Skip to content
@aws/nx-plugin
Blog

MCP Server to Relational Database

The connection generator wires a TypeScript MCP Server to a Relational Database project, making a Prisma client available to all tools registered inside createServer.

Prerequisites

Section titled “Prerequisites”

Before using this generator, ensure you have:

  1. A ts#mcp-server project
  2. A ts#rdb project

Usage

Section titled “Usage”

Run the Generator

Section titled “Run the Generator”
  1. Install the Nx Console VSCode Plugin if you haven't already
  2. Open the Nx Console in VSCode
  3. Click Generate (UI) in the "Common Nx Commands" section
  4. Search for @aws/nx-plugin - connection
  5. Fill in the required parameters
    • Click Generate

    Select your MCP server project as the source and your relational database project as the target. If the project contains multiple MCP server components, specify sourceComponent to disambiguate.

    Options

    Section titled “Options”
    ParameterTypeDefaultDescription
    sourceProject Requiredstring-The source project
    targetProject Requiredstring-The target project to connect to
    sourceComponent string-The source component to connect from (component name, path relative to source project root, or generator id). Use '.' to explicitly select the project as the source.
    targetComponent string-The target component to connect to (component name, path relative to target project root, or generator id). Use '.' to explicitly select the project as the target.
    preferInstallDependencies booleantrueWhether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.

    Generator Output

    Section titled “Generator Output”

    The generator modifies two files in your MCP server’s source directory:

    • Directorypackages/my-service/src/my-mcp
      • server.ts Prisma client fetched and available to all tools registered inside createServer
      • Dockerfile RDS CA bundle installed for SSL connections to Aurora

    Additionally, the <mcp-server-name>-dev target is updated to depend on the database’s dev target.

    Using the Database in MCP Tools

    Section titled “Using the Database in MCP Tools”

    The Prisma client is fetched inside createServer and available to all tools and resources registered there:

    packages/my-service/src/my-mcp/server.ts
    import { getPrisma as getMyDb } from ':my-scope/my-db';
    

    export const createServer = async () => {
      const myDb = await getMyDb();
      const server = new McpServer({ name: 'my-service', version: '1.0.0' });
      // register tools/resources that use myDb
      return server;
    };

    Multiple Databases

    Section titled “Multiple Databases”

    Running the generator again with a different target adds the second database alongside the first. Both are fetched inside createServer:

    packages/my-service/src/my-mcp/server.ts
    export const createServer = async () => {
      const postgresDb = await getPostgresDb();
      const mysqlDb = await getMysqlDb();
      const server = new McpServer({ ... });
      // register tools using both clients
      return server;
    };

    Infrastructure

    Section titled “Infrastructure”

    The generated MCP server construct implements IGrantable and IConnectable, so you can grant network and IAM access to the database directly on the construct.

    packages/infra/src/stacks/application-stack.ts
    import { SecurityGroup } from 'aws-cdk-lib/aws-ec2';
    import { RuntimeNetworkConfiguration } from 'aws-cdk-lib/aws-bedrockagentcore';
    import { MyDatabase } from ':my-scope/common-constructs';
    

    const db = new MyDatabase(this, 'Db', { vpc, ... });
    

    const myMcpServer = new MyMcpServer(this, 'MyMcpServer', {
      networkConfiguration: RuntimeNetworkConfiguration.usingVpc(this, {
        vpc,
        vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
        securityGroups: [
          new SecurityGroup(this, 'MyMcpServerSecurityGroup', { vpc, allowAllOutbound: true }),
        ],
      }),
    });
    

    db.allowDefaultPortFrom(myMcpServer);
    db.grantConnect(myMcpServer);

    allowDefaultPortFrom opens the security group rule so the MCP server runtime can reach the database port. grantConnect grants IAM rds-db:connect permission to the server’s execution role.

    SSL Requirements When Connecting Without RDS Proxy

    Section titled “SSL Requirements When Connecting Without RDS Proxy”

    The connection generator updates the Dockerfile to install the Amazon RDS CA bundle at /usr/local/share/ca-certificates/rds-bundle.crt. Set NODE_EXTRA_CA_CERTS to that path so Node.js trusts the certificate when connecting without RDS Proxy:

    packages/infra/src/stacks/application-stack.ts
    new MyMcpServer(this, 'MyMcpServer', {
      ...
      environmentVariables: {
        NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/rds-bundle.crt',
      },
    });

    For more details, see the Amazon RDS SSL/TLS documentation. When using RDS Proxy, you do not need to configure NODE_EXTRA_CA_CERTS.

    Local Development

    Section titled “Local Development”
    Terminal window
    pnpm nx <mcp-server-name>-dev <project-name>

    This starts the MCP server and all connected databases. The LOCAL_DEV=true environment variable causes each Prisma client to connect to its local Docker database instead of Aurora.