@berthojoris/mcp-mysql-server 1.4.2 → 1.4.4

package/dist/security/securityLayer.d.ts

@@ -1,4 +1,4 @@
-import { FeatureConfig } from '../config/featureConfig.js';
+import { FeatureConfig } from "../config/featureConfig.js";
 export declare class SecurityLayer {
     private ajv;
     private readonly dangerousKeywords;
@@ -22,8 +22,10 @@ export declare class SecurityLayer {
     };
     /**
      * Validate SQL query for security issues
+     * @param query - The SQL query to validate
+     * @param bypassDangerousCheck - If true, skips dangerous keyword check (for users with 'execute' permission)
      */
-    validateQuery(query: string): {
+    validateQuery(query: string, bypassDangerousCheck?: boolean): {
         valid: boolean;
         error?: string;
         queryType?: string;
@@ -44,6 +46,10 @@ export declare class SecurityLayer {
      * Check if a query contains dangerous operations
      */
     hasDangerousOperations(query: string): boolean;
+    /**
+     * Check if execute permission is enabled
+     */
+    hasExecutePermission(): boolean;
     /**
      * Escape identifier for safe use in SQL queries
      */

package/dist/security/securityLayer.js

@@ -10,18 +10,24 @@ class SecurityLayer {
     constructor(featureConfig) {
         this.ajv = new ajv_1.default();
         this.featureConfig = featureConfig || new featureConfig_js_1.FeatureConfig();
-        // Define dangerous SQL keywords that should always be blocked (security threats)
+        // Define dangerous SQL keywords that should ALWAYS be blocked (critical security threats)
+        // These are blocked even with 'execute' permission
         this.dangerousKeywords = [
-            'GRANT', 'REVOKE', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE',
-            'LOAD DATA', 'INFORMATION_SCHEMA', 'MYSQL', 'PERFORMANCE_SCHEMA',
-            'SYS', 'SHOW', 'DESCRIBE', 'DESC', 'EXPLAIN', 'PROCEDURE',
-            'FUNCTION', 'TRIGGER', 'EVENT', 'VIEW', 'INDEX', 'DATABASE',
-            'SCHEMA', 'USER', 'PASSWORD', 'SLEEP', 'BENCHMARK'
+            "GRANT",
+            "REVOKE",
+            "INTO OUTFILE",
+            "INTO DUMPFILE",
+            "LOAD DATA",
+            "MYSQL",
+            "PERFORMANCE_SCHEMA",
+            "SYS",
+            "USER",
+            "PASSWORD",
         ];
         // Define basic allowed SQL operations
-        this.allowedOperations = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];
+        this.allowedOperations = ["SELECT", "INSERT", "UPDATE", "DELETE"];
         // Define DDL operations that require special permission
-        this.ddlOperations = ['CREATE', 'ALTER', 'DROP', 'TRUNCATE', 'RENAME'];
+        this.ddlOperations = ["CREATE", "ALTER", "DROP", "TRUNCATE", "RENAME"];
     }
     /**
      * Validate input against a JSON schema
@@ -32,7 +38,7 @@ class SecurityLayer {
         if (!valid) {
             return {
                 valid: false,
-                errors: validate.errors
+                errors: validate.errors,
             };
         }
         return { valid: true };
@@ -41,52 +47,88 @@ class SecurityLayer {
      * Validate and sanitize table/column names to prevent SQL injection
      */
     validateIdentifier(identifier) {
-        if (!identifier || typeof identifier !== 'string') {
-            return { valid: false, error: 'Identifier must be a non-empty string' };
+        if (!identifier || typeof identifier !== "string") {
+            return { valid: false, error: "Identifier must be a non-empty string" };
         }
         // Check length
         if (identifier.length > 64) {
-            return { valid: false, error: 'Identifier too long (max 64 characters)' };
+            return { valid: false, error: "Identifier too long (max 64 characters)" };
         }
         // MySQL identifier rules: alphanumeric, underscore, dollar sign
         // Must start with letter, underscore, or dollar sign
         const identifierRegex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
         if (!identifierRegex.test(identifier)) {
-            return { valid: false, error: 'Invalid identifier format' };
+            return { valid: false, error: "Invalid identifier format" };
         }
         // Check against MySQL reserved words (basic list)
         const reservedWords = [
-            'SELECT', 'INSERT', 'UPDATE', 'DELETE', 'FROM', 'WHERE', 'JOIN',
-            'INNER', 'LEFT', 'RIGHT', 'OUTER', 'ON', 'AS', 'AND', 'OR', 'NOT',
-            'NULL', 'TRUE', 'FALSE', 'ORDER', 'BY', 'GROUP', 'HAVING', 'LIMIT',
-            'OFFSET', 'DISTINCT', 'ALL', 'EXISTS', 'IN', 'BETWEEN', 'LIKE',
-            'REGEXP', 'CASE', 'WHEN', 'THEN', 'ELSE', 'END', 'IF', 'IFNULL'
+            "SELECT",
+            "INSERT",
+            "UPDATE",
+            "DELETE",
+            "FROM",
+            "WHERE",
+            "JOIN",
+            "INNER",
+            "LEFT",
+            "RIGHT",
+            "OUTER",
+            "ON",
+            "AS",
+            "AND",
+            "OR",
+            "NOT",
+            "NULL",
+            "TRUE",
+            "FALSE",
+            "ORDER",
+            "BY",
+            "GROUP",
+            "HAVING",
+            "LIMIT",
+            "OFFSET",
+            "DISTINCT",
+            "ALL",
+            "EXISTS",
+            "IN",
+            "BETWEEN",
+            "LIKE",
+            "REGEXP",
+            "CASE",
+            "WHEN",
+            "THEN",
+            "ELSE",
+            "END",
+            "IF",
+            "IFNULL",
         ];
         if (reservedWords.includes(identifier.toUpperCase())) {
-            return { valid: false, error: 'Identifier cannot be a reserved word' };
+            return { valid: false, error: "Identifier cannot be a reserved word" };
         }
         return { valid: true };
     }
     /**
      * Validate SQL query for security issues
+     * @param query - The SQL query to validate
+     * @param bypassDangerousCheck - If true, skips dangerous keyword check (for users with 'execute' permission)
      */
-    validateQuery(query) {
-        if (!query || typeof query !== 'string') {
-            return { valid: false, error: 'Query must be a non-empty string' };
+    validateQuery(query, bypassDangerousCheck = false) {
+        if (!query || typeof query !== "string") {
+            return { valid: false, error: "Query must be a non-empty string" };
         }
         const trimmedQuery = query.trim().toUpperCase();
         // Check for empty query
         if (trimmedQuery.length === 0) {
-            return { valid: false, error: 'Query cannot be empty' };
+            return { valid: false, error: "Query cannot be empty" };
         }
         // Check for multiple statements (basic check)
-        if (query.includes(';') && !query.trim().endsWith(';')) {
-            return { valid: false, error: 'Multiple statements not allowed' };
+        if (query.includes(";") && !query.trim().endsWith(";")) {
+            return { valid: false, error: "Multiple statements not allowed" };
         }
         // Remove trailing semicolon for analysis
-        const cleanQuery = trimmedQuery.replace(/;$/, '');
+        const cleanQuery = trimmedQuery.replace(/;$/, "");
         // Determine query type - check basic operations first
-        let queryType = '';
+        let queryType = "";
         for (const operation of this.allowedOperations) {
             if (cleanQuery.startsWith(operation)) {
                 queryType = operation;
@@ -105,35 +147,50 @@ class SecurityLayer {
                     else {
                         return {
                             valid: false,
-                            error: `DDL operation '${ddlOp}' requires 'ddl' permission. Add 'ddl' to your permissions configuration.`
+                            error: `DDL operation '${ddlOp}' requires 'ddl' permission. Add 'ddl' to your permissions configuration.`,
                         };
                     }
                 }
             }
         }
         if (!queryType) {
-            return { valid: false, error: 'Query type not allowed' };
+            return { valid: false, error: "Query type not allowed" };
         }
-        // Check for dangerous keywords (always blocked regardless of permissions)
-        for (const keyword of this.dangerousKeywords) {
-            if (cleanQuery.includes(keyword)) {
-                return { valid: false, error: `Dangerous keyword detected: ${keyword}` };
+        // Check for dangerous keywords (blocked unless user has 'execute' permission)
+        // When bypassDangerousCheck is true (user has 'execute' permission), skip this check
+        if (!bypassDangerousCheck) {
+            for (const keyword of this.dangerousKeywords) {
+                if (cleanQuery.includes(keyword)) {
+                    return {
+                        valid: false,
+                        error: `Dangerous keyword detected: ${keyword}. This requires 'execute' permission.`,
+                    };
+                }
             }
         }
         // Additional checks for specific query types
-        if (queryType === 'SELECT') {
+        // Only enforce these restrictions when user doesn't have 'execute' permission
+        if (queryType === "SELECT" && !bypassDangerousCheck) {
             // Check for UNION attacks
-            if (cleanQuery.includes('UNION')) {
-                return { valid: false, error: 'UNION operations not allowed' };
+            if (cleanQuery.includes("UNION")) {
+                return {
+                    valid: false,
+                    error: "UNION operations not allowed without 'execute' permission",
+                };
             }
             // Check for subqueries in FROM clause (basic check)
-            if (cleanQuery.includes('FROM (')) {
-                return { valid: false, error: 'Subqueries in FROM clause not allowed' };
+            if (cleanQuery.includes("FROM (")) {
+                return {
+                    valid: false,
+                    error: "Subqueries in FROM clause not allowed without 'execute' permission",
+                };
             }
         }
         // Check for comment-based injection attempts
-        if (cleanQuery.includes('/*') || cleanQuery.includes('--') || cleanQuery.includes('#')) {
-            return { valid: false, error: 'Comments not allowed in queries' };
+        if (cleanQuery.includes("/*") ||
+            cleanQuery.includes("--") ||
+            cleanQuery.includes("#")) {
+            return { valid: false, error: "Comments not allowed in queries" };
         }
         return { valid: true, queryType };
     }
@@ -145,7 +202,7 @@ class SecurityLayer {
             return { valid: true, sanitizedParams: [] };
         }
         if (!Array.isArray(params)) {
-            return { valid: false, error: 'Parameters must be an array' };
+            return { valid: false, error: "Parameters must be an array" };
         }
         const sanitizedParams = [];
         for (let i = 0; i < params.length; i++) {
@@ -156,29 +213,38 @@ class SecurityLayer {
                 continue;
             }
             // Validate based on type
-            if (typeof param === 'string') {
+            if (typeof param === "string") {
                 // Check string length
                 if (param.length > 65535) {
-                    return { valid: false, error: `Parameter ${i} too long (max 65535 characters)` };
+                    return {
+                        valid: false,
+                        error: `Parameter ${i} too long (max 65535 characters)`,
+                    };
                 }
                 // Don't modify strings - let MySQL handle escaping through prepared statements
                 sanitizedParams.push(param);
             }
-            else if (typeof param === 'number') {
+            else if (typeof param === "number") {
                 // Validate number
                 if (!Number.isFinite(param)) {
-                    return { valid: false, error: `Parameter ${i} must be a finite number` };
+                    return {
+                        valid: false,
+                        error: `Parameter ${i} must be a finite number`,
+                    };
                 }
                 sanitizedParams.push(param);
             }
-            else if (typeof param === 'boolean') {
+            else if (typeof param === "boolean") {
                 sanitizedParams.push(param);
             }
             else if (param instanceof Date) {
                 sanitizedParams.push(param);
             }
             else {
-                return { valid: false, error: `Parameter ${i} has unsupported type: ${typeof param}` };
+                return {
+                    valid: false,
+                    error: `Parameter ${i} has unsupported type: ${typeof param}`,
+                };
             }
         }
         return { valid: true, sanitizedParams };
@@ -188,7 +254,7 @@ class SecurityLayer {
      */
     isReadOnlyQuery(query) {
         const validation = this.validateQuery(query);
-        return validation.valid && validation.queryType === 'SELECT';
+        return validation.valid && validation.queryType === "SELECT";
     }
     /**
      * Check if a query contains dangerous operations
@@ -197,6 +263,12 @@ class SecurityLayer {
         const validation = this.validateQuery(query);
         return !validation.valid;
     }
+    /**
+     * Check if execute permission is enabled
+     */
+    hasExecutePermission() {
+        return this.featureConfig.isCategoryEnabled(featureConfig_js_1.ToolCategory.EXECUTE);
+    }
     /**
      * Escape identifier for safe use in SQL queries
      */

package/dist/tools/queryTools.d.ts

@@ -1,4 +1,4 @@
-import SecurityLayer from '../security/securityLayer';
+import SecurityLayer from "../security/securityLayer";
 export declare class QueryTools {
     private db;
     private security;

package/dist/tools/queryTools.js

@@ -18,46 +18,49 @@ class QueryTools {
         // Validate input schema
         if (!(0, schemas_1.validateRunQuery)(queryParams)) {
             return {
-                status: 'error',
-                error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateRunQuery.errors)
+                status: "error",
+                error: "Invalid parameters: " + JSON.stringify(schemas_1.validateRunQuery.errors),
             };
         }
         try {
             const { query, params = [] } = queryParams;
+            // Check if user has execute permission to bypass dangerous keyword checks
+            const hasExecutePermission = this.security.hasExecutePermission();
             // Validate query using security layer
-            const queryValidation = this.security.validateQuery(query);
+            // If user has execute permission, allow advanced SQL features
+            const queryValidation = this.security.validateQuery(query, hasExecutePermission);
             if (!queryValidation.valid) {
                 return {
-                    status: 'error',
-                    error: `Query validation failed: ${queryValidation.error}`
+                    status: "error",
+                    error: `Query validation failed: ${queryValidation.error}`,
                 };
             }
             // Ensure it's a SELECT query
-            if (queryValidation.queryType !== 'SELECT') {
+            if (queryValidation.queryType !== "SELECT") {
                 return {
-                    status: 'error',
-                    error: 'Only SELECT queries are allowed with runQuery. Use executeSql for other operations.'
+                    status: "error",
+                    error: "Only SELECT queries are allowed with runQuery. Use executeSql for other operations.",
                 };
             }
             // Validate parameters
             const paramValidation = this.security.validateParameters(params);
             if (!paramValidation.valid) {
                 return {
-                    status: 'error',
-                    error: `Parameter validation failed: ${paramValidation.error}`
+                    status: "error",
+                    error: `Parameter validation failed: ${paramValidation.error}`,
                 };
             }
             // Execute the query with sanitized parameters
             const results = await this.db.query(query, paramValidation.sanitizedParams);
             return {
-                status: 'success',
-                data: results
+                status: "success",
+                data: results,
             };
         }
         catch (error) {
             return {
-                status: 'error',
-                error: error.message
+                status: "error",
+                error: error.message,
             };
         }
     }
@@ -69,49 +72,50 @@ class QueryTools {
         // Validate input schema
         if (!(0, schemas_1.validateRunQuery)(queryParams)) {
             return {
-                status: 'error',
-                error: 'Invalid parameters: ' + JSON.stringify(schemas_1.validateRunQuery.errors)
+                status: "error",
+                error: "Invalid parameters: " + JSON.stringify(schemas_1.validateRunQuery.errors),
             };
         }
         try {
             const { query, params = [] } = queryParams;
             // Validate query using security layer
-            const queryValidation = this.security.validateQuery(query);
+            // Pass true for bypassDangerousCheck since this is executeSql (requires 'execute' permission)
+            const queryValidation = this.security.validateQuery(query, true);
             if (!queryValidation.valid) {
                 return {
-                    status: 'error',
-                    error: `Query validation failed: ${queryValidation.error}`
+                    status: "error",
+                    error: `Query validation failed: ${queryValidation.error}`,
                 };
             }
             // Ensure it's not a SELECT query (use runQuery for that)
-            if (queryValidation.queryType === 'SELECT') {
+            if (queryValidation.queryType === "SELECT") {
                 return {
-                    status: 'error',
-                    error: 'SELECT queries should use runQuery method instead of executeSql.'
+                    status: "error",
+                    error: "SELECT queries should use runQuery method instead of executeSql.",
                 };
             }
             // Validate parameters
             const paramValidation = this.security.validateParameters(params);
             if (!paramValidation.valid) {
                 return {
-                    status: 'error',
-                    error: `Parameter validation failed: ${paramValidation.error}`
+                    status: "error",
+                    error: `Parameter validation failed: ${paramValidation.error}`,
                 };
             }
             // Execute the query with sanitized parameters
             const result = await this.db.query(query, paramValidation.sanitizedParams);
             return {
-                status: 'success',
+                status: "success",
                 data: {
                     affectedRows: result.affectedRows || 0,
-                    insertId: result.insertId || null
-                }
+                    insertId: result.insertId || null,
+                },
             };
         }
         catch (error) {
             return {
-                status: 'error',
-                error: error.message
+                status: "error",
+                error: error.message,
             };
         }
     }

package/package.json

@@ -1,86 +1,86 @@
-{
-  "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.4.2",
-  "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions and data export capabilities",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "bin": {
-    "mcp-mysql": "./bin/mcp-mysql.js"
-  },
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/server.js",
-    "start:mcp": "node dist/mcp-server.js",
-    "start:api": "node dist/server.js",
-    "dev": "ts-node src/index.ts",
-    "dev:mcp": "ts-node src/mcp-server.ts",
-    "dev:api": "ts-node src/server.ts",
-    "test": "jest",
-    "prepare": "npm run build",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "mcp",
-    "mysql",
-    "database",
-    "llm",
-    "ai",
-    "model-context-protocol",
-    "claude",
-    "cline",
-    "windsurf",
-    "agent",
-    "database-tools",
-    "sql",
-    "mysql-client",
-    "ai-tools"
-  ],
-  "author": "Bertho Joris <berthojoris@gmail.com>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/berthojoris/mysql-mcp.git"
-  },
-  "bugs": {
-    "url": "https://github.com/berthojoris/mysql-mcp/issues"
-  },
-  "homepage": "https://github.com/berthojoris/mysql-mcp#readme",
-  "files": [
-    "dist",
-    "bin",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    "manifest.json"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.20.0",
-    "ajv": "^8.12.0",
-    "cors": "^2.8.5",
-    "dotenv": "^16.3.1",
-    "express": "^4.18.2",
-    "express-rate-limit": "^7.1.5",
-    "helmet": "^7.1.0",
-    "jsonwebtoken": "^9.0.2",
-    "morgan": "^1.10.0",
-    "mysql2": "^3.6.1",
-    "winston": "^3.11.0"
-  },
-  "devDependencies": {
-    "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/helmet": "^0.0.48",
-    "@types/jest": "^29.5.4",
-    "@types/jsonwebtoken": "^9.0.5",
-    "@types/morgan": "^1.9.9",
-    "@types/node": "^20.6.0",
-    "@types/winston": "^2.4.4",
-    "jest": "^29.6.4",
-    "ts-jest": "^29.1.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.2.2"
-  }
-}
+{
+  "name": "@berthojoris/mcp-mysql-server",
+  "version": "1.4.4",
+  "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions and data export capabilities",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "mcp-mysql": "./bin/mcp-mysql.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/server.js",
+    "start:mcp": "node dist/mcp-server.js",
+    "start:api": "node dist/server.js",
+    "dev": "ts-node src/index.ts",
+    "dev:mcp": "ts-node src/mcp-server.ts",
+    "dev:api": "ts-node src/server.ts",
+    "test": "jest",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "mysql",
+    "database",
+    "llm",
+    "ai",
+    "model-context-protocol",
+    "claude",
+    "cline",
+    "windsurf",
+    "agent",
+    "database-tools",
+    "sql",
+    "mysql-client",
+    "ai-tools"
+  ],
+  "author": "Bertho Joris <berthojoris@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/berthojoris/mysql-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/berthojoris/mysql-mcp/issues"
+  },
+  "homepage": "https://github.com/berthojoris/mysql-mcp#readme",
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "manifest.json"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.20.0",
+    "ajv": "^8.12.0",
+    "cors": "^2.8.5",
+    "dotenv": "^16.3.1",
+    "express": "^4.18.2",
+    "express-rate-limit": "^7.1.5",
+    "helmet": "^7.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "morgan": "^1.10.0",
+    "mysql2": "^3.6.1",
+    "winston": "^3.11.0"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.17",
+    "@types/express": "^4.17.21",
+    "@types/helmet": "^0.0.48",
+    "@types/jest": "^29.5.4",
+    "@types/jsonwebtoken": "^9.0.5",
+    "@types/morgan": "^1.9.9",
+    "@types/node": "^20.6.0",
+    "@types/winston": "^2.4.4",
+    "jest": "^29.6.4",
+    "ts-jest": "^29.1.1",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.2.2"
+  }
+}