Connect ChatGPT to a MySQL Database with MCP, Safely

To connect ChatGPT to a MySQL database, you need three pieces. First, a MySQL user that can only read. Second, an MCP server that holds that user’s connection and is reachable over HTTPS with sign-in. Third, a custom connector in ChatGPT’s developer mode pointing at that server. ChatGPT then writes SQL, the MCP server runs it read-only, and the rows come back into the chat. Below is how to set up each piece yourself, what the MCP server must refuse, and how Datablare gives you the same result without running a server.

Why ChatGPT needs an MCP connector for MySQL

ChatGPT cannot open a MySQL connection. It can call tools through MCP (Model Context Protocol), the open standard AI apps use to reach outside systems. OpenAI added MCP support in 2025, and ChatGPT’s developer mode lets you add your own MCP servers as custom connectors.

Two things follow from how ChatGPT does this:

• The server must be remote. ChatGPT calls your connector from OpenAI’s side over HTTPS. A server on localhost, or a database only reachable inside your office network, will not work.
• The server must require sign-in. A public URL with no authentication is a public SQL console for your database. Use OAuth so each person signs in, and the server knows who is asking.

Step 1: Create a MySQL user that can only read

Connect as an administrator and create a dedicated user. Replace % with the address your MCP server connects from if you can.

CREATE USER 'ai_reader'@'%' IDENTIFIED BY 'choose-a-strong-password'
  WITH MAX_USER_CONNECTIONS 5;

-- Specific tables
GRANT SELECT ON shop.orders TO 'ai_reader'@'%';
GRANT SELECT ON shop.order_items TO 'ai_reader'@'%';
GRANT SELECT ON shop.products TO 'ai_reader'@'%';

-- A sensitive table, without its sensitive columns
GRANT SELECT (id, city, signup_date) ON shop.customers TO 'ai_reader'@'%';

To expose a whole database, including tables created later, use GRANT SELECT, SHOW VIEW ON shop.* TO 'ai_reader'@'%'; instead.

Never grant FILE (it allows SELECT ... INTO OUTFILE and LOAD_FILE), PROCESS, SUPER or anything on *.*. On MariaDB, also add MAX_STATEMENT_TIME 30 to the CREATE USER so no query runs longer than 30 seconds. The full walkthrough for every engine is in create a read-only database user for AI agents.

Step 2: Make the session read-only and time-limited

MySQL can mark a session read-only. Have your MCP server run this when it connects:

SET SESSION TRANSACTION READ ONLY;
SET SESSION max_execution_time = 30000;  -- milliseconds, applies to SELECT

With the first line, MySQL rejects INSERT, UPDATE and DELETE on regular tables in that session. Two gaps remain. MySQL still allows changes to temporary tables in a read-only transaction. And the session’s own SQL can change these settings back. So the MCP server has to refuse CREATE and SET as well.

Step 3: Check what the MCP server refuses

You can build an MCP server or use an open-source one. Either way, test that it refuses each of these before ChatGPT gets near production:

Query	Why it must be refused
SELECT 1; DELETE FROM orders	A second statement smuggled behind a first
SELECT * FROM customers INTO OUTFILE '/tmp/x'	Writes a file on the database server
SELECT LOAD_FILE('/etc/passwd')	Reads a file from the database server
SELECT SLEEP(600) or BENCHMARK(...)	Holds a connection on purpose
SELECT GET_LOCK('x', 600)	Takes a named lock other sessions may wait on
SET SESSION TRANSACTION READ WRITE	Undoes the read-only session
SELECT USER(), VERSION()	Reveals your login and server, not your data
SELECT * FROM payroll	A table you never meant to expose

It should also cap rows and bytes per result. A SELECT * on a large table can fill ChatGPT’s context and slow your database at the same time.

Step 4: Add the connector in ChatGPT

With your server running at an HTTPS address:

1. In ChatGPT on the web, open Settings, then Apps & Connectors, then Advanced settings, and turn on Developer mode.
2. Back in Apps & Connectors, choose Create. Give it a name, paste your server’s URL as the MCP server URL, set authentication to OAuth, and create it.
3. ChatGPT sends you to your server’s sign-in page. Sign in and allow access.
4. In a new chat, turn the connector on from the + menu and ask a question.

You need a paid ChatGPT plan. On Business or Enterprise, a workspace admin may have to allow custom connectors first. OpenAI renames these menus from time to time; look for “Developer mode” and “Create”.

The Datablare route

Datablare is a hosted MCP gateway. It is the remote server, the OAuth sign-in and the query checks above, plus an audit log, without anything for you to deploy.

1. Sign up at Datablare. To try ChatGPT before connecting your own data, pick Try the e-commerce sample during onboarding. It is an online shop’s customers, products, orders and stock, with tables already described.
2. Add MySQL (or MariaDB) as a data source with the ai_reader user. The database name is optional; Datablare lists every database the user can see. Behind a firewall, allow the IP address shown on the setup screen, or use an SSH tunnel.
3. Choose tables and hide columns. Only selected tables are visible to ChatGPT. In Modeling, switch off columns such as email or phone.
4. Copy the project’s MCP link from the Connect page.
5. Create the connector in ChatGPT as in Step 4, with that link and OAuth. ChatGPT sends you to Datablare to sign in and choose Allow. ChatGPT connects only by signing in; there is no key to paste.
6. Ask, for example: “Which cities had the most repeat customers this year?”
7. Check Audit for the question, who asked, the SQL that ran, the row count and the time taken.

What Datablare does on MySQL

Every session starts with SET SESSION TRANSACTION READ ONLY, and Datablare checks that the setting takes effect when you add the source. The guard refuses everything in the Step 3 table: multiple statements, INTO, OUTFILE, DUMPFILE, LOAD_FILE, SLEEP, BENCHMARK, GET_LOCK, SET, and identity functions such as USER() and VERSION(). A parser checks every table against the ones you exposed and every column against the ones you hid. That includes SELECT *, aliases and subqueries, and the result columns are checked again after the query runs.

Each query gets max_execution_time (30 seconds by default, 60 at most). A stricter limit you set on the user is kept. A row cap applies too: 1,000 by default, at most 5,000, and 1 MB of data. Results go to ChatGPT and are never stored by Datablare. Details are on the MySQL page and in how it works.

What to keep in mind

• ChatGPT receives the rows it reads. They are processed by OpenAI under its terms. Read-only means no changes; it does not mean no exposure. Grant fewer tables and hide columns you would not paste into a chat.
• Prompt injection. Text in your tables, such as product reviews or support messages, can contain instructions aimed at the model. A read-only, narrowly scoped connection limits the damage. It does not prevent the attempt.
• Load. Point the connection at a replica where you have one, and set daily query limits per project.
• Accuracy. ChatGPT can write valid SQL that answers the wrong question. Table descriptions, rules and example questions in a context layer help, and Audit lets you check the SQL behind any number.

Try it

Create a free Datablare account, connect ChatGPT to the sample database in a few minutes, then add your MySQL database with a read-only user. More on connecting ChatGPT and on security.