TL;DR: You exported `MYSQL_PASS` in your terminal, but the MCP server never saw it. MCP clients launch servers with a clean environment. Put every `MYSQL_*` variable in the client config's `env` block instead.

```text
ER_ACCESS_DENIED_ERROR: Access denied for user 'appuser'@'host' (using password value NO)
```

(The tell is `using password value NO` even though you set one.)

## Fix it

1. Move all five variables into the server's `env` block in your client config:

```json
{
  "mcpServers": {
    "mysql": {
      "command": "npx",
      "args": ["-y", "mcp-server-mysql"],
      "env": {
        "MYSQL_HOST": "YOUR_MYSQL_HOST",
        "MYSQL_PORT": "3306",
        "MYSQL_USER": "appuser",
        "MYSQL_PASS": "yourpassword",
        "MYSQL_DB": "mydb"
      }
    }
  }
}
```

2. Fully quit and restart the client. Servers spawn at client launch.

   Expected: `(using password value YES)` in any subsequent error, and with correct values, a working connection.

## When to use this

- The error says `using password value NO` but you definitely set a password somewhere.
- `echo $MYSQL_PASS` works in your terminal but the server acts like it is empty.
- You are on Windows, where GUI-launched servers do not inherit terminal env at all.

## When NOT to use this

- The error says `using password value YES` and still denies access. The value is reaching the server but is wrong.
- The error is `ECONNREFUSED` or `Unknown database`. Those are host and database problems.

## Compatibility

- benborla/mcp-server-mysql and any env-configured MCP database server.
- Claude Desktop, Claude Code, Cursor, Windsurf.

## Why it happens

`export` affects your shell and its children. The MCP client is not your shell's child (especially GUI apps), so it never sees those variables, and the server it spawns inherits the client's clean environment. The `env` block exists precisely to bridge this gap.

## Edge cases

- JSON-escape backslashes and double quotes inside passwords in the config file.
- If you use a secrets manager or 1Password-style env injection, make sure the injection applies to the client process, not just your terminal.
- After moving the vars, unset the shell exports to avoid confusion about which value is live.