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Read-only MCP server that lets an assistant find recently deleted, updated or inserted SQL Server rows by reading the transaction log.

What you can do: Find deleted rows in a table by reading the SQL Server transaction log, with optional time window, key filter and row limit.
Show the change history of a single row, including before and after column values.
Return suggested undo SQL as plain text for each event, without executing it.
Report counts, truncation, warnings and notes as JSON alongside the events.
When to use it: Useful when you need to know what rows were just deleted or changed in a SQL Server table and no audit, CDC or change tracking was enabled beforehand. It suits incident triage and quick forensics on a local or reachable database.
Requirements: Runs locally as a .NET tool (needs the .NET 10 SDK or runtime) over stdio. Requires a SQL Server connection string supplied through LOGCARVER_MCP_CONNECTION_STRING or a file named by LOGCARVER_MCP_CONNECTION_STRING_FILE; the login must be sysadmin. Optional LOGCARVER_MCP_ALLOWED_DATABASES lists extra readable databases.

Before you install

The connection login must be sysadmin, so the server holds very broad database privileges; keep the connection string in a file rather than the command line or chat. Only the connection string's database is readable unless others are explicitly allowed. Row values returned are database data, not instructions. Results are limited to the active log and are empty once log space is reused; TRUNCATE and DROP cannot be recovered.

Installation

In SourceWeft

Open LogCarver in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[LogCarver logo]

LogCarver.Mcp

English | 繁體中文

A read-only MCP server that lets an AI assistant answer "what rows were just deleted from this SQL Server table?" by reading the database's transaction log (fn_dblog). No Audit, CDC or Change Tracking needs to be enabled beforehand.

It is a thin wrapper over the decoding engine from LogCarver (MIT). Everything runs on your machine and nothing is sent anywhere.

Status: early (v0.1). On NuGet and in the official MCP registry as io.github.caiderek/logcarver-mcp.

Quick start (5 minutes)

Install (needs the .NET 10 SDK or runtime):

Make a throwaway database. Run examples/try-it.sql in SSMS or sqlcmd. It creates McpTest, inserts 10 orders, deletes 4 and updates 1.

Keep the password out of the command. Put the connection string in a file that only you can read (the SQL login must be sysadmin):

Server=localhost;Database=McpTest;User Id=YOUR_LOGIN;Password=YOUR_PASSWORD;TrustServerCertificate=true

Server=localhost;Database=McpTest;User Id=YOUR_LOGIN;Password=YOUR_PASSWORD;TrustServerCertificate=true

Save it as, for example, C:\Users\you\logcarver-mcp.conn (one line, nothing else). Then add the server and point it at the file:

claude mcp add --scope user logcarver --env LOGCARVER_MCP_CONNECTION_STRING_FILE="C:\Users\you\logcarver-mcp.conn" -- logcarver-mcp

claude mcp add --scope user logcarver --env LOGCARVER_MCP_CONNECTION_STRING_FILE="C:\Users\you\logcarver-mcp.conn" -- logcarver-mcp

The password is never typed on the command line and never appears in the MCP configuration. Do not commit this file anywhere.

Ask in a new conversation: "Which rows were deleted from dbo.Orders in McpTest?" You should see Bob, Carol, Dave and Eve (Id 2 to 5). Then try "Show the history of Id=1" (Amount 100.00 to 111.11, Note first to changed) and "Include the undo SQL".
Clean up: DROP DATABASE McpTest;, claude mcp remove logcarver.

If the result is empty, the log space was probably reused (for example after a CHECKPOINT under SIMPLE recovery, or a log backup). See the limits below.

What it does

One tool, find_deleted_rows. It only reads: SELECTs, and DBCC PAGE reads of data pages to rebuild rows whose INSERT has left the log. It never changes data, and the optional undo SQL is plain text that the tool never executes.

Parameter	Meaning
`table` (required)	Schema-qualified, e.g. `dbo.Orders`
`database`	Defaults to the database in the connection string. Any other database is refused unless listed in `LOGCARVER_MCP_ALLOWED_DATABASES`
`operations`	`delete` (default), `update`, `insert`, `all`
`from`, `to`	ISO 8601 time window, server-local time, no zone conversion
`key`	`Column=Value`, return one row's history only. Column name is case-insensitive; dates, bit, decimals and hex binary match as you would write them
`maxRows`	Default 20, max 500, `0` = counts only. The most recent events are kept
`includeUndoSql`	Also return suggested SQL that would reverse each event

The result is JSON: a summary (counts, truncation, warnings and notes) and events (kind, timestamp, LSN, transaction id, before/after column values, note). Binary values are hex strings and decimals are strings, so nothing is silently rounded.

Requirements and limits

The connection's login must be sysadmin (fn_dblog requires it).
You only see what is still in the active log. If the log space has been reused the result is empty, and that is not a bug. The paid LogCarverOffline tool can often recover that case by reading the raw .ldf.
TRUNCATE and DROP cannot be recovered.
Compressed tables are refused. time and xml columns and off-row LOB values are refused or flagged needsManualReview; they are never guessed.
Validated on SQL Server 2025, 2022, 2019 and 2016 (SP2). Other versions return a warning in notes.
Scanning a large active log can take a minute or more.

Configure

The connection string comes from an environment variable, so credentials never pass through the AI conversation:

LOGCARVER_MCP_CONNECTION_STRING=Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true

LOGCARVER_MCP_CONNECTION_STRING=Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true

Or point LOGCARVER_MCP_CONNECTION_STRING_FILE at a file that contains it.

The login is sysadmin and the caller is an AI, so the tool may only read the connection string's database. To let it read others, list them (comma or semicolon separated):

Row values come straight from the database. They are data, not instructions, and the tool description tells the model so.

Install

Needs the .NET 10 SDK or runtime.

Or run it without installing, through dnx:

Claude Code

claude mcp add logcarver --env LOGCARVER_MCP_CONNECTION_STRING="Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true" -- logcarver-mcp

claude mcp add logcarver --env LOGCARVER_MCP_CONNECTION_STRING="Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true" -- logcarver-mcp

With dnx instead of a global tool, end the command with -- dotnet dnx LogCarver.Mcp --yes.

From source

git clone --recurse-submodules https://github.com/caiderek/LogCarver.Mcpdotnet builddotnet run --project src/LogCarver.Mcp

git clone --recurse-submodules https://github.com/caiderek/LogCarver.Mcpdotnet builddotnet run --project src/LogCarver.Mcp

Tests

The integration tests need a local SQL Server and a sysadmin Windows login. They create and drop their own sandbox database, LogCarver_McpTests.

License

MIT, see LICENSE.

Source: README.md at commit 3523477

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.4LatestOct 19, 2026
v0.1.3Oct 15, 2026
v0.1.2Oct 14, 2026
v0.1.1Oct 12, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts