@ecubelabs/mysql-mcp 0.0.0-stage → 0.0.1

package/dist/src/ssh/tunnel.js

@@ -0,0 +1,334 @@
+import * as fs from 'fs';
+import * as net from 'net';
+import { Client as SSHClient } from 'ssh2';
+import { MYSQL_HOST, MYSQL_PORT, SSH_CONFIG_HOST, SSH_ENABLED, SSH_HOST, SSH_LOCAL_PORT, SSH_PASSPHRASE, SSH_PORT, SSH_PRIVATE_KEY_PATH, SSH_REUSE_EXISTING, SSH_USER, } from '../config/index.js';
+import { log } from '../utils/index.js';
+import { expandHome, readSSHConfigHost } from './config.js';
+class LocalPortTakenError extends Error {
+}
+const RECONNECT_MAX_ATTEMPTS = 3;
+const RECONNECT_BASE_DELAY_MS = 1000;
+const PROBE_TIMEOUT_MS = 750;
+const SSH_READY_TIMEOUT_MS = 20000;
+let resolvedTunnelConfig = null;
+export function resolveTunnelConfig() {
+    if (resolvedTunnelConfig) {
+        return resolvedTunnelConfig;
+    }
+    const configHost = SSH_CONFIG_HOST;
+    let fromConfig = null;
+    if (configHost) {
+        fromConfig = readSSHConfigHost(configHost);
+        if (!fromConfig) {
+            throw new Error(`MYSQL_SSH_CONFIG_HOST="${configHost}" was not found as a Host alias in ~/.ssh/config. ` +
+                `Either add the alias or set MYSQL_SSH_HOST / MYSQL_SSH_USER explicitly.`);
+        }
+        log('info', `[ssh] resolved alias "${configHost}" from ~/.ssh/config: ` +
+            JSON.stringify({
+                hostName: fromConfig.hostName,
+                user: fromConfig.user,
+                port: fromConfig.port,
+                localForward: fromConfig.localForward,
+            }));
+    }
+    const sshHost = SSH_HOST ?? fromConfig?.hostName;
+    const sshUser = SSH_USER ?? fromConfig?.user;
+    const sshPort = SSH_PORT ?? fromConfig?.port ?? 22;
+    const privateKeyPath = expandHome(SSH_PRIVATE_KEY_PATH ?? fromConfig?.identityFile ?? '~/.ssh/id_rsa');
+    const localPort = SSH_LOCAL_PORT ?? fromConfig?.localForward?.localPort ?? 0;
+    const remoteHost = fromConfig?.localForward?.remoteHost ?? MYSQL_HOST;
+    const remotePort = fromConfig?.localForward?.remotePort ?? MYSQL_PORT;
+    const missing = [];
+    if (!sshHost) {
+        missing.push('MYSQL_SSH_HOST (or a HostName in the alias)');
+    }
+    if (!sshUser) {
+        missing.push('MYSQL_SSH_USER (or a User in the alias)');
+    }
+    if (!remoteHost) {
+        missing.push('MYSQL_HOST (or a LocalForward target in the alias)');
+    }
+    if (missing.length > 0) {
+        throw new Error(`SSH tunnel is enabled but underspecified. Missing: ${missing.join(', ')}.`);
+    }
+    if (!fs.existsSync(privateKeyPath)) {
+        throw new Error(`SSH private key not found at "${privateKeyPath}". ` +
+            `Set MYSQL_SSH_PRIVATE_KEY_PATH to the key that authenticates ${sshUser}@${sshHost}.`);
+    }
+    resolvedTunnelConfig = {
+        sshHost: sshHost,
+        sshPort,
+        sshUser: sshUser,
+        privateKeyPath,
+        passphrase: SSH_PASSPHRASE,
+        localPort,
+        remoteHost: remoteHost,
+        remotePort,
+    };
+    return resolvedTunnelConfig;
+}
+function probeLocalPort(port) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        let settled = false;
+        const finish = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            socket.destroy();
+            resolve(result);
+        };
+        socket.setTimeout(PROBE_TIMEOUT_MS);
+        socket.once('connect', () => finish(true));
+        socket.once('timeout', () => finish(false));
+        socket.once('error', () => finish(false));
+        socket.connect(port, '127.0.0.1');
+    });
+}
+let endpointPromise = null;
+let localServer = null;
+let sshClient = null;
+let activeConfig = null;
+let activeEndpoint = null;
+let shuttingDown = false;
+let fatalError = null;
+function connectSSH(cfg) {
+    return new Promise((resolve, reject) => {
+        const client = new SSHClient();
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            client.destroy();
+            reject(new Error(`SSH handshake with ${cfg.sshUser}@${cfg.sshHost}:${cfg.sshPort} did not complete within ${SSH_READY_TIMEOUT_MS}ms.`));
+        }, SSH_READY_TIMEOUT_MS);
+        client.once('ready', () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            resolve(client);
+        });
+        client.once('error', (err) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            client.destroy();
+            reject(new Error(`SSH connection to ${cfg.sshUser}@${cfg.sshHost}:${cfg.sshPort} failed: ${err.message}`));
+        });
+        let privateKey;
+        try {
+            privateKey = fs.readFileSync(cfg.privateKeyPath);
+        }
+        catch (err) {
+            clearTimeout(timer);
+            settled = true;
+            reject(new Error(`Failed to read SSH private key "${cfg.privateKeyPath}": ${err.message}`));
+            return;
+        }
+        const connectConfig = {
+            host: cfg.sshHost,
+            port: cfg.sshPort,
+            username: cfg.sshUser,
+            privateKey,
+            readyTimeout: SSH_READY_TIMEOUT_MS,
+            keepaliveInterval: 15000,
+            keepaliveCountMax: 3,
+            ...(cfg.passphrase ? { passphrase: cfg.passphrase } : {}),
+        };
+        client.connect(connectConfig);
+    });
+}
+async function reconnect(cfg) {
+    for (let attempt = 1; attempt <= RECONNECT_MAX_ATTEMPTS; attempt++) {
+        if (shuttingDown) {
+            return;
+        }
+        const delay = RECONNECT_BASE_DELAY_MS * 2 ** (attempt - 1);
+        log('error', `[ssh] tunnel dropped; reconnect attempt ${attempt}/${RECONNECT_MAX_ATTEMPTS} in ${delay}ms`);
+        await new Promise((r) => setTimeout(r, delay));
+        if (shuttingDown) {
+            return;
+        }
+        try {
+            const client = await connectSSH(cfg);
+            sshClient = client;
+            fatalError = null;
+            attachDropHandler(client, cfg);
+            log('error', `[ssh] tunnel reconnected on attempt ${attempt}`);
+            return;
+        }
+        catch (err) {
+            log('error', `[ssh] reconnect attempt ${attempt} failed: ${err.message}`);
+        }
+    }
+    fatalError = new Error(`SSH tunnel to ${cfg.sshUser}@${cfg.sshHost}:${cfg.sshPort} could not be re-established after ${RECONNECT_MAX_ATTEMPTS} attempts. ` +
+        `Restart the MCP server once the bastion is reachable again.`);
+    log('error', `[ssh] ${fatalError.message}`);
+}
+let reconnecting = false;
+function attachDropHandler(client, cfg) {
+    const onDrop = () => {
+        if (shuttingDown || reconnecting) {
+            return;
+        }
+        if (sshClient !== client) {
+            return;
+        }
+        sshClient = null;
+        reconnecting = true;
+        void reconnect(cfg).finally(() => {
+            reconnecting = false;
+        });
+    };
+    client.once('close', onDrop);
+    client.once('error', (err) => {
+        log('error', `[ssh] transport error: ${err.message}`);
+        onDrop();
+    });
+}
+export function forwardSocket(socket, client, cfg, unavailable = null) {
+    socket.on('error', (err) => {
+        log('error', `[ssh] local tunnel socket closed with error: ${err.message}`);
+    });
+    if (!client) {
+        socket.destroy(unavailable ?? new Error('SSH tunnel is not currently connected; retry shortly.'));
+        return;
+    }
+    client.forwardOut('127.0.0.1', 0, cfg.remoteHost, cfg.remotePort, (err, stream) => {
+        if (err) {
+            log('error', `[ssh] forwardOut to ${cfg.remoteHost}:${cfg.remotePort} failed: ${err.message}`);
+            socket.destroy(err);
+            return;
+        }
+        socket.pipe(stream).pipe(socket);
+        const cleanup = () => {
+            stream.destroy();
+            socket.destroy();
+        };
+        socket.once('error', cleanup);
+        stream.once('error', cleanup);
+        socket.once('close', () => stream.destroy());
+        stream.once('close', () => socket.destroy());
+    });
+}
+function startLocalServer(cfg, requestedPort) {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer((socket) => forwardSocket(socket, sshClient, cfg, fatalError));
+        server.once('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                reject(new LocalPortTakenError(`Local port ${requestedPort} was claimed by another process.`));
+                return;
+            }
+            reject(new Error(`Failed to open local tunnel listener on port ${requestedPort}: ${err.message}`));
+        });
+        server.listen(requestedPort, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('Local tunnel listener reported no TCP address.'));
+                return;
+            }
+            localServer = server;
+            resolve(address.port);
+        });
+    });
+}
+export function ensureTunnel() {
+    if (!SSH_ENABLED) {
+        return Promise.resolve(null);
+    }
+    if (!endpointPromise) {
+        endpointPromise = (async () => {
+            const cfg = resolveTunnelConfig();
+            activeConfig = cfg;
+            if (SSH_REUSE_EXISTING && cfg.localPort !== 0 && (await probeLocalPort(cfg.localPort))) {
+                log('error', `[ssh] 127.0.0.1:${cfg.localPort} is already accepting connections; reusing it (MYSQL_SSH_REUSE_EXISTING=true).`);
+                activeEndpoint = { host: '127.0.0.1', port: cfg.localPort, reused: true };
+                return activeEndpoint;
+            }
+            log('error', `[ssh] opening tunnel ${cfg.sshUser}@${cfg.sshHost}:${cfg.sshPort} -> ${cfg.remoteHost}:${cfg.remotePort} ` +
+                `(local port ${cfg.localPort === 0 ? 'auto' : cfg.localPort})`);
+            const client = await connectSSH(cfg);
+            sshClient = client;
+            let port;
+            try {
+                port = await startLocalServer(cfg, cfg.localPort);
+            }
+            catch (err) {
+                if (!(err instanceof LocalPortTakenError)) {
+                    client.destroy();
+                    sshClient = null;
+                    throw err;
+                }
+                log('error', `[ssh] local port ${cfg.localPort} is taken; opening our own tunnel on an auto-assigned port instead.`);
+                try {
+                    port = await startLocalServer(cfg, 0);
+                }
+                catch (fallbackErr) {
+                    client.destroy();
+                    sshClient = null;
+                    throw fallbackErr;
+                }
+            }
+            attachDropHandler(client, cfg);
+            log('error', `[ssh] tunnel listening on 127.0.0.1:${port}`);
+            activeEndpoint = { host: '127.0.0.1', port, reused: false };
+            return activeEndpoint;
+        })();
+        endpointPromise.catch(() => {
+            endpointPromise = null;
+            activeConfig = null;
+            activeEndpoint = null;
+        });
+    }
+    return endpointPromise;
+}
+export function getTunnelEndpoint() {
+    return activeEndpoint;
+}
+export function getTunnelFatalError() {
+    return fatalError;
+}
+export function describeTunnel() {
+    if (!SSH_ENABLED) {
+        return null;
+    }
+    if (!activeConfig) {
+        return 'ssh tunnel: enabled (not yet established)';
+    }
+    const { sshUser, sshHost, remoteHost, remotePort } = activeConfig;
+    return `ssh tunnel: ${sshUser}@${sshHost} -> ${remoteHost}:${remotePort}`;
+}
+export async function stopTunnel() {
+    shuttingDown = true;
+    const server = localServer;
+    localServer = null;
+    if (server) {
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            server.unref();
+            setTimeout(resolve, 1000);
+        });
+    }
+    const client = sshClient;
+    sshClient = null;
+    if (client) {
+        try {
+            client.end();
+            client.destroy();
+        }
+        catch (err) {
+            log('error', `[ssh] error closing SSH client: ${err.message}`);
+        }
+    }
+    endpointPromise = null;
+    activeConfig = null;
+    activeEndpoint = null;
+    shuttingDown = false;
+}

package/dist/src/types/index.js

@@ -0,0 +1 @@
+export {};

package/dist/src/utils/index.js

@@ -0,0 +1,11 @@
+import { ENABLE_LOGGING } from '../config/index.js';
+export function tableResourceUri(schema, table) {
+    return `mysql://tables/${encodeURIComponent(schema)}/${encodeURIComponent(table)}`;
+}
+export function log(type = 'info', ...args) {
+    if (!ENABLE_LOGGING) {
+        return;
+    }
+    const prefix = type === 'error' ? '[error]' : '[info]';
+    console.error(prefix, ...args);
+}

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@ecubelabs/mysql-mcp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.1",
+  "description": "Read-only MySQL MCP server that reaches its database through an SSH bastion, with per-environment profiles",
+  "license": "MIT",
+  "repository": {
+    "url": "https://github.com/Ecube-Labs/skynet.git",
+    "directory": "packages/mysql-mcp"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "dist/index.js",
+  "bin": "dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "lint": "oxfmt --check . && oxlint && eslint index.ts \"src/**/*.ts\"",
+    "lint:ci": "oxfmt --check . && oxlint --quiet && eslint --quiet index.ts \"src/**/*.ts\"",
+    "lint:fix": "oxfmt . && oxlint --fix --quiet && eslint --fix index.ts \"src/**/*.ts\"",
+    "build": "tsc && shx chmod +x dist/index.js",
+    "prepack": "yarn build",
+    "watch": "tsc --watch",
+    "test": "tsc -p tsconfig.test.json && vitest run",
+    "test:watch": "vitest",
+    "start:stage": "./bin/mcp-mysql-stage.sh",
+    "start:prod": "./bin/mcp-mysql-prod.sh"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.31.0",
+    "mysql2": "^3.14.1",
+    "node-sql-parser": "^5.3.9",
+    "ssh2": "^1.17.0"
+  },
+  "devDependencies": {
+    "@semantic-release/npm": "^13.1.5",
+    "@types/node": "^22.20.2",
+    "@types/ssh2": "^1.15.5",
+    "eslint": "^9.27.0",
+    "eslint-config-skynet": "^0.0.0",
+    "semantic-release": "^25.0.9",
+    "semantic-release-monorepo": "^8.0.2",
+    "shx": "^0.3.4",
+    "typescript": "^5.8.3",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.0"
+  }
 }