Give Codex read-only access to MySQL

Codex can query MySQL from the terminal. Run a local MCP server such as dbhub against a replica, or connect MySQL to Contextflo once and give Codex a single URL. Create a read-only user before either.

Option 1: dbhub in Codex

@bytebase/dbhub supports MySQL. It runs as a local stdio server through npx and takes a DSN for your database. Point the DSN at a replica, and use a read-only user.

In ~/.codex/config.toml:

[mcp_servers.mysql]
command = "npx"
args = ["-y", "@bytebase/dbhub"]

Add your DSN to args as the dbhub README describes. Credentials sit in your own config file, on your own machine. Nothing is shared with teammates.

Option 2: Contextflo

Create a read-only user:

CREATE USER 'contextflo_ro'@'%' IDENTIFIED BY '<password>';
GRANT SELECT ON mydb.* TO 'contextflo_ro'@'%';

In Contextflo, go to Data Sources, then Add data source, and choose MySQL. Enter host, port, username and password. SSL is on by default, and an SSH bastion is optional. Pick tables and invite your team.

In Codex:

[mcp_servers.contextflo]
url = "https://mcp.contextflo.com/mcp"

codex mcp login contextflo

codex mcp list shows the connection. Contextflo runs SELECT only.

Which one to use

Just you, on your own replica: Option 1.

Your team asks too: Contextflo. Table and column descriptions are generated, your team saves shared definitions, each person gets their own table access, and you get an audit trail of prompts and the SQL that ran.

You do the modeling, we do the rest. Connect MySQL free.

FAQ

Which MCP server works with MySQL in Codex? @bytebase/dbhub supports MySQL and runs over stdio with npx and a DSN. Add it as a [mcp_servers.name] table in ~/.codex/config.toml.

Should Codex connect to my primary MySQL database? Point it at a replica. Agents can write heavy queries, and a replica keeps them off the primary. Add a read-only user on top.

Does Contextflo use SSL to connect to MySQL? SSL is on by default. An SSH bastion is available as an option for databases that are not publicly reachable.

What does the MySQL grant for Contextflo cover? SELECT on one database, for example mydb.*. The user cannot insert, update or delete.