@bytebase/dbhub 1.0.0 → 1.2.0

package/dist/index.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import {
   BUILTIN_TOOL_EXECUTE_SQL,
+  BUILTIN_TOOL_EXPLAIN_SQL,
+  BUILTIN_TOOL_HEALTH_CHECK,
   BUILTIN_TOOL_SEARCH_OBJECTS,
   ConnectorManager,
   classifyConnectionError,
@@ -10,18 +12,20 @@ import {
   loadTomlConfig,
   mapArgumentsToArray,
   resolveAllowedHosts,
+  resolveAuthTokens,
   resolveHost,
   resolvePort,
   resolveSourceConfigs,
   resolveTomlConfigPath,
   resolveTransport
-} from "./chunk-MQR6VX5F.js";
+} from "./chunk-CUBIR72I.js";
 import {
   allowedKeywords,
+  getFirstKeyword,
+  hasEscapeHatchFunction,
   isReadOnlySQL,
-  sqlServerDynamicSqlPattern,
-  sqlServerPassThroughPattern
-} from "./chunk-JO7YQPBQ.js";
+  sqlServerDynamicSqlPattern
+} from "./chunk-PBN2UXB5.js";
 import {
   loadConnectors
 } from "./chunk-WVVMH6FJ.js";
@@ -35,7 +39,7 @@ import {
   parseConnectionInfoFromDSN,
   splitSQLStatements,
   stripCommentsAndStrings
-} from "./chunk-JEZZN2YZ.js";
+} from "./chunk-WIQ4DWGY.js";
 
 // src/server.ts
 import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
@@ -114,7 +118,8 @@ var dmlPattern = /\b(?:insert|update|delete|merge|replace\s+(?:(?:low_priority|d
 var grantRevokePattern = /\b(?:grant|revoke)\b/i;
 function isAdminStatement(stripped, connectorType) {
   if (grantRevokePattern.test(stripped)) return true;
-  return connectorType === "sqlserver" && (sqlServerDynamicSqlPattern.test(stripped) || sqlServerPassThroughPattern.test(stripped));
+  if (hasEscapeHatchFunction(stripped, connectorType)) return true;
+  return connectorType === "sqlserver" && sqlServerDynamicSqlPattern.test(stripped);
 }
 function policyFromReadonly(readonly) {
   const write = readonly === true ? "deny" : "allow";
@@ -206,10 +211,29 @@ function getClientIdentifier(ctx) {
   return "stdio";
 }
 
+// src/utils/normalize-id.ts
+function normalizeSourceId(id) {
+  return id.replace(/[^a-zA-Z0-9]/g, "_");
+}
+
 // src/utils/tool-handler-helpers.ts
 function getEffectiveSourceId(sourceId) {
   return sourceId || "default";
 }
+function toStatementsPayload(resultSets) {
+  return resultSets.map((set) => ({
+    sql: set.sql,
+    rows: set.rows,
+    count: set.rowCount
+  }));
+}
+function resolveTrackedToolName(sourceId, baseName) {
+  const isSingleSource = ConnectorManager.getAvailableSourceIds().length === 1;
+  if (isSingleSource) {
+    return baseName;
+  }
+  return `${baseName}_${normalizeSourceId(getEffectiveSourceId(sourceId))}`;
+}
 function createReadonlyViolationMessage(toolName, sourceId, connectorType) {
   return `Tool '${toolName}' cannot execute in readonly mode for source '${sourceId}'. Only read-only SQL operations are allowed: ${allowedKeywords[connectorType]?.join(", ") || "none"}`;
 }
@@ -272,8 +296,7 @@ function createExecuteSqlToolHandler(sourceId) {
       };
       result = await connector.executeSQL(sql, executeOptions);
       const responseData = {
-        rows: result.rows,
-        count: result.rowCount,
+        statements: toStatementsPayload(result.resultSets),
         source_id: effectiveSourceId,
         ...result.messages && result.messages.length > 0 ? { messages: result.messages } : {}
       };
@@ -332,8 +355,9 @@ async function getTableRowCount(connector, tableName, schemaName) {
     const qualifiedTable = quoteQualifiedIdentifier(tableName, schemaName, connector.id);
     const countQuery = `SELECT COUNT(*) as count FROM ${qualifiedTable}`;
     const result = await connector.executeSQL(countQuery, { maxRows: 1, readonly: true });
-    if (result.rows && result.rows.length > 0) {
-      return Number(result.rows[0].count || result.rows[0].COUNT || 0);
+    const rows = result.resultSets[0]?.rows;
+    if (rows && rows.length > 0) {
+      return Number(rows[0].count || rows[0].COUNT || 0);
     }
   } catch (error) {
     return null;
@@ -785,15 +809,151 @@ function createSearchDatabaseObjectsToolHandler(sourceId) {
   };
 }
 
-// src/utils/tool-metadata.ts
+// src/tools/explain-sql.ts
 import { z as z3 } from "zod";
+var explainSqlSchema = {
+  sql: z3.string().describe("Single SQL statement to explain (no trailing semicolon-separated statements)")
+};
+var explainSqlInputSchema = z3.object(explainSqlSchema);
+function buildExplainStatement(connectorType, sql) {
+  if (connectorType === "sqlite") {
+    return `EXPLAIN QUERY PLAN ${sql}`;
+  }
+  return `EXPLAIN ${sql}`;
+}
+function validateExplainInput(sql, connectorType) {
+  const statements = splitSQLStatements(sql, connectorType);
+  if (statements.length !== 1) {
+    return "explain_sql only supports a single SQL statement";
+  }
+  const firstWord = getFirstKeyword(statements[0], connectorType);
+  if (firstWord === "explain") {
+    return "explain_sql input must not itself start with EXPLAIN";
+  }
+  if (firstWord === "analyze") {
+    return "explain_sql does not support ANALYZE (it must never execute the statement)";
+  }
+  const cleaned = stripCommentsAndStrings(statements[0], connectorType).trim();
+  const leadingOptions = cleaned.match(/^\(([\s\S]*?)\)/)?.[1];
+  if (leadingOptions && /\banalyze\b/i.test(leadingOptions)) {
+    return "explain_sql does not support ANALYZE (it must never execute the statement)";
+  }
+  return null;
+}
+function createExplainSqlToolHandler(sourceId) {
+  return async (args, extra) => {
+    const { sql } = args;
+    const startTime = Date.now();
+    const effectiveSourceId = getEffectiveSourceId(sourceId);
+    let success = true;
+    let errorMessage;
+    let result;
+    try {
+      await ConnectorManager.ensureConnected(sourceId);
+      const connector = ConnectorManager.getCurrentConnector(sourceId);
+      const validationError = validateExplainInput(sql, connector.id);
+      if (validationError) {
+        success = false;
+        errorMessage = validationError;
+        return createToolErrorResponse(errorMessage, "INVALID_INPUT");
+      }
+      const explainStatement = buildExplainStatement(connector.id, sql);
+      result = await connector.executeSQL(explainStatement, { readonly: true });
+      const responseData = {
+        rows: result.resultSets[0].rows,
+        count: result.resultSets[0].rowCount,
+        source_id: effectiveSourceId,
+        ...result.messages && result.messages.length > 0 ? { messages: result.messages } : {}
+      };
+      return createToolSuccessResponse(responseData);
+    } catch (error) {
+      success = false;
+      errorMessage = error.message;
+      const classified = tryClassifyConnectionError(error, sourceId, effectiveSourceId);
+      if (classified) return classified;
+      return createToolErrorResponse(errorMessage, "EXECUTION_ERROR");
+    } finally {
+      trackToolRequest(
+        {
+          sourceId: effectiveSourceId,
+          toolName: resolveTrackedToolName(sourceId, "explain_sql"),
+          sql
+        },
+        startTime,
+        extra,
+        success,
+        errorMessage
+      );
+    }
+  };
+}
 
-// src/utils/normalize-id.ts
-function normalizeSourceId(id) {
-  return id.replace(/[^a-zA-Z0-9]/g, "_");
+// src/tools/health-check.ts
+import { z as z4 } from "zod";
+var healthCheckSchema = {};
+var healthCheckInputSchema = z4.object(healthCheckSchema);
+function createHealthCheckToolHandler(sourceId) {
+  return async (_args, extra) => {
+    const startTime = Date.now();
+    const effectiveSourceId = getEffectiveSourceId(sourceId);
+    let success = true;
+    let errorMessage;
+    try {
+      await ConnectorManager.ensureConnected(sourceId);
+      const connector = ConnectorManager.getCurrentConnector(sourceId);
+      if (!connector.getHealthCheck) {
+        success = false;
+        errorMessage = `health_check is not supported for '${connector.id}' sources yet`;
+        return createToolErrorResponse(errorMessage, "UNSUPPORTED");
+      }
+      const health = await connector.getHealthCheck();
+      return createToolSuccessResponse({
+        source_id: effectiveSourceId,
+        ...health.connections ? {
+          connections: {
+            total: health.connections.total,
+            active: health.connections.active,
+            idle: health.connections.idle,
+            idle_in_transaction: health.connections.idleInTransaction,
+            ...health.connections.idleInTransactionAborted !== void 0 ? { idle_in_transaction_aborted: health.connections.idleInTransactionAborted } : {},
+            max_connections: health.connections.maxConnections,
+            longest_idle_in_transaction_seconds: health.connections.longestIdleInTransactionSeconds,
+            longest_active_query_seconds: health.connections.longestActiveQuerySeconds
+          }
+        } : {},
+        ...health.bufferCache ? {
+          buffer_cache: {
+            hit_ratio_pct: health.bufferCache.hitRatioPct,
+            blocks_hit: health.bufferCache.blocksHit,
+            blocks_read: health.bufferCache.blocksRead
+          }
+        } : {},
+        ...health.notes && health.notes.length > 0 ? { notes: health.notes } : {}
+      });
+    } catch (error) {
+      success = false;
+      errorMessage = error.message;
+      const classified = tryClassifyConnectionError(error, sourceId, effectiveSourceId);
+      if (classified) return classified;
+      return createToolErrorResponse(errorMessage, "EXECUTION_ERROR");
+    } finally {
+      trackToolRequest(
+        {
+          sourceId: effectiveSourceId,
+          toolName: effectiveSourceId === "default" ? "health_check" : `health_check_${effectiveSourceId}`,
+          sql: ""
+        },
+        startTime,
+        extra,
+        success,
+        errorMessage
+      );
+    }
+  };
 }
 
 // src/utils/tool-metadata.ts
+import { z as z5 } from "zod";
 function buildSourceDescriptionPrefix(description) {
   const trimmed = description?.trim() ?? "";
   if (!trimmed) return "";
@@ -803,17 +963,17 @@ function zodToParameters(schema) {
   const parameters = [];
   for (const [key, zodType] of Object.entries(schema)) {
     const description = zodType.description || "";
-    const required = !(zodType instanceof z3.ZodOptional);
+    const required = !(zodType instanceof z5.ZodOptional);
     let type = "string";
-    if (zodType instanceof z3.ZodString) {
+    if (zodType instanceof z5.ZodString) {
       type = "string";
-    } else if (zodType instanceof z3.ZodNumber) {
+    } else if (zodType instanceof z5.ZodNumber) {
       type = "number";
-    } else if (zodType instanceof z3.ZodBoolean) {
+    } else if (zodType instanceof z5.ZodBoolean) {
       type = "boolean";
-    } else if (zodType instanceof z3.ZodArray) {
+    } else if (zodType instanceof z5.ZodArray) {
       type = "array";
-    } else if (zodType instanceof z3.ZodObject) {
+    } else if (zodType instanceof z5.ZodObject) {
       type = "object";
     }
     parameters.push({
@@ -825,20 +985,28 @@ function zodToParameters(schema) {
   }
   return parameters;
 }
-function getExecuteSqlMetadata(sourceId) {
+function resolveBuiltinToolNaming(sourceId, baseName, titleLabel) {
   const sourceIds = ConnectorManager.getAvailableSourceIds();
   const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
   const dbType = sourceConfig.type;
   const isSingleSource = sourceIds.length === 1;
+  const name = isSingleSource ? baseName : `${baseName}_${normalizeSourceId(sourceId)}`;
+  const title = isSingleSource ? `${titleLabel} (${dbType})` : `${titleLabel} on ${sourceId} (${dbType})`;
+  const userDescPrefix = buildSourceDescriptionPrefix(sourceConfig.description);
+  return { dbType, isSingleSource, name, title, userDescPrefix };
+}
+function getExecuteSqlMetadata(sourceId) {
+  const { dbType, isSingleSource, name, title, userDescPrefix } = resolveBuiltinToolNaming(
+    sourceId,
+    "execute_sql",
+    "Execute SQL"
+  );
   const registry = getToolRegistry();
   const toolConfig = registry.getBuiltinToolConfig(BUILTIN_TOOL_EXECUTE_SQL, sourceId);
   const executeOptions = {
     readonly: toolConfig?.readonly,
     maxRows: toolConfig?.max_rows
   };
-  const toolName = isSingleSource ? "execute_sql" : `execute_sql_${normalizeSourceId(sourceId)}`;
-  const title = isSingleSource ? `Execute SQL (${dbType})` : `Execute SQL on ${sourceId} (${dbType})`;
-  const userDescPrefix = buildSourceDescriptionPrefix(sourceConfig.description);
   const readonlyNote = executeOptions.readonly ? " [READ-ONLY MODE]" : "";
   const maxRowsNote = executeOptions.maxRows ? ` (limited to ${executeOptions.maxRows} rows)` : "";
   const description = isSingleSource ? `${userDescPrefix}Execute SQL queries on the ${dbType} database${readonlyNote}${maxRowsNote}` : `${userDescPrefix}Execute SQL queries on the '${sourceId}' ${dbType} database${readonlyNote}${maxRowsNote}`;
@@ -855,25 +1023,62 @@ function getExecuteSqlMetadata(sourceId) {
     openWorldHint: false
   };
   return {
-    name: toolName,
+    name,
     description,
     schema: executeSqlSchema,
     annotations
   };
 }
 function getSearchObjectsMetadata(sourceId) {
-  const sourceIds = ConnectorManager.getAvailableSourceIds();
-  const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
-  const dbType = sourceConfig.type;
-  const isSingleSource = sourceIds.length === 1;
-  const toolName = isSingleSource ? "search_objects" : `search_objects_${normalizeSourceId(sourceId)}`;
-  const title = isSingleSource ? `Search Database Objects (${dbType})` : `Search Database Objects on ${sourceId} (${dbType})`;
-  const userDescPrefix = buildSourceDescriptionPrefix(sourceConfig.description);
+  const { dbType, isSingleSource, name, title, userDescPrefix } = resolveBuiltinToolNaming(
+    sourceId,
+    "search_objects",
+    "Search Database Objects"
+  );
   const description = isSingleSource ? `${userDescPrefix}Search and list database objects on the ${dbType} database` : `${userDescPrefix}Search and list database objects on the '${sourceId}' ${dbType} database`;
+  return { name, description, title };
+}
+function getExplainSqlMetadata(sourceId) {
+  const { dbType, isSingleSource, name, title, userDescPrefix } = resolveBuiltinToolNaming(
+    sourceId,
+    "explain_sql",
+    "Explain Query Plan"
+  );
+  const description = isSingleSource ? `${userDescPrefix}Show the execution plan for a SQL statement on the ${dbType} database without running it (always read-only).` : `${userDescPrefix}Show the execution plan for a SQL statement on the '${sourceId}' ${dbType} database without running it (always read-only).`;
+  const annotations = {
+    title,
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  };
+  return {
+    name,
+    description,
+    schema: explainSqlSchema,
+    annotations
+  };
+}
+function getHealthCheckMetadata(sourceId) {
+  const { dbType, isSingleSource, name, title, userDescPrefix } = resolveBuiltinToolNaming(
+    sourceId,
+    "health_check",
+    "Health Check"
+  );
+  const description = isSingleSource ? `${userDescPrefix}Report connection pool and buffer cache health metrics for the ${dbType} database (read-only).` : `${userDescPrefix}Report connection pool and buffer cache health metrics for the '${sourceId}' ${dbType} database (read-only).`;
+  const annotations = {
+    title,
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: false,
+    // Metrics change from call to call, unlike explain_sql's plan output
+    openWorldHint: false
+  };
   return {
-    name: toolName,
+    name,
     description,
-    title
+    schema: healthCheckSchema,
+    annotations
   };
 }
 function customParamsToToolParams(params) {
@@ -910,13 +1115,13 @@ function buildSearchObjectsTool(sourceId) {
         name: "object_type",
         type: "string",
         required: true,
-        description: "Object type to search: schema, table, view, column, procedure, function, index"
+        description: "Object type to search"
       },
       {
         name: "pattern",
         type: "string",
         required: false,
-        description: "LIKE pattern (% = any chars, _ = one char). Default: %"
+        description: "LIKE pattern (% = any chars, _ = one char)"
       },
       {
         name: "schema",
@@ -940,13 +1145,23 @@ function buildSearchObjectsTool(sourceId) {
         name: "limit",
         type: "integer",
         required: false,
-        description: "Max results (default: 100, max: 1000)"
+        description: "Max results"
       }
     ],
     readonly: true
     // search_objects is always readonly
   };
 }
+function buildExplainSqlTool(sourceId) {
+  const explainMetadata = getExplainSqlMetadata(sourceId);
+  return {
+    name: explainMetadata.name,
+    description: explainMetadata.description,
+    parameters: zodToParameters(explainMetadata.schema),
+    readonly: true
+    // explain_sql is always readonly
+  };
+}
 function buildCustomTool(toolConfig) {
   return {
     name: toolConfig.name,
@@ -965,6 +1180,8 @@ function getToolsForSource(sourceId) {
       return buildExecuteSqlTool(sourceId, toolConfig);
     } else if (toolConfig.name === "search_objects") {
       return buildSearchObjectsTool(sourceId);
+    } else if (toolConfig.name === "explain_sql") {
+      return buildExplainSqlTool(sourceId);
     } else {
       return buildCustomTool(toolConfig);
     }
@@ -972,7 +1189,7 @@ function getToolsForSource(sourceId) {
 }
 
 // src/tools/custom-tool-handler.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 function buildZodSchemaFromParameters(parameters) {
   if (!parameters || parameters.length === 0) {
     return {};
@@ -982,26 +1199,26 @@ function buildZodSchemaFromParameters(parameters) {
     let fieldSchema;
     switch (param.type) {
       case "string":
-        fieldSchema = z4.string().describe(param.description);
+        fieldSchema = z6.string().describe(param.description);
         break;
       case "integer":
-        fieldSchema = z4.number().int().describe(param.description);
+        fieldSchema = z6.number().int().describe(param.description);
         break;
       case "float":
-        fieldSchema = z4.number().describe(param.description);
+        fieldSchema = z6.number().describe(param.description);
         break;
       case "boolean":
-        fieldSchema = z4.boolean().describe(param.description);
+        fieldSchema = z6.boolean().describe(param.description);
         break;
       case "array":
-        fieldSchema = z4.array(z4.unknown()).describe(param.description);
+        fieldSchema = z6.array(z6.unknown()).describe(param.description);
         break;
       default:
         throw new Error(`Unsupported parameter type: ${param.type}`);
     }
     if (param.allowed_values && param.allowed_values.length > 0) {
       if (param.type === "string") {
-        fieldSchema = z4.enum(param.allowed_values).describe(param.description);
+        fieldSchema = z6.enum(param.allowed_values).describe(param.description);
       } else {
         fieldSchema = fieldSchema.refine(
           (val) => param.allowed_values.includes(val),
@@ -1022,7 +1239,7 @@ var customToolInputSchemas = /* @__PURE__ */ new WeakMap();
 function getCustomToolInputSchema(toolConfig) {
   let schema = customToolInputSchemas.get(toolConfig);
   if (!schema) {
-    schema = z4.object(buildZodSchemaFromParameters(toolConfig.parameters));
+    schema = z6.object(buildZodSchemaFromParameters(toolConfig.parameters));
     customToolInputSchemas.set(toolConfig, schema);
   }
   return schema;
@@ -1058,8 +1275,7 @@ function createCustomToolHandler(toolConfig) {
         paramValues
       );
       const responseData = {
-        rows: result.rows,
-        count: result.rowCount,
+        statements: toStatementsPayload(result.resultSets),
         source_id: toolConfig.source
       };
       return createToolSuccessResponse(responseData);
@@ -1068,7 +1284,7 @@ function createCustomToolHandler(toolConfig) {
       errorMessage = error.message;
       const classified = tryClassifyConnectionError(error, toolConfig.source, toolConfig.source);
       if (classified) return classified;
-      if (error instanceof z4.ZodError) {
+      if (error instanceof z6.ZodError) {
         const issues = error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
         errorMessage = `Parameter validation failed: ${issues}`;
       } else {
@@ -1108,6 +1324,10 @@ function registerTools(server) {
         registerExecuteSqlTool(server, sourceId);
       } else if (toolConfig.name === BUILTIN_TOOL_SEARCH_OBJECTS) {
         registerSearchObjectsTool(server, sourceId);
+      } else if (toolConfig.name === BUILTIN_TOOL_EXPLAIN_SQL) {
+        registerExplainSqlTool(server, sourceId);
+      } else if (toolConfig.name === BUILTIN_TOOL_HEALTH_CHECK) {
+        registerHealthCheckTool(server, sourceId);
       } else {
         registerCustomTool(server, sourceId, toolConfig);
       }
@@ -1144,6 +1364,30 @@ function registerSearchObjectsTool(server, sourceId) {
     createSearchDatabaseObjectsToolHandler(sourceId)
   );
 }
+function registerExplainSqlTool(server, sourceId) {
+  const metadata = getExplainSqlMetadata(sourceId);
+  server.registerTool(
+    metadata.name,
+    {
+      description: metadata.description,
+      inputSchema: explainSqlInputSchema,
+      annotations: metadata.annotations
+    },
+    createExplainSqlToolHandler(sourceId)
+  );
+}
+function registerHealthCheckTool(server, sourceId) {
+  const metadata = getHealthCheckMetadata(sourceId);
+  server.registerTool(
+    metadata.name,
+    {
+      description: metadata.description,
+      inputSchema: healthCheckInputSchema,
+      annotations: metadata.annotations
+    },
+    createHealthCheckToolHandler(sourceId)
+  );
+}
 function registerCustomTool(server, sourceId, toolConfig) {
   const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
   const dbType = sourceConfig.type;
@@ -1585,6 +1829,32 @@ function validateOrigin(originHeader, hostHeader, allowedHosts) {
   return { ok: true };
 }
 
+// src/utils/auth-token.ts
+import { timingSafeEqual } from "node:crypto";
+var BEARER_PREFIX = "Bearer ";
+function constantTimeEqual(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function validateAuthToken(authorizationHeader, tokens) {
+  if (tokens.length === 0) return { ok: true };
+  if (!authorizationHeader || !authorizationHeader.startsWith(BEARER_PREFIX)) {
+    return {
+      ok: false,
+      status: 401,
+      message: "Missing or malformed Authorization header. Expected: Bearer <token>"
+    };
+  }
+  const presented = authorizationHeader.slice(BEARER_PREFIX.length);
+  const matches = tokens.some((token) => constantTimeEqual(presented, token));
+  if (!matches) {
+    return { ok: false, status: 401, message: "Invalid bearer token" };
+  }
+  return { ok: true };
+}
+
 // src/server.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path.dirname(__filename);
@@ -1639,7 +1909,7 @@ See documentation for more details on configuring database connections.
     const sources = sourceConfigsData.sources;
     console.error(`Configuration source: ${sourceConfigsData.source}`);
     await connectorManager.connectWithSources(sources);
-    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-ZU6ZFNQ2.js");
+    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-XMEJF7WW.js");
     initializeToolRegistry2({
       sources: sourceConfigsData.sources,
       tools: sourceConfigsData.tools
@@ -1669,6 +1939,7 @@ See documentation for more details on configuring database connections.
     const port = transportData.type === "http" ? resolvePort().port : null;
     const host = transportData.type === "http" ? resolveHost().host : null;
     const allowedHosts = transportData.type === "http" ? buildAllowedHosts(resolveAllowedHosts().hosts, host ?? void 0, getSelfHosts()) : /* @__PURE__ */ new Set();
+    const { tokens: authTokens, source: authTokenSource } = resolveAuthTokens();
     const activeModes = [];
     const modeDescriptions = [];
     const isDemo = isDemoMode();
@@ -1703,18 +1974,26 @@ See documentation for more details on configuring database connections.
         }
         res.header("Access-Control-Allow-Origin", origin || "http://localhost");
         res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-        res.header("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, MCP-Protocol-Version, Mcp-Method, Mcp-Name");
+        res.header("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id, MCP-Protocol-Version, Mcp-Method, Mcp-Name");
         res.header("Access-Control-Allow-Credentials", "true");
         if (req.method === "OPTIONS") {
           return res.sendStatus(200);
         }
         next();
       });
-      const frontendPath = path.join(__dirname, "public");
-      app.use(express.static(frontendPath));
       app.get("/healthz", (req, res) => {
         res.status(200).send("OK");
       });
+      app.use((req, res, next) => {
+        const result = validateAuthToken(req.headers.authorization, authTokens);
+        if (!result.ok) {
+          res.header("WWW-Authenticate", "Bearer");
+          return res.status(result.status).json({ error: "Unauthorized", message: result.message });
+        }
+        next();
+      });
+      const frontendPath = path.join(__dirname, "public");
+      app.use(express.static(frontendPath));
       app.get("/api/sources", listSources);
       app.get("/api/sources/:sourceId", getSource);
       app.get("/api/requests", listRequests);
@@ -1746,6 +2025,11 @@ See documentation for more details on configuring database connections.
         } else {
           console.error(`Allowed hosts: ${[...allowedHosts].join(", ")} (set --allowed-hosts to serve other hostnames)`);
         }
+        if (authTokens.length > 0) {
+          console.error(`Auth: bearer token required (${authTokens.length} token(s) configured via ${authTokenSource})`);
+        } else {
+          console.error("Auth: disabled (set --auth-token or DBHUB_AUTH_TOKEN to require a bearer token)");
+        }
         if (process.env.NODE_ENV === "development") {
           console.error("Development mode detected!");
           console.error("   Workbench dev server (with HMR): http://localhost:5173");
@@ -1780,11 +2064,11 @@ See documentation for more details on configuring database connections.
 
 // src/index.ts
 var connectorModules = [
-  { load: () => import("./postgres-YAYHDXVD.js"), name: "PostgreSQL", driver: "pg" },
-  { load: () => import("./sqlserver-COKW7RIK.js"), name: "SQL Server", driver: "mssql" },
-  { load: () => import("./sqlite-5M7SDAQZ.js"), name: "SQLite", driver: "node:sqlite" },
-  { load: () => import("./mysql-CDUKJMNN.js"), name: "MySQL", driver: "mysql2" },
-  { load: () => import("./mariadb-72C2BNCG.js"), name: "MariaDB", driver: "mariadb" }
+  { load: () => import("./postgres-6XY2GPQV.js"), name: "PostgreSQL", driver: "pg" },
+  { load: () => import("./sqlserver-IIGRXGYK.js"), name: "SQL Server", driver: "mssql" },
+  { load: () => import("./sqlite-CZE6Z36Y.js"), name: "SQLite", driver: "node:sqlite" },
+  { load: () => import("./mysql-RLDQI3SJ.js"), name: "MySQL", driver: "mysql2" },
+  { load: () => import("./mariadb-E33EXGJZ.js"), name: "MariaDB", driver: "mariadb" }
 ];
 loadConnectors(connectorModules).then(() => main()).catch((error) => {
   console.error("Fatal error:", error);