GoSQLX

io.github.ajitpratap0由 GitHub 帳號 ajitpratap0 發布v1.17.0更新於 Oct 31, 2026

SQL validation, formatting, parsing, metadata extraction, linting, and security analysis.

已驗證Streamable HTTP可網頁執行資料庫開發者工具安全與監控

概覽

AI 產生的概覽

遠端 MCP 伺服器,讓助理在不連線資料庫的情況下驗證、格式化、解析、檢查風格並掃描 SQL 注入風險,支援八種方言。

可以做什麼
  • 驗證 SQL 語法,可指定 postgresql、mysql、snowflake 等方言
  • 將 SQL 格式化為每行一個子句,可設定關鍵字大小寫、縮排寬度與結尾分號
  • 解析 SQL 並回傳語句數量與各語句型別的 AST 摘要
  • 擷取查詢引用的資料表、欄位與函式
  • 依風格規則檢查 SQL,涵蓋空白、縮排、行長、對齊、關鍵字大小寫與逗號位置
  • 掃描 SQL 中的注入模式,如恆真式、UNION 攻擊與堆疊查詢,並附嚴重程度統計
適用情境
適合讓助理審查、整理或快速核對貼上的 SQL,而不必授予資料庫存取權限。可用於程式碼審查、查詢格式化、方言檢查與初步的注入模式篩檢。
執行需求
需要遠端 Streamable HTTP 端點;未宣告任何套件、帳號、API 金鑰或環境變數。用戶端須支援 HTTP 傳輸,互動式報告檢視需要支援 MCP Apps 的宿主。
安裝前請注意
伺服器聲明其工具為唯讀、具確定性,且從不連線資料庫或執行 SQL,因此無法真正執行查詢或對真實資料驗證。送出的 SQL 文字會傳到第三方託管端點,請勿貼上含密鑰或敏感字面值的查詢。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 GoSQLX,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.ajitpratap0%2Fgosqlx/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "gosqlx": {
      "type": "http",
      "url": "https://mcp.gosqlx.dev/mcp"
    }
  }
}

README

[GoSQLX: a gopher mascot with a magnifying glass, a database and a rising arrow]

GoSQLX

Pure-Go SQL parser, formatter, linter and security scanner for 8 dialects.

[CI] [Go Reference] [Release] [License] [OpenSSF Scorecard]

Playground  ·  Docs  ·  Benchmarks  ·  VS Code  ·  MCP server


~2.8M parses/sec†363 ns parse latency†~80–85% SQL-99 (est.)8 dialects0 race conditions

† Parse stage only (pre-tokenized input to AST), SELECT id, name FROM users, Apple M4, Go 1.27, median of 20 runs of BenchmarkPerformanceBaseline. Complex queries take longer (see performance_baselines.json). Reproduce: go test -run ^$ -bench BenchmarkPerformanceBaseline -benchmem -count=20 ./pkg/sql/parser/.


[Terminal demo: gosqlx validate, format and lint on one query, then the WASM playground]

What is GoSQLX?

GoSQLX is a production-ready SQL parsing SDK for Go. It tokenizes, parses, and generates ASTs from SQL with zero-copy optimizations and intelligent object pooling - parsing a simple SELECT in about 363 ns (~2.8M parses/sec).

Why GoSQLX?

  • Not an ORM - a parser. You get the AST, you decide what to do with it.
  • Not slow - zero-copy tokenization, sync.Pool recycling, no allocations on hot paths.
  • Not limited - PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. CTEs, window functions, MERGE, set operations.
  • Not just a library - CLI, VS Code extension, GitHub Action, MCP server, WASM playground, Python bindings.

Install

Go library

bash
go get github.com/ajitpratap0/GoSQLX

CLI

bash
go install github.com/ajitpratap0/GoSQLX/cmd/gosqlx@latest

VS Code

bash
code --install-extension ajitpratap0.gosqlx

The extension bundles the binary, so there is no extra setup. Learn more.

MCP server

bash
claude mcp add --transport http gosqlx https://mcp.gosqlx.dev/mcp

7 SQL tools in Claude, Cursor, or any MCP client. MCP guide.

Claude Code plugin (skills, slash commands, SQL reviewer agent): /plugin marketplace add ajitpratap0/GoSQLX then /plugin install gosqlx@gosqlx - details.

ChatGPT app: add https://mcp.gosqlx.dev/mcp as a connector in developer mode for an interactive analysis widget - details.

[MCP] [Glama MCP Server]

GitHub Action

yaml
- uses: ajitpratap0/GoSQLX@v1  with:    files: '**/*.sql'    validate: true

Quick start

Source: examples/readme_quickstart/main.go, compiled in CI against HEAD and the latest release.

go
package main
import (	"context"	"errors"	"fmt"	"log"
	"github.com/ajitpratap0/GoSQLX/pkg/gosqlx"	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast")
func main() {	ctx := context.Background()
	// ParseTree is the recommended entry point. It returns an	// opaque handle with built-in helpers.	tree, err := gosqlx.ParseTree(ctx, "SELECT id, name FROM users WHERE active = true",		gosqlx.WithDialect("postgresql"))	if err != nil {		// Sentinel errors work with errors.Is		if errors.Is(err, gosqlx.ErrSyntax) {			log.Fatalf("syntax error: %v", err)		}		log.Fatal(err)	}	fmt.Println("Tables:", tree.Tables())	fmt.Println(tree.Format(gosqlx.WithIndent(2), gosqlx.WithUppercaseKeywords(true)))
	// Walk the AST - typed walkers avoid the type-assertion dance:	tree.WalkSelects(func(s *ast.SelectStatement) bool {		fmt.Printf("  SELECT with %d columns\n", len(s.Columns))		return true	})
	// The legacy Parse/Format/Validate API still works for v1.x code.	// See docs/MIGRATION.md for the Tree migration guide.}

Output:

text
Tables: [users]SELECT id, nameFROM usersWHERE active = true  SELECT with 2 columns

Formatting turns one-line SQL into a readable query:

[Before: one-line lowercase SQL. After gosqlx format: SELECT, FROM, INNER JOIN, WHERE, GROUP BY, HAVING, ORDER BY and LIMIT each on their own line]

Features

[Architecture: SQL bytes go through the tokenizer to TokenWithSpan, the parser builds an AST, and the formatter, linter, security scanner, transpiler and fingerprinter consume it]
  • Parser - zero-copy tokenizer, recursive descent parser and full AST generation.
  • Analysis - SQL injection scanner, 30 lint rules (L001-L030), 20 optimizer rules and metadata extraction.
  • Tooling - AST-based formatter, query transforms API, VS Code extension and GitHub Action.
  • Syntax highlighting - dialect-aware highlighting for terminals (ANSI), HTML/CSS, JSON spans, LSP semantic tokens and WASM; gosqlx highlight query.sql or gosqlx.HighlightANSI(sql).
  • Multi-dialect - 8 dialects with dedicated grammar support: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, Snowflake, ClickHouse. The --dialect flag and WithDialect accept 11 names: those 8 (postgresql, mysql, mariadb, sqlserver, oracle, sqlite, snowflake, clickhouse) plus generic, bigquery and redshift. BigQuery and Redshift have no dialect-specific keyword set (they use the generic keywords) and only capability-gated grammar, such as BigQuery's QUALIFY, PIVOT/UNPIVOT, UNNEST in FROM and (struct).field access.
  • AI-ready - MCP server with 7 tools, public remote endpoint, Streamable HTTP.
  • Tested - race-detector clean in CI, ~80-85% SQL-99 (estimated).

Documentation


Contributing

GoSQLX is built by contributors like you. Whether it's a bug fix, new feature, documentation improvement, or just a typo - every contribution matters.

bash
git clone https://github.com/ajitpratap0/GoSQLX.git && cd GoSQLXtask check    # fmt → vet → lint → test (with race detection)
  1. Fork & branch from main
  2. Write tests - we use TDD and require race-free code
  3. Run task check - must pass before PR
  4. Open a PR - we review within 24 hours

Contributing Guide · Code of Conduct · Governance


Community

Questions or ideas: Discussions. Found a bug or want a feature: Issues.


License

Apache License 2.0 - see LICENSE for details.


來源:README.md,提交 271e15e

工具

7

analyze_sql

Analyze SQL

Use this when the user wants a complete review of a SQL query. Runs validate, parse, metadata, security, lint, and format concurrently and returns one composite report; hosts that support MCP Apps render it as an interactive report.

輸入參數sql必填

extract_metadata

Extract SQL metadata

Use this when the user wants the tables, columns, and functions a SQL query references (e.g. for lineage or impact analysis). Returns {tables, columns, functions}.

輸入參數sql必填

format_sql

Format SQL

Use this when the user wants SQL pretty-printed or reformatted: one clause per line, optional upper-case keywords and trailing semicolon. Comments are preserved; unplaceable optimizer hints are refused. Returns {formatted_sql, options}.

輸入參數sql必填indent_sizeadd_semicolonuppercase_keywords

lint_sql

Lint SQL

Use this when the user wants SQL style feedback. Applies the same 10 rules as `gosqlx lint`: L001 trailing whitespace, L002 mixed indentation, L003 consecutive blank lines, L004 indentation depth, L005 line length (>100), L006 column alignment, L007 keyword case (upper), L008 comma placement (trailing), L009 aliasing consistency, L010 redundant whitespace. Returns {violation_count, violations}.

輸入參數sql必填

parse_sql

Parse SQL

Use this when the user wants to know how SQL parses: returns an AST summary with the statement count and the type of each statement, optionally for a specific dialect. GO batch separators are excluded from the count.

輸入參數sql必填dialect

security_scan

Scan SQL for injection

Use this when the user wants SQL checked for injection patterns: tautologies, UNION attacks, stacked queries, comment bypasses, and more. Returns findings with severity counts.

輸入參數sql必填

validate_sql

Validate SQL

Use this when the user wants to know whether a SQL statement is syntactically valid, optionally for a specific dialect. Returns {valid: bool, error?: string, dialect?: string}.

輸入參數sql必填dialect

版本歷史

2
  1. v1.17.0最新Oct 31, 2026
  2. v1.16.0Oct 22, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分