@kingsnow129/database-mcp 0.4.0 → 0.4.2

package/README.md

@@ -13,11 +13,17 @@ It provides tools for:
 ## Release
 
 Current release:
-- NPM package: `@kingsnow129/database-mcp@0.4.0`
+- NPM package: `@kingsnow129/database-mcp@0.4.2`
 - MCP server name: `database-mcp`
-- VSIX helper: `database-mcp-helper@0.4.0`
+- VSIX helper: `database-mcp-helper@0.4.2`
 
-## What Is New In 0.4.0
+## What Is New In 0.4.2
+
+- Added SQL Server Windows integrated auth support with `integratedAuth`.
+- Added `--integratedAuth` CLI override handling in `connect` flow.
+- Added optional dependency `msnodesqlv8` for integrated auth SQL Server driver.
+
+## What Was Introduced In 0.4.0
 
 - Multi-database profile model (`servers` + `databases`) is now the primary config.
 - Automatic profile resolution during `connect`:
@@ -111,14 +117,16 @@ Build and install locally:
 cd vscode-extension
 npm install
 npm run package
-code --install-extension database-mcp-helper-0.4.0.vsix --force
+code --install-extension database-mcp-helper-0.4.2.vsix --force
 ```
 
 ## Safety Defaults
 
-- Read-only mode defaults to `true`
+- Read-only mode is hard-enforced (`connect.readOnly` overrides are ignored)
 - Query tool only accepts one SELECT statement
 - Semicolons are blocked
+- Stored procedure execution (`exec`, `execute`, `sp_*`, `xp_*`) is blocked
+- Function-call style execution patterns like `schema.fn(...)` are blocked
 - Returned rows are capped (default `200`)
 
 ## Development

package/dist/server.js

@@ -17,9 +17,12 @@ dotenv.config();
 
 const {Pool: PostgresPool}=pg;
 
+let sqlMsnodesqlv8Cache;
+
 const SUPPORTED_ENGINES=new Set(["sqlserver","postgres","mysql"]);
 
 const CLI_OPTION_MAP={
+  target: "target",
   alias: "alias",
   serverName: "serverName",
   defaultAlias: "defaultAlias",
@@ -34,6 +37,7 @@ const CLI_OPTION_MAP={
   database: "database",
   user: "user",
   password: "password",
+  integratedAuth: "integratedAuth",
   encrypt: "encrypt",
   ssl: "ssl",
   trustServerCertificate: "trustServerCertificate",
@@ -68,7 +72,7 @@ function parseCliArgs(argv) {
 
     const rawToken=String(token).slice(2);
     if(rawToken==="help") {
-      console.error("Supported flags: --alias --serverName --defaultAlias --profilesFile --currentServer --currentDatabase --engine --host --connectionString --server --port --database --user --password --encrypt --ssl --trustServerCertificate --readOnly --maxRows");
+      console.error("Supported flags: --target --alias --serverName --defaultAlias --profilesFile --currentServer --currentDatabase --engine --host --connectionString --server --port --database --user --password --integratedAuth --encrypt --ssl --trustServerCertificate --readOnly --maxRows");
       process.exit(0);
     }
 
@@ -194,6 +198,16 @@ function resolveSavedProfile(overrides={}) {
   const profiles=loadProfiles();
   const {servers,aliases}=profiles;
 
+  const requestedTarget=firstDefined(overrides.target,cliOptions.target);
+  const matchServerByHost=(hostOrServer) => {
+    const wanted=normalizeHostForCompare(hostOrServer);
+    return Object.entries(servers).find(([,cfg]) => {
+      const hostA=normalizeHostForCompare(cfg?.host);
+      const hostB=normalizeHostForCompare(cfg?.server);
+      return wanted===hostA||wanted===hostB;
+    });
+  };
+
   const requestedAlias=firstDefined(overrides.alias,cliOptions.alias,process.env.DB_ALIAS);
   const requestedServerName=firstDefined(
     overrides.serverName,
@@ -209,6 +223,26 @@ function resolveSavedProfile(overrides={}) {
   let serverName;
   let serverProfile;
 
+  if(requestedTarget) {
+    const targetKey=String(requestedTarget).trim();
+    if(aliases[targetKey]&&typeof aliases[targetKey]==="object") {
+      source="target:alias";
+      aliasName=targetKey;
+      serverProfile=aliases[targetKey];
+    } else if(servers[targetKey]&&typeof servers[targetKey]==="object") {
+      source="target:serverName";
+      serverName=targetKey;
+      serverProfile=servers[targetKey];
+    } else {
+      const foundByTargetHost=matchServerByHost(targetKey);
+      if(foundByTargetHost) {
+        source="target:host";
+        serverName=foundByTargetHost[0];
+        serverProfile=foundByTargetHost[1];
+      }
+    }
+  }
+
   if(requestedAlias) {
     const aliasKey=String(requestedAlias).trim();
     if(aliases[aliasKey]&&typeof aliases[aliasKey]==="object") {
@@ -232,12 +266,7 @@ function resolveSavedProfile(overrides={}) {
   }
 
   if(!serverProfile&&requestedHost) {
-    const wanted=normalizeHostForCompare(requestedHost);
-    const found=Object.entries(servers).find(([,cfg]) => {
-      const hostA=normalizeHostForCompare(cfg?.host);
-      const hostB=normalizeHostForCompare(cfg?.server);
-      return wanted===hostA||wanted===hostB;
-    });
+    const found=matchServerByHost(requestedHost);
     if(found) {
       source="host";
       serverName=found[0];
@@ -386,7 +415,12 @@ function buildConfig(overrides={}) {
   );
 
   const integratedAuth=boolFromEnv(
-    firstDefined(overrides.integratedAuth,serverProfile?.integratedAuth,process.env.DB_INTEGRATED_AUTH),
+    firstDefined(
+      overrides.integratedAuth,
+      cliOptions.integratedAuth,
+      serverProfile?.integratedAuth,
+      process.env.DB_INTEGRATED_AUTH
+    ),
     false
   );
 
@@ -402,7 +436,8 @@ function buildConfig(overrides={}) {
     user: integratedAuth? "":user,
     password: integratedAuth? "":password,
     connectionString,
-    readOnly: boolFromEnv(firstDefined(overrides.readOnly,dbConfig?.readOnly,serverProfile?.readOnly),getReadOnlyDefault()),
+    // Enforce hard read-only mode regardless of caller overrides.
+    readOnly: true,
     maxRows: intFromEnv(firstDefined(overrides.maxRows,dbConfig?.maxRows,serverProfile?.maxRows),getMaxRowsDefault()),
     trustServerCertificate: boolFromEnv(
       firstDefined(
@@ -476,12 +511,9 @@ function createSqlServerConfig(config) {
   };
 
   if(config.integratedAuth) {
-    baseConfig.authentication={
-      type: "default",
-      options: {
-        userName: undefined,
-        password: undefined
-      }
+    baseConfig.options={
+      ...baseConfig.options,
+      trustedConnection: true
     };
   } else {
     baseConfig.user=config.user;
@@ -491,6 +523,36 @@ function createSqlServerConfig(config) {
   return baseConfig;
 }
 
+function getSqlServerDriver(config) {
+  if(!config.integratedAuth) {
+    return {
+      module: sql,
+      driverName: "tedious"
+    };
+  }
+
+  if(process.platform!=="win32") {
+    throw new Error("SQL Server integratedAuth is only supported on Windows hosts.");
+  }
+
+  if(sqlMsnodesqlv8Cache===undefined) {
+    try {
+      sqlMsnodesqlv8Cache=_require("mssql/msnodesqlv8");
+    } catch {
+      sqlMsnodesqlv8Cache=null;
+    }
+  }
+
+  if(!sqlMsnodesqlv8Cache) {
+    throw new Error("Integrated auth requires the optional dependency 'msnodesqlv8'. Install it and restart MCP.");
+  }
+
+  return {
+    module: sqlMsnodesqlv8Cache,
+    driverName: "msnodesqlv8"
+  };
+}
+
 function createPostgresConfig(config) {
   if(config.connectionString) {
     return {
@@ -643,9 +705,10 @@ async function connectPool(overrides={}) {
   await closePoolIfAny();
 
   if(config.engine==="sqlserver") {
+    const sqlDriver=getSqlServerDriver(config);
     const sqlConfig=createSqlServerConfig(config);
-    const client=await new sql.ConnectionPool(sqlConfig).connect();
-    connection={engine: "sqlserver",client};
+    const client=await new sqlDriver.module.ConnectionPool(sqlConfig).connect();
+    connection={engine: "sqlserver",client,sqlDriver: sqlDriver.driverName};
   } else if(config.engine==="postgres") {
     const pgConfig=createPostgresConfig(config);
     const client=new PostgresPool(pgConfig);
@@ -670,8 +733,10 @@ async function connectPool(overrides={}) {
     serverName: config.serverName,
     profileSource: config.profileSource,
     engine: config.engine,
+    sqlDriver: connection?.sqlDriver,
     host: config.host,
     database: config.database,
+    integratedAuth: config.integratedAuth,
     readOnly: runtimeSettings.readOnly,
     maxRows: runtimeSettings.maxRows
   };
@@ -739,6 +804,9 @@ function validateQuerySafety(sqlText) {
 
   const blockedPatterns=[
     /\b(insert|update|delete|drop|alter|create|truncate|merge|exec|execute|grant|revoke)\b/i,
+    /\b(call|declare)\b/i,
+    /\b(?:sp_|xp_)[A-Za-z0-9_]*\b/i,
+    /\b[A-Za-z0-9_]+\.[A-Za-z0-9_]+\s*\(/i,
     /--/,
     /\/\*/
   ];
@@ -756,7 +824,9 @@ async function handleToolCall(name,args={}) {
   switch(name) {
     case TOOL_NAMES.CONNECT: {
       const overrides={
+        ...(args.target? {target: args.target}:{}),
         ...(args.alias? {alias: args.alias}:{}),
+        ...(args.serverName? {serverName: args.serverName}:{}),
         ...(args.engine? {engine: args.engine}:{}),
         ...(args.connectionString? {connectionString: args.connectionString}:{}),
         ...(args.host? {host: args.host}:{}),
@@ -765,7 +835,7 @@ async function handleToolCall(name,args={}) {
         ...(args.database? {database: args.database}:{}),
         ...(args.user? {user: args.user}:{}),
         ...(args.password? {password: args.password}:{}),
-        ...(args.readOnly!==undefined? {readOnly: Boolean(args.readOnly)}:{}),
+        ...(args.integratedAuth!==undefined? {integratedAuth: Boolean(args.integratedAuth)}:{}),
         ...(args.maxRows!==undefined? {maxRows: Number(args.maxRows)}:{}),
         ...(args.encrypt!==undefined? {encrypt: Boolean(args.encrypt)}:{}),
         ...(args.ssl!==undefined? {ssl: Boolean(args.ssl)}:{}),
@@ -969,6 +1039,7 @@ server.setRequestHandler(ListToolsRequestSchema,async () => {
         inputSchema: {
           type: "object",
           properties: {
+            target: {type: "string"},
             alias: {type: "string"},
             serverName: {type: "string"},
             engine: {type: "string",enum: ["sqlserver","postgres","mysql"]},
@@ -979,6 +1050,7 @@ server.setRequestHandler(ListToolsRequestSchema,async () => {
             database: {type: "string"},
             user: {type: "string"},
             password: {type: "string"},
+            integratedAuth: {type: "boolean"},
             encrypt: {type: "boolean"},
             ssl: {type: "boolean"},
             trustServerCertificate: {type: "boolean"},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kingsnow129/database-mcp",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "mcpName": "io.github.kingsnow129/database-mcp",
   "description": "Database MCP server for SQL Server, PostgreSQL, and MySQL with profile-based auto resolution",
   "author": "kingsnow129",
@@ -51,5 +51,8 @@
     "mysql2": "^3.11.3",
     "mssql": "^11.0.1",
     "pg": "^8.13.1"
+  },
+  "optionalDependencies": {
+    "msnodesqlv8": "^4.4.0"
   }
 }