@cainli/mcp-server-mysql 2.0.8 → 2.0.9

package/dist/index.js

@@ -72,6 +72,10 @@ export const configSchema = z.object({
     debug: z.boolean().default(false).describe("Enable debug logging"),
 });
 export default function createMcpServer({ sessionId, config, }) {
+    const isDebugEnabled = config?.debug ?? false;
+    if (isDebugEnabled) {
+        log("info", "Debug mode enabled");
+    }
     const server = new Server({
         name: "MySQL MCP Server",
         version: process.env.npm_package_version || "1.0.0",
@@ -123,12 +127,17 @@ export default function createMcpServer({ sessionId, config, }) {
         information_schema.tables
       WHERE
         table_schema NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys')
-        ${!isMultiDbMode && mcpConfig.mysql.database ? `AND table_schema = '${mcpConfig.mysql.database}'` : ''}
       ORDER BY
         table_schema, table_name
     `;
-            const queryResult = (await executeReadOnlyQuery(tablesQuery));
-            const tables = JSON.parse(queryResult.content[0].text);
+            let queryParams = [];
+            let finalQuery = tablesQuery;
+            if (!isMultiDbMode && mcpConfig.mysql.database) {
+                finalQuery = tablesQuery.replace('ORDER BY', `AND table_schema = ?\n      ORDER BY`);
+                queryParams.push(mcpConfig.mysql.database);
+            }
+            const rawResult = await executeQuery(finalQuery, queryParams);
+            const tables = rawResult[0];
             log("info", `Found ${tables.length} tables`);
             const resources = tables.map((table) => ({
                 uri: `mysql://tables/${table.name}`,
@@ -164,11 +173,18 @@ export default function createMcpServer({ sessionId, config, }) {
             let columnsQuery = "SELECT column_name, data_type FROM information_schema.columns WHERE table_name = ?";
             let queryParams = [tableName];
             const schemaName = dbName || (!isMultiDbMode ? mcpConfig.mysql.database : null);
+            if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
+                throw new Error(`Invalid table name: ${tableName}`);
+            }
+            if (schemaName && !/^[a-zA-Z0-9_]+$/.test(schemaName)) {
+                throw new Error(`Invalid schema name: ${schemaName}`);
+            }
             if (schemaName) {
                 columnsQuery += " AND table_schema = ?";
                 queryParams.push(schemaName);
             }
-            const results = (await executeQuery(columnsQuery, queryParams));
+            const rawResult = await executeQuery(columnsQuery, queryParams);
+            const results = rawResult[0];
             return {
                 contents: [
                     {
@@ -306,7 +322,7 @@ if (isMainModule()) {
     log("info", "Running in standalone mode");
     (async () => {
         try {
-            const mcpServer = createMcpServer({ config: { debug: false } });
+            const mcpServer = createMcpServer({});
             if (IS_REMOTE_MCP && REMOTE_SECRET_KEY?.length) {
                 const app = express();
                 app.use(express.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cainli/mcp-server-mysql",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": "MCP server for interacting with MySQL databases with write operations support",
   "license": "MIT",
   "author": "cainli (https://github.com/cainli)",