@neverinfamous/mysql-mcp 2.1.0

package/src/adapters/mysql/tools/roles.ts

@@ -0,0 +1,202 @@
+/**
+ * MySQL Roles Tools - 8 tools for role management
+ */
+
+import { z } from 'zod';
+import type { MySQLAdapter } from '../MySQLAdapter.js';
+import type { ToolDefinition, RequestContext } from '../../../types/index.js';
+
+const RoleListSchema = z.object({
+    pattern: z.string().optional().describe('Filter pattern (LIKE syntax)')
+});
+
+const RoleCreateSchema = z.object({
+    name: z.string().describe('Role name'),
+    ifNotExists: z.boolean().default(true)
+});
+
+const RoleDropSchema = z.object({
+    name: z.string().describe('Role name'),
+    ifExists: z.boolean().default(true)
+});
+
+const RoleGrantsSchema = z.object({ role: z.string() });
+
+const RoleGrantPrivilegeSchema = z.object({
+    role: z.string(),
+    privileges: z.array(z.string()),
+    database: z.string().default('*'),
+    table: z.string().default('*')
+});
+
+const RoleAssignSchema = z.object({
+    role: z.string(),
+    user: z.string(),
+    host: z.string().default('%'),
+    withAdminOption: z.boolean().default(false)
+});
+
+const RoleRevokeSchema = z.object({
+    role: z.string(),
+    user: z.string(),
+    host: z.string().default('%')
+});
+
+const UserRolesSchema = z.object({
+    user: z.string(),
+    host: z.string().default('%')
+});
+
+export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
+    return [
+        {
+            name: 'mysql_role_list',
+            title: 'MySQL List Roles',
+            description: 'List all roles defined in MySQL.',
+            group: 'roles',
+            inputSchema: RoleListSchema,
+            requiredScopes: ['read'],
+            annotations: { readOnlyHint: true, idempotentHint: true },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { pattern } = RoleListSchema.parse(params);
+                let query = `SELECT u.User as roleName, u.Host FROM mysql.user u
+                    WHERE u.account_locked='Y' AND u.password_expired='Y' AND u.authentication_string=''`;
+                if (pattern) query += ` AND u.User LIKE '${pattern}'`;
+                const result = await adapter.executeQuery(query);
+                return { roles: result.rows ?? [], count: result.rows?.length ?? 0 };
+            }
+        },
+        {
+            name: 'mysql_role_create',
+            title: 'MySQL Create Role',
+            description: 'Create a new role.',
+            group: 'roles',
+            inputSchema: RoleCreateSchema,
+            requiredScopes: ['admin'],
+            annotations: { readOnlyHint: false },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { name, ifNotExists } = RoleCreateSchema.parse(params);
+                if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) throw new Error('Invalid role name');
+                const clause = ifNotExists ? 'IF NOT EXISTS ' : '';
+                await adapter.executeQuery(`CREATE ROLE ${clause}'${name}'`);
+                return { success: true, roleName: name };
+            }
+        },
+        {
+            name: 'mysql_role_drop',
+            title: 'MySQL Drop Role',
+            description: 'Drop a role.',
+            group: 'roles',
+            inputSchema: RoleDropSchema,
+            requiredScopes: ['admin'],
+            annotations: { readOnlyHint: false, destructiveHint: true },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { name, ifExists } = RoleDropSchema.parse(params);
+                if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) throw new Error('Invalid role name');
+                await adapter.executeQuery(`DROP ROLE ${ifExists ? 'IF EXISTS ' : ''}'${name}'`);
+                return { success: true, roleName: name };
+            }
+        },
+        {
+            name: 'mysql_role_grants',
+            title: 'MySQL Role Grants',
+            description: 'List privileges granted to a role.',
+            group: 'roles',
+            inputSchema: RoleGrantsSchema,
+            requiredScopes: ['read'],
+            annotations: { readOnlyHint: true, idempotentHint: true },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { role } = RoleGrantsSchema.parse(params);
+                // SHOW GRANTS cannot be always prepared
+                const result = await adapter.rawQuery(`SHOW GRANTS FOR '${role}'`);
+                const grants = (result.rows ?? []).map(r => Object.values(r)[0]);
+                return { role, grants };
+            }
+        },
+        {
+            name: 'mysql_role_grant',
+            title: 'MySQL Grant to Role',
+            description: 'Grant privileges to a role.',
+            group: 'roles',
+            inputSchema: RoleGrantPrivilegeSchema,
+            requiredScopes: ['admin'],
+            annotations: { readOnlyHint: false },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { role, privileges, database, table } = RoleGrantPrivilegeSchema.parse(params);
+                if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(role)) throw new Error('Invalid role name');
+
+                let targetDb = database;
+                let targetTable = table;
+
+                // Handle schema-qualified table names (e.g. "db.table")
+                if (targetTable.includes('.') && targetTable !== '*') {
+                    const [dbPart, tablePart] = targetTable.split('.');
+                    if (dbPart && tablePart) {
+                        targetDb = dbPart;
+                        targetTable = tablePart;
+                    }
+                }
+
+                const db = targetDb === '*' ? '*' : `\`${targetDb}\``;
+                const tbl = targetTable === '*' ? '*' : `\`${targetTable}\``;
+                
+                let onClause = `${db}.${tbl}`;
+                if (targetDb === '*' && targetTable !== '*') {
+                    // Cannot use * for db with specific table (MySQL syntax error)
+                    // Assume current database if table is specified but db is wildcard
+                    onClause = tbl;
+                }
+
+                await adapter.rawQuery(`GRANT ${privileges.join(', ')} ON ${onClause} TO '${role}'`);
+                return { success: true, role, privileges, database: targetDb, table: targetTable };
+            }
+        },
+        {
+            name: 'mysql_role_assign',
+            title: 'MySQL Assign Role',
+            description: 'Assign a role to a user.',
+            group: 'roles',
+            inputSchema: RoleAssignSchema,
+            requiredScopes: ['admin'],
+            annotations: { readOnlyHint: false },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { role, user, host, withAdminOption } = RoleAssignSchema.parse(params);
+                let sql = `GRANT '${role}' TO '${user}'@'${host}'`;
+                if (withAdminOption) sql += ' WITH ADMIN OPTION';
+                await adapter.rawQuery(sql);
+                await adapter.rawQuery(`SET DEFAULT ROLE '${role}' TO '${user}'@'${host}'`);
+                return { success: true, role, user, host };
+            }
+        },
+        {
+            name: 'mysql_role_revoke',
+            title: 'MySQL Revoke Role',
+            description: 'Revoke a role from a user.',
+            group: 'roles',
+            inputSchema: RoleRevokeSchema,
+            requiredScopes: ['admin'],
+            annotations: { readOnlyHint: false },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { role, user, host } = RoleRevokeSchema.parse(params);
+                await adapter.rawQuery(`REVOKE '${role}' FROM '${user}'@'${host}'`);
+                return { success: true, role, user, host };
+            }
+        },
+        {
+            name: 'mysql_user_roles',
+            title: 'MySQL User Roles',
+            description: 'List roles assigned to a user.',
+            group: 'roles',
+            inputSchema: UserRolesSchema,
+            requiredScopes: ['read'],
+            annotations: { readOnlyHint: true, idempotentHint: true },
+            handler: async (params: unknown, _context: RequestContext) => {
+                const { user, host } = UserRolesSchema.parse(params);
+                const result = await adapter.executeQuery(
+                    `SELECT FROM_USER as roleName, FROM_HOST as roleHost, WITH_ADMIN_OPTION as admin
+                     FROM mysql.role_edges WHERE TO_USER=? AND TO_HOST=?`, [user, host]);
+                return { user, host, roles: result.rows ?? [] };
+            }
+        }
+    ];
+}

package/src/adapters/mysql/tools/router.ts

@@ -0,0 +1,405 @@
+/**
+ * MySQL Router Management Tools
+ * 
+ * Tools for monitoring and managing MySQL Router via its REST API.
+ * 9 tools total.
+ * 
+ * Router REST API documentation:
+ * https://dev.mysql.com/doc/mysql-router/8.0/en/mysql-router-rest-api.html
+ */
+
+import type { ToolDefinition, RequestContext, RouterConfig } from '../../../types/index.js';
+import type { MySQLAdapter } from '../MySQLAdapter.js';
+import https from 'node:https';
+import {
+    RouterBaseInputSchema,
+    RouteNameInputSchema,
+    MetadataNameInputSchema,
+    ConnectionPoolNameInputSchema
+} from '../types/router-types.js';
+
+// =============================================================================
+// Router HTTP Client Helper
+// =============================================================================
+
+/**
+ * Get Router configuration from environment variables
+ */
+function getRouterConfig(): RouterConfig {
+    return {
+        url: process.env['MYSQL_ROUTER_URL'] ?? 'https://localhost:8443',
+        username: process.env['MYSQL_ROUTER_USER'] ?? '',
+        password: process.env['MYSQL_ROUTER_PASSWORD'] ?? '',
+        insecure: process.env['MYSQL_ROUTER_INSECURE'] === 'true',
+        apiVersion: process.env['MYSQL_ROUTER_API_VERSION'] ?? '/api/20190715'
+    };
+}
+
+/**
+ * Fetch data from MySQL Router REST API using native https module.
+ * 
+ * Note: We use the https module instead of fetch() because Node.js native fetch
+ * uses undici under the hood, which doesn't support the rejectUnauthorized option
+ * in the same way as https.Agent. This ensures proper handling of self-signed
+ * certificates when MYSQL_ROUTER_INSECURE=true.
+ */
+async function routerFetch(
+    path: string,
+    config?: RouterConfig
+): Promise<unknown> {
+    const cfg = config ?? getRouterConfig();
+    const baseUrl = cfg.url ?? 'https://localhost:8443';
+    const apiVersion = cfg.apiVersion ?? '/api/20190715';
+    const username = cfg.username ?? '';
+    const password = cfg.password ?? '';
+    const insecure = cfg.insecure ?? false;
+
+    const fullUrl = `${baseUrl}${apiVersion}${path}`;
+    const parsedUrl = new URL(fullUrl);
+
+    return new Promise((resolve, reject) => {
+        const headers: Record<string, string> = {
+            'Accept': 'application/json'
+        };
+
+        if (username && password) {
+            const auth = Buffer.from(`${username}:${password}`).toString('base64');
+            headers['Authorization'] = `Basic ${auth}`;
+        }
+
+        // Build request options
+        // SECURITY NOTE: rejectUnauthorized=false is INTENTIONAL for development/testing
+        // environments where MySQL Router uses self-signed certificates. It is only
+        // activated when the user explicitly sets MYSQL_ROUTER_INSECURE=true.
+        // In production, users should configure proper TLS certificates on MySQL Router.
+        // @see https://dev.mysql.com/doc/mysql-router/8.0/en/mysql-router-conf-options.html#option_mysqlrouter_server_ssl_key
+        const requestOptions: https.RequestOptions = {
+            hostname: parsedUrl.hostname,
+            port: parsedUrl.port || 8443,
+            path: parsedUrl.pathname,
+            method: 'GET',
+            headers,
+            // CodeQL: This is intentional - see SECURITY NOTE above
+            // nosemgrep: nodejs.lang.security.audit.tls-connection-insecure.tls-connection-insecure
+            rejectUnauthorized: !insecure, // codeql-ignore js/disabling-certificate-validation
+            timeout: 10000 // 10 second timeout
+        };
+
+        const req = https.request(requestOptions, (res) => {
+            let data = '';
+
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+
+            res.on('end', () => {
+                const statusCode = res.statusCode ?? 0;
+                if (statusCode >= 200 && statusCode < 300) {
+                    try {
+                        resolve(JSON.parse(data));
+                    } catch {
+                        reject(new Error(`Invalid JSON response: ${data}`));
+                    }
+                } else {
+                    reject(new Error(`Router API error: ${statusCode} ${res.statusMessage ?? 'Unknown'}`));
+                }
+            });
+        });
+
+        req.on('error', (error) => {
+            reject(new Error(`Router API request failed: ${error.message}`));
+        });
+
+        req.on('timeout', () => {
+            req.destroy();
+            reject(new Error('Router API request timed out'));
+        });
+
+        req.end();
+    });
+}
+
+// =============================================================================
+// Tool Registration
+// =============================================================================
+
+/**
+ * Get all Router management tools
+ */
+export function getRouterTools(_adapter: MySQLAdapter): ToolDefinition[] {
+    return [
+        createRouterStatusTool(),
+        createRouterRoutesTool(),
+        createRouterRouteStatusTool(),
+        createRouterRouteHealthTool(),
+        createRouterRouteConnectionsTool(),
+        createRouterRouteDestinationsTool(),
+        createRouterRouteBlockedHostsTool(),
+        createRouterMetadataStatusTool(),
+        createRouterPoolStatusTool()
+    ];
+}
+
+// =============================================================================
+// Router Status Tools
+// =============================================================================
+
+/**
+ * Get MySQL Router status
+ */
+function createRouterStatusTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_status',
+        title: 'MySQL Router Status',
+        description: 'Get MySQL Router process status including version, hostname, and uptime. Requires Router REST API access.',
+        group: 'router',
+        inputSchema: RouterBaseInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (_params: unknown, _context: RequestContext) => {
+            const result = await routerFetch('/router/status');
+            return {
+                success: true,
+                status: result
+            };
+        }
+    };
+}
+
+/**
+ * List all configured routes
+ */
+function createRouterRoutesTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_routes',
+        title: 'MySQL Router Routes',
+        description: 'List all configured routes in MySQL Router. Returns route names that can be used with other router tools.',
+        group: 'router',
+        inputSchema: RouterBaseInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (_params: unknown, _context: RequestContext) => {
+            const result = await routerFetch('/routes');
+            return {
+                success: true,
+                routes: result
+            };
+        }
+    };
+}
+
+// =============================================================================
+// Route-Specific Tools
+// =============================================================================
+
+/**
+ * Get status of a specific route
+ */
+function createRouterRouteStatusTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_route_status',
+        title: 'MySQL Router Route Status',
+        description: 'Get operational status of a specific route including active connections, total connections, and blocked hosts count.',
+        group: 'router',
+        inputSchema: RouteNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { routeName } = RouteNameInputSchema.parse(params);
+            const result = await routerFetch(`/routes/${encodeURIComponent(routeName)}/status`);
+            return {
+                success: true,
+                routeName,
+                status: result
+            };
+        }
+    };
+}
+
+/**
+ * Check health of a specific route
+ */
+function createRouterRouteHealthTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_route_health',
+        title: 'MySQL Router Route Health',
+        description: 'Check if a route is alive and functioning. Returns isAlive boolean indicating route health.',
+        group: 'router',
+        inputSchema: RouteNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { routeName } = RouteNameInputSchema.parse(params);
+            const result = await routerFetch(`/routes/${encodeURIComponent(routeName)}/health`);
+            return {
+                success: true,
+                routeName,
+                health: result
+            };
+        }
+    };
+}
+
+/**
+ * List active connections on a route
+ */
+function createRouterRouteConnectionsTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_route_connections',
+        title: 'MySQL Router Route Connections',
+        description: 'List active connections on a route including source/destination addresses, bytes transferred, and connection times.',
+        group: 'router',
+        inputSchema: RouteNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { routeName } = RouteNameInputSchema.parse(params);
+            const result = await routerFetch(`/routes/${encodeURIComponent(routeName)}/connections`);
+            return {
+                success: true,
+                routeName,
+                connections: result
+            };
+        }
+    };
+}
+
+/**
+ * List backend destinations for a route
+ */
+function createRouterRouteDestinationsTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_route_destinations',
+        title: 'MySQL Router Route Destinations',
+        description: 'List backend MySQL server destinations for a route. Shows address and port of each destination server.',
+        group: 'router',
+        inputSchema: RouteNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { routeName } = RouteNameInputSchema.parse(params);
+            const result = await routerFetch(`/routes/${encodeURIComponent(routeName)}/destinations`);
+            return {
+                success: true,
+                routeName,
+                destinations: result
+            };
+        }
+    };
+}
+
+/**
+ * List blocked hosts for a route
+ */
+function createRouterRouteBlockedHostsTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_route_blocked_hosts',
+        title: 'MySQL Router Blocked Hosts',
+        description: 'List IP addresses that have been blocked for a route due to too many failed connection attempts.',
+        group: 'router',
+        inputSchema: RouteNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { routeName } = RouteNameInputSchema.parse(params);
+            const result = await routerFetch(`/routes/${encodeURIComponent(routeName)}/blockedHosts`);
+            return {
+                success: true,
+                routeName,
+                blockedHosts: result
+            };
+        }
+    };
+}
+
+// =============================================================================
+// Metadata Cache Tools
+// =============================================================================
+
+/**
+ * Get metadata cache status
+ */
+function createRouterMetadataStatusTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_metadata_status',
+        title: 'MySQL Router Metadata Status',
+        description: 'Get InnoDB Cluster metadata cache status including refresh statistics and last refresh host.',
+        group: 'router',
+        inputSchema: MetadataNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { metadataName } = MetadataNameInputSchema.parse(params);
+            const result = await routerFetch(`/metadata/${encodeURIComponent(metadataName)}/status`);
+            return {
+                success: true,
+                metadataName,
+                status: result
+            };
+        }
+    };
+}
+
+// =============================================================================
+// Connection Pool Tools
+// =============================================================================
+
+/**
+ * Get connection pool status
+ */
+function createRouterPoolStatusTool(): ToolDefinition {
+    return {
+        name: 'mysql_router_pool_status',
+        title: 'MySQL Router Pool Status',
+        description: 'Get MySQL Router connection pool status including reused connections and idle server connections.',
+        group: 'router',
+        inputSchema: ConnectionPoolNameInputSchema,
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true,
+            openWorldHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { poolName } = ConnectionPoolNameInputSchema.parse(params);
+            const result = await routerFetch(`/connection_pool/${encodeURIComponent(poolName)}/status`);
+            return {
+                success: true,
+                poolName,
+                status: result
+            };
+        }
+    };
+}

package/src/adapters/mysql/tools/schema/__tests__/constraints.test.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createListConstraintsTool } from '../constraints.js';
+import type { MySQLAdapter } from '../../../MySQLAdapter.js';
+import { createMockMySQLAdapter, createMockRequestContext, createMockQueryResult } from '../../../../../__tests__/mocks/index.js';
+
+describe('Schema Constraint Tools', () => {
+    let mockAdapter: ReturnType<typeof createMockMySQLAdapter>;
+    let mockContext: ReturnType<typeof createMockRequestContext>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockAdapter = createMockMySQLAdapter();
+        mockContext = createMockRequestContext();
+    });
+
+    describe('mysql_list_constraints', () => {
+        it('should query INFORMATION_SCHEMA for constraints', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([
+                { name: 'PRIMARY', type: 'PRIMARY KEY', tableName: 'users' }
+            ]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            const result = await tool.handler({ table: 'users' }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('information_schema');
+            expect(result).toBeDefined();
+        });
+
+        it('should filter by table when provided', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            await tool.handler({ table: 'users' }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const params = mockAdapter.executeQuery.mock.calls[0][1] as unknown[];
+            expect(params).toContain('users');
+        });
+
+        it('should filter by type when provided', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            await tool.handler({ table: 'users', type: 'PRIMARY KEY' }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('CONSTRAINT_TYPE = ?');
+            const params = mockAdapter.executeQuery.mock.calls[0][1] as unknown[];
+            expect(params).toContain('PRIMARY KEY');
+        });
+
+        it('should parse schema.table format and pass schema as first param', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            await tool.handler({ table: 'myschema.users' }, mockContext);
+
+            const params = mockAdapter.executeQuery.mock.calls[0][1] as unknown[];
+            expect(params[0]).toBe('myschema');  // schemaName
+            expect(params[1]).toBe('users');     // tableName
+        });
+
+        it('should pass null schema for unqualified table names', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            await tool.handler({ table: 'users' }, mockContext);
+
+            const params = mockAdapter.executeQuery.mock.calls[0][1] as unknown[];
+            expect(params[0]).toBeNull();  // schemaName should be null
+            expect(params[1]).toBe('users');
+        });
+
+        it('should handle special characters in schema-qualified names', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([
+                { name: 'fk_orders', type: 'FOREIGN KEY', referencedTable: 'customers' }
+            ]));
+
+            const tool = createListConstraintsTool(mockAdapter as unknown as MySQLAdapter);
+            const result = await tool.handler({ table: 'test_db.order_items' }, mockContext);
+
+            const params = mockAdapter.executeQuery.mock.calls[0][1] as unknown[];
+            expect(params[0]).toBe('test_db');
+            expect(params[1]).toBe('order_items');
+            expect(result).toHaveProperty('constraints');
+        });
+    });
+});