MySQL connector

The MySQL connector opens a read-only TLS connection from OrgMCP to your MySQL 8 / MariaDB / Aurora MySQL database and exposes nine live MCP tools (schema/table explore, guarded SELECT, catalog-resolved stored procedures, and mysql_diagnose). It is tools-only — there is no knowledge-source picker and no RAG crawler.

Connect

1. Create a least-privilege role. Prefer GRANT EXECUTE on COMMENT-documented lookup procedures over table SELECT (see the operator runbook).
2. In the OrgMCP admin console, open Connectors → Add → MySQL.
3. Paste a mysql://user:password@host:3306/database URI (or mariadb://). Do not append ?ssl-mode= — configure TLS with the connector fields instead.
4. Choose sslMode (verify-full recommended) and optionally paste a private CA PEM in caCert.
5. Click Test connection. Green means the role can see at least one user schema or one stored routine. Zero of both fails.

Network requirements

• A direct connection requires a publicly routable database host. Private, loopback, and cloud-metadata addresses are refused (SSRF protection).
• An SSH bastion may forward to a private (RFC1918 / IPv6 ULA) database. The bastion itself must still be publicly routable. Allow OrgMCP egress to port 3306 and port 22 when tunnelling.

Stored procedures

Use mysql_list_procedures first — it returns each routine's COMMENT and parameter names/modes/types. A name alone is not enough for an agent to tell q from role. Then call mysql_call_procedure with bound parameters. Raw CALL in mysql_run_query is rejected.

What does not get indexed

• Nothing — this connector has no RAG ingest and no source_type. Use the live mysql_* tools (or another connector) for searchable knowledge.

Operator runbook: docs/RUN-mysql-connector.md. Canonical matrix: docs/ARCH-connector-capabilities.md. See also PostgreSQL.