Python MCP Server to Relational Database

The connection generator wires a Python MCP Server to a Python Relational Database project, making the database session available to all tools registered in the server.

Prerequisites

Before using this generator, ensure you have:

1. A py#mcp-server project
2. A py#rdb project

Usage

Run the Generator

Run this generator@aws/nx-plugin:connection

CLI

pnpm

$ pnpm nx g @aws/nx-plugin:connection

yarn

$ yarn nx g @aws/nx-plugin:connection

npm

$ npx nx g @aws/nx-plugin:connection

bun

$ bunx nx g @aws/nx-plugin:connection

VSCode

1. Install the Nx Console VSCode Plugin if you haven't already
2. Open the Nx Console in VSCode
3. Click Generate (UI) in the "Common Nx Commands" section
4. Search for @aws/nx-plugin - connection
5. Fill in the required parameters
6. Click Generate

Build your command5

sourceProjectRequired

targetProjectRequired

sourceComponent

targetComponent

preferInstallDependencies

true

--dry-runYou can also perform a dry-run to see what files would be changed

Select your MCP server project as the source and your relational database project as the target. If the project contains multiple MCP server components, specify sourceComponent to disambiguate.

Options

Generator Options5 options

sourceProjectRequiredstring

The source project

targetProjectRequiredstring

The target project to connect to

sourceComponentstring

The source component to connect from (component name, path relative to source project root, or generator id). Use '.' to explicitly select the project as the source.

targetComponentstring

The target component to connect to (component name, path relative to target project root, or generator id). Use '.' to explicitly select the project as the target.

preferInstallDependenciesbooleanDefault: true

Whether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.

Generator Output

• Directorypackages/my_service

  • project.json Adds a dependency from my_mcp_server-dev on the database’s dev target
  • pyproject.toml Adds the database package as a workspace dependency
  • Directorymy_service

    • Directorymy_mcp_server

      • Dockerfile Adds the RDS CA bundle used for direct Aurora connections (only when the MCP server’s infra is agentcore-ecr)

Using the Database in MCP Tools

Import session_context from your database package and use it inside your MCP server tools:

packages/my_service/my_service/my_mcp_server/server.py

from sqlmodel import select
from my_scope_my_db import session_context
from my_scope_my_db.models.example import ExampleModel

@mcp.tool()
async def list_examples() -> str:
    """List all example records."""
    async with session_context() as session:
        items = (await session.execute(select(ExampleModel))).scalars().all()
        return str([item.model_dump() for item in items])

Multiple Databases

Running the generator again with a different target adds the second database alongside the first. Both session contexts are available to all tools:

packages/my_service/my_service/my_mcp_server/server.py

from my_scope_my_db import session_context as my_db_session_context
from my_scope_other_db import session_context as other_db_session_context

Infrastructure

The generated MCP server construct implements IGrantable and IConnectable, so you can grant network and IAM access to the database directly on the construct.

CDK

packages/infra/src/stacks/application-stack.ts

import { SecurityGroup } from 'aws-cdk-lib/aws-ec2';
import { RuntimeNetworkConfiguration } from 'aws-cdk-lib/aws-bedrockagentcore';
import { MyDatabase } from '@my-scope/common-constructs';

const db = new MyDatabase(this, 'Db', { vpc, ... });

const myMcpServer = new MyMcpServer(this, 'MyMcpServer', {
  networkConfiguration: RuntimeNetworkConfiguration.usingVpc(this, {
    vpc,
    vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
    securityGroups: [
      new SecurityGroup(this, 'MyMcpServerSecurityGroup', { vpc, allowAllOutbound: true }),
    ],
  }),
});

db.allowDefaultPortFrom(myMcpServer);
db.grantConnect(myMcpServer);

allowDefaultPortFrom opens the security group rule so the MCP server runtime can reach the database port. grantConnect grants IAM rds-db:connect permission to the server’s execution role.

Terraform

Run the MCP server inside the same VPC as the database, grant it rds-db:connect via additional_iam_policy_statements, and open the network path with a pair of security group rules. The aws_vpc.main and aws_subnet resources are defined in the database deployment guide:

packages/infra/src/main.tf

module "my_database" {
  source              = "../../common/terraform/src/app/dbs/my-database"
  vpc_id              = aws_vpc.main.id
  database_subnet_ids = aws_subnet.database[*].id
  lambda_subnet_ids   = aws_subnet.private[*].id
}

module "my_mcp_server" {
  source     = "../../common/terraform/src/app/mcp-servers/my-mcp-server"
  enable_vpc = true
  vpc_id     = aws_vpc.main.id
  subnet_ids = aws_subnet.private[*].id

  appconfig_application_id  = module.runtime_config_appconfig.application_id
  appconfig_application_arn = module.runtime_config_appconfig.application_arn

  additional_iam_policy_statements = [
    {
      Effect = "Allow"
      Action = ["rds-db:connect"]
      Resource = [
        "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.my_database.connect_resource_id}/${module.my_database.database_runtime_user}"
      ]
    }
  ]
}

resource "aws_vpc_security_group_ingress_rule" "mcp_server_to_database" {
  description                  = "Allow the MCP server runtime to connect to the database"
  security_group_id            = module.my_database.security_group_id
  referenced_security_group_id = module.my_mcp_server.security_group_id
  from_port                    = module.my_database.cluster_port
  to_port                      = module.my_database.cluster_port
  ip_protocol                  = "tcp"
}

resource "aws_vpc_security_group_egress_rule" "mcp_server_to_database" {
  description                  = "Allow outbound traffic from the MCP server runtime to the database"
  security_group_id            = module.my_mcp_server.security_group_id
  referenced_security_group_id = module.my_database.security_group_id
  from_port                    = module.my_database.cluster_port
  to_port                      = module.my_database.cluster_port
  ip_protocol                  = "tcp"
}

appconfig_application_id/appconfig_application_arn come from the shared runtime configuration AppConfig application declared once in your root module, not from the database module. That application exposes the database namespace by default, so the database module’s runtime configuration entry is deployed without further configuration.

SSL Requirements When Connecting Without RDS Proxy

When the MCP server connects directly to the Aurora cluster (without RDS Proxy), the connection generator updates the generated MCP server Dockerfile to install the Amazon RDS CA bundle into the system trust store:

ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /usr/local/share/ca-certificates/rds-global-bundle.crt
RUN update-ca-certificates

When using RDS Proxy, you do not need to configure the RDS CA bundle in the MCP server runtime.

Local Development

pnpm

pnpm nx <mcp-server-name>-dev <project-name>

yarn

yarn nx <mcp-server-name>-dev <project-name>

npm

npx nx <mcp-server-name>-dev <project-name>

bun

bunx nx <mcp-server-name>-dev <project-name>

This starts the MCP server and all connected databases. The LOCAL_DEV=true environment variable causes the database client to connect to its local Docker database instead of Aurora.