@dbx-app/mcp-server 0.4.38 → 0.4.40

package/README.md

@@ -23,8 +23,8 @@ The MCP protocol, connection loading, SQL safety, schema access, Redis support,
 - **Local, Web, and Docker modes** using the same tool interface
 - **Direct native execution** for supported SQL, Redis, and MongoDB connections
 - **Agent/JDBC database support** through DBX agent infrastructure when the required agent and JRE are installed
-- **SQL safety controls** for writes, destructive SQL, Redis commands, and MongoDB mutations
-- **Connection scoping** for limiting an MCP server to one connection or database
+- **DBX-managed access policy** with a connection allowlist and three execution modes
+- **SQL, Redis, and MongoDB safety controls** that reload the policy for every request
 - **Offline execution** through downloadable native binaries
 - **Optional desktop integration** for opening tables and displaying query results in DBX
 
@@ -142,8 +142,8 @@ Ask the MCP client to:
 | Tool | Description |
 | --- | --- |
 | `dbx_list_connections` | List connections visible to the MCP session |
-| `dbx_add_connection` | Add a connection to local DBX storage |
-| `dbx_remove_connection` | Remove a connection from local DBX storage |
+| `dbx_add_connection` | Add a connection to DBX storage |
+| `dbx_remove_connection` | Remove a connection from DBX storage |
 | `dbx_list_tables` | List tables, views, or collections |
 | `dbx_describe_table` | Return columns and table metadata |
 | `dbx_get_schema_context` | Return compact schema context suitable for an AI model |
@@ -213,42 +213,43 @@ Point `DBX_DATA_DIR` at the portable `data` directory containing `dbx.db`:
 }
 ```
 
-## Connection Scoping
+## DBX-managed MCP Policy
 
-Restrict one MCP server to a connection or database:
+DBX stores one authoritative policy under **Settings → MCP** and reloads it for every request:
+
+| Permission mode | Allowed operations |
+| --- | --- |
+| Read only | Queries and metadata reads |
+| Data read/write | Regular inserts, effectively filtered updates/deletes, scoped MongoDB mutations, and ordinary Redis writes |
+| Full access | Also permits broad updates/deletes, DDL, `TRUNCATE`, MongoDB destructive operations, and Redis `FLUSH*` |
+
+**Allowed connections** controls which stable connection IDs MCP can list or resolve. Connection-level read-only protection, production protection, database credentials, and the allowlist remain upper bounds in every mode.
+
+Conditions such as `WHERE TRUE`, `WHERE 1 = 1`, `_id: {$exists: true}`, complementary predicates, and opaque MongoDB filters remain high risk. Unknown Redis commands also fail closed.
+
+Legacy connection scope variables can still narrow the DBX allowlist for existing client configurations:
 
 ```json
 {
   "mcpServers": {
-    "dbx-production-readonly": {
+    "dbx-production-scope": {
       "command": "dbx-mcp-server",
       "env": {
         "DBX_MCP_SCOPE_CONNECTION_NAME": "production-postgres",
-        "DBX_MCP_SCOPE_DATABASE": "analytics",
-        "DBX_MCP_ALLOW_WRITES": "0"
+        "DBX_MCP_SCOPE_DATABASE": "analytics"
       }
     }
   }
 }
 ```
 
-Use either `DBX_MCP_SCOPE_CONNECTION_ID` or `DBX_MCP_SCOPE_CONNECTION_NAME`. The scoped database is optional.
+Use `DBX_MCP_SCOPE_CONNECTION_ID`, comma-separated `DBX_MCP_SCOPE_CONNECTION_IDS`, or `DBX_MCP_SCOPE_CONNECTION_NAME`. ID scopes take precedence over the name scope. The scoped database is optional.
 
 ## Safety
 
-Regular writes are enabled by default. Force a read-only session with:
-
-```bash
-DBX_MCP_ALLOW_WRITES=0
-```
-
-Dangerous operations such as `DROP`, `TRUNCATE`, `ALTER`, Redis `FLUSHALL`, or dangerous MongoDB mutations remain blocked unless explicitly enabled:
+Choose **Read only**, **Data read/write**, or **Full access** in DBX instead of placing permission flags in client configuration. Updated servers do not let `DBX_MCP_ALLOW_WRITES` or `DBX_MCP_ALLOW_DANGEROUS_SQL` widen the DBX policy. For upgrade compatibility, `DBX_MCP_ALLOW_WRITES=0` (or `false`) keeps MCP read-only until a central policy is saved for the first time; the legacy permission variables are ignored afterward.
 
-```bash
-DBX_MCP_ALLOW_DANGEROUS_SQL=1
-```
-
-MongoDB update/delete operations require a non-empty filter unless dangerous operations are enabled. Aggregation stages such as `$out` and `$merge` are treated as writes.
+MongoDB update/delete operations require a verifiably effective filter unless Full access is enabled. Aggregation stages such as `$out` and `$merge` are treated as high-risk writes.
 
 SQL text is not included in normal MCP errors or logged by default. Enable temporary diagnostics with `DBX_MCP_DEBUG_SQL=1` and disable it after troubleshooting.
 
@@ -259,9 +260,9 @@ SQL text is not included in normal MCP errors or logged by default. Enable tempo
 | `DBX_DATA_DIR` | Override the local DBX data directory |
 | `DBX_WEB_URL` | Use a DBX Web/Docker backend |
 | `DBX_WEB_PASSWORD` | Authenticate to the DBX Web backend |
-| `DBX_MCP_ALLOW_WRITES` | Set to `0` to force read-only execution |
-| `DBX_MCP_ALLOW_DANGEROUS_SQL` | Set to `1` to allow dangerous SQL, Redis, and MongoDB operations |
-| `DBX_MCP_SCOPE_CONNECTION_ID` | Restrict tools to one connection ID |
+| `DBX_MCP_ALLOW_WRITES` | Upgrade compatibility only: `0`/`false` keeps an unconfigured policy read-only |
+| `DBX_MCP_SCOPE_CONNECTION_ID` | Compatibility scope for one connection ID |
+| `DBX_MCP_SCOPE_CONNECTION_IDS` | Compatibility scope for multiple connection IDs |
 | `DBX_MCP_SCOPE_CONNECTION_NAME` | Restrict tools to one connection name |
 | `DBX_MCP_SCOPE_DATABASE` | Restrict tools to one database |
 | `DBX_MCP_DEBUG_SQL` | Include SQL in temporary diagnostics |
@@ -329,8 +330,6 @@ Build a release binary:
 cargo build --release -p dbx-mcp --no-default-features
 ```
 
-The previous TypeScript MCP implementation remains in `packages/mcp-server/src` for migration tests and compatibility reference; it is not the npm runtime entrypoint.
-
 ## DBX CLI
 
 `@dbx-app/cli` is a separate terminal-oriented package and currently remains TypeScript/Node.js based:
@@ -450,8 +449,8 @@ MCP 配置：
 | 工具 | 说明 |
 | --- | --- |
 | `dbx_list_connections` | 列出当前 MCP 会话可见的连接 |
-| `dbx_add_connection` | 添加本地连接配置 |
-| `dbx_remove_connection` | 删除本地连接配置 |
+| `dbx_add_connection` | 添加 DBX 连接配置 |
+| `dbx_remove_connection` | 删除 DBX 连接配置 |
 | `dbx_list_tables` | 列出表、视图或集合 |
 | `dbx_describe_table` | 获取字段和表结构 |
 | `dbx_get_schema_context` | 获取适合 AI 使用的紧凑 Schema 上下文 |
@@ -492,40 +491,43 @@ Web 模式不会读取本机 DBX 桌面存储，也不会暴露桌面 UI 工具
 
 npm 和 GitHub Release 中的原生 MCP 文件不会捆绑所有厂商的专有 JDBC Driver。请先通过 DBX Driver Manager 安装对应 Agent 和 JRE，或提供兼容的 DBX Agent 目录。
 
-### 连接作用域和只读模式
+### DBX 管理的 MCP 策略
+
+DBX 在 **设置 → MCP** 中保存一份权威策略，并在每次请求时重新读取：
+
+| 权限模式 | 允许的操作 |
+| --- | --- |
+| 只读 | 查询和元数据读取 |
+| 数据读写 | 普通插入、带有效过滤条件的更新/删除、范围明确的 MongoDB 修改和普通 Redis 写入 |
+| 完全访问 | 额外允许大范围更新/删除、DDL、`TRUNCATE`、MongoDB 破坏性操作和 Redis `FLUSH*` |
+
+**允许访问的连接** 决定 MCP 可以列出和解析哪些稳定连接 ID。连接自身只读、生产库保护、数据库账号权限和 allowlist 在任何模式下都是权限上限。
+
+`WHERE TRUE`、`WHERE 1 = 1`、`_id: {$exists: true}`、互补条件或不透明 MongoDB 过滤器仍按高风险处理。未知 Redis 命令也会失败关闭。
+
+旧连接 scope 变量可继续兼容读取，但只能进一步收窄 DBX allowlist：
 
 ```json
 {
   "mcpServers": {
-    "dbx-production-readonly": {
+    "dbx-production-scope": {
       "command": "dbx-mcp-server",
       "env": {
         "DBX_MCP_SCOPE_CONNECTION_NAME": "production-postgres",
-        "DBX_MCP_SCOPE_DATABASE": "analytics",
-        "DBX_MCP_ALLOW_WRITES": "0"
+        "DBX_MCP_SCOPE_DATABASE": "analytics"
       }
     }
   }
 }
 ```
 
-作用域模式会隐藏连接增删和桌面 UI 工具。
+可使用 `DBX_MCP_SCOPE_CONNECTION_ID`、逗号分隔的 `DBX_MCP_SCOPE_CONNECTION_IDS` 或 `DBX_MCP_SCOPE_CONNECTION_NAME`。ID scope 优先于名称 scope；作用域模式会隐藏连接增删和桌面 UI 工具。
 
 ### SQL 和命令安全
 
-默认允许常规 `INSERT`、`UPDATE`、`DELETE ... WHERE ...`。强制只读：
+请在 DBX 中选择 **只读**、**数据读写** 或 **完全访问**，不要在客户端配置中放置权限开关。新版 Server 不允许 `DBX_MCP_ALLOW_WRITES` 或 `DBX_MCP_ALLOW_DANGEROUS_SQL` 放宽 DBX 中央策略。为兼容升级，在中央策略首次保存前，`DBX_MCP_ALLOW_WRITES=0`（或 `false`）仍会保持 MCP 只读；策略保存后旧权限变量即被忽略。
 
-```bash
-DBX_MCP_ALLOW_WRITES=0
-```
-
-允许 `DROP`、`TRUNCATE`、`ALTER`、Redis `FLUSHALL` 或危险 MongoDB 操作：
-
-```bash
-DBX_MCP_ALLOW_DANGEROUS_SQL=1
-```
-
-MongoDB 更新和删除默认要求非空 filter；`$out`、`$merge` 聚合阶段按写操作处理。
+MongoDB 更新和删除在未启用完全访问时必须提供可验证有效的 filter；`$out`、`$merge` 聚合阶段按高风险写操作处理。
 
 ### 环境变量
 
@@ -534,9 +536,9 @@ MongoDB 更新和删除默认要求非空 filter；`$out`、`$merge` 聚合阶
 | `DBX_DATA_DIR` | 覆盖本地 DBX 数据目录 |
 | `DBX_WEB_URL` | 使用 DBX Web/Docker 后端 |
 | `DBX_WEB_PASSWORD` | DBX Web 登录密码 |
-| `DBX_MCP_ALLOW_WRITES` | 设置为 `0` 强制只读 |
-| `DBX_MCP_ALLOW_DANGEROUS_SQL` | 设置为 `1` 允许危险操作 |
-| `DBX_MCP_SCOPE_CONNECTION_ID` | 限制到指定连接 ID |
+| `DBX_MCP_ALLOW_WRITES` | 仅用于升级兼容：`0`/`false` 使尚未配置的策略保持只读 |
+| `DBX_MCP_SCOPE_CONNECTION_ID` | 兼容旧配置：限制到指定连接 ID |
+| `DBX_MCP_SCOPE_CONNECTION_IDS` | 兼容旧配置：限制到多个连接 ID |
 | `DBX_MCP_SCOPE_CONNECTION_NAME` | 限制到指定连接名称 |
 | `DBX_MCP_SCOPE_DATABASE` | 限制到指定数据库 |
 | `DBX_MCP_DEBUG_SQL` | 临时输出 SQL 诊断信息 |
@@ -578,8 +580,6 @@ pnpm --filter @dbx-app/mcp-server test
 cargo build --release -p dbx-mcp --no-default-features
 ```
 
-旧 TypeScript MCP 源码仍保留在 `packages/mcp-server/src`，用于迁移测试和兼容参考，不再是 npm 的运行入口。
-
 ### DBX CLI
 
 `@dbx-app/cli` 是独立的终端包，目前仍使用 TypeScript/Node.js：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dbx-app/mcp-server",
-  "version": "0.4.38",
+  "version": "0.4.40",
   "description": "MCP server for DBX — query databases from Claude Code, Cursor, and other AI agents",
   "keywords": [
     "ai-agent",
@@ -28,12 +28,12 @@
   ],
   "type": "module",
   "optionalDependencies": {
-    "@dbx-app/mcp-darwin-arm64": "0.4.38",
-    "@dbx-app/mcp-darwin-x64": "0.4.38",
-    "@dbx-app/mcp-linux-arm64-gnu": "0.4.38",
-    "@dbx-app/mcp-linux-x64-gnu": "0.4.38",
-    "@dbx-app/mcp-win32-arm64": "0.4.38",
-    "@dbx-app/mcp-win32-x64": "0.4.38"
+    "@dbx-app/mcp-darwin-arm64": "0.4.40",
+    "@dbx-app/mcp-darwin-x64": "0.4.40",
+    "@dbx-app/mcp-linux-arm64-gnu": "0.4.40",
+    "@dbx-app/mcp-linux-x64-gnu": "0.4.40",
+    "@dbx-app/mcp-win32-arm64": "0.4.40",
+    "@dbx-app/mcp-win32-x64": "0.4.40"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/t8y2/dbx",
     "source": "github"
   },
-  "version": "0.4.38",
+  "version": "0.4.40",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dbx-app/mcp-server",
-      "version": "0.4.38",
+      "version": "0.4.40",
       "transport": {
         "type": "stdio"
       }