@dbx-app/mcp-server 0.4.25 → 0.4.27

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createRequire } from "node:module";
 import { z } from "zod";
-import { buildSchemaContext, createBackend, evaluateRedisCommandSafety, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, isMainModule, mdTable, notifyReload, parseMongoAggregateCommand, postBridge, sqlSafetyFromEnv, splitSqlStatements, } from "@dbx-app/node-core";
+import { buildSchemaContext, createBackend, evaluateRedisCommandSafety, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, isMainModule, mdTable, notifyReload, parseMongoAggregateCommand, assessProductionSql, isLikelyMongoMutation, isProductionDatabase, postBridge, sqlSafetyFromEnv, splitSqlStatements, } from "@dbx-app/node-core";
 const require = createRequire(import.meta.url);
 const packageJson = require("../package.json");
 export const DBX_MCP_PACKAGE_VERSION = packageJson.version ?? "0.0.0";
@@ -16,6 +16,22 @@ function toolError(code, message) {
 function withDatabase(config, database) {
     return database === undefined ? config : { ...config, database };
 }
+function metadataScope(config, database, schema) {
+    if (config.db_type !== "dameng") {
+        return { config: withDatabase(config, database), schema };
+    }
+    // Dameng exposes tables under user-owned schemas rather than separate
+    // databases. Accept the legacy database argument as a schema, and default to
+    // the login user when neither argument is provided.
+    const resolvedSchema = schema?.trim() || database?.trim() || config.username?.trim() || undefined;
+    return { config, schema: resolvedSchema };
+}
+function connectionIdentity(config) {
+    return `${config.name} (${config.id}) [${config.db_type} @ ${config.host}:${config.port}]`;
+}
+function labeledText(config, body) {
+    return text(`[${connectionIdentity(config)}]\n${body}`);
+}
 function formatQueryToolResult(result, title) {
     const prefix = title ? `${title}\n` : "";
     if (result.columns.length === 0)
@@ -66,12 +82,33 @@ async function loadScopedConnections(backend, scope) {
         return connections;
     return connections.filter((config) => connectionMatchesScope(config, scope));
 }
-async function resolveConnection(backend, scope, requestedName) {
+async function resolveConnection(backend, scope, requestedId, requestedName) {
+    // connection_id takes priority over connection_name when both are provided.
+    if (requestedId?.trim()) {
+        const connections = await backend.loadConnections();
+        const config = connections.find((c) => c.id === requestedId.trim());
+        if (!config)
+            return { error: toolError("CONNECTION_NOT_FOUND", `Connection with id "${requestedId}" not found.`) };
+        // In scoped mode, verify the resolved connection is within the scope.
+        if (scopeEnabled(scope) && !connectionMatchesScope(config, scope)) {
+            return { error: toolError("CONNECTION_OUT_OF_SCOPE", `Connection "${requestedId}" is outside this DBX AI session scope.`) };
+        }
+        return { config };
+    }
     if (!scopeEnabled(scope)) {
         if (!requestedName?.trim())
             return { error: toolError("CONNECTION_NOT_FOUND", "Connection name is required.") };
-        const config = await backend.findConnection(requestedName);
-        return config ? { config } : { error: toolError("CONNECTION_NOT_FOUND", `Connection "${requestedName}" not found.`) };
+        const connections = await backend.loadConnections();
+        const matching = connections.filter((c) => c.name.toLowerCase() === requestedName.trim().toLowerCase());
+        if (matching.length === 0)
+            return { error: toolError("CONNECTION_NOT_FOUND", `Connection "${requestedName}" not found.`) };
+        if (matching.length > 1) {
+            const lines = matching.map((c) => `- ${c.id}: ${c.db_type} @ ${c.host}:${c.port}`);
+            return {
+                error: toolError("AMBIGUOUS_CONNECTION", `Multiple connections found with name "${requestedName}". Please specify connection_id:\n${lines.join("\n")}`),
+            };
+        }
+        return { config: matching[0] };
     }
     const [scopedConfig] = await loadScopedConnections(backend, scope);
     if (!scopedConfig)
@@ -93,44 +130,51 @@ export function createDbxMcpServer(backend, options = {}) {
         const connections = await loadScopedConnections(backend, scope);
         if (connections.length === 0)
             return text("No connections configured in DBX.");
-        const rows = connections.map((c) => [c.name, c.db_type, c.host, String(c.port), c.database || ""]);
-        return text(mdTable(["Name", "Type", "Host", "Port", "Database"], rows));
+        const rows = connections.map((c) => [c.id, c.name, c.db_type, c.host, String(c.port), c.database || ""]);
+        return text(mdTable(["ID", "Name", "Type", "Host", "Port", "Database"], rows));
     });
     server.tool("dbx_list_tables", "List tables and views for a database connection", {
+        connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
         connection_name: z.string().optional().describe("Name of the DBX connection"),
-        database: z.string().optional().describe("Database name"),
-        schema: z.string().optional().describe("Schema name (default: public for PostgreSQL)"),
-    }, async ({ connection_name, database, schema }) => {
-        const { config, error } = await resolveConnection(backend, scope, connection_name);
+        database: z.string().optional().describe("Database name; for Dameng this is also accepted as a schema alias"),
+        schema: z.string().optional().describe("Schema name (default: public for PostgreSQL, login user for Dameng)"),
+    }, async ({ connection_id, connection_name, database, schema }) => {
+        const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
-        const tables = await backend.listTables(withDatabase(config, database ?? scope.database), schema);
+        const resolvedConfig = config;
+        const scopeValue = metadataScope(resolvedConfig, database ?? scope.database, schema);
+        const tables = await backend.listTables(scopeValue.config, scopeValue.schema);
         if (tables.length === 0)
             return text("No tables found.");
         const rows = tables.map((t) => [t.name, t.type]);
-        return text(mdTable(["Table", "Type"], rows));
+        return labeledText(resolvedConfig, mdTable(["Table", "Type"], rows));
     });
     server.tool("dbx_describe_table", "Get column definitions for a table", {
+        connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
         connection_name: z.string().optional().describe("Name of the DBX connection"),
         table: z.string().describe("Table name"),
-        database: z.string().optional().describe("Database name"),
-        schema: z.string().optional().describe("Schema name (default: public for PostgreSQL)"),
-    }, async ({ connection_name, table, database, schema }) => {
-        const { config, error } = await resolveConnection(backend, scope, connection_name);
+        database: z.string().optional().describe("Database name; for Dameng this is also accepted as a schema alias"),
+        schema: z.string().optional().describe("Schema name (default: public for PostgreSQL, login user for Dameng)"),
+    }, async ({ connection_id, connection_name, table, database, schema }) => {
+        const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
-        const columns = await backend.describeTable(withDatabase(config, database ?? scope.database), table, schema);
+        const resolvedConfig = config;
+        const scopeValue = metadataScope(resolvedConfig, database ?? scope.database, schema);
+        const columns = await backend.describeTable(scopeValue.config, table, scopeValue.schema);
         if (columns.length === 0)
             return text("No columns found.");
         const rows = columns.map((c) => [c.is_primary_key ? `${c.name} (PK)` : c.name, c.data_type, c.is_nullable ? "YES" : "NO", c.column_default ?? "", c.comment ?? ""]);
-        return text(mdTable(["Column", "Type", "Nullable", "Default", "Comment"], rows));
+        return labeledText(resolvedConfig, mdTable(["Column", "Type", "Nullable", "Default", "Comment"], rows));
     });
     server.tool("dbx_execute_query", "Execute a SQL query on a database connection (max 100 rows returned)", {
+        connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
         connection_name: z.string().optional().describe("Name of the DBX connection"),
         database: z.string().optional().describe("Database name"),
         sql: z.string().describe("SQL query to execute"),
-    }, async ({ connection_name, database, sql }) => {
-        const { config, error } = await resolveConnection(backend, scope, connection_name);
+    }, async ({ connection_id, connection_name, database, sql }) => {
+        const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
         const scopedConfig = config;
@@ -141,6 +185,13 @@ export function createDbxMcpServer(backend, options = {}) {
             const safety = evaluateSqlSafety(sql, { ...sqlSafetyFromEnv(), allowMultipleStatements: true });
             if (!safety.allowed)
                 return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
+            const production = assessProductionSql(sql, scopedConfig, database ?? scope.database ?? scopedConfig.database);
+            if (production.active && production.isMutation) {
+                return toolError("PRODUCTION_WRITE_BLOCKED", "MCP cannot execute writes against a production database. Return the SQL for a user to review and run in DBX.");
+            }
+        }
+        else if (isProductionDatabase(scopedConfig, database ?? scope.database ?? scopedConfig.database) && isLikelyMongoMutation(sql)) {
+            return toolError("PRODUCTION_WRITE_BLOCKED", "MCP cannot execute writes against a production database. Return the command for a user to review and run in DBX.");
         }
         // MongoDB shell commands don't fit the SQL safety evaluator; the backend
         // (node-core executeQuery) applies command-aware read/write gating.
@@ -151,8 +202,8 @@ export function createDbxMcpServer(backend, options = {}) {
                 results.push(await backend.executeQuery(withDatabase(scopedConfig, database ?? scope.database), statement));
             }
             if (results.length === 1)
-                return formatQueryToolResult(results[0]);
-            return text(results.map((result, index) => formatQueryToolResult(result, `Statement ${index + 1}`).content[0].text).join("\n\n"));
+                return labeledText(scopedConfig, formatQueryToolResult(results[0]).content[0].text);
+            return labeledText(scopedConfig, results.map((result, index) => formatQueryToolResult(result, `Statement ${index + 1}`).content[0].text).join("\n\n"));
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -160,11 +211,12 @@ export function createDbxMcpServer(backend, options = {}) {
         }
     });
     server.tool("dbx_execute_redis_command", "Execute a Redis command on a Redis connection", {
+        connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
         connection_name: z.string().optional().describe("Name of the DBX Redis connection"),
         db: z.number().int().min(0).optional().describe("Redis logical database number (default: scoped/default database or 0)"),
         command: z.string().describe("Redis command to execute, for example: GET mykey, INFO, or DBSIZE"),
-    }, async ({ connection_name, db, command }) => {
-        const { config, error } = await resolveConnection(backend, scope, connection_name);
+    }, async ({ connection_id, connection_name, db, command }) => {
+        const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
         const scopedConfig = config;
@@ -177,11 +229,14 @@ export function createDbxMcpServer(backend, options = {}) {
         const safety = evaluateRedisCommandSafety(command, sqlSafetyFromEnv());
         if (!safety.allowed)
             return toolError("REDIS_COMMAND_BLOCKED", safety.reason ?? "Redis command blocked.");
+        if (isProductionDatabase(scopedConfig, String(defaultRedisDb(scopedConfig, scope, db))) && safety.safety !== "allowed") {
+            return toolError("PRODUCTION_WRITE_BLOCKED", "MCP cannot execute write or dangerous Redis commands against a production database.");
+        }
         try {
             const result = await backend.executeRedisCommand(scopedConfig, defaultRedisDb(scopedConfig, scope, db), command, {
                 skipSafetyCheck: safety.skipSafetyCheck,
             });
-            return formatRedisCommandToolResult(result);
+            return labeledText(scopedConfig, formatRedisCommandToolResult(result).content[0].text);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -189,23 +244,25 @@ export function createDbxMcpServer(backend, options = {}) {
         }
     });
     server.tool("dbx_get_schema_context", "Get compact table and column context for writing SQL", {
+        connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
         connection_name: z.string().optional().describe("Name of the DBX connection"),
         database: z.string().optional().describe("Database name"),
         schema: z.string().optional().describe("Schema name (default: public for PostgreSQL)"),
         tables: z.array(z.string()).optional().describe("Specific table names to include"),
         max_tables: z.number().int().min(1).max(20).default(8).describe("Maximum number of tables to include"),
-    }, async ({ connection_name, database, schema, tables, max_tables }) => {
-        const { config, error } = await resolveConnection(backend, scope, connection_name);
+    }, async ({ connection_id, connection_name, database, schema, tables, max_tables }) => {
+        const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
-        const context = await buildSchemaContext(backend, withDatabase(config, database ?? scope.database), {
+        const resolvedConfig = config;
+        const context = await buildSchemaContext(backend, withDatabase(resolvedConfig, database ?? scope.database), {
             schema,
             tables,
             maxTables: max_tables,
         });
         if (context.tables.length === 0)
             return text("No matching tables found.");
-        return text(formatSchemaContext(context));
+        return labeledText(resolvedConfig, formatSchemaContext(context));
     });
     if (!scoped) {
         server.tool("dbx_add_connection", "Add a new database connection to DBX", {
@@ -250,7 +307,35 @@ export function createDbxMcpServer(backend, options = {}) {
         });
         server.tool("dbx_remove_connection", "Remove a database connection from DBX", {
             connection_name: z.string().describe("Name of the connection to remove"),
-        }, async ({ connection_name }) => {
+            connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to remove by id instead of name)"),
+        }, async ({ connection_name, connection_id }) => {
+            if (connection_id?.trim()) {
+                if (backend.removeConnectionById) {
+                    const removed = await backend.removeConnectionById(connection_id.trim());
+                    if (!removed)
+                        return toolError("CONNECTION_NOT_FOUND", `Connection with id "${connection_id}" not found.`);
+                    await notifyReload();
+                    return text(`Connection with id "${connection_id}" removed.`);
+                }
+                // Fallback: resolve by id then remove by name
+                const connections = await backend.loadConnections();
+                const config = connections.find((c) => c.id === connection_id.trim());
+                if (!config)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection with id "${connection_id}" not found.`);
+                const removed = await backend.removeConnection(config.name);
+                if (!removed)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection "${config.name}" could not be removed.`);
+                await notifyReload();
+                return text(`Connection "${config.name}" (id: ${config.id}) removed.`);
+            }
+            const allConnections = await backend.loadConnections();
+            const matching = allConnections.filter((c) => c.name.toLowerCase() === connection_name.toLowerCase());
+            if (matching.length === 0)
+                return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
+            if (matching.length > 1) {
+                const lines = matching.map((c) => `- ${c.id}: ${c.db_type} @ ${c.host}:${c.port}`);
+                return toolError("AMBIGUOUS_CONNECTION", `Multiple connections found with name "${connection_name}". Please specify connection_id:\n${lines.join("\n")}`);
+            }
             const removed = await backend.removeConnection(connection_name);
             if (!removed)
                 return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
@@ -261,24 +346,62 @@ export function createDbxMcpServer(backend, options = {}) {
     // Desktop-only tools: open table and execute-and-show require the Tauri bridge
     if (!isWebMode && !scoped) {
         server.tool("dbx_open_table", "Open a table in DBX desktop app UI. Requires DBX to be running.", {
-            connection_name: z.string().describe("Name of the DBX connection"),
+            connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
+            connection_name: z.string().optional().describe("Name of the DBX connection"),
             table: z.string().describe("Table name to open"),
             database: z.string().optional().describe("Database name"),
             schema: z.string().optional().describe("Schema name"),
-        }, async ({ connection_name, table, database, schema }) => {
-            const config = await backend.findConnection(connection_name);
-            if (!config)
-                return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
-            return bridgeRequest("/open-table", { connection_name, table, database, schema }, `Opened ${table} in DBX`);
+        }, async ({ connection_id, connection_name, table, database, schema }) => {
+            let config;
+            if (connection_id?.trim()) {
+                const connections = await backend.loadConnections();
+                config = connections.find((c) => c.id === connection_id.trim());
+                if (!config)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection with id "${connection_id}" not found.`);
+            }
+            else if (connection_name?.trim()) {
+                const connections = await backend.loadConnections();
+                const matching = connections.filter((c) => c.name.toLowerCase() === connection_name.toLowerCase());
+                if (matching.length === 0)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
+                if (matching.length > 1) {
+                    const lines = matching.map((c) => `- ${c.id}: ${c.db_type} @ ${c.host}:${c.port}`);
+                    return toolError("AMBIGUOUS_CONNECTION", `Multiple connections found with name "${connection_name}". Please specify connection_id:\n${lines.join("\n")}`);
+                }
+                config = matching[0];
+            }
+            else {
+                return toolError("CONNECTION_NOT_FOUND", "Either connection_id or connection_name is required.");
+            }
+            return bridgeRequest("/open-table", { connection_id: config.id, connection_name: config.name, table, database, schema }, `Opened ${table} in DBX`);
         });
         server.tool("dbx_execute_and_show", "Execute a SQL query in DBX desktop app UI and show results there. Requires DBX to be running.", {
-            connection_name: z.string().describe("Name of the DBX connection"),
+            connection_id: z.string().optional().describe("Unique ID of the DBX connection (use this to disambiguate when multiple connections share the same name)"),
+            connection_name: z.string().optional().describe("Name of the DBX connection"),
             sql: z.string().describe("SQL query to execute"),
             database: z.string().optional().describe("Database name"),
-        }, async ({ connection_name, sql, database }) => {
-            const config = await backend.findConnection(connection_name);
-            if (!config)
-                return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
+        }, async ({ connection_id, connection_name, sql, database }) => {
+            let config;
+            if (connection_id?.trim()) {
+                const connections = await backend.loadConnections();
+                config = connections.find((c) => c.id === connection_id.trim());
+                if (!config)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection with id "${connection_id}" not found.`);
+            }
+            else if (connection_name?.trim()) {
+                const connections = await backend.loadConnections();
+                const matching = connections.filter((c) => c.name.toLowerCase() === connection_name.toLowerCase());
+                if (matching.length === 0)
+                    return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
+                if (matching.length > 1) {
+                    const lines = matching.map((c) => `- ${c.id}: ${c.db_type} @ ${c.host}:${c.port}`);
+                    return toolError("AMBIGUOUS_CONNECTION", `Multiple connections found with name "${connection_name}". Please specify connection_id:\n${lines.join("\n")}`);
+                }
+                config = matching[0];
+            }
+            else {
+                return toolError("CONNECTION_NOT_FOUND", "Either connection_id or connection_name is required.");
+            }
             const safetyOptions = sqlSafetyFromEnv();
             if (config?.db_type === "mongodb") {
                 const aggregate = parseMongoAggregateCommand(sql);
@@ -293,10 +416,22 @@ export function createDbxMcpServer(backend, options = {}) {
                 if (!safety.allowed)
                     return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
             }
+            if (config?.db_type === "mongodb") {
+                if (isProductionDatabase(config, database ?? scope.database ?? config.database) && isLikelyMongoMutation(sql)) {
+                    return toolError("PRODUCTION_WRITE_BLOCKED", "MCP cannot send writes against a production database to DBX.");
+                }
+            }
+            else {
+                const production = assessProductionSql(sql, config, database ?? scope.database ?? config.database);
+                if (production.active && production.isMutation) {
+                    return toolError("PRODUCTION_WRITE_BLOCKED", "MCP cannot send writes against a production database to DBX.");
+                }
+            }
             // MongoDB shell commands bypass the SQL safety evaluator; pass MCP
             // safety flags to the desktop executor for command-aware gating.
             return bridgeRequest("/execute-query", {
-                connection_name,
+                connection_id: config.id,
+                connection_name: config.name,
                 sql,
                 database,
                 allow_writes: safetyOptions.allowWrites,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dbx-app/mcp-server",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "description": "MCP server for DBX — query databases from Claude Code, Cursor, and other AI agents",
   "keywords": [
     "ai-agent",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "zod": "^3.25.20",
-    "@dbx-app/node-core": "^0.4.25"
+    "@dbx-app/node-core": "^0.4.27"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/t8y2/dbx",
     "source": "github"
   },
-  "version": "0.4.25",
+  "version": "0.4.27",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dbx-app/mcp-server",
-      "version": "0.4.25",
+      "version": "0.4.27",
       "transport": {
         "type": "stdio"
       }