@berthojoris/mcp-mysql-server 1.40.5 → 1.40.7

package/dist/tools/dataExportTools.js

@@ -62,6 +62,33 @@ class DataExportTools {
             .replace(/\0/g, "\\0");
         return `'${escaped}'`;
     }
+    escapeCsvValue(value) {
+        if (value === null || value === undefined)
+            return "";
+        const normalizedValue = value instanceof Date
+            ? value.toISOString()
+            : Buffer.isBuffer(value)
+                ? value.toString("base64")
+                : String(value);
+        if (/[",\r\n]/.test(normalizedValue)) {
+            return `"${normalizedValue.replace(/"/g, '""')}"`;
+        }
+        return normalizedValue;
+    }
+    rowsToCSV(rows, includeHeaders) {
+        if (rows.length === 0) {
+            return "";
+        }
+        const columns = Object.keys(rows[0]);
+        const csvRows = [];
+        if (includeHeaders) {
+            csvRows.push(columns.map((column) => this.escapeCsvValue(column)).join(","));
+        }
+        for (const row of rows) {
+            csvRows.push(columns.map((column) => this.escapeCsvValue(row[column])).join(","));
+        }
+        return `${csvRows.join("\n")}\n`;
+    }
     /**
      * Export table data to CSV format
      */
@@ -179,33 +206,7 @@ class DataExportTools {
                     },
                 };
             }
-            // Generate CSV
-            let csv = "";
-            // Add headers if requested
-            if (include_headers) {
-                const headers = Object.keys(results[0]).join(",");
-                csv += headers + "\n";
-            }
-            // Add data rows
-            for (const row of results) {
-                const values = Object.values(row)
-                    .map((value) => {
-                    if (value === null)
-                        return "";
-                    if (typeof value === "string") {
-                        // Escape quotes and wrap in quotes if contains comma or newline
-                        if (value.includes(",") ||
-                            value.includes("\n") ||
-                            value.includes('"')) {
-                            return `"${value.replace(/"/g, '""')}"`;
-                        }
-                        return value;
-                    }
-                    return String(value);
-                })
-                    .join(",");
-                csv += values + "\n";
-            }
+            const csv = this.rowsToCSV(results, include_headers);
             return {
                 status: "success",
                 data: {
@@ -221,5 +222,45 @@ class DataExportTools {
             };
         }
     }
+    async exportQueryToCSV(queryParams) {
+        try {
+            const { query, params = [], include_headers = true, } = queryParams;
+            const queryValidation = this.security.validateQuery(query, this.security.hasExecutePermission());
+            if (!queryValidation.valid) {
+                return {
+                    status: "error",
+                    error: `Query validation failed: ${queryValidation.error}`,
+                };
+            }
+            if (queryValidation.queryType !== "SELECT") {
+                return {
+                    status: "error",
+                    error: "export_query_to_csv only accepts SELECT queries.",
+                };
+            }
+            const paramValidation = this.security.validateParameters(params);
+            if (!paramValidation.valid) {
+                return {
+                    status: "error",
+                    error: `Parameter validation failed: ${paramValidation.error}`,
+                };
+            }
+            const results = await this.db.query(query, paramValidation.sanitizedParams, false);
+            const maskedResults = this.security.masking.processResults(results);
+            return {
+                status: "success",
+                data: {
+                    csv: this.rowsToCSV(maskedResults, include_headers),
+                    row_count: maskedResults.length,
+                },
+            };
+        }
+        catch (error) {
+            return {
+                status: "error",
+                error: error.message,
+            };
+        }
+    }
 }
 exports.DataExportTools = DataExportTools;

package/dist/tools/ddlTools.d.ts

@@ -7,6 +7,8 @@ export declare class DdlTools {
      * Sanitize default value for SQL safety
      */
     private sanitizeDefaultValue;
+    private validateColumnType;
+    private validateIdentifier;
     /**
      * Create a new table
      */

package/dist/tools/ddlTools.js

@@ -52,16 +52,59 @@ class DdlTools {
         // For other types, convert to string and escape
         return `'${String(defaultValue).replace(/\\/g, "\\\\").replace(/'/g, "''")}'`;
     }
+    validateColumnType(columnType) {
+        if (!columnType || typeof columnType !== "string") {
+            return { valid: false, error: "Column type must be a non-empty string" };
+        }
+        const normalizedType = columnType.trim().replace(/\s+/g, " ");
+        if (normalizedType.length > 128) {
+            return { valid: false, error: "Column type is too long" };
+        }
+        const safeTypePattern = /^(?:(?:TINY|SMALL|MEDIUM|BIG)?INT(?:EGER)?|DECIMAL|NUMERIC|FLOAT|DOUBLE(?: PRECISION)?|REAL|BIT|BOOL(?:EAN)?|CHAR|VARCHAR|BINARY|VARBINARY|TINYTEXT|TEXT|MEDIUMTEXT|LONGTEXT|TINYBLOB|BLOB|MEDIUMBLOB|LONGBLOB|DATE|DATETIME|TIMESTAMP|TIME|YEAR|JSON)(?:\s*\(\s*\d+(?:\s*,\s*\d+)?\s*\))?(?:\s+(?:UNSIGNED|ZEROFILL))*$/i;
+        if (!safeTypePattern.test(normalizedType)) {
+            return {
+                valid: false,
+                error: "Invalid or unsupported column type. Use a standard MySQL data type such as INT, VARCHAR(255), DECIMAL(10,2), TEXT, DATETIME, or JSON.",
+            };
+        }
+        return { valid: true };
+    }
+    validateIdentifier(identifier, label) {
+        const validation = this.security.validateIdentifier(identifier);
+        if (!validation.valid) {
+            return {
+                valid: false,
+                error: `Invalid ${label}: ${validation.error}`,
+            };
+        }
+        return { valid: true };
+    }
     /**
      * Create a new table
      */
     async createTable(params) {
         try {
             const { table_name, columns, indexes } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
+            if (!Array.isArray(columns) || columns.length === 0) {
+                return { status: "error", error: "At least one column is required" };
+            }
+            const escapedTableName = this.security.escapeIdentifier(table_name);
             // Build column definitions
             const columnDefs = columns
                 .map((col) => {
-                let def = `\`${col.name}\` ${col.type}`;
+                const columnValidation = this.validateIdentifier(col.name, "column name");
+                if (!columnValidation.valid) {
+                    throw new Error(columnValidation.error);
+                }
+                const typeValidation = this.validateColumnType(col.type);
+                if (!typeValidation.valid) {
+                    throw new Error(`Invalid column type for '${col.name}': ${typeValidation.error}`);
+                }
+                let def = `${this.security.escapeIdentifier(col.name)} ${col.type.trim()}`;
                 if (col.nullable === false) {
                     def += " NOT NULL";
                 }
@@ -80,16 +123,29 @@ class DdlTools {
             })
                 .join(", ");
             // Build the CREATE TABLE query
-            let query = `CREATE TABLE \`${table_name}\` (${columnDefs})`;
+            let query = `CREATE TABLE ${escapedTableName} (${columnDefs})`;
             // Execute the query
             await this.db.query(query);
             // Create indexes if specified
             let queryCount = 1;
             if (indexes && indexes.length > 0) {
                 for (const index of indexes) {
+                    const indexValidation = this.validateIdentifier(index.name, "index name");
+                    if (!indexValidation.valid) {
+                        return { status: "error", error: indexValidation.error };
+                    }
+                    if (!Array.isArray(index.columns) || index.columns.length === 0) {
+                        return { status: "error", error: "Index columns are required" };
+                    }
                     const indexType = index.unique ? "UNIQUE INDEX" : "INDEX";
-                    const indexColumns = index.columns.map((c) => `\`${c}\``).join(", ");
-                    const indexQuery = `CREATE ${indexType} \`${index.name}\` ON \`${table_name}\` (${indexColumns})`;
+                    const indexColumns = index.columns.map((c) => {
+                        const columnValidation = this.validateIdentifier(c, "index column name");
+                        if (!columnValidation.valid) {
+                            throw new Error(columnValidation.error);
+                        }
+                        return this.security.escapeIdentifier(c);
+                    }).join(", ");
+                    const indexQuery = `CREATE ${indexType} ${this.security.escapeIdentifier(index.name)} ON ${escapedTableName} (${indexColumns})`;
                     await this.db.query(indexQuery);
                     queryCount++;
                 }
@@ -115,8 +171,16 @@ class DdlTools {
     async alterTable(params) {
         try {
             const { table_name, operations } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
+            if (!Array.isArray(operations) || operations.length === 0) {
+                return { status: "error", error: "At least one alter operation is required" };
+            }
+            const escapedTableName = this.security.escapeIdentifier(table_name);
             for (const op of operations) {
-                let query = `ALTER TABLE \`${table_name}\``;
+                let query = `ALTER TABLE ${escapedTableName}`;
                 switch (op.type) {
                     case "add_column":
                         if (!op.column_name || !op.column_type) {
@@ -125,7 +189,13 @@ class DdlTools {
                                 error: "column_name and column_type required for add_column",
                             };
                         }
-                        query += ` ADD COLUMN \`${op.column_name}\` ${op.column_type}`;
+                        const addColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!addColumnValidation.valid)
+                            return { status: "error", error: addColumnValidation.error };
+                        const addTypeValidation = this.validateColumnType(op.column_type);
+                        if (!addTypeValidation.valid)
+                            return { status: "error", error: addTypeValidation.error };
+                        query += ` ADD COLUMN ${this.security.escapeIdentifier(op.column_name)} ${op.column_type.trim()}`;
                         if (op.nullable === false)
                             query += " NOT NULL";
                         if (op.default !== undefined) {
@@ -141,7 +211,10 @@ class DdlTools {
                                 error: "column_name required for drop_column",
                             };
                         }
-                        query += ` DROP COLUMN \`${op.column_name}\``;
+                        const dropColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!dropColumnValidation.valid)
+                            return { status: "error", error: dropColumnValidation.error };
+                        query += ` DROP COLUMN ${this.security.escapeIdentifier(op.column_name)}`;
                         break;
                     case "modify_column":
                         if (!op.column_name || !op.column_type) {
@@ -150,7 +223,13 @@ class DdlTools {
                                 error: "column_name and column_type required for modify_column",
                             };
                         }
-                        query += ` MODIFY COLUMN \`${op.column_name}\` ${op.column_type}`;
+                        const modifyColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!modifyColumnValidation.valid)
+                            return { status: "error", error: modifyColumnValidation.error };
+                        const modifyTypeValidation = this.validateColumnType(op.column_type);
+                        if (!modifyTypeValidation.valid)
+                            return { status: "error", error: modifyTypeValidation.error };
+                        query += ` MODIFY COLUMN ${this.security.escapeIdentifier(op.column_name)} ${op.column_type.trim()}`;
                         if (op.nullable === false)
                             query += " NOT NULL";
                         if (op.default !== undefined) {
@@ -166,7 +245,16 @@ class DdlTools {
                                 error: "column_name, new_column_name, and column_type required for rename_column",
                             };
                         }
-                        query += ` CHANGE COLUMN \`${op.column_name}\` \`${op.new_column_name}\` ${op.column_type}`;
+                        const oldColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!oldColumnValidation.valid)
+                            return { status: "error", error: oldColumnValidation.error };
+                        const newColumnValidation = this.validateIdentifier(op.new_column_name, "new column name");
+                        if (!newColumnValidation.valid)
+                            return { status: "error", error: newColumnValidation.error };
+                        const renameTypeValidation = this.validateColumnType(op.column_type);
+                        if (!renameTypeValidation.valid)
+                            return { status: "error", error: renameTypeValidation.error };
+                        query += ` CHANGE COLUMN ${this.security.escapeIdentifier(op.column_name)} ${this.security.escapeIdentifier(op.new_column_name)} ${op.column_type.trim()}`;
                         break;
                     case "add_index":
                         if (!op.index_name || !op.index_columns) {
@@ -175,9 +263,18 @@ class DdlTools {
                                 error: "index_name and index_columns required for add_index",
                             };
                         }
+                        const addIndexValidation = this.validateIdentifier(op.index_name, "index name");
+                        if (!addIndexValidation.valid)
+                            return { status: "error", error: addIndexValidation.error };
                         const indexType = op.unique ? "UNIQUE INDEX" : "INDEX";
-                        const columns = op.index_columns.map((c) => `\`${c}\``).join(", ");
-                        query += ` ADD ${indexType} \`${op.index_name}\` (${columns})`;
+                        const columns = op.index_columns.map((c) => {
+                            const columnValidation = this.validateIdentifier(c, "index column name");
+                            if (!columnValidation.valid) {
+                                throw new Error(columnValidation.error);
+                            }
+                            return this.security.escapeIdentifier(c);
+                        }).join(", ");
+                        query += ` ADD ${indexType} ${this.security.escapeIdentifier(op.index_name)} (${columns})`;
                         break;
                     case "drop_index":
                         if (!op.index_name) {
@@ -186,7 +283,10 @@ class DdlTools {
                                 error: "index_name required for drop_index",
                             };
                         }
-                        query += ` DROP INDEX \`${op.index_name}\``;
+                        const dropIndexValidation = this.validateIdentifier(op.index_name, "index name");
+                        if (!dropIndexValidation.valid)
+                            return { status: "error", error: dropIndexValidation.error };
+                        query += ` DROP INDEX ${this.security.escapeIdentifier(op.index_name)}`;
                         break;
                     default:
                         return {
@@ -218,8 +318,12 @@ class DdlTools {
     async dropTable(params) {
         try {
             const { table_name, if_exists } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
             const ifExistsClause = if_exists ? "IF EXISTS " : "";
-            const query = `DROP TABLE ${ifExistsClause}\`${table_name}\``;
+            const query = `DROP TABLE ${ifExistsClause}${this.security.escapeIdentifier(table_name)}`;
             await this.db.query(query);
             return {
                 status: "success",
@@ -242,13 +346,14 @@ class DdlTools {
     async executeDdl(params) {
         try {
             const { query } = params;
-            // Basic validation - ensure it's a DDL query
-            const upperQuery = query.trim().toUpperCase();
-            const isDdl = upperQuery.startsWith("CREATE") ||
-                upperQuery.startsWith("ALTER") ||
-                upperQuery.startsWith("DROP") ||
-                upperQuery.startsWith("TRUNCATE") ||
-                upperQuery.startsWith("RENAME");
+            const queryValidation = this.security.validateQuery(query);
+            if (!queryValidation.valid) {
+                return {
+                    status: "error",
+                    error: `DDL validation failed: ${queryValidation.error}`,
+                };
+            }
+            const isDdl = ["CREATE", "ALTER", "DROP", "TRUNCATE", "RENAME"].includes(queryValidation.queryType || "");
             if (!isDdl) {
                 return {
                     status: "error",

package/dist/tools/toolArgumentValidation.js

@@ -19,6 +19,11 @@ function validateToolArguments(name, args) {
             case "execute_write_query":
             case "execute_ddl":
                 return (0, inputValidation_js_1.validateQuery)({ query: args?.query || "" });
+            case "export_query_to_csv":
+                return (0, inputValidation_js_1.validateQuery)({
+                    query: args?.query || "",
+                    params: args?.params,
+                });
             case "bulk_insert":
                 return (0, inputValidation_js_1.validateBulkInsert)(args);
             case "list_tables":

package/dist/tools/utilityTools.d.ts

@@ -1,3 +1,17 @@
+interface RuntimeToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema?: any;
+    input_schema?: any;
+    output_schema?: any;
+}
+interface ListAllToolsOptions {
+    tools?: RuntimeToolDefinition[];
+    enabledToolNames?: string[];
+    accessProfile?: any;
+    serverName?: string;
+    serverVersion?: string;
+}
 export declare class UtilityTools {
     private db;
     constructor();
@@ -41,7 +55,7 @@ export declare class UtilityTools {
     /**
      * Lists all available tools in this MySQL MCP server
      */
-    listAllTools(): Promise<{
+    listAllTools(params?: ListAllToolsOptions): Promise<{
         status: string;
         data?: any;
         error?: string;
@@ -58,3 +72,4 @@ export declare class UtilityTools {
         error?: string;
     }>;
 }
+export {};

package/dist/tools/utilityTools.js

@@ -295,33 +295,88 @@ class UtilityTools {
     /**
      * Lists all available tools in this MySQL MCP server
      */
-    async listAllTools() {
+    async listAllTools(params) {
         try {
-            // Read manifest.json to get tool definitions
-            const manifestPath = path_1.default.resolve(__dirname, "..", "..", "manifest.json");
-            if (!fs_1.default.existsSync(manifestPath)) {
-                return {
-                    status: "error",
-                    error: "manifest.json not found in project root.",
-                };
+            let source = "runtime";
+            let serverName = params?.serverName || "mysql-mcp-server";
+            let serverVersion = params?.serverVersion || "unknown";
+            let toolDefinitions = params?.tools || [];
+            if (toolDefinitions.length === 0) {
+                const manifestPath = path_1.default.resolve(__dirname, "..", "..", "manifest.json");
+                if (!fs_1.default.existsSync(manifestPath)) {
+                    return {
+                        status: "error",
+                        error: "Runtime tool catalog was not supplied and manifest.json was not found.",
+                    };
+                }
+                const manifest = JSON.parse(fs_1.default.readFileSync(manifestPath, "utf-8"));
+                source = "manifest_fallback";
+                serverName = manifest.name || serverName;
+                serverVersion = manifest.version || serverVersion;
+                toolDefinitions = manifest.tools || [];
             }
-            const manifestContent = fs_1.default.readFileSync(manifestPath, "utf-8");
-            const manifest = JSON.parse(manifestContent);
-            const tools = manifest.tools.map((tool) => ({
+            const enabledToolNames = new Set(params?.enabledToolNames || toolDefinitions.map((tool) => tool.name));
+            const tools = toolDefinitions.map((tool) => ({
                 name: tool.name,
                 description: tool.description,
-                input_schema: tool.input_schema,
-                output_schema: tool.output_schema
+                enabled: enabledToolNames.has(tool.name),
+                input_schema: tool.inputSchema || tool.input_schema || {},
+                output_schema: tool.output_schema || { type: "object" },
             }));
             return {
                 status: "success",
                 data: {
+                    source,
                     total_tools: tools.length,
-                    server_name: manifest.name,
-                    server_version: manifest.version,
-                    server_description: manifest.description,
-                    tools: tools
-                }
+                    enabled_tools: tools.filter((tool) => tool.enabled).length,
+                    disabled_tools: tools.filter((tool) => !tool.enabled).length,
+                    server_name: serverName,
+                    server_version: serverVersion,
+                    access_profile: params?.accessProfile,
+                    agent_guidance: {
+                        recommended_first_calls: [
+                            "describe_connection",
+                            "list_databases",
+                            "list_tables",
+                            "get_schema_rag_context",
+                        ],
+                        workflows: {
+                            explore_schema: [
+                                "describe_connection",
+                                "list_tables",
+                                "get_database_summary",
+                                "get_schema_rag_context",
+                            ],
+                            inspect_table: [
+                                "read_table_schema",
+                                "get_column_statistics",
+                                "read_records",
+                            ],
+                            run_safe_query: [
+                                "get_schema_rag_context",
+                                "run_select_query with dry_run=true",
+                                "run_select_query",
+                            ],
+                            export_data: [
+                                "export_table_to_csv for simple table exports",
+                                "export_query_to_csv for SELECT query exports",
+                            ],
+                            modify_data: [
+                                "begin_transaction",
+                                "execute_in_transaction",
+                                "commit_transaction or rollback_transaction",
+                            ],
+                        },
+                        selection_rules: [
+                            "Use get_schema_rag_context before generating SQL to reduce token usage.",
+                            "Use run_select_query only for SELECT statements.",
+                            "Use execute_write_query for INSERT, UPDATE, and DELETE.",
+                            "Use execute_ddl only for CREATE, ALTER, DROP, TRUNCATE, and RENAME.",
+                            "Prefer structured tools over raw SQL when possible.",
+                        ],
+                    },
+                    tools,
+                },
             };
         }
         catch (error) {