@neverinfamous/mysql-mcp 2.2.0 → 2.3.1

package/src/adapters/mysql/tools/shell/__tests__/restore.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import * as child_process from "child_process";
+import * as fsModule from "fs";
 import {
   createMockMySQLAdapter,
   createMockRequestContext,
@@ -13,6 +14,19 @@ vi.mock("child_process", () => ({
   spawn: vi.fn(),
 }));
 
+vi.mock("fs", async () => {
+  const actual = await vi.importActual<typeof import("fs")>("fs");
+  return {
+    ...actual,
+    promises: {
+      ...actual.promises,
+      mkdtemp: vi.fn().mockResolvedValue("/tmp/mysqlsh_script_abc123"),
+      writeFile: vi.fn().mockResolvedValue(undefined),
+      rm: vi.fn().mockResolvedValue(undefined),
+    },
+  };
+});
+
 describe("Shell Restore and Script Tools", () => {
   let mockAdapter: ReturnType<typeof createMockMySQLAdapter>;
   let mockContext: ReturnType<typeof createMockRequestContext>;
@@ -226,7 +240,7 @@ describe("Shell Restore and Script Tools", () => {
       expect(args).toContain("--py");
     });
 
-    it("should run sql script", async () => {
+    it("should run sql script via secure temp file", async () => {
       setupMockSpawn("SQL output");
 
       const tool = createShellRunScriptTool();
@@ -241,6 +255,19 @@ describe("Shell Restore and Script Tools", () => {
       expect(result.success).toBe(true);
       const args = mockSpawn.mock.calls[0][1];
       expect(args).toContain("--sql");
+      expect(args).toContain("--file");
+
+      // Verify secure temp dir was created and cleaned up
+      const fsp = fsModule.promises;
+      expect(fsp.mkdtemp).toHaveBeenCalled();
+      expect(fsp.writeFile).toHaveBeenCalledWith(
+        expect.stringContaining("script.sql"),
+        "SELECT 1",
+        "utf8",
+      );
+      expect(fsp.rm).toHaveBeenCalledWith("/tmp/mysqlsh_script_abc123", {
+        recursive: true,
+      });
     });
   });
 });

package/src/adapters/mysql/tools/shell/common.ts

@@ -196,8 +196,24 @@ export async function execShellJS(
     }
     // Fatal dump errors
     if (stderrClean.includes("Fatal error during dump")) {
+      // Extract specific MySQL error lines (e.g., "ERROR: Unknown column 'x' in 'where clause'")
+      const errorLines = stderrClean
+        .split(/\r?\n/)
+        .filter((line) => /^ERROR:/i.test(line.trim()));
+      const specificError =
+        errorLines.length > 0
+          ? errorLines
+              .map((line) => line.trim().replace(/^ERROR:\s*/i, ""))
+              .join("; ")
+          : null;
+
+      if (specificError) {
+        throw new Error(specificError);
+      }
+
+      // Fallback: no specific error extracted, use generic message with privilege hint
       throw new Error(
-        `MySQL Shell dump failed: ${stderrClean}. ` +
+        `MySQL Shell dump failed: Fatal error during dump. ` +
           `This may be caused by missing privileges. For dumpSchemas, try excludeEvents: true. ` +
           `For dumpTables, try all: false.`,
       );
@@ -223,7 +239,23 @@ export async function execShellJS(
       }
 
       if (!parsed.success) {
-        throw new Error(parsed.error ?? "Unknown MySQL Shell error");
+        const errorMsg = parsed.error ?? "Unknown MySQL Shell error";
+
+        // For "Fatal error during dump" errors, check stderr for specific MySQL error details
+        if (errorMsg.includes("Fatal error during dump") && stderrClean) {
+          const errorLines = stderrClean
+            .split(/\r?\n/)
+            .filter((line) => /^ERROR:/i.test(line.trim()));
+
+          if (errorLines.length > 0) {
+            const specificError = errorLines
+              .map((line) => line.trim().replace(/^ERROR:\s*/i, ""))
+              .join("; ");
+            throw new Error(specificError);
+          }
+        }
+
+        throw new Error(errorMsg);
       }
       return parsed.result;
     }

package/src/adapters/mysql/tools/shell/restore.ts

@@ -94,11 +94,74 @@ export function createShellLoadDumpTool(): ToolDefinition {
       }
 
       try {
+        if (dryRun) {
+          // For dry runs, use execMySQLShell directly to capture stderr
+          // where MySQL Shell outputs the summary of what would be loaded
+          const config = getShellConfig();
+          const dryRunJsCode = `
+            var __result__;
+            try {
+                __result__ = (function() { ${jsCode} })();
+                print(JSON.stringify({ success: true, result: __result__ }));
+            } catch (e) {
+                print(JSON.stringify({ success: false, error: e.message }));
+            }
+          `;
+          const rawResult = await execMySQLShell(
+            ["--uri", config.connectionUri, "--js", "-e", dryRunJsCode],
+            { timeout: 3600000 },
+          );
+
+          // Parse stderr for dry run summary, filtering out common warnings
+          const stderrClean = rawResult.stderr
+            .replace(
+              /WARNING: Using a password on the command line interface can be insecure\.\s*/gi,
+              "",
+            )
+            .trim();
+
+          // Check for errors in the JSON output
+          const lines = rawResult.stdout.trim().split("\n");
+          for (let i = lines.length - 1; i >= 0; i--) {
+            const line = lines[i];
+            if (!line) continue;
+            const trimmedLine = line.trim();
+            if (trimmedLine.startsWith("{")) {
+              let parsed: {
+                success: boolean;
+                result?: unknown;
+                error?: string;
+              };
+              try {
+                parsed = JSON.parse(trimmedLine) as {
+                  success: boolean;
+                  result?: unknown;
+                  error?: string;
+                };
+              } catch {
+                continue;
+              }
+              if (!parsed.success) {
+                throw new Error(parsed.error ?? "Unknown MySQL Shell error");
+              }
+              break;
+            }
+          }
+
+          return {
+            success: true,
+            inputDir,
+            dryRun: true,
+            localInfileEnabled: updateServerSettings,
+            dryRunOutput: stderrClean || undefined,
+          };
+        }
+
         const result = await execShellJS(jsCode, { timeout: 3600000 });
         return {
           success: true,
           inputDir,
-          dryRun: dryRun ?? false,
+          dryRun: false,
           localInfileEnabled: updateServerSettings,
           result,
         };
@@ -169,10 +232,10 @@ export function createShellRunScriptTool(): ToolDefinition {
       // SQL scripts with comments or multi-line content break when passed via -e
       // Use --file approach for SQL to properly handle all syntax
       if (language === "sql") {
-        const tempFile = join(
-          tmpdir(),
-          `mysqlsh_script_${Date.now()}_${Math.random().toString(36).slice(2)}.sql`,
-        );
+        // Create a secure temp directory via mkdtemp (restrictive permissions,
+        // unique path) to avoid CodeQL js/insecure-temporary-file alert.
+        const tempDir = await fs.mkdtemp(join(tmpdir(), `mysqlsh_script_`));
+        const tempFile = join(tempDir, "script.sql");
         try {
           await fs.writeFile(tempFile, script, "utf8");
           const args = [
@@ -184,8 +247,8 @@ export function createShellRunScriptTool(): ToolDefinition {
           ];
           result = await execMySQLShell(args, { timeout });
         } finally {
-          // Cleanup temp file
-          await fs.unlink(tempFile).catch(() => void 0);
+          // Cleanup temp directory and its contents
+          await fs.rm(tempDir, { recursive: true }).catch(() => void 0);
         }
       } else {
         // JS and Python work fine with -e

package/src/adapters/mysql/tools/spatial/__tests__/operations.test.ts

@@ -123,6 +123,7 @@ describe("Spatial Operations Tools", () => {
       expect(result).toHaveProperty("bufferWkt");
       expect(result).toHaveProperty("bufferGeoJson");
       expect(result).toHaveProperty("segments", 8);
+      expect(result).toHaveProperty("precision", 6);
     });
 
     it("should use ST_Buffer_Strategy with Cartesian SRID", async () => {
@@ -151,6 +152,34 @@ describe("Spatial Operations Tools", () => {
       const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
       expect(call).toContain("ST_Buffer_Strategy('point_circle', 4)");
       expect(result).toHaveProperty("segments", 4);
+      expect(result).toHaveProperty("precision", 6);
+    });
+
+    it("should pass custom precision to ST_AsGeoJSON", async () => {
+      mockAdapter.executeQuery.mockResolvedValue(
+        createMockQueryResult([
+          {
+            buffer_wkt: "POLYGON(...)",
+            buffer_geojson: '{"type":"Polygon"}',
+          },
+        ]),
+      );
+
+      const tool = createSpatialBufferTool(
+        mockAdapter as unknown as MySQLAdapter,
+      );
+      const result = await tool.handler(
+        {
+          geometry: "POINT(-73.9857 40.7484)",
+          distance: 1000,
+          precision: 2,
+        },
+        mockContext,
+      );
+
+      const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+      expect(call).toContain(", 2) as buffer_geojson");
+      expect(result).toHaveProperty("precision", 2);
     });
   });
 

package/src/adapters/mysql/tools/spatial/operations.ts

@@ -60,6 +60,15 @@ const BufferSchema = z.object({
     .describe(
       "Number of segments per quarter-circle for buffer polygon approximation (default: 8, MySQL default: 32). Lower values produce simpler polygons with smaller payloads. Only effective with Cartesian geometries (SRID 0); geographic SRIDs use MySQL's internal algorithm.",
     ),
+  precision: z
+    .number()
+    .int()
+    .min(0)
+    .max(15)
+    .default(6)
+    .describe(
+      "Decimal precision for GeoJSON output coordinates (default: 6, ~0.11m accuracy). Lower values reduce payload size.",
+    ),
 });
 
 const TransformSchema = z.object({
@@ -152,7 +161,8 @@ export function createSpatialBufferTool(adapter: MySQLAdapter): ToolDefinition {
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { geometry, distance, srid, segments } = BufferSchema.parse(params);
+      const { geometry, distance, srid, segments, precision } =
+        BufferSchema.parse(params);
 
       try {
         // ST_Buffer_Strategy only works with Cartesian (non-geographic) SRIDs.
@@ -164,7 +174,7 @@ export function createSpatialBufferTool(adapter: MySQLAdapter): ToolDefinition {
         const result = await adapter.executeQuery(
           `SELECT 
                     ST_AsText(ST_Buffer(ST_GeomFromText(?, ${String(srid)}, 'axis-order=long-lat'), ?${strategyClause})) as buffer_wkt,
-                    ST_AsGeoJSON(ST_Buffer(ST_GeomFromText(?, ${String(srid)}, 'axis-order=long-lat'), ?${strategyClause})) as buffer_geojson`,
+                    ST_AsGeoJSON(ST_Buffer(ST_GeomFromText(?, ${String(srid)}, 'axis-order=long-lat'), ?${strategyClause}), ${String(precision)}) as buffer_geojson`,
           [geometry, distance, geometry, distance],
         );
 
@@ -175,6 +185,7 @@ export function createSpatialBufferTool(adapter: MySQLAdapter): ToolDefinition {
           bufferDistance: distance,
           segments,
           segmentsApplied: !isGeographic,
+          precision,
           srid,
         };
       } catch (error) {

package/src/adapters/mysql/tools/spatial/setup.ts

@@ -163,6 +163,23 @@ export function createSpatialCreateIndexTool(
           }
         }
 
+        // Check if a SPATIAL index already exists on this column (any name)
+        const existingIdx = await adapter.executeQuery(
+          `SELECT INDEX_NAME FROM information_schema.STATISTICS
+           WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ? AND COLUMN_NAME = ? AND INDEX_TYPE = 'SPATIAL'
+           LIMIT 1`,
+          [table, column],
+        );
+
+        const existingRow = existingIdx.rows?.[0];
+        if (existingRow) {
+          const existingName = String(existingRow["INDEX_NAME"]);
+          return {
+            success: false,
+            reason: `Spatial index '${existingName}' already exists on column '${column}' of table '${table}'`,
+          };
+        }
+
         await adapter.executeQuery(
           `CREATE SPATIAL INDEX \`${idxName}\` ON \`${table}\`(\`${column}\`)`,
         );
@@ -181,6 +198,12 @@ export function createSpatialCreateIndexTool(
         if (msg.includes("Cannot create SPATIAL index on nullable column")) {
           return { success: false, reason: msg };
         }
+        if (msg.includes("Duplicate key name")) {
+          return {
+            success: false,
+            reason: `Index '${idxName}' already exists on table '${table}'`,
+          };
+        }
         return { success: false, error: msg };
       }
     },

package/src/adapters/mysql/tools/sysschema/__tests__/resources.test.ts

@@ -52,6 +52,9 @@ describe("Sys Schema Resource Tools", () => {
         tableStatistics: unknown[];
         indexStatistics: unknown[];
         autoIncrementStatus: unknown[];
+        tableStatisticsCount: number;
+        indexStatisticsCount: number;
+        autoIncrementStatusCount: number;
         schemaName: string;
       };
 
@@ -59,6 +62,9 @@ describe("Sys Schema Resource Tools", () => {
       expect(result.tableStatistics).toHaveLength(1);
       expect(result.indexStatistics).toHaveLength(1);
       expect(result.autoIncrementStatus).toHaveLength(1);
+      expect(result.tableStatisticsCount).toBe(1);
+      expect(result.indexStatisticsCount).toBe(1);
+      expect(result.autoIncrementStatusCount).toBe(1);
       expect(result.schemaName).toBe("testdb");
     });
 
@@ -113,6 +119,9 @@ describe("Sys Schema Resource Tools", () => {
       expect(result.tableStatistics).toEqual([]);
       expect(result.indexStatistics).toEqual([]);
       expect(result.autoIncrementStatus).toEqual([]);
+      expect(result.tableStatisticsCount).toBe(0);
+      expect(result.indexStatisticsCount).toBe(0);
+      expect(result.autoIncrementStatusCount).toBe(0);
     });
 
     it("should return exists: false for nonexistent schema (P154)", async () => {
@@ -144,9 +153,15 @@ describe("Sys Schema Resource Tools", () => {
       );
       const result = (await tool.handler({}, mockContext)) as {
         schemaName: string;
+        tableStatisticsCount: number;
+        indexStatisticsCount: number;
+        autoIncrementStatusCount: number;
       };
 
       expect(result.schemaName).toBe("real_db_name");
+      expect(result.tableStatisticsCount).toBe(0);
+      expect(result.indexStatisticsCount).toBe(0);
+      expect(result.autoIncrementStatusCount).toBe(0);
       // First call should be SELECT DATABASE()
       const firstCall = mockAdapter.executeQuery.mock.calls[0][0] as string;
       expect(firstCall).toContain("SELECT DATABASE()");
@@ -235,11 +250,15 @@ describe("Sys Schema Resource Tools", () => {
       const result = (await tool.handler({}, mockContext)) as {
         globalMemory: unknown[];
         memoryByUser: unknown[];
+        globalMemoryCount: number;
+        memoryByUserCount: number;
       };
 
       expect(mockAdapter.executeQuery).toHaveBeenCalledTimes(2);
       expect(result.globalMemory).toHaveLength(1);
       expect(result.memoryByUser).toHaveLength(1);
+      expect(result.globalMemoryCount).toBe(1);
+      expect(result.memoryByUserCount).toBe(1);
     });
 
     it("should handle null rows", async () => {
@@ -255,6 +274,8 @@ describe("Sys Schema Resource Tools", () => {
 
       expect(result.globalMemory).toEqual([]);
       expect(result.memoryByUser).toEqual([]);
+      expect(result.globalMemoryCount).toBe(0);
+      expect(result.memoryByUserCount).toBe(0);
     });
   });
 });

package/src/adapters/mysql/tools/sysschema/resources.ts

@@ -142,6 +142,9 @@ export function createSysSchemaStatsTool(
         tableStatistics: tableStats.rows ?? [],
         indexStatistics: indexStats.rows ?? [],
         autoIncrementStatus: autoIncStats.rows ?? [],
+        tableStatisticsCount: (tableStats.rows ?? []).length,
+        indexStatisticsCount: (indexStats.rows ?? []).length,
+        autoIncrementStatusCount: (autoIncStats.rows ?? []).length,
         schemaName: resolvedSchema,
       };
     },
@@ -262,6 +265,8 @@ export function createSysMemorySummaryTool(
       return {
         globalMemory: globalStats.rows ?? [],
         memoryByUser: userStats.rows ?? [],
+        globalMemoryCount: (globalStats.rows ?? []).length,
+        memoryByUserCount: (userStats.rows ?? []).length,
       };
     },
   };

package/src/adapters/mysql/tools/text/fulltext.ts

@@ -10,7 +10,12 @@ import type {
   ToolDefinition,
   RequestContext,
 } from "../../../../types/index.js";
-import { FulltextCreateSchema, FulltextSearchSchema } from "../../types.js";
+import {
+  FulltextCreateSchema,
+  FulltextCreateSchemaBase,
+  FulltextSearchSchema,
+  FulltextSearchSchemaBase,
+} from "../../types.js";
 import { z } from "zod";
 import {
   validateIdentifier,
@@ -75,7 +80,7 @@ export function createFulltextCreateTool(
     description:
       "Create a FULLTEXT index on specified columns for fast text search.",
     group: "fulltext",
-    inputSchema: FulltextCreateSchema,
+    inputSchema: FulltextCreateSchemaBase,
     requiredScopes: ["write"],
     annotations: {
       readOnlyHint: false,
@@ -156,7 +161,7 @@ export function createFulltextDropTool(adapter: MySQLAdapter): ToolDefinition {
   };
 }
 
-const FulltextSearchWithTruncateSchema = FulltextSearchSchema.extend({
+const FulltextSearchWithTruncateSchema = FulltextSearchSchemaBase.extend({
   maxLength: z
     .number()
     .optional()
@@ -180,8 +185,11 @@ export function createFulltextSearchTool(
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { table, columns, query, mode, maxLength } =
-        FulltextSearchWithTruncateSchema.parse(params);
+      const parsed = FulltextSearchSchema.parse(params);
+      const { table, columns, query, mode } = parsed;
+      const maxLength = (params as Record<string, unknown>)["maxLength"] as
+        | number
+        | undefined;
 
       // Validate inputs
       validateQualifiedIdentifier(table, "table");

package/src/adapters/mysql/tools/text/processing.ts

@@ -12,10 +12,18 @@ import type {
 } from "../../../../types/index.js";
 import {
   RegexpMatchSchema,
+  RegexpMatchSchemaBase,
   LikeSearchSchema,
+  LikeSearchSchemaBase,
   SoundexSchema,
+  SoundexSchemaBase,
+  SubstringSchema,
+  SubstringSchemaBase,
+  ConcatSchema,
+  ConcatSchemaBase,
+  CollationConvertSchema,
+  CollationConvertSchemaBase,
 } from "../../types.js";
-import { z } from "zod";
 import {
   validateIdentifier,
   validateQualifiedIdentifier,
@@ -29,7 +37,7 @@ export function createRegexpMatchTool(adapter: MySQLAdapter): ToolDefinition {
     title: "MySQL REGEXP Match",
     description: "Find rows where column matches a regular expression pattern.",
     group: "text",
-    inputSchema: RegexpMatchSchema,
+    inputSchema: RegexpMatchSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -70,7 +78,7 @@ export function createLikeSearchTool(adapter: MySQLAdapter): ToolDefinition {
     description:
       "Find rows using LIKE pattern matching with % and _ wildcards.",
     group: "text",
-    inputSchema: LikeSearchSchema,
+    inputSchema: LikeSearchSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -110,7 +118,7 @@ export function createSoundexTool(adapter: MySQLAdapter): ToolDefinition {
     title: "MySQL SOUNDEX",
     description: "Find rows with phonetically similar values using SOUNDEX.",
     group: "text",
-    inputSchema: SoundexSchema,
+    inputSchema: SoundexSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -145,27 +153,20 @@ export function createSoundexTool(adapter: MySQLAdapter): ToolDefinition {
 }
 
 export function createSubstringTool(adapter: MySQLAdapter): ToolDefinition {
-  const schema = z.object({
-    table: z.string(),
-    column: z.string(),
-    start: z.number().describe("Starting position (1-indexed)"),
-    length: z.number().optional().describe("Number of characters"),
-    where: z.string().optional(),
-  });
-
   return {
     name: "mysql_substring",
     title: "MySQL SUBSTRING",
     description: "Extract substrings from column values.",
     group: "text",
-    inputSchema: schema,
+    inputSchema: SubstringSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { table, column, start, length, where } = schema.parse(params);
+      const { table, column, start, length, where } =
+        SubstringSchema.parse(params);
 
       // Validate inputs
       validateQualifiedIdentifier(table, "table");
@@ -201,35 +202,12 @@ export function createSubstringTool(adapter: MySQLAdapter): ToolDefinition {
 }
 
 export function createConcatTool(adapter: MySQLAdapter): ToolDefinition {
-  const schema = z.object({
-    table: z.string(),
-    columns: z.array(z.string()).describe("Columns to concatenate"),
-    separator: z
-      .string()
-      .optional()
-      .default(" ")
-      .describe("Separator between values"),
-    alias: z
-      .string()
-      .optional()
-      .default("concatenated")
-      .describe("Result column name"),
-    where: z.string().optional(),
-    includeSourceColumns: z
-      .boolean()
-      .optional()
-      .default(true)
-      .describe(
-        "Include individual source columns in output (default: true). Set to false for minimal payload.",
-      ),
-  });
-
   return {
     name: "mysql_concat",
     title: "MySQL CONCAT",
     description: "Concatenate multiple columns with an optional separator.",
     group: "text",
-    inputSchema: schema,
+    inputSchema: ConcatSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -237,7 +215,7 @@ export function createConcatTool(adapter: MySQLAdapter): ToolDefinition {
     },
     handler: async (params: unknown, _context: RequestContext) => {
       const { table, columns, separator, alias, where, includeSourceColumns } =
-        schema.parse(params);
+        ConcatSchema.parse(params);
 
       // Validate inputs
       validateQualifiedIdentifier(table, "table");
@@ -278,28 +256,21 @@ export function createConcatTool(adapter: MySQLAdapter): ToolDefinition {
 export function createCollationConvertTool(
   adapter: MySQLAdapter,
 ): ToolDefinition {
-  const schema = z.object({
-    table: z.string(),
-    column: z.string(),
-    charset: z.string().describe("Target character set (e.g., utf8mb4)"),
-    collation: z.string().optional().describe("Target collation"),
-    where: z.string().optional(),
-  });
-
   return {
     name: "mysql_collation_convert",
     title: "MySQL Collation Convert",
     description:
       "Convert column values to a different character set or collation.",
     group: "text",
-    inputSchema: schema,
+    inputSchema: CollationConvertSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { table, column, charset, collation, where } = schema.parse(params);
+      const { table, column, charset, collation, where } =
+        CollationConvertSchema.parse(params);
 
       // Validate inputs
       validateQualifiedIdentifier(table, "table");