DBHub vs MCP Toolbox for Databases

DBHub 43

The server holds database credentials, and the MCP side has no credential over stdio. Over HTTP a bearer token is optional and off by default while the default bind is 0.0.0.0, so an exposed port answers anyone the host allow-list admits (12). Read-only mode classifies statements and adds engine-level read-only transactions on PostgreSQL, with row limits and timeouts; there is no confirmation step for writes when read-only is off (16). Rows reach the model unmarked, and no guidance on treating results as untrusted was found beyond a blog post on the lethal trifecta (4). The workbench shows request traces (8). No SECURITY.md, disclosure policy or security.txt found (3). 12 + 16 + 4 + 8 + 3 = 43.

MCP Toolbox for Databases 75

Source credentials stay in Toolbox, Google sources use IAM, and optional MCP authorisation validates OAuth 2.1 JWTs with required scopes. --allowed-origins and --allowed-hosts default to *, which the CLI docs themselves call unsafe even on localhost, though the default bind is 127.0.0.1 (20). Read-only mode is enforced at the engine, write tools are suppressed, and custom tools can fix SQL and bind parameters to the signed-in user (18). The security docs cover prompt injection and screening through Model Armor (12). OpenTelemetry traces and metrics per call when exported (10). Google's vulnerability intake with a stated response time and GitHub advisories (15). 20 + 18 + 12 + 10 + 15 = 75.

DBHub 73

Both default tools take zod schemas, so inputs are typed JSON Schema (25). dbhub.ai serves llms.txt (10). Descriptions are short and generated per source ("Execute SQL queries on the postgres database [READ-ONLY MODE]"), with the row cap stated, and say little about when not to use a tool (10). search_objects has enums for object type and detail level and a result limit; SQL is free text by nature (12). Docs pages per tool with examples; error formats aren't documented (9). Semver tags without a changelog (7). 25 + 10 + 10 + 12 + 9 + 7 = 73.

MCP Toolbox for Databases 85

Every tool's parameters are typed in tools.yaml and published as JSON Schema over MCP (25). mcp-toolbox.dev serves llms.txt (10). Prebuilt descriptions vary from one line ("Use this tool to execute a single SQL statement.") to detailed, and few say when not to use a tool (12). Typed parameters with required flags; execute_sql takes free SQL (12). Many examples, samples and codelabs; error responses are thinly documented (11). Semver, a dated CHANGELOG and versioned docs (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.