@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/adapters/mysql/tools/proxysql.ts

@@ -2,25 +2,41 @@
  * ProxySQL Management Tools
  *
  * Tools for monitoring and managing ProxySQL via its MySQL-protocol admin interface.
- * 12 tools total.
+ * 11 tools total.
  *
  * ProxySQL admin interface documentation:
  * https://proxysql.com/documentation/ProxySQL-Admin-Interface/
  */
 
 import mysql from "mysql2/promise";
+import { ZodError } from "zod";
 import type { ToolDefinition, RequestContext } from "../../../types/index.js";
 import type { MySQLAdapter } from "../MySQLAdapter.js";
 import {
   ProxySQLBaseInputSchema,
   ProxySQLStatusInputSchema,
   ProxySQLLimitInputSchema,
+  ProxySQLLimitInputSchemaBase,
   ProxySQLHostgroupInputSchema,
+  ProxySQLHostgroupInputSchemaBase,
   ProxySQLVariableFilterSchema,
+  ProxySQLVariableFilterSchemaBase,
   ProxySQLCommandInputSchema,
   type ProxySQLConfig,
 } from "../types/proxysql-types.js";
 
+/** Extract human-readable messages from a ZodError instead of raw JSON array */
+function formatZodError(error: ZodError): string {
+  return error.issues.map((i) => i.message).join("; ");
+}
+
+/**
+ * Safe character set for LIKE patterns.
+ * Allows alphanumeric, underscore, dash, dot, percent (%), and space.
+ * Rejects SQL injection characters like single quotes, semicolons, parentheses, etc.
+ */
+const LIKE_SAFE_RE = /^[a-zA-Z0-9_%\-. *]+$/;
+
 // =============================================================================
 // ProxySQL Connection Helper
 // =============================================================================
@@ -98,7 +114,6 @@ export function getProxySQLTools(_adapter: MySQLAdapter): ToolDefinition[] {
   return [
     createProxySQLStatusTool(),
     createProxySQLServersTool(),
-    createProxySQLHostgroupsTool(),
     createProxySQLQueryRulesTool(),
     createProxySQLQueryDigestTool(),
     createProxySQLConnectionPoolTool(),
@@ -133,42 +148,52 @@ function createProxySQLStatusTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { summary } = ProxySQLStatusInputSchema.parse(params);
-      const rows = await proxySQLQuery("SELECT * FROM stats_mysql_global");
-
-      if (summary) {
-        // Key metrics for summary mode
-        const keyMetrics = [
-          "ProxySQL_Uptime",
-          "Questions",
-          "Slow_queries",
-          "Active_Transactions",
-          "Client_Connections_connected",
-          "Client_Connections_created",
-          "Server_Connections_connected",
-          "Server_Connections_created",
-          "Query_Cache_Entries",
-          "Query_Cache_Memory_bytes",
-          "mysql_backend_buffers_bytes",
-          "mysql_frontend_buffers_bytes",
-        ];
-        const filteredRows = rows.filter((row) =>
-          keyMetrics.includes(row["Variable_Name"] as string),
-        );
+      try {
+        const { summary } = ProxySQLStatusInputSchema.parse(params);
+        const rows = await proxySQLQuery("SELECT * FROM stats_mysql_global");
+
+        if (summary) {
+          // Key metrics for summary mode
+          const keyMetrics = [
+            "ProxySQL_Uptime",
+            "Questions",
+            "Slow_queries",
+            "Active_Transactions",
+            "Client_Connections_connected",
+            "Client_Connections_created",
+            "Server_Connections_connected",
+            "Server_Connections_created",
+            "Query_Cache_Entries",
+            "Query_Cache_Memory_bytes",
+            "mysql_backend_buffers_bytes",
+            "mysql_frontend_buffers_bytes",
+          ];
+          const filteredRows = rows.filter((row) =>
+            keyMetrics.includes(row["Variable_Name"] as string),
+          );
+          return {
+            success: true,
+            summary: true,
+            stats: filteredRows,
+            totalVarsAvailable: rows.length,
+          };
+        }
+
         return {
           success: true,
-          summary: true,
-          stats: filteredRows,
+          summary: false,
+          stats: rows,
           totalVarsAvailable: rows.length,
         };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
       }
-
-      return {
-        success: true,
-        summary: false,
-        stats: rows,
-        totalVarsAvailable: rows.length,
-      };
     },
   };
 }
@@ -191,47 +216,57 @@ function createProxySQLRuntimeStatusTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { summary } = ProxySQLStatusInputSchema.parse(params);
-      const [versionRow] = await proxySQLQuery(
-        "SELECT variable_value FROM global_variables WHERE variable_name = 'admin-version'",
-      );
-      const adminVars = await proxySQLQuery(
-        "SELECT * FROM global_variables WHERE variable_name LIKE 'admin-%'",
-      );
-
-      // Redact sensitive admin variables (passwords, credentials)
-      const redactedVars = redactSensitiveVariables(adminVars);
-
-      if (summary) {
-        // Key admin variables for summary mode
-        const keyAdminVars = [
-          "admin-version",
-          "admin-read_only",
-          "admin-cluster_username",
-          "admin-mysql_ifaces",
-          "admin-restapi_enabled",
-          "admin-web_enabled",
-          "admin-stats_mysql_connection_pool",
-        ];
-        const filteredVars = redactedVars.filter((row) =>
-          keyAdminVars.includes(row["variable_name"] as string),
+      try {
+        const { summary } = ProxySQLStatusInputSchema.parse(params);
+        const [versionRow] = await proxySQLQuery(
+          "SELECT variable_value FROM global_variables WHERE variable_name = 'admin-version'",
+        );
+        const adminVars = await proxySQLQuery(
+          "SELECT * FROM global_variables WHERE variable_name LIKE 'admin-%'",
         );
+
+        // Redact sensitive admin variables (passwords, credentials)
+        const redactedVars = redactSensitiveVariables(adminVars);
+
+        if (summary) {
+          // Key admin variables for summary mode
+          const keyAdminVars = [
+            "admin-version",
+            "admin-read_only",
+            "admin-cluster_username",
+            "admin-mysql_ifaces",
+            "admin-restapi_enabled",
+            "admin-web_enabled",
+            "admin-stats_mysql_connection_pool",
+          ];
+          const filteredVars = redactedVars.filter((row) =>
+            keyAdminVars.includes(row["variable_name"] as string),
+          );
+          return {
+            success: true,
+            summary: true,
+            version: versionRow?.["variable_value"] ?? "unknown",
+            adminVariables: filteredVars,
+            totalAdminVarsAvailable: redactedVars.length,
+          };
+        }
+
         return {
           success: true,
-          summary: true,
+          summary: false,
           version: versionRow?.["variable_value"] ?? "unknown",
-          adminVariables: filteredVars,
+          adminVariables: redactedVars,
           totalAdminVarsAvailable: redactedVars.length,
         };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
       }
-
-      return {
-        success: true,
-        summary: false,
-        version: versionRow?.["variable_value"] ?? "unknown",
-        adminVariables: redactedVars,
-        totalAdminVarsAvailable: redactedVars.length,
-      };
     },
   };
 }
@@ -250,7 +285,7 @@ function createProxySQLServersTool(): ToolDefinition {
     description:
       "List configured backend MySQL servers from mysql_servers table. Shows hostgroup, hostname, port, status, and weights.",
     group: "proxysql",
-    inputSchema: ProxySQLHostgroupInputSchema,
+    inputSchema: ProxySQLHostgroupInputSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -258,47 +293,28 @@ function createProxySQLServersTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
-      let sql = "SELECT * FROM mysql_servers";
-      if (hostgroup_id !== undefined) {
-        sql += ` WHERE hostgroup_id = ${hostgroup_id}`;
+      try {
+        const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
+        let sql = "SELECT * FROM mysql_servers";
+        if (hostgroup_id !== undefined) {
+          const safeId = Math.max(0, Math.floor(hostgroup_id));
+          sql += ` WHERE hostgroup_id = ${safeId}`;
+        }
+        const rows = await proxySQLQuery(sql);
+        return {
+          success: true,
+          servers: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
       }
-      const rows = await proxySQLQuery(sql);
-      return {
-        success: true,
-        servers: rows,
-        count: rows.length,
-      };
-    },
-  };
-}
-
-/**
- * List hostgroup configurations and connection pool stats
- */
-function createProxySQLHostgroupsTool(): ToolDefinition {
-  return {
-    name: "proxysql_hostgroups",
-    title: "ProxySQL Hostgroups",
-    description:
-      "List hostgroup configurations with connection pool statistics. Shows connections used/free, query counts, and latency.",
-    group: "proxysql",
-    inputSchema: ProxySQLBaseInputSchema,
-    requiredScopes: ["read"],
-    annotations: {
-      readOnlyHint: true,
-      idempotentHint: true,
-      openWorldHint: true,
-    },
-    handler: async (_params: unknown, _context: RequestContext) => {
-      const rows = await proxySQLQuery(
-        "SELECT * FROM stats_mysql_connection_pool",
-      );
-      return {
-        success: true,
-        hostgroups: rows,
-        count: rows.length,
-      };
     },
   };
 }
@@ -317,7 +333,7 @@ function createProxySQLQueryRulesTool(): ToolDefinition {
     description:
       "List query routing rules from mysql_query_rules table. Shows rule IDs, match patterns, destination hostgroups, and cache settings.",
     group: "proxysql",
-    inputSchema: ProxySQLLimitInputSchema,
+    inputSchema: ProxySQLLimitInputSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -325,16 +341,26 @@ function createProxySQLQueryRulesTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { limit } = ProxySQLLimitInputSchema.parse(params);
-      const maxRows = limit ?? 100;
-      const rows = await proxySQLQuery(
-        `SELECT * FROM mysql_query_rules LIMIT ${maxRows}`,
-      );
-      return {
-        success: true,
-        queryRules: rows,
-        count: rows.length,
-      };
+      try {
+        const { limit } = ProxySQLLimitInputSchema.parse(params);
+        const maxRows = Math.max(0, Math.floor(limit ?? 100));
+        const rows = await proxySQLQuery(
+          `SELECT * FROM mysql_query_rules LIMIT ${maxRows}`,
+        );
+        return {
+          success: true,
+          queryRules: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -349,7 +375,7 @@ function createProxySQLQueryDigestTool(): ToolDefinition {
     description:
       "Get query digest statistics showing top queries by execution count. Useful for identifying queries for routing, rewriting, or caching.",
     group: "proxysql",
-    inputSchema: ProxySQLLimitInputSchema,
+    inputSchema: ProxySQLLimitInputSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -357,16 +383,26 @@ function createProxySQLQueryDigestTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { limit } = ProxySQLLimitInputSchema.parse(params);
-      const maxRows = limit ?? 50;
-      const rows = await proxySQLQuery(
-        `SELECT hostgroup, schemaname, username, digest, digest_text, count_star, sum_time, min_time, max_time FROM stats_mysql_query_digest ORDER BY count_star DESC LIMIT ${maxRows}`,
-      );
-      return {
-        success: true,
-        queryDigests: rows,
-        count: rows.length,
-      };
+      try {
+        const { limit } = ProxySQLLimitInputSchema.parse(params);
+        const maxRows = Math.max(0, Math.floor(limit ?? 50));
+        const rows = await proxySQLQuery(
+          `SELECT hostgroup, schemaname, username, digest, digest_text, count_star, sum_time, min_time, max_time FROM stats_mysql_query_digest ORDER BY count_star DESC LIMIT ${maxRows}`,
+        );
+        return {
+          success: true,
+          queryDigests: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -385,7 +421,7 @@ function createProxySQLConnectionPoolTool(): ToolDefinition {
     description:
       "Get connection pool statistics per backend server. Shows connections used/free, errors, queries, bytes transferred, and latency.",
     group: "proxysql",
-    inputSchema: ProxySQLHostgroupInputSchema,
+    inputSchema: ProxySQLHostgroupInputSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -393,17 +429,28 @@ function createProxySQLConnectionPoolTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
-      let sql = "SELECT * FROM stats_mysql_connection_pool";
-      if (hostgroup_id !== undefined) {
-        sql += ` WHERE hostgroup = ${hostgroup_id}`;
+      try {
+        const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
+        let sql = "SELECT * FROM stats_mysql_connection_pool";
+        if (hostgroup_id !== undefined) {
+          const safeId = Math.max(0, Math.floor(hostgroup_id));
+          sql += ` WHERE hostgroup = ${safeId}`;
+        }
+        const rows = await proxySQLQuery(sql);
+        return {
+          success: true,
+          connectionPools: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
       }
-      const rows = await proxySQLQuery(sql);
-      return {
-        success: true,
-        connectionPools: rows,
-        count: rows.length,
-      };
     },
   };
 }
@@ -430,15 +477,25 @@ function createProxySQLUsersTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (_params: unknown, _context: RequestContext) => {
-      // Don't expose passwords, select specific columns
-      const rows = await proxySQLQuery(
-        "SELECT username, active, use_ssl, default_hostgroup, default_schema, transaction_persistent, max_connections, comment FROM mysql_users",
-      );
-      return {
-        success: true,
-        users: rows,
-        count: rows.length,
-      };
+      try {
+        // Don't expose passwords, select specific columns
+        const rows = await proxySQLQuery(
+          "SELECT username, active, use_ssl, default_hostgroup, default_schema, transaction_persistent, max_connections, comment FROM mysql_users",
+        );
+        return {
+          success: true,
+          users: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -457,7 +514,7 @@ function createProxySQLGlobalVariablesTool(): ToolDefinition {
     description:
       "Get ProxySQL global variables. Filter by prefix: mysql (MySQL proxy settings), admin (admin interface settings), or all. Use like parameter for pattern matching.",
     group: "proxysql",
-    inputSchema: ProxySQLVariableFilterSchema,
+    inputSchema: ProxySQLVariableFilterSchemaBase,
     requiredScopes: ["read"],
     annotations: {
       readOnlyHint: true,
@@ -465,47 +522,63 @@ function createProxySQLGlobalVariablesTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { prefix, like, limit } =
-        ProxySQLVariableFilterSchema.parse(params);
-      const conditions: string[] = [];
-
-      // Apply prefix filter
-      if (prefix === "mysql") {
-        conditions.push("variable_name LIKE 'mysql-%'");
-      } else if (prefix === "admin") {
-        conditions.push("variable_name LIKE 'admin-%'");
-      }
+      try {
+        const { prefix, like, limit } =
+          ProxySQLVariableFilterSchema.parse(params);
+        const conditions: string[] = [];
+
+        // Apply prefix filter
+        if (prefix === "mysql") {
+          conditions.push("variable_name LIKE 'mysql-%'");
+        } else if (prefix === "admin") {
+          conditions.push("variable_name LIKE 'admin-%'");
+        }
+
+        // Validate like pattern against safe character set
+        if (like) {
+          if (!LIKE_SAFE_RE.test(like)) {
+            return {
+              success: false,
+              error: `Invalid like pattern: '${like}' — only alphanumeric, underscore, dash, dot, percent (%), and space characters are allowed`,
+            };
+          }
+          const sanitizedLike = like.replace(/'/g, "''");
+          conditions.push(`variable_name LIKE '${sanitizedLike}'`);
+        }
+
+        const whereClause =
+          conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
+
+        // Get total count (without LIMIT) for truncation awareness
+        const countRows = await proxySQLQuery(
+          `SELECT COUNT(*) AS cnt FROM global_variables${whereClause}`,
+        );
+        const countRow = countRows[0] ?? { cnt: 0 };
+        const totalVarsAvailable = Number(countRow["cnt"]);
 
-      // Apply like pattern filter (sanitize input)
-      if (like) {
-        const sanitizedLike = like.replace(/'/g, "''");
-        conditions.push(`variable_name LIKE '${sanitizedLike}'`);
-      }
+        const maxRows = Math.max(0, Math.floor(limit ?? 50));
+        const rows = await proxySQLQuery(
+          `SELECT * FROM global_variables${whereClause} LIMIT ${maxRows}`,
+        );
 
-      const whereClause =
-        conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
-
-      // Get total count (without LIMIT) for truncation awareness
-      const countRows = await proxySQLQuery(
-        `SELECT COUNT(*) AS cnt FROM global_variables${whereClause}`,
-      );
-      const countRow = countRows[0] ?? { cnt: 0 };
-      const totalVarsAvailable = Number(countRow["cnt"]);
-
-      const maxRows = limit ?? 50;
-      const rows = await proxySQLQuery(
-        `SELECT * FROM global_variables${whereClause} LIMIT ${maxRows}`,
-      );
-
-      // Redact sensitive credential values (passwords, credentials)
-      const redactedRows = redactSensitiveVariables(rows);
-
-      return {
-        success: true,
-        variables: redactedRows,
-        count: redactedRows.length,
-        totalVarsAvailable,
-      };
+        // Redact sensitive credential values (passwords, credentials)
+        const redactedRows = redactSensitiveVariables(rows);
+
+        return {
+          success: true,
+          variables: redactedRows,
+          count: redactedRows.length,
+          totalVarsAvailable,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -532,12 +605,22 @@ function createProxySQLMemoryStatsTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (_params: unknown, _context: RequestContext) => {
-      const rows = await proxySQLQuery("SELECT * FROM stats_memory_metrics");
-      return {
-        success: true,
-        memoryStats: rows,
-        count: rows.length,
-      };
+      try {
+        const rows = await proxySQLQuery("SELECT * FROM stats_memory_metrics");
+        return {
+          success: true,
+          memoryStats: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -563,13 +646,23 @@ function createProxySQLCommandsTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { command } = ProxySQLCommandInputSchema.parse(params);
-      await proxySQLQuery(command);
-      return {
-        success: true,
-        command,
-        message: `Command executed: ${command}`,
-      };
+      try {
+        const { command } = ProxySQLCommandInputSchema.parse(params);
+        await proxySQLQuery(command);
+        return {
+          success: true,
+          command,
+          message: `Command executed: ${command}`,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }
@@ -596,12 +689,24 @@ function createProxySQLProcessListTool(): ToolDefinition {
       openWorldHint: true,
     },
     handler: async (_params: unknown, _context: RequestContext) => {
-      const rows = await proxySQLQuery("SELECT * FROM stats_mysql_processlist");
-      return {
-        success: true,
-        processes: rows,
-        count: rows.length,
-      };
+      try {
+        const rows = await proxySQLQuery(
+          "SELECT * FROM stats_mysql_processlist",
+        );
+        return {
+          success: true,
+          processes: rows,
+          count: rows.length,
+        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     },
   };
 }