PuroDelphi mcpFirebird

Stable 2.12.0: includes all changes from 2.12.0-alpha.1 through alpha.5: MCP 2026-07-28 alongside 2025 clients, safer timeout/connection cleanup, corrected tool schemas and derived SQL parsing. Historical HTTP/CORS/OAuth defaults remain supported; HTTP hardening is opt-in with MCP_HTTP_SECURITY_MODE=strict. Node.js 20.19+ is required; older runtimes must stay on 2.11.0 until upgraded. Existing nonempty QUERY_TIMEOUT values now take effect. Read the release notes and migration guide.

Implementation of Anthropic's MCP (Model Context Protocol) for Firebird databases.

MCP Firebird is a server that implements Anthropic's Model Context Protocol (MCP) for Firebird SQL databases. It allows Large Language Models (LLMs) like Claude to access, analyze, and manipulate data in Firebird databases securely and in a controlled manner.

This server has been upgraded to support the latest enterprise standards in the MCP ecosystem:

• ⚡ Connection Pooling (Zero Latency): Repetitive database queries now use persistent in-memory connections, completely bypassing handshake overhead and executing almost instantly.
• 🎯 Proactive Events (Triggers): Native integration with Firebird's POST_EVENT. The server listens to database events in real-time and proactively notifies the AI client (e.g., Claude/n8n) without requiring continuous polling.
  • Quick Example: Ask your agent to subscribe_to_event with NEW_ORDER. When Firebird runs POST_EVENT 'NEW_ORDER', your agent gets instantly notified! Read detailed guide and examples.
• 🛡️ Enterprise-Managed Authorization (EMA): Don't want to expose your actual database password (SYSDBA) to the LLM client? Enable EMA to require an --api-key on incoming connections. The server intercepts this token and injects the real password securely under the hood.
  • Quick Example: Start the server with --password "real_password" --api-key "my-secure-token". The remote client connects using Authorization: Bearer my-secure-token. The database password never leaves the server! Read detailed guide in Security.
• 🌊 Bidirectional Streaming (Streamable HTTP / SSE): Perfect for n8n or remote deployments. Provides real-time event streaming and stateful sessions across HTTP.
  • Quick Example: Start the server with TRANSPORT_TYPE=sse SSE_PORT=3003. Configure your client (like n8n) to connect to http://YOUR_SERVER:3003/mcp. Read detailed guide.

MCP Firebird supports multiple deployment architectures. We highly recommend using Streamable HTTP (SSE) for modern, enterprise, or remote deployments.

Ideal for connecting n8n, cloud platforms, remote agents, or tools that don't reside on the same machine as your database.

Installation:

npm install -g mcp-firebird

Run the Server: Set up your environment variables (or .env file):

export TRANSPORT_TYPE=sse
export SSE_PORT=3003

# Real database credentials protected on the server side:
export FIREBIRD_PASSWORD=masterkey 
# Enable EMA to protect external access:
export FIREBIRD_API_KEY=my_secret_token_123

mcp-firebird --database /path/to/database.fdb --user SYSDBA

Client Connection: Your AI client (e.g., MCP Inspector, n8n) connects to http://localhost:3003 and, thanks to EMA, only needs to provide the API KEY instead of the actual database password.

This is the classic method recommended only for personal use on the same machine (e.g., Claude Desktop). Claude spawns its own MCP Firebird subprocess in the background.

• SQL Queries: Execute SQL queries on Firebird databases

• Schema Analysis: Get detailed information about tables, columns, and relationships

• Database Metadata: Inspect triggers, stored procedures, functions, and packages with source code

• Performance Analysis: Analyze query performance and suggest optimizations

• Security: Includes SQL query validation, EMA, and Connection Pooling.

• Dual Driver Support: Choose between simple installation (default) or native driver with wire encryption support.

MCP Firebird supports two driver options:

npx -y mcp-firebird --database=/path/to/database.fdb

⚠️ CRITICAL: npx does NOT work with the native driver. You MUST install globally.

⚠️ IMPORTANT: Wire encryption must be configured on the Firebird server (firebird.conf), not on the client.

Server Configuration (required first):

# In firebird.conf on the server
WireCrypt = Required  # or Enabled

Client Installation (MUST be global):

# Step 1: Install build tools
# Windows: Visual Studio Build Tools (https://visualstudio.microsoft.com/downloads/)
# Linux: sudo apt-get install build-essential python3 firebird-dev
# macOS: xcode-select --install && brew install firebird

# Step 2: Install MCP Firebird globally
npm install -g mcp-firebird

# Step 3: Install native driver globally
npm install -g node-firebird-driver-native

# Step 4: Run directly (WITHOUT npx)
mcp-firebird --use-native-driver \
  --database=/path/to/database.fdb \
  --host=localhost \
  --user=SYSDBA \
  --password=masterkey

Why not npx? When npx runs a package from its temporary cache, it cannot access globally installed modules like node-firebird-driver-native. Both packages must be installed globally in the same location.

📚 For detailed installation instructions, see:

• Native Driver Installation Guide - Step-by-step for Windows/Linux/macOS
• Wire Encryption Guide
• Advanced Installation Guide

# Global installation
npm install -g mcp-firebird

# Run the server
npx -y mcp-firebird --database /path/to/database.fdb

Stable Features (v2.2.3):

• 🐛 FIXED: SSE JSON parsing bug - resolves "Invalid message: [object Object]" errors
• ✨ Streamable HTTP transport support (MCP 2025-03-26)
• 🔄 Unified server with automatic protocol detection
• 📊 Enhanced session management and monitoring
• 🛠️ Modern MCP SDK integration (v1.13.2)
• 🔧 Improved error handling and logging
• 🧪 Comprehensive test suite with 9+ tests for SSE functionality

# Install alpha version with latest features
npm install -g mcp-firebird@alpha

# Or use specific alpha version
npm install -g mcp-firebird@2.4.0-alpha.0

Alpha Features (v2.4.0-alpha.0):

• � NEW: Ready for next development cycle
• ✨ All stable features from v2.2.3 included
• 🔄 Unified server with automatic protocol detection
• 📊 Enhanced session management and monitoring
• 🛠️ Modern MCP SDK integration (v1.13.2)
• 🔧 Improved error handling and logging
• 🧪 Comprehensive test suite with 9+ tests for SSE functionality
• 📚 Enhanced documentation with troubleshooting guides

Note: The SSE JSON parsing bug fix is now available in stable v2.2.3

For VSCode and GitHub Copilot integration, see VSCode Integration.

1. Edit the Claude Desktop configuration:

   code $env:AppData\Claude\claude_desktop_config.json  # Windows
   code ~/Library/Application\ Support/Claude/claude_desktop_config.json  # macOS

2. Add the MCP Firebird configuration:

   {
     "mcpServers": {
       "mcp-firebird": {
         "command": "npx",
         "args": [
           "mcp-firebird",
           "--host",
           "localhost",
           "--port",
           "3050",
           "--database",
           "C:\\path\\to\\database.fdb",
           "--user",
           "SYSDBA",
           "--password",
           "masterkey"
         ],
         "type": "stdio"
       }
     }
   }

3. Restart Claude Desktop

MCP Firebird supports multiple transport protocols to accommodate different client needs and deployment scenarios.

The STDIO transport is the standard method for Claude Desktop integration:

{
  "mcpServers": {
    "mcp-firebird": {
      "command": "npx",
      "args": [
        "mcp-firebird",
        "--database", "C:\\path\\to\\database.fdb",
        "--user", "SYSDBA",
        "--password", "masterkey"
      ],
      "type": "stdio"
    }
  }
}

SSE transport allows the server to run as a web service, useful for web applications and remote access:

# Start SSE server on default port 3003
npx mcp-firebird --transport-type sse --database /path/to/database.fdb

# Custom port and full configuration
npx mcp-firebird \
  --transport-type sse \
  --sse-port 3003 \
  --database /path/to/database.fdb \
  --host localhost \
  --port 3050 \
  --user SYSDBA \
  --password masterkey

# Set environment variables
export TRANSPORT_TYPE=sse
export SSE_PORT=3003
export DB_HOST=localhost
export DB_PORT=3050
export DB_DATABASE=/path/to/database.fdb
export DB_USER=SYSDBA
export DB_PASSWORD=masterkey

# Start server
npx mcp-firebird

Once the SSE server is running, clients can connect to:

• SSE Endpoint: http://localhost:3003/sse
• Messages Endpoint: http://localhost:3003/messages
• Health Check: http://localhost:3003/health

The latest MCP protocol supporting bidirectional communication:

# Start with Streamable HTTP
npx mcp-firebird --transport-type http --http-port 3003 --database /path/to/database.fdb

Supports both SSE and Streamable HTTP protocols simultaneously with automatic detection:

# Start unified server (supports both SSE and Streamable HTTP)
npx mcp-firebird --transport-type unified --http-port 3003 --database /path/to/database.fdb

• SSE (Legacy): http://localhost:3003/sse
• Streamable HTTP (Modern): http://localhost:3003/mcp
• Protocol auto-detection: http://localhost:3003/mcp
• Health Check: http://localhost:3003/health

npx mcp-firebird \
  --transport-type sse \
  --sse-port 3003 \
  --database ./dev-database.fdb \
  --user SYSDBA \
  --password masterkey

npx mcp-firebird \
  --transport-type unified \
  --http-port 3003 \
  --database /var/lib/firebird/production.fdb \
  --host db-server \
  --port 3050 \
  --user APP_USER \
  --password $DB_PASSWORD

docker run -d \
  --name mcp-firebird \
  -p 3003:3003 \
  -e TRANSPORT_TYPE=sse \
  -e SSE_PORT=3003 \
  -e DB_DATABASE=/data/database.fdb \
  -v /path/to/database:/data \
  purodelhi/mcp-firebird:latest

Configure session timeouts and limits:

# Environment variables for session management
export SSE_SESSION_TIMEOUT_MS=1800000    # 30 minutes
export MAX_SESSIONS=1000                 # Maximum concurrent sessions
export SESSION_CLEANUP_INTERVAL_MS=60000 # Cleanup every minute

npx mcp-firebird --transport-type sse

For browser applications, restrict access to one or more comma-separated origins. The default is * with browser credentials disabled, so existing STDIO and Bearer-token MCP clients remain compatible:

# Allow specific browser origins
export MCP_ALLOWED_ORIGIN="https://myapp.com,https://localhost:3000"

npx mcp-firebird --transport-type sse

Stable 2.12.0 includes the 2.11.0 security improvements and all five 2.12.0 alphas. Install with npm install -g mcp-firebird@latest, or pin mcp-firebird@2.12.0. Explicit policies remain enforced; review the migration guide and release notes, especially the Node.js minimum and QUERY_TIMEOUT activation.

Raw SQL writes are disabled by default. 2.11.0 preserves the historical ALLOW_RAW_SQL=true switch for writes, including DDL, without requiring new flags. Explicitly configured operation/table/row/masking/role restrictions and sql.allowDDL=false are never bypassed by that switch. See the security guide for opt-in controls and the structured get-table-data filter format.

Custom security files can be loaded with --security-config /absolute/path/security-config.json or the FIREBIRD_SECURITY_CONFIG environment variable. SECURITY_CONFIG and SECURITY_CONFIG_PATH are fallback aliases, in that order; the CLI option takes precedence over environment variables. Use a JSON object such as {"security":{"allowedTables":["EMPLOYEES"],"allowedOperations":["SELECT"],"maxRows":100}}. Trusted CommonJS files are also supported. Restart after changing the policy and check for Loaded security configuration from .... Starting with 2.11.0-alpha.2, invalid or missing selected files stop initialization instead of silently applying defaults. See the security guide.

Starting with 2.11.0-alpha.1, set FIREBIRD_SECURITY_JSON to that same JSON string to configure security without a file. SQL options are also supported. In 2.11.0-alpha.3, advanced restrictions are opt-in: no implicit resource quotas, deadlines, catalog denial or new routine restrictions. Set only the controls you need; for example, {"security":{"maxRows":100}} activates just that row cap. Explicit policies are enforced, including options that older releases did not enforce. File paths take precedence. Only a trusted administrator/launcher may set the variable; HTTP/SSE clients cannot change it. Inline JSON is limited to 64 KiB (UTF-8), validated without executing code, and not logged by the loader. Invalid policies reject initialization. Unset the variable to disable that source and restart after changes. Review the migration notice, configuration examples and implementation review.

For production deployments, use a reverse proxy like nginx:

server {
    listen 443 ssl;
    server_name mcp-firebird.yourdomain.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        proxy_pass http://localhost:3003;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

1. Wire Encryption Incompatibility (Firebird 3.0+) ⚠️ CRITICAL

   Error: Incompatible wire encryption levels requested on client and server

   IMPORTANT: The node-firebird library does NOT support Firebird 3.0+ wire encryption. The --wire-crypt parameter does NOT work.

   ONLY Solution: You MUST disable wire encryption on the Firebird server:

   For Firebird 3.0, add to firebird.conf:

   WireCrypt = Disabled
   AuthServer = Srp, Legacy_Auth

   For Firebird 4.0+, add to firebird.conf:

   WireCrypt = Disabled
   AuthServer = Srp256, Srp, Legacy_Auth

   For Firebird 5.0 Docker:

   environment:
     FIREBIRD_CONF_WireCrypt: Disabled
     FIREBIRD_CONF_AuthServer: Srp256, Srp

   If you cannot change server configuration, see Wire Encryption Limitation for alternatives.

2. Database Path Issues on Linux/Unix

   Problem: Remote connection strings or Unix paths not working

   Solution: This is fixed in v2.4.0-alpha.1+. The following paths now work correctly:

   • Remote: server:/path/to/database.fdb
   • Unix absolute: /var/lib/firebird/database.fdb
   • IP-based: 192.168.1.100:/data/db.fdb

3. I/O Error with Mixed-Case Paths on Windows

   Error: I/O error during CreateFile (open) operation

   Problem: Database path with mixed case (e.g., C:\MyData\database.fdb) causes errors

   Workarounds:

   • Use all-uppercase paths: C:\MYDATA\DATABASE.FDB
   • Use forward slashes: C:/MyData/database.fdb
   • See Wire Encryption Fix Documentation for more details

1. Connection Refused

   # Check if server is running
   curl http://localhost:3003/health
   
   # Check port availability
   netstat -an | grep 3003

2. Session Timeout

   # Increase session timeout
   export SSE_SESSION_TIMEOUT_MS=3600000  # 1 hour

3. CORS Errors

   # Allow all origins (development only)
   export CORS_ORIGIN="*"

4. Memory Issues

   # Reduce max sessions
   export MAX_SESSIONS=100
   
   # Enable more frequent cleanup
   export SESSION_CLEANUP_INTERVAL_MS=30000

5. JSON Parsing Issues (Fixed in v2.3.0-alpha.1+)

   # If experiencing "Invalid message: [object Object]" errors,
   # upgrade to the latest alpha version:
   npm install mcp-firebird@alpha
   
   # Or use the latest alpha directly:
   npx mcp-firebird@alpha --transport-type sse

   Note: Versions prior to 2.3.0-alpha.1 had a bug where POST requests to /messages endpoint failed to parse JSON body correctly. This has been fixed with improved middleware handling for both application/json and text/plain content types.

# Enable debug logging
export LOG_LEVEL=debug

# Monitor server health
curl http://localhost:3003/health | jq

# Check active sessions
curl http://localhost:3003/health | jq '.sessions'

For more detailed information, check the following documents:

• Complete Installation
• Configuration Options
• Available Tools
• Database Metadata Tools - Inspect triggers, procedures, functions, and packages
• Resources, Tools, and Prompts Reference - Complete guide to all MCP capabilities

• Transport Configuration

• VSCode Integration
• Docker Configuration
• Usage from Different Languages

• Security
• Troubleshooting
• Wire Encryption Fix - Firebird 3.0+ compatibility and Linux path fix

• Use Cases and Examples

If you find MCP Firebird useful for your work or projects, please consider supporting its development through a donation. Your contributions help maintain and improve this tool.

• GitHub Sponsors: Sponsor @PuroDelphi
• PayPal: Donate via PayPal

Another great way to support this project is by hiring our AI agents through Asistentes Autónomos. We offer specialized AI assistants for various business needs, helping you automate tasks and improve productivity.

⭐ Donors, sponsors, and clients receive priority support and assistance with issues, feature requests, and implementation guidance. While we strive to help all users, those who support the project financially will receive faster response times and dedicated assistance.

Your support is greatly appreciated and helps ensure the continued development of MCP Firebird!

This project is licensed under the MIT License - see the LICENSE file for details.