MySQL MCP: ER_ACCESS_DENIED_ERROR Access denied for user (check MYSQL_USER/PASS)

Not specified by the original author.

TL;DR: Access denied for user means the MySQL MCP server is sending the wrong username or password, or the user is not allowed to connect from the client's host. Test the exact credentials with the mysql CLI, fix MYSQL_USER / MYSQL_PASS in the client config env block, restart.

ER_ACCESS_DENIED_ERROR: Access denied for user 'appuser'@'YOUR_HOST' (using password value YES)

Fix it

1. Test the credentials outside the MCP layer with the exact same values:

mysql -h YOUR_MYSQL_HOST -u appuser -p'yourpassword' -e "SELECT 1;"

Expected: 1. If this fails, the problem is the credentials or grants, not the MCP server.

2. Check the host part. 'appuser'@'YOUR_HOST' and 'appuser'@'%' are different MySQL users. If the MCP server connects over TCP from another host, the user needs a matching host entry:

CREATE USER 'appuser'@'%' IDENTIFIED BY 'yourpassword';
GRANT SELECT ON mydb.* TO 'appuser'@'%';
FLUSH PRIVILEGES;

3. Update the client config env block:

{
  "env": {
    "MYSQL_HOST": "YOUR_MYSQL_HOST",
    "MYSQL_PORT": "3306",
    "MYSQL_USER": "appuser",
    "MYSQL_PASS": "yourpassword",
    "MYSQL_DB": "mydb"
  }
}

4. Restart the MCP client.

   Expected: the server connects and tools work.

When to use this

• Every tool call fails with ER_ACCESS_DENIED_ERROR.
• The mysql CLI with the same credentials also fails (proves it is credentials, not MCP).

When NOT to use this

• The error is ER_BAD_DB_ERROR: Unknown database. Auth worked; the database name is wrong.
• The error is ECONNREFUSED. The server is unreachable.
• The error mentions caching_sha2_password. That is an auth-plugin problem, different fix.

Compatibility

• benborla/mcp-server-mysql (MYSQL_HOST/PORT/USER/PASS/DB env config).
• MySQL 5.7, 8.x, MariaDB.

Why it happens

MySQL authenticates the pair of (username, host), not just the username. MCP configs get copied between machines, so the password is right but the host the server connects from does not match any grant. The (using password value YES) detail tells you a password was sent; the fix is aligning the user, password, and host grant.

Edge cases

• Special characters in MYSQL_PASS inside JSON need JSON escaping. A # or ! is fine; a \ or " needs escaping.
• MySQL 8 defaults to caching_sha2_password. Old clients fail with a plugin error, not access denied. If you see the plugin named, that is your problem instead.
• Skip-name-resolve servers: use IP addresses in host grants, not hostnames.

The benborla/mcp-server-mysql server authenticates with MYSQLUSER and MYSQLPASS environment variables. ERACCESSDENIED_ERROR: Access denied for user is the standard MySQL authentication failure, documented across MySQL troubleshooting guides with the fix of verifying the database username and password in the configuration and ensuring the MySQL server is running. For the MCP server the credentials live in the client config env block, not a .env file the server reads itself. Source: https://github.com/benborla/mcp-server-mysql

Not specified by the original author.

TL;DR: MySQL 8 uses caching_sha2_password by default and your MCP server's MySQL client cannot speak it. Either switch the user back to mysql_native_password, or upgrade the server package to a client that supports the new plugin.

Error: ER_NOT_SUPPORTED_AUTH_MODE: Client does not support authentication protocol requested by server; consider upgrading MySQL client

Fix it

1. Option A, change the user's plugin (fastest, keeps the old client working):

ALTER USER 'appuser'@'%' IDENTIFIED WITH mysql_native_password BY 'yourpassword';
FLUSH PRIVILEGES;

2. Option B, upgrade the MCP server package so its MySQL client supports caching_sha2_password. Check the server repo for a version bump, reinstall, restart the client.

3. Restart the MCP client and retry.

   Expected: the server authenticates and tools work.

When to use this

• The error names caching_sha2_password or says the client does not support the authentication protocol.
• You recently upgraded MySQL 5.7 to 8.x and the MCP server broke.

When NOT to use this

• The error is plain ER_ACCESS_DENIED_ERROR with no plugin mentioned. That is wrong credentials.
• You are on MySQL 5.7 or MariaDB. The plugin default never changed there.

Compatibility

• benborla/mcp-server-mysql and other Node mysql/mysql2-based MCP servers.
• MySQL 8.x.

Why it happens

MySQL 8.0 flipped the default auth plugin to caching_sha2_password, which uses a different handshake. Older mysql npm clients predate it and fail the handshake entirely. The server is reachable and the password is right; the two sides just cannot complete the auth protocol.

Edge cases

• mysql_native_password is weaker and deprecated. Prefer upgrading the client for anything facing a network.
• Changing the plugin requires re-setting the password in the same statement, or auth breaks differently.
• Managed MySQL 8 (RDS, Cloud SQL) also defaults to the new plugin. The ALTER USER fix works there too if you have privileges.

MySQL 8.0 changed the default authentication plugin from mysqlnativepassword to cachingsha2password, and clients that do not support the new plugin fail with an authentication plugin error rather than a normal access-denied. The documented fixes are altering the user to use mysqlnativepassword or upgrading the client library to one that supports cachingsha2password. This is the classic MySQL 8 upgrade breakage and affects the Node mysql clients commonly used by MCP servers.

Not specified by the original author.

TL;DR: You exported MYSQL_PASS in your terminal, but the MCP server never saw it. MCP clients launch servers with a clean environment. Put every MYSQL_* variable in the client config's env block instead.

ER_ACCESS_DENIED_ERROR: Access denied for user 'appuser'@'host' (using password value NO)

(The tell is using password value NO even though you set one.)

Fix it

1. Move all five variables into the server's env block in your client config:

{
  "mcpServers": {
    "mysql": {
      "command": "npx",
      "args": ["-y", "mcp-server-mysql"],
      "env": {
        "MYSQL_HOST": "YOUR_MYSQL_HOST",
        "MYSQL_PORT": "3306",
        "MYSQL_USER": "appuser",
        "MYSQL_PASS": "yourpassword",
        "MYSQL_DB": "mydb"
      }
    }
  }
}

2. Fully quit and restart the client. Servers spawn at client launch.

   Expected: (using password value YES) in any subsequent error, and with correct values, a working connection.

When to use this

• The error says using password value NO but you definitely set a password somewhere.
• echo $MYSQL_PASS works in your terminal but the server acts like it is empty.
• You are on Windows, where GUI-launched servers do not inherit terminal env at all.

When NOT to use this

• The error says using password value YES and still denies access. The value is reaching the server but is wrong.
• The error is ECONNREFUSED or Unknown database. Those are host and database problems.

Compatibility

• benborla/mcp-server-mysql and any env-configured MCP database server.
• Claude Desktop, Claude Code, Cursor, Windsurf.

Why it happens

export affects your shell and its children. The MCP client is not your shell's child (especially GUI apps), so it never sees those variables, and the server it spawns inherits the client's clean environment. The env block exists precisely to bridge this gap.

Edge cases

• JSON-escape backslashes and double quotes inside passwords in the config file.
• If you use a secrets manager or 1Password-style env injection, make sure the injection applies to the client process, not just your terminal.
• After moving the vars, unset the shell exports to avoid confusion about which value is live.

The benborla/mcp-server-mysql server reads its configuration (MYSQLHOST, MYSQLPORT, MYSQLUSER, MYSQLPASS, MYSQLDB) from environment variables. MCP clients launch stdio servers with a clean environment that does not inherit interactive shell exports, so variables set via export in a terminal are not visible to the server process. The reliable channel is the env block in the MCP client configuration (claudedesktop_config.json, .mcp.json). This is the same documented behavior as other env-configured MCP database servers.