MSSQL

Usage Instructions

Security & least-privilege

The block applies defense-in-depth guards, but the definitive access control is the database login's own permissions. Grant each connection the least privilege it needs.

Built-in guards (defense-in-depth, not a substitute for least privilege):

• The Query operation accepts read-only SELECT / WITH statements only; anything that mutates data or schema is rejected.
• The Execute operation permits per-object DDL and static EXEC dbo.<proc>, but blocks cluster-level, privilege-escalation, and out-of-band T-SQL: xp_cmdshell and other xp_* procedures, sp_configure, OPENROWSET / OPENQUERY / OPENDATASOURCE, BULK INSERT, dynamic EXEC(...) / EXEC @var / sp_executesql, EXECUTE AS, sp_execute_external_script, BACKUP / RESTORE, RECONFIGURE, SHUTDOWN, ALTER SERVER, login/user/role changes, GRANT / REVOKE / DENY, and linked-server / SQL Agent procedures.
• Update and Delete wrap the supplied WHERE clause so an injected fragment cannot batch a second statement onto the query.

Recommended login setup — this is the real guarantee:

• Query (read-only) route: connect with a login that has only db_datareader. A read-only login is the definitive read-only guarantee; the SELECT-only guard is a second layer.
• Insert / Update / Delete / Execute route: use a scoped login with only the roles the workflow needs — db_datawriter for CRUD, and db_ddladmin only if it creates or alters tables. Avoid db_owner / server admin.
• Prefer separate, purpose-scoped logins per workflow over one broad login. A permitted EXEC dbo.<proc> runs at the connecting login's permissions, so a least-privilege login also bounds what any allowed procedure can do.

Connection hygiene:

• Store the password or access token as a workspace secret ({{VAR}}), never inline in the block.
• Keep encrypt enabled (default) and trustServerCertificate disabled (default) against real servers; only trust a self-signed certificate for a known internal host you control.

Example — a read-only login for the Query route (SQL auth):

CREATE USER app_readonly WITH PASSWORD = '<strong-password>';
ALTER ROLE db_datareader ADD MEMBER app_readonly;

Integrate Microsoft SQL Server and Azure SQL into the workflow. Supports SQL authentication and Azure AD access-token authentication. Can query, insert, update, delete, execute raw T-SQL, and introspect schema.

Tools

mssql_query

Execute a SELECT query on a MSSQL / Azure SQL database

Input

Output

mssql_insert

Insert data into a MSSQL / Azure SQL database

Input

Output

mssql_update

Update data in a MSSQL / Azure SQL database

Input

Output

mssql_delete

Delete data from a MSSQL / Azure SQL database

Input

Output

mssql_execute

Execute raw T-SQL on a MSSQL / Azure SQL database

Input

Output

mssql_introspect

Introspect a MSSQL / Azure SQL database schema

Input

Output