Add mTLS (mutual TLS) support

[vkazmirchuk]

Summary

This PR adds support for mutual TLS (mTLS) client certificate authentication, enabling connections to ClickHouse servers that require client certificates.

Changes

• Added new environment variables in mcp_env.py:

  • CLICKHOUSE_CA_CERT: Path to CA certificate file for SSL verification
  • CLICKHOUSE_CLIENT_CERT: Path to client certificate file for mTLS authentication
  • CLICKHOUSE_CLIENT_CERT_KEY: Path to client private key file (optional if using combined .pem)
  • CLICKHOUSE_TLS_MODE: TLS mode for client certificate usage (mutual, proxy, or strict)

• Updated get_client_config() to pass these parameters to clickhouse_connect.get_client()

• Added comprehensive documentation in README.md:

  • New "mTLS (Mutual TLS) Variables" section with all four environment variables
  • Example configuration for mTLS setup
  • Example Claude Desktop configuration with mTLS

Motivation

Some ClickHouse deployments require mutual TLS authentication for enhanced security. Currently, there's no way to configure client certificates in mcp-clickhouse, which prevents connections to such servers.

The clickhouse-connect library already supports these parameters (ca_cert, client_cert, client_cert_key, tls_mode), so this PR simply exposes them through environment variables.

Example Usage

{
  "mcpServers": {
    "mcp-clickhouse": {
      "command": "uv",
      "args": ["run", "--with", "mcp-clickhouse", "--python", "3.10", "mcp-clickhouse"],
      "env": {
        "CLICKHOUSE_HOST": "your-secure-clickhouse.example.com",
        "CLICKHOUSE_PORT": "8443",
        "CLICKHOUSE_USER": "your-user",
        "CLICKHOUSE_PASSWORD": "your-password",
        "CLICKHOUSE_SECURE": "true",
        "CLICKHOUSE_CA_CERT": "/path/to/ca.crt",
        "CLICKHOUSE_CLIENT_CERT": "/path/to/client.crt",
        "CLICKHOUSE_CLIENT_CERT_KEY": "/path/to/client.key",
        "CLICKHOUSE_TLS_MODE": "mutual"
      }
    }
  }
}

Testing

• Tested with ClickHouse server requiring mTLS authentication
• Verified backward compatibility (no changes when mTLS variables are not set)

[CLAassistant]

All committers have signed the CLA.