MySQL

Give an agent read-only access to MySQL schemas and server metrics through the ilert MCP connector.

Required permissions

Tool	Required Permission	Description
list_databases	SELECT	List all databases in the MySQL server. Useful for discovering available databases.
list_tables	SELECT	List all tables in a specific database. Useful for discovering available tables and their structure.
describe_table	SELECT	Get detailed schema information about a table including columns, data types, indexes, and constraints.
get_metrics	PROCESS, REPLICATION CLIENT	Get MySQL metrics in one call: InnoDB stats, current process list, replication status, connection counts, and lock information. Useful for diagnosing long-running queries, deadlocks, and replication lag.

The MySQL integration is read-only and does not expose an arbitrary SQL query tool. The agent can inspect schemas and read server metrics, but it cannot access your data.

Create MySQL user

Using the MySQL MCP server requires a MySQL user with specific read-only privileges. The connector performs the following operations:

• SHOW DATABASES - List all databases
• SHOW TABLES FROM <database> - List tables in a database
• DESCRIBE <database>.<table> - Get table schema
• SHOW TABLE STATUS - Get table metadata
• SHOW STATUS / SHOW GLOBAL STATUS - Get MySQL status variables
• SHOW VARIABLES / SHOW GLOBAL VARIABLES - Get MySQL configuration variables
• SHOW PROCESSLIST - View current queries and connections
• SHOW SLAVE STATUS / SHOW MASTER STATUS - View replication status
• SHOW ENGINE INNODB STATUS - View InnoDB status and lock information

Required Privileges:

The user needs the following privileges:

1. PROCESS - Required for SHOW PROCESSLIST and SHOW ENGINE INNODB STATUS
2. REPLICATION CLIENT - Required for SHOW SLAVE STATUS and SHOW MASTER STATUS
3. SELECT - Required for SHOW DATABASES, SHOW TABLES, DESCRIBE, and SHOW TABLE STATUS on databases you want to query

Note: The following operations work WITHOUT additional privileges:

• SHOW STATUS / SHOW GLOBAL STATUS - works for all users
• SHOW VARIABLES / SHOW GLOBAL VARIABLES - works for all users

Important: SHOW DATABASES only shows databases that the user has privileges on. To see and query databases, you need to grant SELECT privilege on them.

Example SQL Script:

-- Create the user
CREATE USER IF NOT EXISTS 'ilert_mcp_connector'@'%' IDENTIFIED BY 'your_secure_password_here';

-- Grant global privileges for monitoring
GRANT PROCESS ON *.* TO 'ilert_mcp_connector'@'%';
GRANT REPLICATION CLIENT ON *.* TO 'ilert_mcp_connector'@'%';

-- Grant SELECT on all databases (read-only access)
-- Option 1: Grant on all databases
GRANT SELECT ON *.* TO 'ilert_mcp_connector'@'%';

-- Option 2: Grant on specific databases only (more secure)
-- GRANT SELECT ON `database1`.* TO 'ilert_mcp_connector'@'%';
-- GRANT SELECT ON `database2`.* TO 'ilert_mcp_connector'@'%';

-- Apply changes
FLUSH PRIVILEGES;

-- Verify grants
SHOW GRANTS FOR 'ilert_mcp_connector'@'%';

Security Note:

• SELECT privilege is read-only - the user cannot modify data
• For maximum security, grant SELECT only on specific databases you need to monitor
• If you need to monitor all databases, use GRANT SELECT ON *.*

Deploy the ilert MCP connector

ilert does not connect to your MySQL server directly. The MySQL MCP server calls the ilert MCP connector, a service you deploy in your own network and expose over a public HTTPS URL. Deployment, the auth token and all configuration options are on its own page:

ilert MCP connector

Enable MySQL on the connector with these variables:

MYSQL_ENABLED=true
MYSQL_HOST=mysql.internal
MYSQL_PORT=3306
MYSQL_USER=ilert_mcp_connector
MYSQL_PASSWORD=your_password
MYSQL_DATABASE=information_schema

MYSQL_DATABASE only sets the default database for the connection — the agent addresses other databases by name, as long as the user has SELECT on them.

Connect MySQL with agent

To connect MySQL with your AI SRE agent:

1

Navigate to Agents in the ilert navigation menu

2

Open the agent detail view for the agent you want to configure

3

Go to the Tools tab

4

Under the ilert hosted MCP servers section, locate the MySQL card

5

Click Connect on the MySQL card

6

In the connection dialog that appears:

• Select connector: Choose "Create new connector" (or select an existing connector if you have one)
• Type: Select Bearer Token from the dropdown
• Secret name: Enter a name for your connector (e.g., "MySQL Production" or "MySQL Main")
• Secret value: Enter the AUTH_TOKEN value from your connector deployment
• Host URL: Enter the public URL where your connector is reachable (e.g., https://ilert-mcp-connector.example.com)

7

Click Connect to complete the connection

8

After connecting, you can enable or disable specific tools needed for alert investigation, such as:

• list_databases - List all databases in the MySQL server
• list_tables - List all tables in a specific database
• describe_table - Get detailed schema information about a table
• get_metrics - Get InnoDB stats, process list, replication status, connections, and locks

The MySQL integration is now connected and ready to use for root cause analysis.