Culprit SQL Studio

Culprit SQL Studio is an open-source (MIT) desktop app, CLI and MCP server for database performance tuning, published by Cristian Pufu on GitHub. It reads the statistics a database already keeps and reports in plain language what is slow, what it costs and how to fix and verify it. It supports SQL Server, PostgreSQL, TimescaleDB, YugabyteDB, MySQL, MariaDB and SQLite on macOS, Windows and Linux.

What It Is

Culprit is an investigation tool for slow databases rather than a continuously running monitor. It connects like a database client, with no agent or collector installed on the server, and reads catalog and statistics sources such as Query Store, pg_stat_statements and performance_schema. Findings are ranked by their share of database time, and each includes the evidence, a fix meant to be safe on production and a way to verify it. Fixes are shown and copied, never applied automatically.

Analysis Workflow

The README describes 68 checks covering runaway plan loops, plan regressions, missing and unused indexes, N+1 query patterns, lock pile-ups, spills to disk, and sequence or transaction-ID exhaustion. Execution plans come with plain-word insights and a cost diagram, and two plans can be compared. Users can drag across a database-time chart to compare periods and see what got slower, what is new, and nearby deploys or statistics changes. Live views show blocking trees and deadlocks. An index advisor can test a virtual index with HypoPG on supported providers before it is built.

Coding Agents and CI

culprit mcp exposes 27 tools over the Model Context Protocol for agents such as Claude Code, Codex and Cursor. Access is set per connection: off, statistics and plans (the default), or read-only queries approved one at a time, and every call is written to a local audit log. CLI commands output JSON, and culprit lint-sql checks migration files offline against a saved snapshot and can emit SARIF 2.1.0 for GitHub code scanning.

Safety and Privacy

Scans use catalog and statistics views with short lock timeouts, and estimated plans execute nothing. Statements that could change data on a production connection require confirmation. The project states there is no account, cloud or telemetry, and passwords are kept in the OS keychain.