@dbx-app/mcp-server 0.4.29 → 0.4.31

package/README.md

@@ -124,6 +124,10 @@ DBX_MCP_ALLOW_DANGEROUS_SQL=1
 
 Redis connections use `dbx_execute_redis_command` instead of `dbx_execute_query`. Redis write commands honor `DBX_MCP_ALLOW_WRITES`; dangerous Redis commands such as `KEYS`, `FLUSHALL`, and `EVAL` require `DBX_MCP_ALLOW_DANGEROUS_SQL=1`.
 
+## SQL Diagnostics Privacy
+
+SQL statements are not included in normal MCP errors and are not logged by default. To enable temporary diagnostics, set `DBX_MCP_DEBUG_SQL=1` (or `DBX_SQL_DEBUG=1`). Diagnostic statements redact quoted literals and common secret assignments, and are truncated to 512 characters. Do not enable this setting unless the resulting diagnostic metadata is appropriate for the environment.
+
 ## How It Works
 
 ```

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createRequire } from "node:module";
 import { z } from "zod";
-import { buildSchemaContext, createBackend, evaluateRedisCommandSafety, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, isMainModule, mdTable, notifyReload, parseMongoAggregateCommand, assessProductionSql, isLikelyMongoMutation, isProductionDatabase, postBridge, sqlSafetyFromEnv, splitSqlStatements, } from "@dbx-app/node-core";
+import { buildSchemaContext, createBackend, evaluateRedisCommandSafety, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, isMainModule, mdTable, notifyReload, parseMongoAggregateCommand, assessProductionSql, isLikelyMongoMutation, isProductionDatabase, postBridge, logSqlDiagnostic, sqlSafetyFromEnv, splitSqlStatements, supportsHashLineComments, } from "@dbx-app/node-core";
 const require = createRequire(import.meta.url);
 const packageJson = require("../package.json");
 export const DBX_MCP_PACKAGE_VERSION = packageJson.version ?? "0.0.0";
@@ -174,6 +174,7 @@ export function createDbxMcpServer(backend, options = {}) {
         database: z.string().optional().describe("Database name"),
         sql: z.string().describe("SQL query to execute"),
     }, async ({ connection_id, connection_name, database, sql }) => {
+        logSqlDiagnostic("dbx_execute_query", sql, { connection_id, connection_name, database });
         const { config, error } = await resolveConnection(backend, scope, connection_id, connection_name);
         if (error)
             return error;
@@ -182,7 +183,8 @@ export function createDbxMcpServer(backend, options = {}) {
             return toolError("REDIS_COMMAND_REQUIRED", "Redis connections do not accept SQL through dbx_execute_query. Use dbx_execute_redis_command with a Redis command such as GET key or INFO.");
         }
         if (scopedConfig.db_type !== "mongodb") {
-            const safety = evaluateSqlSafety(sql, { ...sqlSafetyFromEnv(), allowMultipleStatements: true });
+            const hashLineComments = supportsHashLineComments(scopedConfig.db_type);
+            const safety = evaluateSqlSafety(sql, { ...sqlSafetyFromEnv(), allowMultipleStatements: true, hashLineComments });
             if (!safety.allowed)
                 return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
             const production = assessProductionSql(sql, scopedConfig, database ?? scope.database ?? scopedConfig.database);
@@ -196,7 +198,7 @@ export function createDbxMcpServer(backend, options = {}) {
         // MongoDB shell commands don't fit the SQL safety evaluator; the backend
         // (node-core executeQuery) applies command-aware read/write gating.
         try {
-            const statements = scopedConfig.db_type === "mongodb" ? [sql] : splitSqlStatements(sql);
+            const statements = scopedConfig.db_type === "mongodb" ? [sql] : splitSqlStatements(sql, { hashLineComments: supportsHashLineComments(scopedConfig.db_type) });
             const results = [];
             for (const statement of statements) {
                 results.push(await backend.executeQuery(withDatabase(scopedConfig, database ?? scope.database), statement));
@@ -413,7 +415,8 @@ export function createDbxMcpServer(backend, options = {}) {
                 }
             }
             else {
-                const safety = evaluateSqlSafety(sql, { ...safetyOptions, allowMultipleStatements: true });
+                const hashLineComments = supportsHashLineComments(config?.db_type);
+                const safety = evaluateSqlSafety(sql, { ...safetyOptions, allowMultipleStatements: true, hashLineComments });
                 if (!safety.allowed)
                     return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
             }
@@ -430,6 +433,7 @@ export function createDbxMcpServer(backend, options = {}) {
             }
             // MongoDB shell commands bypass the SQL safety evaluator; pass MCP
             // safety flags to the desktop executor for command-aware gating.
+            logSqlDiagnostic("dbx_execute_in_app", sql, { connection_id: config.id, connection_name: config.name, database });
             return bridgeRequest("/execute-query", {
                 connection_id: config.id,
                 connection_name: config.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dbx-app/mcp-server",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "description": "MCP server for DBX — query databases from Claude Code, Cursor, and other AI agents",
   "keywords": [
     "ai-agent",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "zod": "^3.25.20",
-    "@dbx-app/node-core": "^0.4.29"
+    "@dbx-app/node-core": "^0.4.31"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/t8y2/dbx",
     "source": "github"
   },
-  "version": "0.4.29",
+  "version": "0.4.31",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dbx-app/mcp-server",
-      "version": "0.4.29",
+      "version": "0.4.31",
       "transport": {
         "type": "stdio"
       }