@berthojoris/mcp-mysql-server 1.16.2 → 1.16.4

package/dist/tools/securityAuditTools.js

@@ -0,0 +1,319 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityAuditTools = void 0;
+const connection_1 = __importDefault(require("../db/connection"));
+const config_1 = require("../config/config");
+class SecurityAuditTools {
+    constructor() {
+        this.db = connection_1.default.getInstance();
+    }
+    validateDatabaseAccess(requestedDatabase) {
+        const connectedDatabase = config_1.dbConfig.database;
+        if (!connectedDatabase) {
+            return {
+                valid: false,
+                database: "",
+                error: "No database specified in connection string. Cannot access any database.",
+            };
+        }
+        if (!requestedDatabase) {
+            return { valid: true, database: connectedDatabase };
+        }
+        if (requestedDatabase !== connectedDatabase) {
+            return {
+                valid: false,
+                database: "",
+                error: `Access denied. You can only access the connected database '${connectedDatabase}'. Requested database '${requestedDatabase}' is not allowed.`,
+            };
+        }
+        return { valid: true, database: connectedDatabase };
+    }
+    async auditDatabaseSecurity(params) {
+        try {
+            const dbValidation = this.validateDatabaseAccess(params?.database);
+            if (!dbValidation.valid) {
+                return { status: "error", error: dbValidation.error };
+            }
+            const includeUsers = params?.include_user_account_checks ?? true;
+            const includePrivileges = params?.include_privilege_checks ?? true;
+            const findings = [];
+            const notes = [
+                "This audit is best-effort and depends on the MySQL account's privileges.",
+                "The tool only runs hardcoded read-only inspection queries.",
+            ];
+            // ===== Server variables / configuration checks (generally accessible) =====
+            const vars = await this.readVariables([
+                "require_secure_transport",
+                "have_ssl",
+                "tls_version",
+                "validate_password.policy",
+                "validate_password.length",
+                "default_password_lifetime",
+                "local_infile",
+                "secure_file_priv",
+                "skip_name_resolve",
+                "bind_address",
+                "log_error_verbosity",
+                "slow_query_log",
+            ]);
+            const requireSecureTransport = this.asOnOff(vars["require_secure_transport"]);
+            const haveSsl = (vars["have_ssl"] || "").toString().toUpperCase();
+            if (requireSecureTransport === "OFF") {
+                findings.push({
+                    severity: "high",
+                    title: "TLS not enforced (require_secure_transport=OFF)",
+                    evidence: `require_secure_transport=${vars["require_secure_transport"] ?? "<unknown>"}`,
+                    recommendation: "Set require_secure_transport=ON and require clients to connect over TLS.",
+                });
+            }
+            else if (requireSecureTransport === "ON") {
+                findings.push({
+                    severity: "info",
+                    title: "TLS enforced (require_secure_transport=ON)",
+                    evidence: `require_secure_transport=${vars["require_secure_transport"]}`,
+                    recommendation: "Keep TLS enforcement enabled.",
+                });
+            }
+            if (haveSsl && haveSsl !== "YES") {
+                findings.push({
+                    severity: "high",
+                    title: "Server SSL support not available (have_ssl != YES)",
+                    evidence: `have_ssl=${vars["have_ssl"]}`,
+                    recommendation: "Enable SSL/TLS support on the server (configure certificates) and verify client TLS connections.",
+                });
+            }
+            const localInfile = this.asOnOff(vars["local_infile"]);
+            if (localInfile === "ON") {
+                findings.push({
+                    severity: "medium",
+                    title: "LOCAL INFILE is enabled (local_infile=ON)",
+                    evidence: `local_infile=${vars["local_infile"]}`,
+                    recommendation: "Disable local_infile unless required, as it can expand attack surface for data exfiltration.",
+                });
+            }
+            const secureFilePriv = (vars["secure_file_priv"] ?? "").toString();
+            if (secureFilePriv === "") {
+                findings.push({
+                    severity: "medium",
+                    title: "secure_file_priv is empty (no restriction)",
+                    evidence: "secure_file_priv=<empty>",
+                    recommendation: "Set secure_file_priv to a dedicated directory (or NULL) to restrict file import/export paths.",
+                });
+            }
+            const passwordLifetime = this.asInt(vars["default_password_lifetime"]);
+            if (passwordLifetime === 0) {
+                findings.push({
+                    severity: "low",
+                    title: "Password expiration disabled (default_password_lifetime=0)",
+                    evidence: `default_password_lifetime=${vars["default_password_lifetime"]}`,
+                    recommendation: "Consider setting a password expiration policy aligned with your org's security requirements.",
+                });
+            }
+            const vPolicy = vars["validate_password.policy"];
+            const vLen = this.asInt(vars["validate_password.length"]);
+            if (vPolicy === undefined && vLen === undefined) {
+                findings.push({
+                    severity: "low",
+                    title: "Password validation plugin settings not detected",
+                    evidence: "validate_password.* variables not present",
+                    recommendation: "Consider enabling validate_password component/plugin (MySQL version dependent) for stronger password policies.",
+                });
+            }
+            else {
+                if (vLen !== undefined && vLen < 12) {
+                    findings.push({
+                        severity: "medium",
+                        title: "Password minimum length may be weak",
+                        evidence: `validate_password.length=${vars["validate_password.length"]}`,
+                        recommendation: "Increase password length (e.g. 12+).",
+                    });
+                }
+            }
+            // ===== User/account checks (requires mysql.user privileges) =====
+            if (includeUsers) {
+                const userCheck = await this.tryReadUserAccounts();
+                if (userCheck.status === "skipped") {
+                    notes.push(userCheck.note);
+                }
+                else if (userCheck.status === "ok") {
+                    findings.push(...userCheck.findings);
+                }
+            }
+            // ===== Privilege checks (information_schema schema/table privileges) =====
+            if (includePrivileges) {
+                const privCheck = await this.tryReadPrivilegeSummaries();
+                if (privCheck.status === "skipped") {
+                    notes.push(privCheck.note);
+                }
+                else if (privCheck.status === "ok") {
+                    findings.push(...privCheck.findings);
+                }
+            }
+            const summary = this.summarizeFindings(findings);
+            return {
+                status: "success",
+                data: {
+                    database: dbValidation.database,
+                    findings: findings.sort((a, b) => this.severityRank(b.severity) - this.severityRank(a.severity)),
+                    summary,
+                    notes,
+                },
+            };
+        }
+        catch (error) {
+            return { status: "error", error: error.message };
+        }
+    }
+    severityRank(s) {
+        switch (s) {
+            case "critical":
+                return 5;
+            case "high":
+                return 4;
+            case "medium":
+                return 3;
+            case "low":
+                return 2;
+            case "info":
+            default:
+                return 1;
+        }
+    }
+    summarizeFindings(findings) {
+        const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+        for (const f of findings) {
+            summary[f.severity]++;
+        }
+        return summary;
+    }
+    asOnOff(value) {
+        if (value === undefined || value === null)
+            return "UNKNOWN";
+        const v = value.toString().trim().toUpperCase();
+        if (v === "ON" || v === "1" || v === "YES")
+            return "ON";
+        if (v === "OFF" || v === "0" || v === "NO")
+            return "OFF";
+        return "UNKNOWN";
+    }
+    asInt(value) {
+        if (value === undefined || value === null)
+            return undefined;
+        const n = parseInt(value.toString(), 10);
+        return Number.isFinite(n) ? n : undefined;
+    }
+    async readVariables(keys) {
+        const results = {};
+        const query = "SHOW VARIABLES WHERE Variable_name IN (" + keys.map(() => "?").join(",") + ")";
+        const rows = await this.db.query(query, keys);
+        for (const row of rows) {
+            results[row.Variable_name] = row.Value;
+        }
+        return results;
+    }
+    async tryReadUserAccounts() {
+        try {
+            // We intentionally do NOT return authentication_string or password hashes.
+            const rows = await this.db.query(`
+        SELECT
+          User as user,
+          Host as host,
+          account_locked,
+          password_expired,
+          plugin
+        FROM mysql.user
+        WHERE User NOT IN ('mysql.sys', 'mysql.session', 'mysql.infoschema')
+      `);
+            const findings = [];
+            const anonymous = rows.filter((r) => !r.user);
+            if (anonymous.length > 0) {
+                findings.push({
+                    severity: "critical",
+                    title: "Anonymous MySQL user accounts detected",
+                    evidence: `Found ${anonymous.length} anonymous account(s) in mysql.user`,
+                    recommendation: "Remove anonymous users or lock them; restrict Host to localhost if required.",
+                });
+            }
+            const rootRemote = rows.filter((r) => (r.user || "").toLowerCase() === "root" && (r.host || "") !== "localhost");
+            if (rootRemote.length > 0) {
+                findings.push({
+                    severity: "high",
+                    title: "Remote root accounts detected",
+                    evidence: `root accounts with non-localhost Host found: ${rootRemote
+                        .slice(0, 5)
+                        .map((r) => `${r.user}@${r.host}`)
+                        .join(", ")}${rootRemote.length > 5 ? ", ..." : ""}`,
+                    recommendation: "Restrict root access to localhost or a tightly controlled admin network; use named admin accounts instead.",
+                });
+            }
+            const wildcardHosts = rows.filter((r) => (r.host || "") === "%");
+            if (wildcardHosts.length > 0) {
+                findings.push({
+                    severity: "medium",
+                    title: "User accounts with wildcard host (%) detected",
+                    evidence: `Accounts with Host='%': ${wildcardHosts
+                        .slice(0, 8)
+                        .map((r) => `${r.user}@${r.host}`)
+                        .join(", ")}${wildcardHosts.length > 8 ? ", ..." : ""}`,
+                    recommendation: "Prefer explicit Host values (specific IPs/subnets) instead of '%' where possible.",
+                });
+            }
+            const unlocked = rows.filter((r) => ("" + r.account_locked).toUpperCase() === "N");
+            if (unlocked.length > 0) {
+                findings.push({
+                    severity: "info",
+                    title: "Unlocked user accounts present",
+                    evidence: `Unlocked accounts count: ${unlocked.length}`,
+                    recommendation: "Ensure unused accounts are locked or removed, and use strong authentication plugins.",
+                });
+            }
+            return { status: "ok", findings };
+        }
+        catch (e) {
+            return {
+                status: "skipped",
+                note: `User/account checks skipped: insufficient privileges to read mysql.user (${e.message}).`,
+            };
+        }
+    }
+    async tryReadPrivilegeSummaries() {
+        try {
+            // These INFORMATION_SCHEMA views are generally less sensitive than mysql.user.
+            const schemaPriv = await this.db.query(`
+        SELECT GRANTEE as grantee, TABLE_SCHEMA as schema_name, PRIVILEGE_TYPE as privilege_type
+        FROM INFORMATION_SCHEMA.SCHEMA_PRIVILEGES
+        WHERE TABLE_SCHEMA NOT IN ('mysql','performance_schema','information_schema','sys')
+      `);
+            const findings = [];
+            const anyAll = schemaPriv.filter((r) => (r.privilege_type || "").toUpperCase() === "ALL PRIVILEGES");
+            if (anyAll.length > 0) {
+                findings.push({
+                    severity: "medium",
+                    title: "Broad schema privileges detected (ALL PRIVILEGES)",
+                    evidence: `Found ${anyAll.length} schema privilege rows with ALL PRIVILEGES`,
+                    recommendation: "Review and apply least privilege for schema-level grants; prefer role-based access.",
+                });
+            }
+            const grantOption = schemaPriv.filter((r) => (r.privilege_type || "").toUpperCase() === "GRANT OPTION");
+            if (grantOption.length > 0) {
+                findings.push({
+                    severity: "high",
+                    title: "GRANT OPTION detected in schema privileges",
+                    evidence: `Found ${grantOption.length} schema privilege rows with GRANT OPTION`,
+                    recommendation: "Minimize GRANT OPTION; it can allow privilege escalation if misassigned.",
+                });
+            }
+            return { status: "ok", findings };
+        }
+        catch (e) {
+            return {
+                status: "skipped",
+                note: `Privilege checks skipped: unable to read INFORMATION_SCHEMA privilege views (${e.message}).`,
+            };
+        }
+    }
+}
+exports.SecurityAuditTools = SecurityAuditTools;

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "mysql-mcp",
   "description": "A Model Context Protocol for MySQL database interaction",
-  "version": "1.13.0",
+  "version": "1.16.4",
   "tools": [
     {
       "name": "list_databases",
@@ -537,5 +537,85 @@
         }
       }
     }
+    ,
+    {
+      "name": "design_schema_from_requirements",
+      "description": "Designs a database schema from natural language requirements and outputs proposed DDL (does not execute).",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "requirements_text": { "type": "string" },
+          "entities": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": { "type": "string" },
+                "fields": { "type": "array", "items": { "type": "string" } }
+              },
+              "required": ["name"]
+            }
+          },
+          "naming_convention": { "type": "string", "enum": ["snake_case", "camelCase"] },
+          "include_audit_columns": { "type": "boolean" },
+          "id_type": { "type": "string", "enum": ["BIGINT", "UUID"] },
+          "engine": { "type": "string" },
+          "charset": { "type": "string" },
+          "collation": { "type": "string" }
+        },
+        "required": ["requirements_text"]
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": {
+          "status": { "type": "string" },
+          "data": { "type": "object" },
+          "error": { "type": ["string", "null"] }
+        }
+      }
+    },
+    {
+      "name": "audit_database_security",
+      "description": "Audits MySQL security configuration and (optionally) accounts/privileges using read-only inspection queries.",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "database": { "type": "string" },
+          "include_user_account_checks": { "type": "boolean" },
+          "include_privilege_checks": { "type": "boolean" }
+        }
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": {
+          "status": { "type": "string" },
+          "data": { "type": "object" },
+          "error": { "type": ["string", "null"] }
+        }
+      }
+    },
+    {
+      "name": "recommend_indexes",
+      "description": "Analyzes performance_schema query digests and suggests concrete CREATE INDEX statements.",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "database": { "type": "string" },
+          "max_query_patterns": { "type": "number" },
+          "max_recommendations": { "type": "number" },
+          "min_execution_count": { "type": "number" },
+          "min_avg_time_ms": { "type": "number" },
+          "include_unused_index_warnings": { "type": "boolean" }
+        }
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": {
+          "status": { "type": "string" },
+          "data": { "type": "object" },
+          "error": { "type": ["string", "null"] }
+        }
+      }
+    }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.16.2",
+  "version": "1.16.4",
   "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions, backup/restore, data import/export, and data migration capabilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,7 +15,7 @@
     "dev": "ts-node src/index.ts",
     "dev:mcp": "ts-node src/mcp-server.ts",
     "dev:api": "ts-node src/server.ts",
-    "test": "jest",
+    "test": "jest --passWithNoTests",
     "prepare": "npm run build",
     "prepublishOnly": "npm run build"
   },