How to add DBHub to Windsurf
Zero-dependency, token-efficient database MCP server for Postgres, MySQL, SQL Server, MariaDB, and SQLite. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.
Last updated June 14, 2026 · 3.0k★ · stdio · no auth
Windsurf config for DBHub
npx @bytebase/dbhub@latest --transport stdio --dsn "postgres://user:password@localhost:5432/dbname"{
"mcpServers": {
"dbhub": {
"command": "npx",
"args": [
"@bytebase/dbhub@latest",
"--transport",
"stdio",
"--dsn",
"postgres://user:password@localhost:5432/dbname"
]
}
}
}Setup steps
- 1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
- 2Paste the DBHub config below.
- 3Fill in placeholder secrets, then save.
- 4Click Refresh in the MCP panel.
- 5DBHub's tools become available to Cascade.
Before you start
- Node.js >= 22.5.0 (for the NPM/npx install; DBHub uses the built-in node:sqlite module)
- Docker (optional, for the container-based install)
- A reachable database (PostgreSQL, MySQL, MariaDB, SQL Server, or SQLite) and its DSN connection string
What DBHub can do in Windsurf
execute_sqlExecute SQL queries with transaction support and safety controls (read-only mode, row limiting, query timeout).
search_objectsSearch and explore database schemas, tables, columns, indexes, and procedures with progressive disclosure.
Custom ToolsDefine reusable, parameterized SQL operations in your dbhub.toml configuration file.
Security
The HTTP transport defaults to --host 0.0.0.0, exposing DBHub on every network interface, and DBHub does not authenticate HTTP clients. For production, bind to 127.0.0.1 and front it with a reverse proxy (nginx/Caddy) or a firewall. The HTTP transport has built-in DNS-rebinding protection, accepting only requests whose Host is loopback, this machine's own hostname/IPs, or a name allowed via --allowed-hosts. Use read-only mode, row limiting, and query timeouts as guardrails against runaway operations. Credentials are passed via the DSN connection string.
DBHub + Windsurf FAQ
Where is the Windsurf config file?
Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the DBHub config there under the "mcpServers" key and restart the client.
Is DBHub safe to use with Windsurf?
The HTTP transport defaults to --host 0.0.0.0, exposing DBHub on every network interface, and DBHub does not authenticate HTTP clients. For production, bind to 127.0.0.1 and front it with a reverse proxy (nginx/Caddy) or a firewall. The HTTP transport has built-in DNS-rebinding protection, accepting only requests whose Host is loopback, this machine's own hostname/IPs, or a name allowed via --allowed-hosts. Use read-only mode, row limiting, and query timeouts as guardrails against runaway operations. Credentials are passed via the DSN connection string.
Which databases does DBHub support?
PostgreSQL, MySQL, MariaDB, SQL Server (MSSQL), and SQLite, all through a single MCP interface.
How do I connect to multiple databases at once?
Use TOML configuration files to define multiple connections, letting one DBHub instance manage production, staging, and development databases simultaneously. See the Multi-Database Configuration docs at dbhub.ai/config/toml.
Does DBHub authenticate HTTP clients?
No. The HTTP transport does not authenticate clients and defaults to host 0.0.0.0. For production, bind to 127.0.0.1 and front it with a reverse proxy or firewall. It does include built-in DNS-rebinding protection via Host header checks and --allowed-hosts.