@dbx-app/mcp-server 0.4.4 → 0.4.5

package/README.md

@@ -92,7 +92,7 @@ See the [DBX CLI README](../cli/README.md) for command details.
 
 ## SQL Safety
 
-`dbx_execute_query` is read-only by default. To allow write statements such as `INSERT` or `UPDATE`, set:
+`dbx_execute_query` accepts multiple SQL statements and executes them one at a time after checking each statement. It is read-only by default. To allow write statements such as `INSERT` or `UPDATE`, set:
 
 ```bash
 DBX_MCP_ALLOW_WRITES=1
@@ -213,7 +213,7 @@ dbx query local "select 1" --json
 
 ### SQL 安全
 
-`dbx_execute_query` 默认只读。若要允许 `INSERT`、`UPDATE` 等写操作，设置：
+`dbx_execute_query` 支持多条 SQL 语句，会逐条完成安全检查并依次执行。默认只读。若要允许 `INSERT`、`UPDATE` 等写操作，设置：
 
 ```bash
 DBX_MCP_ALLOW_WRITES=1

package/dist/index.js

@@ -2,9 +2,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
 import { z } from "zod";
-import { buildSchemaContext, createBackend, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, mdTable, notifyReload, parseMongoAggregateCommand, postBridge, sqlSafetyFromEnv, } from "@dbx-app/node-core";
+import { buildSchemaContext, createBackend, evaluateMongoAggregateSafety, evaluateSqlSafety, formatCell, formatSchemaContext, isMainModule, mdTable, notifyReload, parseMongoAggregateCommand, postBridge, sqlSafetyFromEnv, splitSqlStatements, } from "@dbx-app/node-core";
 const require = createRequire(import.meta.url);
 const packageJson = require("../package.json");
 export const DBX_MCP_PACKAGE_VERSION = packageJson.version ?? "0.0.0";
@@ -17,6 +16,13 @@ function toolError(code, message) {
 function withDatabase(config, database) {
     return database === undefined ? config : { ...config, database };
 }
+function formatQueryToolResult(result, title) {
+    const prefix = title ? `${title}\n` : "";
+    if (result.columns.length === 0)
+        return text(`${prefix}Query executed. ${result.row_count} row(s) affected.`);
+    const rows = result.rows.map((r) => result.columns.map((c) => formatCell(r[c])));
+    return text(`${prefix}${mdTable(result.columns, rows)}\n\n${result.row_count} row(s)`);
+}
 export const DBX_CONNECTION_TYPE_DESCRIPTION = "Database type: postgres, mysql, sqlite, redis, duckdb, clickhouse, sqlserver, mongodb, oracle, elasticsearch, doris, starrocks, redshift, dameng, kingbase, highgo, vastbase, goldendb, gaussdb, yashandb, databricks, saphana, teradata, vertica, firebird, exasol, opengauss, oceanbase-oracle, gbase, h2, snowflake, trino, hive, db2, informix, neo4j, cassandra, bigquery, kylin, sundb, tdengine, xugu, jdbc, access";
 export function createDbxMcpServer(backend, options = {}) {
     const isWebMode = options.isWebMode ?? !!process.env.DBX_WEB_URL;
@@ -75,18 +81,21 @@ export function createDbxMcpServer(backend, options = {}) {
         if (!config)
             return toolError("CONNECTION_NOT_FOUND", `Connection "${connection_name}" not found.`);
         if (config.db_type !== "mongodb") {
-            const safety = evaluateSqlSafety(sql, sqlSafetyFromEnv());
+            const safety = evaluateSqlSafety(sql, { ...sqlSafetyFromEnv(), allowMultipleStatements: true });
             if (!safety.allowed)
                 return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
         }
         // MongoDB shell commands don't fit the SQL safety evaluator; the backend
         // (node-core executeQuery) applies command-aware read/write gating.
         try {
-            const result = await backend.executeQuery(withDatabase(config, database), sql);
-            if (result.columns.length === 0)
-                return text(`Query executed. ${result.row_count} row(s) affected.`);
-            const rows = result.rows.map((r) => result.columns.map((c) => formatCell(r[c])));
-            return text(`${mdTable(result.columns, rows)}\n\n${result.row_count} row(s)`);
+            const statements = config.db_type === "mongodb" ? [sql] : splitSqlStatements(sql);
+            const results = [];
+            for (const statement of statements) {
+                results.push(await backend.executeQuery(withDatabase(config, database), statement));
+            }
+            if (results.length === 1)
+                return formatQueryToolResult(results[0]);
+            return text(results.map((result, index) => formatQueryToolResult(result, `Statement ${index + 1}`).content[0].text).join("\n\n"));
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -184,7 +193,7 @@ export function createDbxMcpServer(backend, options = {}) {
                 }
             }
             else {
-                const safety = evaluateSqlSafety(sql, safetyOptions);
+                const safety = evaluateSqlSafety(sql, { ...safetyOptions, allowMultipleStatements: true });
                 if (!safety.allowed)
                     return toolError("SQL_BLOCKED", safety.reason ?? "SQL blocked.");
             }
@@ -214,7 +223,7 @@ async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMainModule(import.meta.url, process.argv[1])) {
     main().catch((e) => {
         console.error("MCP Server failed to start:", e);
         process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dbx-app/mcp-server",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "mcpName": "io.github.t8y2/dbx",
   "description": "MCP server for DBX — query databases from Claude Code, Cursor, and other AI agents",
   "type": "module",
@@ -34,7 +34,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "zod": "^3.25.20",
-    "@dbx-app/node-core": "^0.4.4"
+    "@dbx-app/node-core": "^0.4.5"
   },
   "devDependencies": {
     "@types/node": "^22.15.21",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/t8y2/dbx",
     "source": "github"
   },
-  "version": "0.4.4",
+  "version": "0.4.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dbx-app/mcp-server",
-      "version": "0.4.4",
+      "version": "0.4.5",
       "transport": {
         "type": "stdio"
       }