@neverinfamous/mysql-mcp 2.1.0

package/.dockerignore

@@ -0,0 +1,41 @@
+# Dependencies
+node_modules/
+
+# Build outputs (rebuilt in Docker)
+dist/
+
+# Git
+.git/
+.gitignore
+
+# IDE and editor
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Documentation (not needed in image)
+*.md
+!README.md
+docs/
+
+# Development files
+.env
+.env.*
+!.env.example
+*.log
+
+# Test files
+tests/
+__tests__/
+*.test.ts
+*.spec.ts
+coverage/
+
+# GitHub
+.github/
+
+# Misc
+.DS_Store
+Thumbs.db
+releases/

package/.env.example

@@ -0,0 +1,33 @@
+# MySQL Connection
+MYSQL_HOST=localhost
+MYSQL_PORT=3306
+MYSQL_USER=root
+MYSQL_PASSWORD=your_password_here
+MYSQL_DATABASE=your_database
+
+# Connection Pool
+MYSQL_POOL_SIZE=10
+MYSQL_POOL_TIMEOUT=10000
+
+# MySQL Router REST API (optional - for router tools)
+MYSQL_ROUTER_URL=https://localhost:8443
+MYSQL_ROUTER_USER=router_admin
+MYSQL_ROUTER_PASSWORD=your_router_password
+MYSQL_ROUTER_INSECURE=false
+
+# ProxySQL Admin Interface (optional - for proxysql tools)
+PROXYSQL_HOST=localhost
+PROXYSQL_PORT=6032
+PROXYSQL_USER=admin
+PROXYSQL_PASSWORD=admin
+
+# OAuth 2.0 Authentication (optional - for enterprise deployments)
+# See https://github.com/neverinfamous/mysql-mcp/wiki/OAuth for setup guide
+OAUTH_ENABLED=false
+OAUTH_ISSUER=http://localhost:8080/realms/mysql-mcp
+OAUTH_AUDIENCE=mysql-mcp
+# OAUTH_JWKS_URI=                # Optional: auto-discovered from issuer
+# OAUTH_CLOCK_TOLERANCE=60       # Optional: clock drift tolerance in seconds
+
+# Server
+MYSQLMCP_PORT=3001

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug Report
+about: Report a bug
+title: '[BUG] '
+labels: bug
+---
+
+## Description
+What happened?
+
+## Steps to Reproduce
+1. ...
+2. ...
+3. ...
+
+## Expected Behavior
+What should happen.
+
+## Actual Behavior
+What actually happened.
+
+## Environment
+- mysql-mcp Version:
+- Node.js Version:
+- MySQL Version:
+- OS:
+
+## Additional Context
+Any other relevant information.

package/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+name: Feature Request
+about: Suggest a feature
+title: '[FEATURE] '
+labels: enhancement
+---
+
+## Feature Description
+What you'd like to see.
+
+## Use Case
+Why this feature would be useful.
+
+## Proposed Solution
+How it could work.
+
+## Alternatives Considered
+Any alternative solutions you've thought of.
+
+## Additional Context
+Any other relevant information.

package/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+
+    commit-message:
+      prefix: "chore"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+
+    commit-message:
+      prefix: "chore"

package/.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Description
+Brief description of the changes.
+
+## Related Issue
+Closes #
+
+## Type of Change
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+
+## How Has This Been Tested?
+Describe the tests you ran.
+
+## Checklist
+- [ ] My code follows the project's style guidelines
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes

package/.github/workflows/codeql.yml

@@ -0,0 +1,64 @@
+name: "CodeQL Analysis"
+
+on:
+  push:
+    branches: [ "master" ]
+    paths:
+      - '**.js'
+      - '**.jsx'
+      - '**.ts'
+      - '**.tsx'
+      - '**.mjs'
+      - '**.cjs'
+      - 'package.json'
+  pull_request:
+    branches: [ "master" ]
+    paths:
+      - '**.js'
+      - '**.jsx'
+      - '**.ts'
+      - '**.tsx'
+      - '**.mjs'
+      - '**.cjs'
+      - 'package.json'
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'pull_request' }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript-typescript' ]
+    steps:
+    - uses: actions/checkout@v6
+    - name: Check for JS/TS files
+      id: check-files
+      run: |
+        if find . -type f \( -name "*.js" -o -name "*.jsx" -o -name "*.ts" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" \) | grep -q .; then
+          echo "has_code=true" >> $GITHUB_OUTPUT
+        else
+          echo "has_code=false" >> $GITHUB_OUTPUT
+        fi
+    - uses: github/codeql-action/init@v4
+      if: steps.check-files.outputs.has_code == 'true'
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended,security-and-quality
+    - uses: github/codeql-action/autobuild@v4
+      if: steps.check-files.outputs.has_code == 'true'
+    - uses: github/codeql-action/analyze@v4
+      if: steps.check-files.outputs.has_code == 'true'
+      with:
+        category: "/language:${{matrix.language}}"
+    - name: Skip notification
+      if: steps.check-files.outputs.has_code == 'false'
+      run: echo "No JavaScript/TypeScript files found. Skipping CodeQL analysis."
+

package/.github/workflows/docker-publish.yml

@@ -0,0 +1,285 @@
+name: Build and Push Docker Images
+
+on:
+  push:
+    branches: [ master ]
+    tags: [ 'v*' ]
+  pull_request:
+    branches: [ master ]
+
+env:
+  REGISTRY: docker.io
+  IMAGE_NAME: writenotenow/mysql-mcp
+
+permissions:
+  contents: read
+  packages: write
+  security-events: write  # For security scanning
+  pull-requests: write    # For PR comments
+  id-token: write        # For supply chain attestations
+  attestations: write    # For generating attestations
+
+jobs:
+  # Quality gate - must pass before any builds
+  quality-gate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: '20'
+        cache: 'npm'
+
+    - name: Install dependencies
+      run: npm ci
+
+    - name: Lint
+      run: npm run lint
+
+    - name: Type check
+      run: npm run typecheck
+
+    - name: Run tests
+      run: npm test
+
+  # Build each platform on native architecture (avoids QEMU emulation issues)
+  build-platform:
+    needs: quality-gate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Docker Hub
+      if: github.event_name != 'pull_request'
+      uses: docker/login-action@v3
+      continue-on-error: true
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+
+    - name: Read version from VERSION file
+      id: version
+      run: |
+        if [ -f "VERSION" ]; then
+          VERSION=$(head -1 VERSION | tr -d '[:space:]')
+        fi
+        if [ -z "$VERSION" ]; then
+          VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
+        fi
+        if [ -z "$VERSION" ]; then
+          VERSION="1.0.0"
+        fi
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+        echo "Detected version: $VERSION"
+
+    - name: Extract metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        flavor: |
+          latest=false
+          suffix=-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+        tags: |
+          type=sha,prefix=sha-,format=short
+
+    - name: Build and push platform image
+      id: build
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: Dockerfile
+        platforms: ${{ matrix.platform }}
+        push: ${{ github.event_name != 'pull_request' }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: type=gha,scope=${{ matrix.platform }}
+        cache-to: type=gha,scope=${{ matrix.platform }},mode=max
+        provenance: mode=max
+        sbom: true
+
+    - name: Export digest
+      if: github.event_name != 'pull_request'
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest
+      if: github.event_name != 'pull_request'
+      uses: actions/upload-artifact@v6
+      with:
+        name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+  # Security scan on amd64 image only (runs in parallel)
+  security-scan:
+    runs-on: ubuntu-latest
+    needs: build-platform
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      security-events: write
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build image for scanning
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: Dockerfile
+        platforms: linux/amd64
+        push: false
+        load: true
+        tags: local-scan:latest
+        cache-from: type=gha,scope=linux/amd64
+
+    - name: Docker Scout security scan
+      timeout-minutes: 10
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
+        docker images local-scan:latest
+        echo "🔍 Running Docker Scout security scan"
+        if timeout 480 docker scout cves local-scan:latest > scout_output.txt 2>&1; then
+          echo "📊 Scan completed successfully"
+          cat scout_output.txt
+          if grep -E "(CRITICAL|HIGH)" scout_output.txt | grep -v "0  " > /dev/null; then
+            echo "⚠️ Critical or high severity vulnerabilities detected (informational)"
+          else
+            echo "✅ No critical/high severity vulnerabilities"
+          fi
+        else
+          echo "⚠️ Docker Scout scan timed out or failed"
+        fi
+
+  # Merge platform images into multi-arch manifest
+  merge-and-push:
+    runs-on: ubuntu-latest
+    needs: [build-platform, security-scan]
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      deployments: write
+    
+    environment:
+      name: ${{ github.ref == 'refs/heads/master' && 'production' || '' }}
+      url: https://hub.docker.com/r/writenotenow/mysql-mcp
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Download digests
+      uses: actions/download-artifact@v7
+      with:
+        path: /tmp/digests
+        pattern: digests-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+
+    - name: Read version
+      id: version
+      run: |
+        if [ -f "VERSION" ]; then
+          VERSION=$(head -1 VERSION | tr -d '[:space:]')
+        fi
+        if [ -z "$VERSION" ]; then
+          VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
+        fi
+        if [ -z "$VERSION" ]; then
+          VERSION="1.0.0"
+        fi
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+    - name: Extract metadata for manifest
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        flavor: |
+          latest=auto
+        tags: |
+          type=semver,pattern=v{{version}}
+          type=raw,value=v${{ steps.version.outputs.version }},enable={{is_default_branch}}
+          type=raw,value=latest,enable={{is_default_branch}}
+          type=sha,prefix=sha-,format=short
+
+    - name: Create and push manifest
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+
+    - name: Inspect manifest
+      run: |
+        docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+
+    # Update Docker Hub description
+    - name: Update Docker Hub Description
+      if: github.ref == 'refs/heads/master'
+      uses: peter-evans/dockerhub-description@v5
+      continue-on-error: true
+      timeout-minutes: 5
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+        repository: ${{ env.IMAGE_NAME }}
+        readme-filepath: ./DOCKER_README.md
+        short-description: "MySQL MCP with 191 tools, OAuth 2.1, HTTP Streamable, Smart Tool Filtering & Connection Pooling."
+
+    - name: Deployment Summary
+      if: github.ref == 'refs/heads/master'
+      run: |
+        echo "✅ Successfully published Docker images to production"
+        echo "🐳 Registry: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+        echo "🏷️ Tags: ${{ steps.meta.outputs.tags }}"
+        echo "📝 Commit: ${{ github.sha }}"
+        echo "👤 Published by: ${{ github.actor }}"

package/.github/workflows/publish-npm.yml

@@ -0,0 +1,75 @@
+name: Publish to NPM
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (must match VERSION file or package.json)"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/@neverinfamous/mysql-mcp
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Read version
+        id: version
+        run: |
+          if [ -f "VERSION" ]; then
+            VERSION=$(head -1 VERSION | tr -d '[:space:]')
+          fi
+          if [ -z "$VERSION" ]; then
+            VERSION=$(node -p "require('./package.json').version")
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Detected version: $VERSION"
+
+      - name: Verify version matches release tag
+        if: github.event_name == 'release'
+        run: |
+          RELEASE_VERSION="${GITHUB_REF#refs/tags/}"
+          RELEASE_VERSION="${RELEASE_VERSION#v}"
+          PKG_VERSION="${{ steps.version.outputs.version }}"
+          echo "Package version: $PKG_VERSION"
+          echo "Release version: $RELEASE_VERSION"
+          if [ "$PKG_VERSION" != "$RELEASE_VERSION" ]; then
+            echo "Error: Version mismatch!"
+            echo "Expected: $PKG_VERSION"
+            echo "Got: $RELEASE_VERSION"
+            exit 1
+          fi
+
+      - name: Build package
+        run: npm run build
+
+      - name: Publish to NPM
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Verify publication
+        run: |
+          sleep 10
+          npm view @neverinfamous/mysql-mcp version