agent safety

Agent safety answer

sqlcmd sends SQL to Microsoft SQL Server and Azure SQL targets.

Credential access

Reads database passwords, connection strings, tokens, and environment credentials.

Remote mutation

Can create, alter, drop, import, and export database state.

Publish/artifact risk

Can dump or load data artifacts containing sensitive records.

Recommended control

Gate write SQL, dumps, imports, and credential-bearing connection strings.

Agent-use guidance

Allow safe metadata queries; require approval for writes, exports, and secret use.

install

Additional install commands

macOS

Homebrewverified · 100%

brew install sqlcmd

local Homebrew formula metadata

Linux

Nixverified · 92%

nix profile install nixpkgs#sqlcmd

nixpkgs package indexes · pkgs/by-name/sq/sqlcmd/package.nix · source: api.github.com

Windows

Chocolateyverified · 92%

choco install sqlcmd

Chocolatey community package catalog · sqlcmd · source: community.chocolatey.org

Windows Package Managerverified · 92%

winget install --id Microsoft.Sqlcmd -e

Windows Package Manager source index · Microsoft.Sqlcmd · source: cdn.winget.microsoft.com

overview

Package summary

Microsoft SQL Server command-line interface

Project links

Commands and aliases

sqlcmd

history

Project history and usage

sqlcmd is Microsoft's command-line interface for SQL Server and Azure SQL. The Homebrew formula tracks the newer Go implementation, go-sqlcmd, which preserves much of the long-running ODBC sqlcmd workflow while adding modern package-manager distribution and container-oriented commands.

Project history

Microsoft's go-sqlcmd repository was created in 2021, and its README says the project aims to be a complete Go port of the original ODBC sqlcmd using the go-mssqldb driver.

The first preview releases appeared in 2021. The README documents both backward-compatible ODBC-style flags and newer POSIX-style flags, plus additions such as local SQL Server container creation and context management.

Adoption history

The Go version is explicitly packaged for major platforms: the README lists Winget, Chocolatey, Homebrew, Linuxbrew, apt, yum, zypper, and release artifacts. The input package metadata lists Homebrew, Chocolatey, Nix, and Winget identifiers.

How it is used

Common usage includes running queries against SQL Server or Azure SQL, piping SQL into the CLI for scripts, creating local SQL Server containers with sqlcmd create mssql, and switching saved connection contexts stored under ~/.sqlcmd/sqlconfig.

Why package nerds care

Package nerds care about go-sqlcmd because it turns a historically vendor-installed database utility into a cross-platform package-manager CLI, bridging Windows SQL Server habits with Homebrew, Winget, Chocolatey, Linux packaging, and container-first local development.

Timeline

2021: go-sqlcmd repository created.
2021: v0.0.5 and v0.1.0 preview releases published.
2022: early releases add more compatibility switches.
Current README: documents package-manager installs and backward compatibility differences from ODBC sqlcmd.

Related projects

go-sqlcmd is related to the original ODBC sqlcmd, Microsoft's go-mssqldb driver, SQL Server, Azure SQL Database, Azure Synapse, Docker or Podman local SQL Server workflows, and Azure Data Studio integration.

Sources

https://api.github.com/repos/microsoft/go-sqlcmd
https://api.github.com/repos/microsoft/go-sqlcmd/releases
https://github.com/microsoft/go-sqlcmd#readme
https://learn.microsoft.com/en-us/sql/tools/sqlcmd/sqlcmd-utility
input.source_facts.package-manager

security posture

Risk level: blue

broad file, network, media, or database tool signal.

Risk classifier

blue risk · medium confidence · tool

Why

broad file, network, media, or database tool signal

Signals

text:sql,server

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: ~/.sqlcmd/sqlconfig

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix: ~/.sqlcmd/sqlconfig

executables

Installed executables

Command	Kind	Exposure	Note
`sqlcmd`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version1.10.0

manager updated2026-04-10

local dataok

upstreamcurrent

latest detectedv1.10.0

https://github.com/microsoft/go-sqlcmd

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:sqlcmd
Version	1.10.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/sqlcmd
Homepage	https://github.com/microsoft/go-sqlcmd
Repository	https://github.com/microsoft/go-sqlcmd
Upstream docs	https://github.com/microsoft/go-sqlcmd#readme
License	MIT
Source archive	https://github.com/microsoft/go-sqlcmd/archive/refs/tags/v1.10.0.tar.gz
Last updated	2026-04-10T21:11:12Z
Pulse	updated
Build dependencies	go
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	sqlcmd
Version Scheme	0
Revision	0
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

sqlcmd

nix profile install nixpkgs#sqlcmd

normalized package name match
Matched by: Sqlcmd

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/sq/sqlcmd/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

Chocolatey95%

sqlcmd

choco install sqlcmd

normalized package name match
Matched by: Sqlcmd

Chocolatey community package catalog · community.chocolatey.org · Chocolatey community package catalog: sqlcmd from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','sql2008r2.cmdline'

winget95%

Microsoft.Sqlcmd

winget install --id Microsoft.Sqlcmd -e

normalized package name match
Matched by: Sqlcmd

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Microsoft.Sqlcmd from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/sqlcmd.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated agent safety answer
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install sqlcmd with Homebrew, chocolatey, Nix, winget