GoSQLX

io.github.ajitpratap0由 GitHub 账号 ajitpratap0 发布v1.17.0更新于 Oct 31, 2026

SQL validation, formatting, parsing, metadata extraction, linting, and security analysis.

已验证Streamable HTTP可网页运行数据库开发者工具安全与监控

概览

AI 生成的概览

远程 MCP 服务器,让助手在不连接数据库的情况下校验、格式化、解析、检查风格并扫描 SQL 注入风险,支持八种方言。

可以做什么
  • 校验 SQL 语法,可指定 postgresql、mysql、snowflake 等方言
  • 将 SQL 格式化为每行一个子句,可设置关键字大小写、缩进宽度和结尾分号
  • 解析 SQL 并返回语句数量与各语句类型的 AST 摘要
  • 提取查询引用的表、列和函数
  • 按风格规则检查 SQL,涵盖空白、缩进、行长、对齐、关键字大小写和逗号位置
  • 扫描 SQL 中的注入模式,如恒真式、UNION 攻击和堆叠查询,并给出严重级别统计
适用场景
适合让助手审查、整理或快速核对粘贴进来的 SQL,而无需授予数据库访问权限。可用于代码评审、查询格式化、方言检查和初步的注入模式筛查。
运行要求
需要一个远程 Streamable HTTP 端点;未声明任何软件包、账号、API 密钥或环境变量。客户端需支持 HTTP 传输,交互式报告视图需要支持 MCP Apps 的宿主。
安装前请注意
服务器声明其工具为只读、确定性执行,且从不连接数据库或执行 SQL,因此无法真正运行查询或对真实数据做验证。提交的 SQL 文本会发送到第三方托管端点,请勿粘贴含密钥或敏感字面量的查询。

安装

在 SourceWeft 中

  1. 打开 控制台中的 GoSQLX,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.ajitpratap0%2Fgosqlx/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "gosqlx": {
      "type": "http",
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

README

[GoSQLX: a gopher mascot with a magnifying glass, a database and a rising arrow]

GoSQLX

Pure-Go SQL parser, formatter, linter and security scanner for 8 dialects.

[CI] [Go Reference] [Release] [License] [OpenSSF Scorecard]

Playground  ·  Docs  ·  Benchmarks  ·  VS Code  ·  MCP server


~2.8M parses/sec†363 ns parse latency†~80–85% SQL-99 (est.)8 dialects0 race conditions

† Parse stage only (pre-tokenized input to AST), SELECT id, name FROM users, Apple M4, Go 1.27, median of 20 runs of BenchmarkPerformanceBaseline. Complex queries take longer (see performance_baselines.json). Reproduce: go test -run ^$ -bench BenchmarkPerformanceBaseline -benchmem -count=20 ./pkg/sql/parser/.


[Terminal demo: gosqlx validate, format and lint on one query, then the WASM playground]

What is GoSQLX?

GoSQLX is a production-ready SQL parsing SDK for Go. It tokenizes, parses, and generates ASTs from SQL with zero-copy optimizations and intelligent object pooling - parsing a simple SELECT in about 363 ns (~2.8M parses/sec).

Why GoSQLX?

  • Not an ORM - a parser. You get the AST, you decide what to do with it.
  • Not slow - zero-copy tokenization, sync.Pool recycling, no allocations on hot paths.
  • Not limited - PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. CTEs, window functions, MERGE, set operations.
  • Not just a library - CLI, VS Code extension, GitHub Action, MCP server, WASM playground, Python bindings.

Install

Go library

bash
go get github.com/ajitpratap0/GoSQLX

CLI

bash
go install github.com/ajitpratap0/GoSQLX/cmd/gosqlx@latest

VS Code

bash
code --install-extension ajitpratap0.gosqlx

The extension bundles the binary, so there is no extra setup. Learn more.

MCP server

bash
claude mcp add --transport http gosqlx https://mcp.gosqlx.dev/mcp

7 SQL tools in Claude, Cursor, or any MCP client. MCP guide.

Claude Code plugin (skills, slash commands, SQL reviewer agent): /plugin marketplace add ajitpratap0/GoSQLX then /plugin install gosqlx@gosqlx - details.

ChatGPT app: add https://mcp.gosqlx.dev/mcp as a connector in developer mode for an interactive analysis widget - details.

[MCP] [Glama MCP Server]

GitHub Action

yaml
- uses: ajitpratap0/GoSQLX@v1  with:    files: '**/*.sql'    validate: true

Quick start

Source: examples/readme_quickstart/main.go, compiled in CI against HEAD and the latest release.

go
package main
import (	"context"	"errors"	"fmt"	"log"
	"github.com/ajitpratap0/GoSQLX/pkg/gosqlx"	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast")
func main() {	ctx := context.Background()
	// ParseTree is the recommended entry point. It returns an	// opaque handle with built-in helpers.	tree, err := gosqlx.ParseTree(ctx, "SELECT id, name FROM users WHERE active = true",		gosqlx.WithDialect("postgresql"))	if err != nil {		// Sentinel errors work with errors.Is		if errors.Is(err, gosqlx.ErrSyntax) {			log.Fatalf("syntax error: %v", err)		}		log.Fatal(err)	}	fmt.Println("Tables:", tree.Tables())	fmt.Println(tree.Format(gosqlx.WithIndent(2), gosqlx.WithUppercaseKeywords(true)))
	// Walk the AST - typed walkers avoid the type-assertion dance:	tree.WalkSelects(func(s *ast.SelectStatement) bool {		fmt.Printf("  SELECT with %d columns\n", len(s.Columns))		return true	})
	// The legacy Parse/Format/Validate API still works for v1.x code.	// See docs/MIGRATION.md for the Tree migration guide.}

Output:

text
Tables: [users]SELECT id, nameFROM usersWHERE active = true  SELECT with 2 columns

Formatting turns one-line SQL into a readable query:

[Before: one-line lowercase SQL. After gosqlx format: SELECT, FROM, INNER JOIN, WHERE, GROUP BY, HAVING, ORDER BY and LIMIT each on their own line]

Features

[Architecture: SQL bytes go through the tokenizer to TokenWithSpan, the parser builds an AST, and the formatter, linter, security scanner, transpiler and fingerprinter consume it]
  • Parser - zero-copy tokenizer, recursive descent parser and full AST generation.
  • Analysis - SQL injection scanner, 30 lint rules (L001-L030), 20 optimizer rules and metadata extraction.
  • Tooling - AST-based formatter, query transforms API, VS Code extension and GitHub Action.
  • Syntax highlighting - dialect-aware highlighting for terminals (ANSI), HTML/CSS, JSON spans, LSP semantic tokens and WASM; gosqlx highlight query.sql or gosqlx.HighlightANSI(sql).
  • Multi-dialect - 8 dialects with dedicated grammar support: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. The --dialect flag and WithDialect accept 11 names: those 8 (postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, clickhouse) plus generic, bigquery and redshift. BigQuery and Redshift have no dialect-specific keyword set (they use the generic keywords) and only capability-gated grammar, such as BigQuery's QUALIFY, PIVOT/UNPIVOT, UNNEST in FROM and (struct).field access.
  • AI-ready - MCP server with 7 tools, public remote endpoint, Streamable HTTP.
  • Tested - race-detector clean in CI, ~80-85% SQL-99 (estimated).

Documentation


Contributing

GoSQLX is built by contributors like you. Whether it's a bug fix, new feature, documentation improvement, or just a typo - every contribution matters.

bash
git clone https://github.com/ajitpratap0/GoSQLX.git && cd GoSQLXtask check    # fmt → vet → lint → test (with race detection)
  1. Fork & branch from main
  2. Write tests - we use TDD and require race-free code
  3. Run task check - must pass before PR
  4. Open a PR - we review within 24 hours

Contributing Guide · Code of Conduct · Governance


Community

Questions or ideas: Discussions. Found a bug or want a feature: Issues.


License

Apache License 2.0 - see LICENSE for details.


来源:README.md,提交 271e15e

工具

7

analyze_sql

Analyze SQL

Use this when the user wants a complete review of a SQL query. Runs validate, parse, metadata, security, lint, and format concurrently and returns one composite report; hosts that support MCP Apps render it as an interactive report.

输入参数sql必填

extract_metadata

Extract SQL metadata

Use this when the user wants the tables, columns, and functions a SQL query references (e.g. for lineage or impact analysis). Returns {tables, columns, functions}.

输入参数sql必填

format_sql

Format SQL

Use this when the user wants SQL pretty-printed or reformatted: one clause per line, optional upper-case keywords and trailing semicolon. Comments are preserved; unplaceable optimizer hints are refused. Returns {formatted_sql, options}.

输入参数sql必填indent_sizeadd_semicolonuppercase_keywords

lint_sql

Lint SQL

Use this when the user wants SQL style feedback. Applies the same 10 rules as `gosqlx lint`: L001 trailing whitespace, L002 mixed indentation, L003 consecutive blank lines, L004 indentation depth, L005 line length (>100), L006 column alignment, L007 keyword case (upper), L008 comma placement (trailing), L009 aliasing consistency, L010 redundant whitespace. Returns {violation_count, violations}.

输入参数sql必填

parse_sql

Parse SQL

Use this when the user wants to know how SQL parses: returns an AST summary with the statement count and the type of each statement, optionally for a specific dialect. GO batch separators are excluded from the count.

输入参数sql必填dialect

security_scan

Scan SQL for injection

Use this when the user wants SQL checked for injection patterns: tautologies, UNION attacks, stacked queries, comment bypasses, and more. Returns findings with severity counts.

输入参数sql必填

validate_sql

Validate SQL

Use this when the user wants to know whether a SQL statement is syntactically valid, optionally for a specific dialect. Returns {valid: bool, error?: string, dialect?: string}.

输入参数sql必填dialect

版本历史

2
  1. v1.17.0最新Oct 31, 2026
  2. v1.16.0Oct 22, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分