@cmd233/mcp-database-server 1.3.0 → 1.4.1

package/dist/src/db/sqlserver-adapter.js

@@ -296,6 +296,8 @@ export class SqlServerAdapter {
     getDescribeTableQuery(tableName) {
         // 验证并转义表名，防止 SQL 注入
         const escapedTableName = escapeIdentifier(tableName);
+        // 用于字符串比较（不带方括号）
+        const safeTableName = tableName.replace(/'/g, "''");
         return `
       SELECT
         c.COLUMN_NAME as name,
@@ -316,13 +318,13 @@ export class SqlServerAdapter {
             SELECT o.object_id
             FROM sys.objects o
             INNER JOIN sys.schemas s ON o.schema_id = s.schema_id
-            WHERE o.name = ${escapedTableName} AND s.name = c.TABLE_SCHEMA
+            WHERE o.name = '${safeTableName}' AND s.name = c.TABLE_SCHEMA
             AND o.type IN ('U', 'V')
           )
           AND ep.minor_id = c.ORDINAL_POSITION
           AND ep.name = 'MS_Description'
       WHERE
-        c.TABLE_NAME = ${escapedTableName}
+        c.TABLE_NAME = '${safeTableName}'
       ORDER BY
         c.ORDINAL_POSITION
     `;

package/dist/src/handlers/toolHandlers.js

@@ -165,45 +165,6 @@ export function handleListTools() {
                     destructiveHint: true
                 }
             },
-            {
-                name: "drop_table",
-                title: "Drop Table",
-                description: "Permanently delete a table from the database. " +
-                    "This operation has been DISABLED for security reasons. " +
-                    "DROP operations should be handled by DBA at the database level. " +
-                    "Contact your database administrator if you need to delete a table.",
-                inputSchema: {
-                    type: "object",
-                    properties: {
-                        table_name: {
-                            type: "string",
-                            description: "Name of the table to delete"
-                        },
-                        confirm: {
-                            type: "boolean",
-                            description: "Must be set to true to confirm table deletion"
-                        },
-                    },
-                    required: ["table_name", "confirm"],
-                },
-                outputSchema: {
-                    type: "object",
-                    properties: {
-                        success: {
-                            type: "boolean",
-                            description: "True if the table was dropped successfully"
-                        },
-                        message: {
-                            type: "string",
-                            description: "Success message with the dropped table name"
-                        }
-                    }
-                },
-                annotations: {
-                    readOnlyHint: false,
-                    destructiveHint: true
-                }
-            },
             {
                 name: "export_query",
                 title: "Export Query",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cmd233/mcp-database-server",
-    "version": "1.3.0",
+    "version": "1.4.1",
     "description": "MCP server for interacting with SQLite, SQL Server, PostgreSQL and MySQL databases (Added stored procedure support and enhanced SQL injection protection)",
     "license": "MIT",
     "author": "cmd233",