@berthojoris/mcp-mysql-server 1.0.2 → 1.1.0

package/README.md

@@ -925,48 +925,7 @@ curl http://localhost:3000/health
 
 ---
 
-## 🚀 Publishing to npm
-
-To make your MCP server available to the world:
-
-### 1. Update package.json
-
-```json
-{
-  "name": "@your-username/mcp-mysql",
-  "author": "Your Name <your.email@example.com>",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/berthojoris/mysql-mcp.git"
-  }
-}
-```
-
-### 2. Build
-
-```bash
-npm run build
-```
-
-### 3. Publish
-
-```bash
-# Login to npm
-npm login
-
-# Publish (for scoped packages)
-npm publish --access public
-```
-
-### 4. Users Can Install
-
-```bash
-npx @your-username/mcp-mysql mysql://user:pass@localhost:3306/db "list,read,utility"
-```
-
----
-
-## 🐛 Troubleshooting
+##  Troubleshooting
 
 ### MCP Server Not Connecting
 

package/dist/tools/databaseTools.d.ts

@@ -3,7 +3,8 @@ export declare class DatabaseTools {
     private db;
     constructor();
     /**
-     * List all available databases
+     * List only the connected database (security restriction)
+     * This prevents access to other databases on the MySQL server
      */
     listDatabases(): Promise<{
         status: string;

package/dist/tools/databaseTools.js

@@ -6,20 +6,37 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DatabaseTools = void 0;
 const connection_1 = __importDefault(require("../db/connection"));
 const schemas_1 = require("../validation/schemas");
+const config_1 = require("../config/config");
 class DatabaseTools {
     constructor() {
         this.db = connection_1.default.getInstance();
     }
     /**
-     * List all available databases
+     * List only the connected database (security restriction)
+     * This prevents access to other databases on the MySQL server
      */
     async listDatabases() {
         try {
-            const results = await this.db.query('SHOW DATABASES');
-            const databases = results.map(row => row.Database);
+            // Only return the database specified in the connection string
+            // This is a security measure to prevent access to other databases
+            if (!config_1.dbConfig.database) {
+                return {
+                    status: 'error',
+                    error: 'No database specified in connection string. Please specify a database name in your MySQL connection URL.'
+                };
+            }
+            // Verify the database exists and is accessible
+            const results = await this.db.query('SELECT DATABASE() as current_database');
+            const currentDatabase = results[0]?.current_database;
+            if (!currentDatabase) {
+                return {
+                    status: 'error',
+                    error: 'No database selected. Please ensure your connection string includes a valid database name.'
+                };
+            }
             return {
                 status: 'success',
-                data: databases
+                data: [currentDatabase]
             };
         }
         catch (error) {
@@ -41,8 +58,23 @@ class DatabaseTools {
             };
         }
         try {
+            // Security validation: if database is specified, ensure it matches the connected database
+            if (params.database) {
+                if (!config_1.dbConfig.database) {
+                    return {
+                        status: 'error',
+                        error: 'No database specified in connection string. Cannot access other databases.'
+                    };
+                }
+                if (params.database !== config_1.dbConfig.database) {
+                    return {
+                        status: 'error',
+                        error: `Access denied. You can only access the connected database '${config_1.dbConfig.database}'. Requested database '${params.database}' is not allowed.`
+                    };
+                }
+            }
             let query = 'SHOW TABLES';
-            // If database is specified, use it
+            // If database is specified and validated, use it
             if (params.database) {
                 query = `SHOW TABLES FROM \`${params.database}\``;
             }

package/dist/tools/storedProcedureTools.d.ts

@@ -3,6 +3,10 @@ export declare class StoredProcedureTools {
     private db;
     private security;
     constructor(security: SecurityLayer);
+    /**
+     * Validate database access - ensures only the connected database can be accessed
+     */
+    private validateDatabaseAccess;
     /**
      * List all stored procedures in the current database
      */

package/dist/tools/storedProcedureTools.js

@@ -12,6 +12,38 @@ class StoredProcedureTools {
         this.db = connection_1.default.getInstance();
         this.security = security;
     }
+    /**
+     * Validate database access - ensures only the connected database can be accessed
+     */
+    validateDatabaseAccess(requestedDatabase) {
+        const connectedDatabase = config_1.dbConfig.database;
+        if (!connectedDatabase) {
+            return {
+                valid: false,
+                database: '',
+                error: 'No database specified in connection string. Cannot access any database.'
+            };
+        }
+        // If no database is requested, use the connected database
+        if (!requestedDatabase) {
+            return {
+                valid: true,
+                database: connectedDatabase
+            };
+        }
+        // If a specific database is requested, ensure it matches the connected database
+        if (requestedDatabase !== connectedDatabase) {
+            return {
+                valid: false,
+                database: '',
+                error: `Access denied. You can only access the connected database '${connectedDatabase}'. Requested database '${requestedDatabase}' is not allowed.`
+            };
+        }
+        return {
+            valid: true,
+            database: connectedDatabase
+        };
+    }
     /**
      * List all stored procedures in the current database
      */
@@ -24,13 +56,15 @@ class StoredProcedureTools {
                     error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateListStoredProcedures.errors)
                 };
             }
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const database = dbValidation.database;
             const query = `
         SELECT 
           ROUTINE_NAME as name,
@@ -72,14 +106,16 @@ class StoredProcedureTools {
                     error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateGetStoredProcedureInfo.errors)
                 };
             }
-            const { procedure_name } = params;
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const { procedure_name } = params;
+            const database = dbValidation.database;
             // Get procedure information
             const procedureQuery = `
         SELECT 
@@ -148,14 +184,16 @@ class StoredProcedureTools {
             };
         }
         try {
-            const { procedure_name, parameters = [] } = params;
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const { procedure_name, parameters = [] } = params;
+            const database = dbValidation.database;
             // Validate procedure name
             const identifierValidation = this.security.validateIdentifier(procedure_name);
             if (!identifierValidation.valid) {
@@ -260,14 +298,16 @@ class StoredProcedureTools {
             };
         }
         try {
-            const { procedure_name, parameters = [], body, comment } = params;
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const { procedure_name, parameters = [], body, comment } = params;
+            const database = dbValidation.database;
             // Validate procedure name
             const identifierValidation = this.security.validateIdentifier(procedure_name);
             if (!identifierValidation.valid) {
@@ -327,14 +367,16 @@ class StoredProcedureTools {
                     error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateDropStoredProcedure.errors)
                 };
             }
-            const { procedure_name, if_exists = false } = params;
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const { procedure_name, if_exists = false } = params;
+            const database = dbValidation.database;
             // Validate procedure name
             const identifierValidation = this.security.validateIdentifier(procedure_name);
             if (!identifierValidation.valid) {
@@ -371,14 +413,16 @@ class StoredProcedureTools {
                     error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateShowCreateProcedure.errors)
                 };
             }
-            const { procedure_name } = params;
-            const database = params.database || config_1.dbConfig.database;
-            if (!database) {
+            // Validate database access
+            const dbValidation = this.validateDatabaseAccess(params.database);
+            if (!dbValidation.valid) {
                 return {
                     status: 'error',
-                    error: 'No database specified and no current database selected'
+                    error: dbValidation.error
                 };
             }
+            const { procedure_name } = params;
+            const database = dbValidation.database;
             // Validate procedure name
             const identifierValidation = this.security.validateIdentifier(procedure_name);
             if (!identifierValidation.valid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",