@berthojoris/mcp-mysql-server 1.40.6 → 1.42.0

package/dist/tools/ddlTools.js

@@ -52,16 +52,59 @@ class DdlTools {
         // For other types, convert to string and escape
         return `'${String(defaultValue).replace(/\\/g, "\\\\").replace(/'/g, "''")}'`;
     }
+    validateColumnType(columnType) {
+        if (!columnType || typeof columnType !== "string") {
+            return { valid: false, error: "Column type must be a non-empty string" };
+        }
+        const normalizedType = columnType.trim().replace(/\s+/g, " ");
+        if (normalizedType.length > 128) {
+            return { valid: false, error: "Column type is too long" };
+        }
+        const safeTypePattern = /^(?:(?:TINY|SMALL|MEDIUM|BIG)?INT(?:EGER)?|DECIMAL|NUMERIC|FLOAT|DOUBLE(?: PRECISION)?|REAL|BIT|BOOL(?:EAN)?|CHAR|VARCHAR|BINARY|VARBINARY|TINYTEXT|TEXT|MEDIUMTEXT|LONGTEXT|TINYBLOB|BLOB|MEDIUMBLOB|LONGBLOB|DATE|DATETIME|TIMESTAMP|TIME|YEAR|JSON)(?:\s*\(\s*\d+(?:\s*,\s*\d+)?\s*\))?(?:\s+(?:UNSIGNED|ZEROFILL))*$/i;
+        if (!safeTypePattern.test(normalizedType)) {
+            return {
+                valid: false,
+                error: "Invalid or unsupported column type. Use a standard MySQL data type such as INT, VARCHAR(255), DECIMAL(10,2), TEXT, DATETIME, or JSON.",
+            };
+        }
+        return { valid: true };
+    }
+    validateIdentifier(identifier, label) {
+        const validation = this.security.validateIdentifier(identifier);
+        if (!validation.valid) {
+            return {
+                valid: false,
+                error: `Invalid ${label}: ${validation.error}`,
+            };
+        }
+        return { valid: true };
+    }
     /**
      * Create a new table
      */
     async createTable(params) {
         try {
             const { table_name, columns, indexes } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
+            if (!Array.isArray(columns) || columns.length === 0) {
+                return { status: "error", error: "At least one column is required" };
+            }
+            const escapedTableName = this.security.escapeIdentifier(table_name);
             // Build column definitions
             const columnDefs = columns
                 .map((col) => {
-                let def = `\`${col.name}\` ${col.type}`;
+                const columnValidation = this.validateIdentifier(col.name, "column name");
+                if (!columnValidation.valid) {
+                    throw new Error(columnValidation.error);
+                }
+                const typeValidation = this.validateColumnType(col.type);
+                if (!typeValidation.valid) {
+                    throw new Error(`Invalid column type for '${col.name}': ${typeValidation.error}`);
+                }
+                let def = `${this.security.escapeIdentifier(col.name)} ${col.type.trim()}`;
                 if (col.nullable === false) {
                     def += " NOT NULL";
                 }
@@ -80,16 +123,29 @@ class DdlTools {
             })
                 .join(", ");
             // Build the CREATE TABLE query
-            let query = `CREATE TABLE \`${table_name}\` (${columnDefs})`;
+            let query = `CREATE TABLE ${escapedTableName} (${columnDefs})`;
             // Execute the query
             await this.db.query(query);
             // Create indexes if specified
             let queryCount = 1;
             if (indexes && indexes.length > 0) {
                 for (const index of indexes) {
+                    const indexValidation = this.validateIdentifier(index.name, "index name");
+                    if (!indexValidation.valid) {
+                        return { status: "error", error: indexValidation.error };
+                    }
+                    if (!Array.isArray(index.columns) || index.columns.length === 0) {
+                        return { status: "error", error: "Index columns are required" };
+                    }
                     const indexType = index.unique ? "UNIQUE INDEX" : "INDEX";
-                    const indexColumns = index.columns.map((c) => `\`${c}\``).join(", ");
-                    const indexQuery = `CREATE ${indexType} \`${index.name}\` ON \`${table_name}\` (${indexColumns})`;
+                    const indexColumns = index.columns.map((c) => {
+                        const columnValidation = this.validateIdentifier(c, "index column name");
+                        if (!columnValidation.valid) {
+                            throw new Error(columnValidation.error);
+                        }
+                        return this.security.escapeIdentifier(c);
+                    }).join(", ");
+                    const indexQuery = `CREATE ${indexType} ${this.security.escapeIdentifier(index.name)} ON ${escapedTableName} (${indexColumns})`;
                     await this.db.query(indexQuery);
                     queryCount++;
                 }
@@ -115,8 +171,16 @@ class DdlTools {
     async alterTable(params) {
         try {
             const { table_name, operations } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
+            if (!Array.isArray(operations) || operations.length === 0) {
+                return { status: "error", error: "At least one alter operation is required" };
+            }
+            const escapedTableName = this.security.escapeIdentifier(table_name);
             for (const op of operations) {
-                let query = `ALTER TABLE \`${table_name}\``;
+                let query = `ALTER TABLE ${escapedTableName}`;
                 switch (op.type) {
                     case "add_column":
                         if (!op.column_name || !op.column_type) {
@@ -125,7 +189,13 @@ class DdlTools {
                                 error: "column_name and column_type required for add_column",
                             };
                         }
-                        query += ` ADD COLUMN \`${op.column_name}\` ${op.column_type}`;
+                        const addColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!addColumnValidation.valid)
+                            return { status: "error", error: addColumnValidation.error };
+                        const addTypeValidation = this.validateColumnType(op.column_type);
+                        if (!addTypeValidation.valid)
+                            return { status: "error", error: addTypeValidation.error };
+                        query += ` ADD COLUMN ${this.security.escapeIdentifier(op.column_name)} ${op.column_type.trim()}`;
                         if (op.nullable === false)
                             query += " NOT NULL";
                         if (op.default !== undefined) {
@@ -141,7 +211,10 @@ class DdlTools {
                                 error: "column_name required for drop_column",
                             };
                         }
-                        query += ` DROP COLUMN \`${op.column_name}\``;
+                        const dropColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!dropColumnValidation.valid)
+                            return { status: "error", error: dropColumnValidation.error };
+                        query += ` DROP COLUMN ${this.security.escapeIdentifier(op.column_name)}`;
                         break;
                     case "modify_column":
                         if (!op.column_name || !op.column_type) {
@@ -150,7 +223,13 @@ class DdlTools {
                                 error: "column_name and column_type required for modify_column",
                             };
                         }
-                        query += ` MODIFY COLUMN \`${op.column_name}\` ${op.column_type}`;
+                        const modifyColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!modifyColumnValidation.valid)
+                            return { status: "error", error: modifyColumnValidation.error };
+                        const modifyTypeValidation = this.validateColumnType(op.column_type);
+                        if (!modifyTypeValidation.valid)
+                            return { status: "error", error: modifyTypeValidation.error };
+                        query += ` MODIFY COLUMN ${this.security.escapeIdentifier(op.column_name)} ${op.column_type.trim()}`;
                         if (op.nullable === false)
                             query += " NOT NULL";
                         if (op.default !== undefined) {
@@ -166,7 +245,16 @@ class DdlTools {
                                 error: "column_name, new_column_name, and column_type required for rename_column",
                             };
                         }
-                        query += ` CHANGE COLUMN \`${op.column_name}\` \`${op.new_column_name}\` ${op.column_type}`;
+                        const oldColumnValidation = this.validateIdentifier(op.column_name, "column name");
+                        if (!oldColumnValidation.valid)
+                            return { status: "error", error: oldColumnValidation.error };
+                        const newColumnValidation = this.validateIdentifier(op.new_column_name, "new column name");
+                        if (!newColumnValidation.valid)
+                            return { status: "error", error: newColumnValidation.error };
+                        const renameTypeValidation = this.validateColumnType(op.column_type);
+                        if (!renameTypeValidation.valid)
+                            return { status: "error", error: renameTypeValidation.error };
+                        query += ` CHANGE COLUMN ${this.security.escapeIdentifier(op.column_name)} ${this.security.escapeIdentifier(op.new_column_name)} ${op.column_type.trim()}`;
                         break;
                     case "add_index":
                         if (!op.index_name || !op.index_columns) {
@@ -175,9 +263,18 @@ class DdlTools {
                                 error: "index_name and index_columns required for add_index",
                             };
                         }
+                        const addIndexValidation = this.validateIdentifier(op.index_name, "index name");
+                        if (!addIndexValidation.valid)
+                            return { status: "error", error: addIndexValidation.error };
                         const indexType = op.unique ? "UNIQUE INDEX" : "INDEX";
-                        const columns = op.index_columns.map((c) => `\`${c}\``).join(", ");
-                        query += ` ADD ${indexType} \`${op.index_name}\` (${columns})`;
+                        const columns = op.index_columns.map((c) => {
+                            const columnValidation = this.validateIdentifier(c, "index column name");
+                            if (!columnValidation.valid) {
+                                throw new Error(columnValidation.error);
+                            }
+                            return this.security.escapeIdentifier(c);
+                        }).join(", ");
+                        query += ` ADD ${indexType} ${this.security.escapeIdentifier(op.index_name)} (${columns})`;
                         break;
                     case "drop_index":
                         if (!op.index_name) {
@@ -186,7 +283,10 @@ class DdlTools {
                                 error: "index_name required for drop_index",
                             };
                         }
-                        query += ` DROP INDEX \`${op.index_name}\``;
+                        const dropIndexValidation = this.validateIdentifier(op.index_name, "index name");
+                        if (!dropIndexValidation.valid)
+                            return { status: "error", error: dropIndexValidation.error };
+                        query += ` DROP INDEX ${this.security.escapeIdentifier(op.index_name)}`;
                         break;
                     default:
                         return {
@@ -218,8 +318,12 @@ class DdlTools {
     async dropTable(params) {
         try {
             const { table_name, if_exists } = params;
+            const tableValidation = this.validateIdentifier(table_name, "table name");
+            if (!tableValidation.valid) {
+                return { status: "error", error: tableValidation.error };
+            }
             const ifExistsClause = if_exists ? "IF EXISTS " : "";
-            const query = `DROP TABLE ${ifExistsClause}\`${table_name}\``;
+            const query = `DROP TABLE ${ifExistsClause}${this.security.escapeIdentifier(table_name)}`;
             await this.db.query(query);
             return {
                 status: "success",
@@ -242,13 +346,14 @@ class DdlTools {
     async executeDdl(params) {
         try {
             const { query } = params;
-            // Basic validation - ensure it's a DDL query
-            const upperQuery = query.trim().toUpperCase();
-            const isDdl = upperQuery.startsWith("CREATE") ||
-                upperQuery.startsWith("ALTER") ||
-                upperQuery.startsWith("DROP") ||
-                upperQuery.startsWith("TRUNCATE") ||
-                upperQuery.startsWith("RENAME");
+            const queryValidation = this.security.validateQuery(query);
+            if (!queryValidation.valid) {
+                return {
+                    status: "error",
+                    error: `DDL validation failed: ${queryValidation.error}`,
+                };
+            }
+            const isDdl = ["CREATE", "ALTER", "DROP", "TRUNCATE", "RENAME"].includes(queryValidation.queryType || "");
             if (!isDdl) {
                 return {
                     status: "error",

package/dist/tools/relationalSeederTools.d.ts

@@ -0,0 +1,207 @@
+import SecurityLayer from "../security/securityLayer";
+type RowsPerTable = number | Record<string, number>;
+type SeedDomain = "auto" | "generic" | "ecommerce" | "pos" | "crm";
+type SeedTemplate = "ecommerce" | "pos" | "crm";
+type TemplateScale = "small" | "medium" | "large";
+interface SeedRule {
+    generator?: string;
+    values?: any[];
+    value?: any;
+    min?: number;
+    max?: number;
+    start?: string;
+    end?: string;
+    prefix?: string;
+    pattern?: string;
+    domain?: string;
+    nullable?: boolean;
+    source?: string;
+}
+interface TableRequirement {
+    table: string;
+    rows_to_create: number;
+    reason: string;
+    existing_rows: number;
+}
+interface SeedPlan {
+    plan_id: string;
+    database: string;
+    dependency_order: string[];
+    tables_required: TableRequirement[];
+    constraints_detected: {
+        foreign_keys: string[];
+        unique: string[];
+        required_columns: string[];
+    };
+    seed_rules: Record<string, SeedRule>;
+    warnings: string[];
+    requires_confirmation: boolean;
+    confirm_token: string;
+    random_seed: number;
+    options: {
+        strategy: string;
+        respect_existing_data: boolean;
+        include_dependencies: boolean;
+        include_children: boolean;
+        child_rows_per_parent: number;
+        max_rows_per_table: number;
+    };
+}
+interface PlanSeedDataParams {
+    database?: string;
+    target_tables: string[];
+    rows_per_table?: RowsPerTable;
+    include_dependencies?: boolean;
+    include_children?: boolean;
+    child_rows_per_parent?: number;
+    respect_existing_data?: boolean;
+    strategy?: "append";
+    random_seed?: number;
+    max_rows_per_table?: number;
+    max_related_tables?: number;
+    seed_rules?: Record<string, SeedRule>;
+    require_confirmation?: boolean;
+}
+interface GenerateSeedPreviewParams {
+    plan_id: string;
+    locale?: string;
+    realistic?: boolean;
+    max_preview_rows_per_table?: number;
+    email_domain?: string;
+}
+interface ExecuteSeedPlanParams {
+    plan_id: string;
+    dry_run?: boolean;
+    use_transaction?: boolean;
+    batch_size?: number;
+    on_error?: "rollback" | "stop";
+    confirm_token?: string;
+    allow_production?: boolean;
+    email_domain?: string;
+}
+interface ValidateSeedIntegrityParams {
+    plan_id: string;
+    tables?: string[];
+    check_foreign_keys?: boolean;
+    check_orphans?: boolean;
+    check_required_columns?: boolean;
+    check_unique_collisions?: boolean;
+    check_row_counts?: boolean;
+}
+interface InferSeedRulesParams {
+    database?: string;
+    tables?: string[];
+    domain?: SeedDomain;
+    sample_size?: number;
+    max_tables?: number;
+}
+interface SeedFromTemplateParams {
+    database?: string;
+    template: SeedTemplate;
+    scale?: TemplateScale;
+    include?: string[];
+    exclude?: string[];
+    rows_per_table?: RowsPerTable;
+    include_dependencies?: boolean;
+    include_children?: boolean;
+    respect_existing_data?: boolean;
+    random_seed?: number;
+    require_confirmation?: boolean;
+}
+export declare class RelationalSeederTools {
+    private static planCounter;
+    private db;
+    private security;
+    private plans;
+    constructor(security: SecurityLayer);
+    planSeedData(params: PlanSeedDataParams): Promise<{
+        status: string;
+        data?: SeedPlan;
+        error?: string;
+    }>;
+    generateSeedPreview(params: GenerateSeedPreviewParams): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+    executeSeedPlan(params: ExecuteSeedPlanParams): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+    validateSeedIntegrity(params: ValidateSeedIntegrityParams): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+    inferSeedRules(params: InferSeedRulesParams): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+    seedFromTemplate(params: SeedFromTemplateParams): Promise<{
+        status: string;
+        data?: any;
+        error?: string;
+    }>;
+    private resolveDatabase;
+    private loadSchema;
+    private groupForeignKeys;
+    private topologicalSort;
+    private calculateRowsToCreate;
+    private buildInferredSeedRules;
+    private inferRuleForColumn;
+    private detectConstraints;
+    private buildPreview;
+    private buildRowsForTable;
+    private resolveForeignKeyTuple;
+    private generateValue;
+    private preloadExistingParentIds;
+    private ensureIdMapForTable;
+    private loadExistingKeyTuples;
+    private insertRow;
+    private trackInsertedKeys;
+    private countForeignKeyOrphans;
+    private countNullValues;
+    private findUniqueCollisions;
+    private getValidationRowCount;
+    private getRequiredColumns;
+    private shouldSkipColumn;
+    private isIntegerColumn;
+    private isNumberColumn;
+    private isBooleanColumn;
+    private extractEnumValues;
+    private isForeignKeyColumn;
+    private keySignature;
+    private formatForeignKey;
+    private tupleFromRow;
+    private storeTuples;
+    private buildTupleWhereClause;
+    private getSelectableTables;
+    private loadSampleRows;
+    private refineRulesFromSamples;
+    private isSensitiveColumn;
+    private canUseChoiceFromSamples;
+    private inferPatternFromSamples;
+    private detectDomainFromTables;
+    private getDomainRule;
+    private detectTemplateTables;
+    private getTemplateKeywords;
+    private getScaleRows;
+    private buildTemplateRules;
+    private requirementsToInsertMap;
+    private countResolvedForeignKeys;
+    private getExplicitOrDefaultRows;
+    private assertIdentifier;
+    private getStoredPlan;
+    private createPlanId;
+    private createConfirmToken;
+    private isProductionLikeDatabase;
+    private clampNumber;
+    private makeRng;
+    private hashString;
+    private truncate;
+    private pickPersonName;
+    private formatDate;
+}
+export {};