@berthojoris/mcp-mysql-server 1.6.2 → 1.6.3

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to the MySQL MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.3] - 2025-11-23
+
+### Fixed
+- **Missing tools in toolCategoryMap** - Added 42 missing tools to the permission system
+  - View tools: listViews, getViewInfo, createView, alterView, dropView, showCreateView
+  - Trigger tools: listTriggers, getTriggerInfo, createTrigger, dropTrigger, showCreateTrigger
+  - Function tools: listFunctions, getFunctionInfo, createFunction, dropFunction, showCreateFunction, executeFunction
+  - Index tools: listIndexes, getIndexInfo, createIndex, dropIndex, analyzeIndex
+  - Constraint tools: listForeignKeys, listConstraints, addForeignKey, dropForeignKey, addUniqueConstraint, dropConstraint, addCheckConstraint
+  - Maintenance tools: analyzeTable, optimizeTable, checkTable, repairTable, truncateTable, getTableStatus, flushTable, getTableSize
+  - Server tools: showProcessList, killProcess, showStatus, showVariables, explainQuery, showEngineStatus, getServerInfo, showBinaryLogs, showReplicationStatus
+
+- **Security keyword false positives in run_query** - Refined dangerous keywords to avoid blocking common table/column names
+  - Removed generic keywords: `USER`, `PASSWORD`, `MYSQL`, `SYS` that blocked legitimate queries
+  - Added specific security patterns: `MYSQL.USER`, `MYSQL.DB`, `CREATE USER`, `DROP USER`, `ALTER USER`, `SET PASSWORD`, `LOAD_FILE`, `INFORMATION_SCHEMA.USER_PRIVILEGES`
+  - Queries like `SELECT * FROM users` or `SELECT user, password FROM accounts` now work correctly
+
 ## [1.6.2] - 2025-11-22
 
 ### Fixed

package/dist/config/featureConfig.js

@@ -76,6 +76,59 @@ exports.toolCategoryMap = {
     // Query optimization tools
     analyzeQuery: ToolCategory.UTILITY,
     getOptimizationHints: ToolCategory.UTILITY,
+    // View tools
+    listViews: ToolCategory.LIST,
+    getViewInfo: ToolCategory.LIST,
+    createView: ToolCategory.DDL,
+    alterView: ToolCategory.DDL,
+    dropView: ToolCategory.DDL,
+    showCreateView: ToolCategory.LIST,
+    // Trigger tools
+    listTriggers: ToolCategory.LIST,
+    getTriggerInfo: ToolCategory.LIST,
+    createTrigger: ToolCategory.DDL,
+    dropTrigger: ToolCategory.DDL,
+    showCreateTrigger: ToolCategory.LIST,
+    // Function tools
+    listFunctions: ToolCategory.LIST,
+    getFunctionInfo: ToolCategory.LIST,
+    createFunction: ToolCategory.PROCEDURE,
+    dropFunction: ToolCategory.PROCEDURE,
+    showCreateFunction: ToolCategory.LIST,
+    executeFunction: ToolCategory.PROCEDURE,
+    // Index tools
+    listIndexes: ToolCategory.LIST,
+    getIndexInfo: ToolCategory.LIST,
+    createIndex: ToolCategory.DDL,
+    dropIndex: ToolCategory.DDL,
+    analyzeIndex: ToolCategory.UTILITY,
+    // Constraint tools
+    listForeignKeys: ToolCategory.LIST,
+    listConstraints: ToolCategory.LIST,
+    addForeignKey: ToolCategory.DDL,
+    dropForeignKey: ToolCategory.DDL,
+    addUniqueConstraint: ToolCategory.DDL,
+    dropConstraint: ToolCategory.DDL,
+    addCheckConstraint: ToolCategory.DDL,
+    // Table maintenance tools
+    analyzeTable: ToolCategory.UTILITY,
+    optimizeTable: ToolCategory.UTILITY,
+    checkTable: ToolCategory.UTILITY,
+    repairTable: ToolCategory.UTILITY,
+    truncateTable: ToolCategory.DDL,
+    getTableStatus: ToolCategory.LIST,
+    flushTable: ToolCategory.UTILITY,
+    getTableSize: ToolCategory.LIST,
+    // Process and server management tools
+    showProcessList: ToolCategory.LIST,
+    killProcess: ToolCategory.EXECUTE,
+    showStatus: ToolCategory.LIST,
+    showVariables: ToolCategory.LIST,
+    explainQuery: ToolCategory.UTILITY,
+    showEngineStatus: ToolCategory.LIST,
+    getServerInfo: ToolCategory.LIST,
+    showBinaryLogs: ToolCategory.LIST,
+    showReplicationStatus: ToolCategory.LIST,
 };
 /**
  * Class to manage feature configuration based on runtime or environment variables

package/dist/security/securityLayer.js

@@ -12,17 +12,22 @@ class SecurityLayer {
         this.featureConfig = featureConfig || new featureConfig_js_1.FeatureConfig();
         // Define dangerous SQL keywords that should ALWAYS be blocked (critical security threats)
         // These are blocked even with 'execute' permission
+        // Note: Avoid blocking common table/column names like "user" or "password"
         this.dangerousKeywords = [
             "GRANT",
             "REVOKE",
             "INTO OUTFILE",
             "INTO DUMPFILE",
             "LOAD DATA",
-            "MYSQL",
+            "LOAD_FILE",
+            "INFORMATION_SCHEMA.USER_PRIVILEGES",
+            "MYSQL.USER",
+            "MYSQL.DB",
             "PERFORMANCE_SCHEMA",
-            "SYS",
-            "USER",
-            "PASSWORD",
+            "CREATE USER",
+            "DROP USER",
+            "ALTER USER",
+            "SET PASSWORD",
         ];
         // Define basic allowed SQL operations
         this.allowedOperations = ["SELECT", "INSERT", "UPDATE", "DELETE"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@berthojoris/mcp-mysql-server",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "Model Context Protocol server for MySQL database integration with dynamic per-project permissions and data export capabilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",