@berthojoris/mcp-mysql-server 1.13.0 → 1.14.1

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to the MySQL MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.14.1] - 2025-12-08
+
+### Added
+- **Workflow Macros** - New `safe_export_table` tool that combines data export with mandatory masking.
+  - Allows safe export of sensitive data by enforcing masking before the data leaves the database.
+  - Supports configurable masking profiles (strict (default), partial, soft).
+
+## [1.14.0] - 2025-12-08
+
+### Added
+- **Data Masking Profiles** - New security feature to mask sensitive data in query responses.
+  - Configurable via `MCP_MASKING_PROFILE` environment variable.
+  - Profiles: `none` (default), `soft` (secrets), `partial` (secrets + PII), `strict` (all sensitive).
+  - Automatically applies to `run_query` and `read_records`.
+
 ## [1.13.0] - 2025-12-07
 
 ### Added

package/DOCUMENTATIONS.md

@@ -7,7 +7,7 @@ This file contains detailed documentation for all features of the MySQL MCP Serv
 ## Table of Contents
 
 1. [Category Filtering System](#🆕-category-filtering-system) - NEW!
-2. [🔧 Complete Tools Reference](#🔧-complete-tools-reference) - All 120 tools organized by category
+2. [🔧 Complete Tools Reference](#🔧-complete-tools-reference) - All 124 tools organized by category
 3. [DDL Operations](#🏗️-ddl-operations)
 4. [Data Export Tools](#📤-data-export-tools)
 5. [Data Import Tools](#📥-data-import-tools)
@@ -26,19 +26,6 @@ This file contains detailed documentation for all features of the MySQL MCP Serv
 18. [Performance Monitoring](#📈-performance-monitoring)
 19. [Usage Examples](#📋-usage-examples)
 20. [Query Logging & Automatic SQL Display](#📝-query-logging--automatic-sql-display)
-21. [Security Features](#🔒-security-features)
-22. [Query Result Caching](#💾-query-result-caching)
-23. [Query Optimization Hints](#🎯-query-optimization-hints)
-24. [Guided Query Builder/Fixer](#🤖-guided-query-builderfixer)
-25. [Bulk Operations](#🚀-bulk-operations)
-26. [OpenAI Codex Integration](#🤖-openai-codex-integration)
-27. [Troubleshooting](#🛠️-troubleshooting)
-28. [License](#📄-license)
-29. [Roadmap](#🗺️-roadmap)
-
----
-
-## Dual-Layer Filtering System
 
 Control which database operations are available to AI using a **dual-layer filtering system**:
 
@@ -754,6 +741,47 @@ Both tools support:
 
 ---
 
+## 🔄 Workflow Macros
+
+Workflow Macros are composite tools designed to execute complex, multi-step operations safely and efficiently. They encapsulate best practices and security policies (like data masking) into single, atomic tool calls.
+
+### Available Macros
+
+| Tool | Description |
+|------|-------------|
+| `safe_export_table` | Exports table data to CSV with mandated data masking (redaction/hashing) |
+
+### safe_export_table
+
+Exports table data to CSV format *with enforced data masking*. This is safer than standard export tools because it ensures sensitive data is masked before leaving the database layer, regardless of the global masking configuration.
+
+**Parameters:**
+- `table_name` (required): Name of the table to export.
+- `masking_profile` (optional): "strict" (default), "partial", or "soft".
+- `limit` (optional): Maximum rows to export (default 1000, max 10000).
+- `include_headers` (optional): Whether to include CSV headers (default true).
+
+**Example:**
+*User prompt: "Safely export the users table to a CSV file"*
+
+```json
+{
+  "tool": "safe_export_table",
+  "arguments": {
+    "table_name": "users",
+    "masking_profile": "strict"
+  }
+}
+```
+
+**Result:**
+CSV content where:
+- Emails are masked (e.g., `j***@domain.com`)
+- Passwords/secrets are `[REDACTED]`
+- Phone numbers are partially hidden
+
+---
+
 ## 📥 Data Import Tools
 
 The MySQL MCP Server provides tools to import data from various formats into your database tables.
@@ -3759,7 +3787,44 @@ Each bulk operation returns performance metrics:
 
 ---
 
-## 🤖 OpenAI Codex Integration
+## 🎭 Data Masking
+ 
+ The MySQL MCP server includes a robust data masking layer to protect sensitive information (PII, credentials) in query results. This is useful when sharing database access with AI agents or third parties.
+ 
+ ### Features
+ 
+ - **Profile-Based Masking**: Easy configuration profiles (`none`, `soft`, `partial`, `strict`)
+ - **Automatic Detection**: Automatically identifies sensitive columns by name (e.g., `email`, `password`, `ssn`)
+ - **Multiple Strategies**:
+   - **REDACT**: Replaces value with `[REDACTED]`
+   - **PARTIAL**: Partially masks email (`j***@d.com`) and phone/CC (`***1234`)
+   - **HASH**: (Internal placeholder)
+ 
+ ### Configuration
+ 
+ Configure the masking profile via the `MCP_MASKING_PROFILE` environment variable:
+ 
+ ```bash
+ MCP_MASKING_PROFILE=partial
+ ```
+ 
+ ### Profiles Reference
+ 
+ | Profile | Description | Credentials (password, key) | PII (email, phone, ssn) |
+ |---------|-------------|-----------------------------|-------------------------|
+ | `none` | No masking (default) | Show | Show |
+ | `soft` | Protect secrets only | **REDACT** | Show |
+ | `partial` | Balanced security | **REDACT** | **PARTIAL** (j***@...) |
+ | `strict` | Maximum security | **REDACT** | **REDACT** |
+ 
+ ### Behavior
+ 
+ - Masking applies automatically to `run_query` and `read_records` results.
+ - It filters output **after** the query is run, so WHERE clauses still work on the real data (e.g., you can search by email, but the result will be masked).
+ 
+ ---
+ 
+ ## 🤖 OpenAI Codex Integration
 
 OpenAI Codex CLI and VS Code Extension support MCP servers through a shared TOML configuration file. This section provides detailed setup instructions for integrating the MySQL MCP Server with Codex.
 
@@ -4144,7 +4209,7 @@ MIT License - see [LICENSE](LICENSE) file for details.
 | Drift & Migration Assistant (Schema diff + risk summary) | High | High | 4 | ✅ Completed |
 | Safety Sandbox Mode (runQuery dry-run/EXPLAIN-only) | Medium | Low | 5 | ✅ Completed |
 | Anomaly & Slow-Query Watcher | Medium | Medium | 6 | ✅ Completed |
-| Data Masking Profiles for Responses | Medium | Medium | 7 | Planned |
+| Data Masking Profiles for Responses | Medium | Medium | 7 | ✅ Completed |
 | Workflow Macros (e.g., safe_export_table) | Medium | Low | 8 | Planned |
 | Agent-Facing Changelog Feed | Medium | Low | 9 | Planned |
 | Connection Profiles (dev/stage/prod with allow/deny) | High | Low | 10 | Planned |

package/README.md

@@ -50,26 +50,13 @@ Add to your AI agent config (`.mcp.json`, `.cursor/mcp.json`, etc.):
   - [Environment Variables](#environment-variables-configuration)
   - [Local Development](#local-path-configuration)
 - [Permission System](#-permission-system)
-- [Available Tools (120 total)](#-available-tools)
+- [Available Tools (124 total)](#-available-tools)
 - [Documentation](#-detailed-documentation)
 - [Comparison: MCP vs Manual Access](#-mysql-mcp-vs-manual-database-access)
 - [License](#-license)
 
 ---
-
-## Features
-
-| Category | Description |
-|----------|-------------|
-| **Full MCP Support** | Works with Claude Code, Cursor, Windsurf, Zed, Cline, Kilo Code, Roo Code, Gemini CLI, OpenAI Codex, and any MCP-compatible AI agent |
-| **Security First** | Parameterized queries, SQL injection protection, permission-based access control |
-| **121 Powerful Tools** | Complete database operations including CRUD, DDL, transactions, stored procedures, backup/restore, migrations |
-| **Adaptive Presets** | Built-in ReadOnly/Analyst/DBA Lite permission bundles with override merging |
-| **Schema-Aware RAG Pack** | Compact schema snapshots (tables, PK/FK, row estimates) tailored for embeddings-friendly prompts |
-| **Category Filtering** | 22 documentation categories for intuitive, fine-grained access control (backward compatible with 10 legacy categories) |
-| **Transaction Support** | Full ACID transaction management (BEGIN, COMMIT, ROLLBACK) |
-| **Schema Migrations** | Version control for database schema with up/down migrations |
-| **Dual Mode** | Run as MCP server OR as REST API |
+| **Data Masking** | Protect PII/Secrets in responses with configurable profiles (soft/partial/strict) |
 | **TypeScript** | Fully typed with TypeScript definitions |
 
 ---
@@ -106,6 +93,7 @@ DB_USER=root
 DB_PASSWORD=yourpassword
 DB_NAME=yourdatabase
 MCP_CONFIG=list,read,utility
+MCP_MASKING_PROFILE=partial
 ```
 
 ### 2. Build Project (If Cloned Locally)
@@ -367,7 +355,8 @@ Alternative approach using environment variables instead of connection string:
         "DB_PASSWORD": "your_password",
         "DB_NAME": "your_database",
         "MCP_PERMISSIONS": "list,read,utility",
-        "MCP_CATEGORIES": "database_discovery,performance_monitoring"
+        "MCP_CATEGORIES": "database_discovery,performance_monitoring",
+        "MCP_MASKING_PROFILE": "partial"
       }
     }
   }
@@ -496,12 +485,12 @@ Use these categories for fine-grained control that matches the tool organization
 | `server_management` | 9 | Process list, explain queries, server info |
 | `performance_monitoring` | 10 | Metrics, slow queries, health checks |
 | `cache_management` | 5 | Query cache stats and configuration |
-| `query_optimization` | 2 | Analyze queries, get optimization hints |
+| `query_optimization` | 3 | Analyze queries, get optimization hints |
 | `backup_restore` | 5 | Backup/restore database and tables |
 | `import_export` | 5 | Import/export JSON, CSV, SQL |
 | `data_migration` | 5 | Copy, move, clone, sync table data |
 | `schema_migrations` | 9 | Version control for database schema |
-| `analysis` | 3 | AI context optimization and data analysis |
+| `analysis` | 4 | AI context optimization and data analysis |
 
 ### Legacy Categories (Backward Compatible)
 
@@ -531,7 +520,7 @@ Use these categories for fine-grained control that matches the tool organization
 | **Application Backend** | `database_discovery,crud_operations,bulk_operations,custom_queries,transaction_management` | Full app support |
 | **Development & Testing** | `database_discovery,crud_operations,bulk_operations,custom_queries,schema_management,utilities,transaction_management` | Development access |
 | **DBA & DevOps** | `database_discovery,schema_management,table_maintenance,backup_restore,schema_migrations,performance_monitoring` | Admin tasks |
-| **Full Access** | *(leave empty)* | All 120 tools enabled |
+| **Full Access** | *(leave empty)* | All 124 tools enabled |
 
 #### Using Legacy Categories (Backward Compatible)
 
@@ -652,11 +641,11 @@ Use both 2nd argument (permissions) and 3rd argument (categories):
 
 ## Available Tools
 
-The MCP server provides **120 powerful tools** organized into categories:
+The MCP server provides **124 powerful tools** organized into categories:
 
 ### Quick Reference
 
-**121 Tools Available** - Organized into 22 categories
+**124 Tools Available** - Organized into 22 categories
 
 | Category | Count | Key Tools |
 |----------|-------|-----------|

package/dist/config/featureConfig.js

@@ -230,19 +230,6 @@ exports.toolCategoryMap = {
     showReplicationStatus: ToolCategory.LIST,
     // Backup and restore tools
     backupTable: ToolCategory.UTILITY,
-    backupDatabase: ToolCategory.UTILITY,
-    restoreFromSql: ToolCategory.DDL,
-    getCreateTableStatement: ToolCategory.LIST,
-    getDatabaseSchema: ToolCategory.LIST,
-    // Extended data export/import tools
-    exportTableToJSON: ToolCategory.UTILITY,
-    exportQueryToJSON: ToolCategory.UTILITY,
-    exportTableToSql: ToolCategory.UTILITY,
-    importFromCSV: ToolCategory.CREATE,
-    importFromJSON: ToolCategory.CREATE,
-    // Data migration tools
-    copyTableData: ToolCategory.CREATE,
-    moveTableData: ToolCategory.DELETE,
     cloneTable: ToolCategory.DDL,
     compareTableStructure: ToolCategory.LIST,
     syncTableData: ToolCategory.UPDATE,
@@ -397,6 +384,7 @@ exports.toolDocCategoryMap = {
     exportTableToJSON: DocCategory.IMPORT_EXPORT,
     exportQueryToJSON: DocCategory.IMPORT_EXPORT,
     exportTableToSql: DocCategory.IMPORT_EXPORT,
+    safe_export_table: DocCategory.IMPORT_EXPORT,
     importFromCSV: DocCategory.IMPORT_EXPORT,
     importFromJSON: DocCategory.IMPORT_EXPORT,
     // Data Migration

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export declare class MySQLMCP {
     private performanceTools;
     private analysisTools;
     private aiTools;
+    private macroTools;
     private security;
     private featureConfig;
     constructor(permissionsConfig?: string, categoriesConfig?: string, presetName?: string);
@@ -590,6 +591,16 @@ export declare class MySQLMCP {
         suggestions?: string[];
         error?: string;
     }>;
+    safeExportTable(params: {
+        table_name: string;
+        masking_profile?: string;
+        limit?: number;
+        include_headers?: boolean;
+    }): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
     getFeatureStatus(): {
         status: string;
         data: {

package/dist/index.js

@@ -25,6 +25,7 @@ const schemaVersioningTools_1 = require("./tools/schemaVersioningTools");
 const performanceTools_1 = require("./tools/performanceTools");
 const analysisTools_1 = require("./tools/analysisTools");
 const aiTools_1 = require("./tools/aiTools");
+const macroTools_1 = require("./tools/macroTools");
 const securityLayer_1 = __importDefault(require("./security/securityLayer"));
 const connection_1 = __importDefault(require("./db/connection"));
 const featureConfig_1 = require("./config/featureConfig");
@@ -56,7 +57,9 @@ class MySQLMCP {
         this.schemaVersioningTools = new schemaVersioningTools_1.SchemaVersioningTools(this.security);
         this.performanceTools = new performanceTools_1.PerformanceTools(this.security);
         this.analysisTools = new analysisTools_1.AnalysisTools(this.security);
+        this.analysisTools = new analysisTools_1.AnalysisTools(this.security);
         this.aiTools = new aiTools_1.AiTools(this.security);
+        this.macroTools = new macroTools_1.MacroTools(this.security);
     }
     // Helper method to check if tool is enabled
     checkToolEnabled(toolName) {
@@ -535,6 +538,14 @@ class MySQLMCP {
         }
         return await this.aiTools.repairQuery(params);
     }
+    // Workflow Macros
+    async safeExportTable(params) {
+        const check = this.checkToolEnabled("safe_export_table");
+        if (!check.enabled) {
+            return { status: "error", error: check.error };
+        }
+        return await this.macroTools.safeExportTable(params);
+    }
     // Get feature configuration status
     getFeatureStatus() {
         const snapshot = this.featureConfig.getConfigSnapshot();

package/dist/mcp-server.js

@@ -476,6 +476,33 @@ const TOOLS = [
             required: ["query"],
         },
     },
+    {
+        name: "safe_export_table",
+        description: "Exports table data to CSV with enforced data masking rules to protect sensitive information.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                table_name: {
+                    type: "string",
+                    description: "Name of the table to export",
+                },
+                masking_profile: {
+                    type: "string",
+                    enum: ["soft", "partial", "strict"],
+                    description: "Masking profile to apply (default: strict). strict=redact all PII/secrets, partial=partial mask PII, soft=mask secrets only.",
+                },
+                limit: {
+                    type: "number",
+                    description: "Maximum number of rows to export (default: 1000, max: 10000)",
+                },
+                include_headers: {
+                    type: "boolean",
+                    description: "Whether to include CSV headers (default: true)",
+                },
+            },
+            required: ["table_name"],
+        },
+    },
     {
         name: "repair_query",
         description: "Analyzes a SQL query (and optional error) to suggest repairs or optimizations using EXPLAIN and heuristics.",
@@ -3083,6 +3110,12 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             case "export_query_to_json":
                 result = await mysqlMCP.exportQueryToJSON((args || {}));
                 break;
+            case "export_query_to_csv":
+                result = await mysqlMCP.exportQueryToCSV((args || {}));
+                break;
+            case "safe_export_table":
+                result = await mysqlMCP.safeExportTable((args || {}));
+                break;
             case "export_table_to_sql":
                 result = await mysqlMCP.exportTableToSql((args || {}));
                 break;

package/dist/security/maskingLayer.d.ts

@@ -0,0 +1,37 @@
+export declare enum MaskingStrategy {
+    REDACT = "redact",// Replace with [REDACTED]
+    PARTIAL = "partial",// Show first/last chars: a***@b.com
+    HASH = "hash",// SHA256 hash (simulated for simplicity or real)
+    NONE = "none"
+}
+export interface MaskingRule {
+    columnPattern: RegExp;
+    strategy: MaskingStrategy;
+}
+export declare enum MaskingProfile {
+    NONE = "none",
+    SOFT = "soft",// Mask only credentials (passwords, secrets)
+    PARTIAL = "partial",// Mask credentials + partial mask PII (email, phone)
+    STRICT = "strict"
+}
+/**
+ * Data Masking Layer
+ * Handles identifying and masking sensitive data in query results
+ */
+export declare class MaskingLayer {
+    private profile;
+    private rules;
+    constructor(profile?: string);
+    private parseProfile;
+    private getRulesForProfile;
+    /**
+     * Check if filtering is active
+     */
+    isEnabled(): boolean;
+    getProfile(): MaskingProfile;
+    /**
+     * Apply masking to a dataset (array of objects)
+     */
+    processResults(data: any[]): any[];
+    private applyStrategy;
+}

package/dist/security/maskingLayer.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MaskingLayer = exports.MaskingProfile = exports.MaskingStrategy = void 0;
+var MaskingStrategy;
+(function (MaskingStrategy) {
+    MaskingStrategy["REDACT"] = "redact";
+    MaskingStrategy["PARTIAL"] = "partial";
+    MaskingStrategy["HASH"] = "hash";
+    MaskingStrategy["NONE"] = "none"; // No masking
+})(MaskingStrategy || (exports.MaskingStrategy = MaskingStrategy = {}));
+var MaskingProfile;
+(function (MaskingProfile) {
+    MaskingProfile["NONE"] = "none";
+    MaskingProfile["SOFT"] = "soft";
+    MaskingProfile["PARTIAL"] = "partial";
+    MaskingProfile["STRICT"] = "strict"; // Redact all PII and credentials
+})(MaskingProfile || (exports.MaskingProfile = MaskingProfile = {}));
+/**
+ * Data Masking Layer
+ * Handles identifying and masking sensitive data in query results
+ */
+class MaskingLayer {
+    constructor(profile = "none") {
+        this.profile = this.parseProfile(profile);
+        this.rules = this.getRulesForProfile(this.profile);
+    }
+    parseProfile(input) {
+        const normalized = input.toLowerCase().trim();
+        if (Object.values(MaskingProfile).includes(normalized)) {
+            return normalized;
+        }
+        return MaskingProfile.NONE;
+    }
+    getRulesForProfile(profile) {
+        const credentialsPattern = /^(password|passwd|pwd|secret|token|api_key|auth_key|access_token|refresh_token)$/i;
+        const piiPattern = /^(email|phone|mobile|cell|ssn|social_security|credit_card|cc_number|card_number|iban|dob|date_of_birth)$/i;
+        switch (profile) {
+            case MaskingProfile.NONE:
+                return [];
+            case MaskingProfile.SOFT:
+                return [
+                    { columnPattern: credentialsPattern, strategy: MaskingStrategy.REDACT }
+                ];
+            case MaskingProfile.PARTIAL:
+                return [
+                    { columnPattern: credentialsPattern, strategy: MaskingStrategy.REDACT },
+                    { columnPattern: piiPattern, strategy: MaskingStrategy.PARTIAL }
+                ];
+            case MaskingProfile.STRICT:
+                return [
+                    { columnPattern: credentialsPattern, strategy: MaskingStrategy.REDACT },
+                    { columnPattern: piiPattern, strategy: MaskingStrategy.REDACT }
+                ];
+            default:
+                return [];
+        }
+    }
+    /**
+     * Check if filtering is active
+     */
+    isEnabled() {
+        return this.profile !== MaskingProfile.NONE;
+    }
+    getProfile() {
+        return this.profile;
+    }
+    /**
+     * Apply masking to a dataset (array of objects)
+     */
+    processResults(data) {
+        if (!this.isEnabled() || !data || data.length === 0) {
+            return data;
+        }
+        // Identify columns to mask based on the first record (optimization)
+        const firstRecord = data[0];
+        const columns = Object.keys(firstRecord);
+        const columnsToMask = [];
+        for (const col of columns) {
+            for (const rule of this.rules) {
+                if (rule.columnPattern.test(col)) {
+                    columnsToMask.push({ col, strategy: rule.strategy });
+                    break; // Apply first matching rule
+                }
+            }
+        }
+        if (columnsToMask.length === 0) {
+            // No sensitive columns found
+            return data;
+        }
+        // Apply masking to all records
+        return data.map(record => {
+            const maskedRecord = { ...record };
+            for (const { col, strategy } of columnsToMask) {
+                if (maskedRecord[col] !== null && maskedRecord[col] !== undefined) {
+                    maskedRecord[col] = this.applyStrategy(maskedRecord[col], strategy);
+                }
+            }
+            return maskedRecord;
+        });
+    }
+    applyStrategy(value, strategy) {
+        const strVal = String(value);
+        switch (strategy) {
+            case MaskingStrategy.REDACT:
+                return "[REDACTED]";
+            case MaskingStrategy.PARTIAL:
+                if (strVal.includes('@')) {
+                    // Email masking: j***@domain.com
+                    const [local, domain] = strVal.split('@');
+                    const maskedLocal = local.length > 2 ? local[0] + '***' + local[local.length - 1] : '***';
+                    return `${maskedLocal}@${domain}`;
+                }
+                else if (strVal.length > 4) {
+                    // Generic partial: show last 4 chars (e.g. phone/cc)
+                    // or first 1 + last 4
+                    return '***' + strVal.slice(-4);
+                }
+                else {
+                    return "***";
+                }
+            case MaskingStrategy.HASH:
+                // Simple placeholder for hash to avoid crypto dependency if not needed,
+                // or use a simple consistent hash if strictly required. 
+                // For now, let's use a redaction-like placeholder to indicate hashing intent.
+                return "[HASHED]";
+            default:
+                return value;
+        }
+    }
+}
+exports.MaskingLayer = MaskingLayer;

package/dist/security/securityLayer.d.ts

@@ -1,10 +1,12 @@
 import { FeatureConfig } from "../config/featureConfig.js";
+import { MaskingLayer } from "./maskingLayer.js";
 export declare class SecurityLayer {
     private ajv;
     private readonly dangerousKeywords;
     private readonly allowedOperations;
     private readonly ddlOperations;
     private featureConfig;
+    masking: MaskingLayer;
     constructor(featureConfig?: FeatureConfig);
     /**
      * Check if a query is a read-only information query (SHOW, DESCRIBE, EXPLAIN, etc.)

package/dist/security/securityLayer.js

@@ -6,10 +6,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityLayer = void 0;
 const ajv_1 = __importDefault(require("ajv"));
 const featureConfig_js_1 = require("../config/featureConfig.js");
+const maskingLayer_js_1 = require("./maskingLayer.js");
 class SecurityLayer {
     constructor(featureConfig) {
         this.ajv = new ajv_1.default();
         this.featureConfig = featureConfig || new featureConfig_js_1.FeatureConfig();
+        // Initialize masking layer from environment variable
+        const maskingProfile = process.env.MCP_MASKING_PROFILE || "none";
+        this.masking = new maskingLayer_js_1.MaskingLayer(maskingProfile);
         // Define dangerous SQL keywords that should ALWAYS be blocked (critical security threats)
         // These are blocked even with 'execute' permission
         // Note: Avoid blocking common table/column names like "user" or "password"

package/dist/tools/crudTools.js

@@ -187,7 +187,7 @@ class CrudTools {
                 const results = await this.db.query(query, paramValidation.sanitizedParams);
                 return {
                     status: "success",
-                    data: results,
+                    data: this.security.masking.processResults(results),
                     total,
                 };
             }
@@ -197,7 +197,7 @@ class CrudTools {
                 const results = await this.db.query(query, paramValidation.sanitizedParams);
                 return {
                     status: "success",
-                    data: results,
+                    data: this.security.masking.processResults(results),
                     total: results.length,
                 };
             }

package/dist/tools/macroTools.d.ts

@@ -0,0 +1,20 @@
+import SecurityLayer from "../security/securityLayer";
+export declare class MacroTools {
+    private db;
+    private security;
+    constructor(security: SecurityLayer);
+    /**
+     * Safe Export Table: Exports table data to CSV with enforced data masking
+     * This macro prioritizes data safety by applying masking rules before export.
+     */
+    safeExportTable(params: {
+        table_name: string;
+        masking_profile?: string;
+        limit?: number;
+        include_headers?: boolean;
+    }): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+}

package/dist/tools/macroTools.js

@@ -0,0 +1,91 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MacroTools = void 0;
+const connection_1 = __importDefault(require("../db/connection"));
+const maskingLayer_1 = require("../security/maskingLayer");
+class MacroTools {
+    constructor(security) {
+        this.db = connection_1.default.getInstance();
+        this.security = security;
+    }
+    /**
+     * Safe Export Table: Exports table data to CSV with enforced data masking
+     * This macro prioritizes data safety by applying masking rules before export.
+     */
+    async safeExportTable(params) {
+        try {
+            const { table_name, masking_profile = "strict", limit = 1000, include_headers = true, } = params;
+            // 1. Validate table name
+            const tableValidation = this.security.validateIdentifier(table_name);
+            if (!tableValidation.valid) {
+                return {
+                    status: "error",
+                    error: tableValidation.error,
+                };
+            }
+            // 2. Fetch data (with hard limit to prevent OOM on large safe exports)
+            const maxLimit = 10000;
+            const actualLimit = Math.min(limit, maxLimit);
+            const escapedTableName = this.security.escapeIdentifier(table_name);
+            const query = `SELECT * FROM ${escapedTableName} LIMIT ?`;
+            const results = (await this.db.query(query, [actualLimit]));
+            if (results.length === 0) {
+                return {
+                    status: "success",
+                    data: {
+                        csv: include_headers ? "" : "",
+                        row_count: 0,
+                        applied_profile: masking_profile,
+                    },
+                };
+            }
+            // 3. Apply masking explicitly using a new temporary layer to ensure strictness
+            // We don't rely on the global masking profile here; we use the one requested (default strict)
+            const tempMaskingLayer = new maskingLayer_1.MaskingLayer(masking_profile);
+            const maskedResults = tempMaskingLayer.processResults(results);
+            // 4. Convert to CSV
+            let csv = "";
+            if (include_headers) {
+                const headers = Object.keys(maskedResults[0]).join(",");
+                csv += headers + "\n";
+            }
+            for (const row of maskedResults) {
+                const values = Object.values(row)
+                    .map((value) => {
+                    if (value === null)
+                        return "";
+                    if (value === undefined)
+                        return "";
+                    let str = String(value);
+                    // Escape quotes and wrap in quotes if contains comma, newline or quotes
+                    if (str.includes(",") ||
+                        str.includes("\n") ||
+                        str.includes('"')) {
+                        return `"${str.replace(/"/g, '""')}"`;
+                    }
+                    return str;
+                })
+                    .join(",");
+                csv += values + "\n";
+            }
+            return {
+                status: "success",
+                data: {
+                    csv: csv,
+                    row_count: maskedResults.length,
+                    applied_profile: tempMaskingLayer.getProfile(),
+                },
+            };
+        }
+        catch (error) {
+            return {
+                status: "error",
+                error: error.message,
+            };
+        }
+    }
+}
+exports.MacroTools = MacroTools;

package/dist/tools/queryTools.js

@@ -90,9 +90,10 @@ class QueryTools {
             }
             // Execute the query with sanitized parameters
             const results = await this.db.query(finalQuery, paramValidation.sanitizedParams, useCache);
+            const maskedResults = this.security.masking.processResults(results);
             return {
                 status: "success",
-                data: results,
+                data: maskedResults,
                 optimizedQuery,
             };
         }

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "mysql-mcp",
   "description": "A Model Context Protocol for MySQL database interaction",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "tools": [
     {
       "name": "list_databases",
@@ -9,7 +9,9 @@
       "input_schema": {},
       "output_schema": {
         "type": "array",
-        "items": { "type": "string" }
+        "items": {
+          "type": "string"
+        }
       }
     },
     {
@@ -18,7 +20,9 @@
       "input_schema": {},
       "output_schema": {
         "type": "array",
-        "items": { "type": "string" }
+        "items": {
+          "type": "string"
+        }
       }
     },
     {
@@ -27,9 +31,13 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" }
+          "table_name": {
+            "type": "string"
+          }
         },
-        "required": ["table_name"]
+        "required": [
+          "table_name"
+        ]
       },
       "output_schema": {
         "type": "object",
@@ -39,18 +47,38 @@
             "items": {
               "type": "object",
               "properties": {
-                "name": { "type": "string" },
-                "type": { "type": "string" },
-                "nullable": { "type": "boolean" },
-                "default": { "type": ["string", "null"] },
-                "primary_key": { "type": "boolean" }
+                "name": {
+                  "type": "string"
+                },
+                "type": {
+                  "type": "string"
+                },
+                "nullable": {
+                  "type": "boolean"
+                },
+                "default": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "primary_key": {
+                  "type": "boolean"
+                }
               }
             }
           },
-          "primary_key": { "type": ["string", "null"] },
+          "primary_key": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "indexes": {
             "type": "array",
-            "items": { "type": "string" }
+            "items": {
+              "type": "string"
+            }
           }
         }
       }
@@ -61,17 +89,33 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" },
-          "data": { "type": "object" }
+          "table_name": {
+            "type": "string"
+          },
+          "data": {
+            "type": "object"
+          }
         },
-        "required": ["table_name", "data"]
+        "required": [
+          "table_name",
+          "data"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "success": { "type": "boolean" },
-          "id": { "type": ["string", "number"] },
-          "affected_rows": { "type": "number" }
+          "success": {
+            "type": "boolean"
+          },
+          "id": {
+            "type": [
+              "string",
+              "number"
+            ]
+          },
+          "affected_rows": {
+            "type": "number"
+          }
         }
       }
     },
@@ -81,20 +125,42 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" },
-          "filters": { "type": "object" },
-          "limit": { "type": "number" },
-          "offset": { "type": "number" },
-          "sort_by": { "type": "string" },
-          "sort_direction": { "type": "string", "enum": ["ASC", "DESC"] }
+          "table_name": {
+            "type": "string"
+          },
+          "filters": {
+            "type": "object"
+          },
+          "limit": {
+            "type": "number"
+          },
+          "offset": {
+            "type": "number"
+          },
+          "sort_by": {
+            "type": "string"
+          },
+          "sort_direction": {
+            "type": "string",
+            "enum": [
+              "ASC",
+              "DESC"
+            ]
+          }
         },
-        "required": ["table_name"]
+        "required": [
+          "table_name"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "records": { "type": "array" },
-          "total": { "type": "number" }
+          "records": {
+            "type": "array"
+          },
+          "total": {
+            "type": "number"
+          }
         }
       }
     },
@@ -104,18 +170,37 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" },
-          "id_field": { "type": "string" },
-          "id": { "type": ["string", "number"] },
-          "data": { "type": "object" }
+          "table_name": {
+            "type": "string"
+          },
+          "id_field": {
+            "type": "string"
+          },
+          "id": {
+            "type": [
+              "string",
+              "number"
+            ]
+          },
+          "data": {
+            "type": "object"
+          }
         },
-        "required": ["table_name", "id", "data"]
+        "required": [
+          "table_name",
+          "id",
+          "data"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "success": { "type": "boolean" },
-          "affected_rows": { "type": "number" }
+          "success": {
+            "type": "boolean"
+          },
+          "affected_rows": {
+            "type": "number"
+          }
         }
       }
     },
@@ -125,17 +210,33 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" },
-          "id_field": { "type": "string" },
-          "id": { "type": ["string", "number"] }
+          "table_name": {
+            "type": "string"
+          },
+          "id_field": {
+            "type": "string"
+          },
+          "id": {
+            "type": [
+              "string",
+              "number"
+            ]
+          }
         },
-        "required": ["table_name", "id"]
+        "required": [
+          "table_name",
+          "id"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "success": { "type": "boolean" },
-          "affected_rows": { "type": "number" }
+          "success": {
+            "type": "boolean"
+          },
+          "affected_rows": {
+            "type": "number"
+          }
         }
       }
     },
@@ -145,16 +246,26 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "query": { "type": "string" },
-          "params": { "type": "array" }
+          "query": {
+            "type": "string"
+          },
+          "params": {
+            "type": "array"
+          }
         },
-        "required": ["query"]
+        "required": [
+          "query"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "results": { "type": "array" },
-          "fields": { "type": "array" }
+          "results": {
+            "type": "array"
+          },
+          "fields": {
+            "type": "array"
+          }
         }
       }
     },
@@ -164,17 +275,32 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "query": { "type": "string" },
-          "params": { "type": "array" }
+          "query": {
+            "type": "string"
+          },
+          "params": {
+            "type": "array"
+          }
         },
-        "required": ["query"]
+        "required": [
+          "query"
+        ]
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "success": { "type": "boolean" },
-          "affected_rows": { "type": "number" },
-          "insert_id": { "type": ["number", "null"] }
+          "success": {
+            "type": "boolean"
+          },
+          "affected_rows": {
+            "type": "number"
+          },
+          "insert_id": {
+            "type": [
+              "number",
+              "null"
+            ]
+          }
         }
       }
     },
@@ -185,11 +311,21 @@
       "output_schema": {
         "type": "object",
         "properties": {
-          "host": { "type": "string" },
-          "port": { "type": "number" },
-          "database": { "type": "string" },
-          "user": { "type": "string" },
-          "connected": { "type": "boolean" }
+          "host": {
+            "type": "string"
+          },
+          "port": {
+            "type": "number"
+          },
+          "database": {
+            "type": "string"
+          },
+          "user": {
+            "type": "string"
+          },
+          "connected": {
+            "type": "boolean"
+          }
         }
       }
     },
@@ -200,9 +336,15 @@
       "output_schema": {
         "type": "object",
         "properties": {
-          "success": { "type": "boolean" },
-          "latency_ms": { "type": "number" },
-          "message": { "type": "string" }
+          "success": {
+            "type": "boolean"
+          },
+          "latency_ms": {
+            "type": "number"
+          },
+          "message": {
+            "type": "string"
+          }
         }
       }
     },
@@ -212,9 +354,13 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "table_name": { "type": "string" }
+          "table_name": {
+            "type": "string"
+          }
         },
-        "required": ["table_name"]
+        "required": [
+          "table_name"
+        ]
       },
       "output_schema": {
         "type": "object",
@@ -224,9 +370,15 @@
             "items": {
               "type": "object",
               "properties": {
-                "table": { "type": "string" },
-                "column": { "type": "string" },
-                "referenced_column": { "type": "string" }
+                "table": {
+                  "type": "string"
+                },
+                "column": {
+                  "type": "string"
+                },
+                "referenced_column": {
+                  "type": "string"
+                }
               }
             }
           },
@@ -235,9 +387,15 @@
             "items": {
               "type": "object",
               "properties": {
-                "table": { "type": "string" },
-                "column": { "type": "string" },
-                "referenced_column": { "type": "string" }
+                "table": {
+                  "type": "string"
+                },
+                "column": {
+                  "type": "string"
+                },
+                "referenced_column": {
+                  "type": "string"
+                }
               }
             }
           }
@@ -250,18 +408,36 @@
       "input_schema": {
         "type": "object",
         "properties": {
-          "database": { "type": "string", "description": "Optional specific database name" },
-          "max_tables": { "type": "number", "description": "Max tables to include (default 50, max 200)" },
-          "max_columns": { "type": "number", "description": "Max columns per table (default 12, max 200)" },
-          "include_relationships": { "type": "boolean", "description": "Whether to include FK relationships (default true)" }
+          "database": {
+            "type": "string",
+            "description": "Optional specific database name"
+          },
+          "max_tables": {
+            "type": "number",
+            "description": "Max tables to include (default 50, max 200)"
+          },
+          "max_columns": {
+            "type": "number",
+            "description": "Max columns per table (default 12, max 200)"
+          },
+          "include_relationships": {
+            "type": "boolean",
+            "description": "Whether to include FK relationships (default true)"
+          }
         }
       },
       "output_schema": {
         "type": "object",
         "properties": {
-          "database": { "type": "string" },
-          "total_tables": { "type": "number" },
-          "context_text": { "type": "string" }
+          "database": {
+            "type": "string"
+          },
+          "total_tables": {
+            "type": "number"
+          },
+          "context_text": {
+            "type": "string"
+          }
         }
       }
     },
@@ -289,23 +465,77 @@
             "items": {
               "type": "object",
               "properties": {
-                "table_name": { "type": "string" },
-                "row_count": { "type": "number" },
-                "data_size_bytes": { "type": "number" },
-                "index_size_bytes": { "type": "number" },
-                "total_size_mb": { "type": "string" }
+                "table_name": {
+                  "type": "string"
+                },
+                "row_count": {
+                  "type": "number"
+                },
+                "data_size_bytes": {
+                  "type": "number"
+                },
+                "index_size_bytes": {
+                  "type": "number"
+                },
+                "total_size_mb": {
+                  "type": "string"
+                }
               }
             }
           },
           "summary": {
             "type": "object",
             "properties": {
-              "total_tables": { "type": "number" },
-              "total_size_mb": { "type": "string" }
+              "total_tables": {
+                "type": "number"
+              },
+              "total_size_mb": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "name": "repair_query",
+      "description": "Analyzes a SQL query (and optional error) to suggest repairs or optimizations using EXPLAIN and heuristics.",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "query": {
+            "type": "string",
+            "description": "The SQL query to analyze or repair"
+          },
+          "error_message": {
+            "type": "string",
+            "description": "Optional error message received when executing the query"
+          }
+        },
+        "required": [
+          "query"
+        ]
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": {
+          "status": {
+            "type": "string"
+          },
+          "analysis": {
+            "type": "object"
+          },
+          "fixed_query": {
+            "type": "string"
+          },
+          "suggestions": {
+            "type": "array",
+            "items": {
+              "type": "string"
             }
           }
         }
       }
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.13.0",
+  "version": "1.14.1",
   "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions, backup/restore, data import/export, and data migration capabilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -86,4 +86,4 @@
     "ts-node": "^10.9.1",
     "typescript": "^5.2.2"
   }
-}
+}