@berthojoris/mcp-mysql-server 1.6.1 → 1.6.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to the MySQL MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.2] - 2025-11-22
+
+### Fixed
+- **Security keyword false positive bug** - Fixed issue where `run_query` rejected valid SELECT queries containing table names like "users"
+  - The dangerous keyword check was using substring matching (`includes()`) which caused "USER" to match "USERS"
+  - Changed to word boundary regex matching (`\bKEYWORD\b`) to only match whole words
+  - `SELECT * FROM users` now works correctly while `SELECT USER()` is still blocked as intended
+
+### Changed
+- **Updated tool count in README.md** - Corrected tool count from 30/73 to 85 powerful tools
+  - Accurate count of all available MCP tools across all categories
+
 ## [1.4.16] - 2025-11-22
 
 ### Added

package/README.md

@@ -11,7 +11,7 @@ A fully-featured **Model Context Protocol (MCP)** server for MySQL database inte
 
 - ✅ **Full MCP Protocol Support** - Works with Claude Desktop, Cline, Windsurf, and any MCP-compatible AI agent
 - 🔐 **Secure by Default** - Parameterized queries, SQL injection protection, permission-based access control
-- 🛠️ **30 Powerful Tools** - Complete database operations (CRUD, DDL, queries, schema inspection, transactions, stored procedures, bulk operations)
+- 🛠️ **85 Powerful Tools** - Complete database operations (CRUD, DDL, queries, schema inspection, transactions, stored procedures, bulk operations)
 - 🎛️ **Dynamic Per-Project Permissions** - Each AI agent can have different access levels
 - 🗃️ **DDL Support** - Create, alter, and drop tables (when explicitly enabled)
 - 💎 **Transaction Support** - Full ACID transaction management (BEGIN, COMMIT, ROLLBACK)
@@ -463,7 +463,7 @@ After (DDL enabled):
 
 ## 🛠️ Available Tools
 
-The MCP server provides **73 powerful tools**:
+The MCP server provides **85 powerful tools**:
 
 ### Database Discovery (4 tools)
 

package/dist/security/securityLayer.js

@@ -160,7 +160,9 @@ class SecurityLayer {
         // When bypassDangerousCheck is true (user has 'execute' permission), skip this check
         if (!bypassDangerousCheck) {
             for (const keyword of this.dangerousKeywords) {
-                if (cleanQuery.includes(keyword)) {
+                // Use word boundary regex to avoid false positives (e.g., "USER" matching "USERS")
+                const keywordRegex = new RegExp(`\\b${keyword}\\b`, "i");
+                if (keywordRegex.test(cleanQuery)) {
                     return {
                         valid: false,
                         error: `Dangerous keyword detected: ${keyword}. This requires 'execute' permission.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions and data export capabilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",