@neverinfamous/mysql-mcp 2.3.1 → 3.0.1

package/dist/adapters/mysql/tools/proxysql.js

@@ -2,13 +2,24 @@
  * ProxySQL Management Tools
  *
  * Tools for monitoring and managing ProxySQL via its MySQL-protocol admin interface.
- * 12 tools total.
+ * 11 tools total.
  *
  * ProxySQL admin interface documentation:
  * https://proxysql.com/documentation/ProxySQL-Admin-Interface/
  */
 import mysql from "mysql2/promise";
-import { ProxySQLBaseInputSchema, ProxySQLStatusInputSchema, ProxySQLLimitInputSchema, ProxySQLHostgroupInputSchema, ProxySQLVariableFilterSchema, ProxySQLCommandInputSchema, } from "../types/proxysql-types.js";
+import { ZodError } from "zod";
+import { ProxySQLBaseInputSchema, ProxySQLStatusInputSchema, ProxySQLLimitInputSchema, ProxySQLLimitInputSchemaBase, ProxySQLHostgroupInputSchema, ProxySQLHostgroupInputSchemaBase, ProxySQLVariableFilterSchema, ProxySQLVariableFilterSchemaBase, ProxySQLCommandInputSchema, } from "../types/proxysql-types.js";
+/** Extract human-readable messages from a ZodError instead of raw JSON array */
+function formatZodError(error) {
+    return error.issues.map((i) => i.message).join("; ");
+}
+/**
+ * Safe character set for LIKE patterns.
+ * Allows alphanumeric, underscore, dash, dot, percent (%), and space.
+ * Rejects SQL injection characters like single quotes, semicolons, parentheses, etc.
+ */
+const LIKE_SAFE_RE = /^[a-zA-Z0-9_%\-. *]+$/;
 // =============================================================================
 // ProxySQL Connection Helper
 // =============================================================================
@@ -71,7 +82,6 @@ export function getProxySQLTools(_adapter) {
     return [
         createProxySQLStatusTool(),
         createProxySQLServersTool(),
-        createProxySQLHostgroupsTool(),
         createProxySQLQueryRulesTool(),
         createProxySQLQueryDigestTool(),
         createProxySQLConnectionPoolTool(),
@@ -103,38 +113,49 @@ function createProxySQLStatusTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { summary } = ProxySQLStatusInputSchema.parse(params);
-            const rows = await proxySQLQuery("SELECT * FROM stats_mysql_global");
-            if (summary) {
-                // Key metrics for summary mode
-                const keyMetrics = [
-                    "ProxySQL_Uptime",
-                    "Questions",
-                    "Slow_queries",
-                    "Active_Transactions",
-                    "Client_Connections_connected",
-                    "Client_Connections_created",
-                    "Server_Connections_connected",
-                    "Server_Connections_created",
-                    "Query_Cache_Entries",
-                    "Query_Cache_Memory_bytes",
-                    "mysql_backend_buffers_bytes",
-                    "mysql_frontend_buffers_bytes",
-                ];
-                const filteredRows = rows.filter((row) => keyMetrics.includes(row["Variable_Name"]));
+            try {
+                const { summary } = ProxySQLStatusInputSchema.parse(params);
+                const rows = await proxySQLQuery("SELECT * FROM stats_mysql_global");
+                if (summary) {
+                    // Key metrics for summary mode
+                    const keyMetrics = [
+                        "ProxySQL_Uptime",
+                        "Questions",
+                        "Slow_queries",
+                        "Active_Transactions",
+                        "Client_Connections_connected",
+                        "Client_Connections_created",
+                        "Server_Connections_connected",
+                        "Server_Connections_created",
+                        "Query_Cache_Entries",
+                        "Query_Cache_Memory_bytes",
+                        "mysql_backend_buffers_bytes",
+                        "mysql_frontend_buffers_bytes",
+                    ];
+                    const filteredRows = rows.filter((row) => keyMetrics.includes(row["Variable_Name"]));
+                    return {
+                        success: true,
+                        summary: true,
+                        stats: filteredRows,
+                        totalVarsAvailable: rows.length,
+                    };
+                }
                 return {
                     success: true,
-                    summary: true,
-                    stats: filteredRows,
+                    summary: false,
+                    stats: rows,
                     totalVarsAvailable: rows.length,
                 };
             }
-            return {
-                success: true,
-                summary: false,
-                stats: rows,
-                totalVarsAvailable: rows.length,
-            };
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -155,38 +176,49 @@ function createProxySQLRuntimeStatusTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { summary } = ProxySQLStatusInputSchema.parse(params);
-            const [versionRow] = await proxySQLQuery("SELECT variable_value FROM global_variables WHERE variable_name = 'admin-version'");
-            const adminVars = await proxySQLQuery("SELECT * FROM global_variables WHERE variable_name LIKE 'admin-%'");
-            // Redact sensitive admin variables (passwords, credentials)
-            const redactedVars = redactSensitiveVariables(adminVars);
-            if (summary) {
-                // Key admin variables for summary mode
-                const keyAdminVars = [
-                    "admin-version",
-                    "admin-read_only",
-                    "admin-cluster_username",
-                    "admin-mysql_ifaces",
-                    "admin-restapi_enabled",
-                    "admin-web_enabled",
-                    "admin-stats_mysql_connection_pool",
-                ];
-                const filteredVars = redactedVars.filter((row) => keyAdminVars.includes(row["variable_name"]));
+            try {
+                const { summary } = ProxySQLStatusInputSchema.parse(params);
+                const [versionRow] = await proxySQLQuery("SELECT variable_value FROM global_variables WHERE variable_name = 'admin-version'");
+                const adminVars = await proxySQLQuery("SELECT * FROM global_variables WHERE variable_name LIKE 'admin-%'");
+                // Redact sensitive admin variables (passwords, credentials)
+                const redactedVars = redactSensitiveVariables(adminVars);
+                if (summary) {
+                    // Key admin variables for summary mode
+                    const keyAdminVars = [
+                        "admin-version",
+                        "admin-read_only",
+                        "admin-cluster_username",
+                        "admin-mysql_ifaces",
+                        "admin-restapi_enabled",
+                        "admin-web_enabled",
+                        "admin-stats_mysql_connection_pool",
+                    ];
+                    const filteredVars = redactedVars.filter((row) => keyAdminVars.includes(row["variable_name"]));
+                    return {
+                        success: true,
+                        summary: true,
+                        version: versionRow?.["variable_value"] ?? "unknown",
+                        adminVariables: filteredVars,
+                        totalAdminVarsAvailable: redactedVars.length,
+                    };
+                }
                 return {
                     success: true,
-                    summary: true,
+                    summary: false,
                     version: versionRow?.["variable_value"] ?? "unknown",
-                    adminVariables: filteredVars,
+                    adminVariables: redactedVars,
                     totalAdminVarsAvailable: redactedVars.length,
                 };
             }
-            return {
-                success: true,
-                summary: false,
-                version: versionRow?.["variable_value"] ?? "unknown",
-                adminVariables: redactedVars,
-                totalAdminVarsAvailable: redactedVars.length,
-            };
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -202,7 +234,7 @@ function createProxySQLServersTool() {
         title: "ProxySQL Servers",
         description: "List configured backend MySQL servers from mysql_servers table. Shows hostgroup, hostname, port, status, and weights.",
         group: "proxysql",
-        inputSchema: ProxySQLHostgroupInputSchema,
+        inputSchema: ProxySQLHostgroupInputSchemaBase,
         requiredScopes: ["read"],
         annotations: {
             readOnlyHint: true,
@@ -210,43 +242,29 @@ function createProxySQLServersTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
-            let sql = "SELECT * FROM mysql_servers";
-            if (hostgroup_id !== undefined) {
-                sql += ` WHERE hostgroup_id = ${hostgroup_id}`;
+            try {
+                const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
+                let sql = "SELECT * FROM mysql_servers";
+                if (hostgroup_id !== undefined) {
+                    const safeId = Math.max(0, Math.floor(hostgroup_id));
+                    sql += ` WHERE hostgroup_id = ${safeId}`;
+                }
+                const rows = await proxySQLQuery(sql);
+                return {
+                    success: true,
+                    servers: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
             }
-            const rows = await proxySQLQuery(sql);
-            return {
-                success: true,
-                servers: rows,
-                count: rows.length,
-            };
-        },
-    };
-}
-/**
- * List hostgroup configurations and connection pool stats
- */
-function createProxySQLHostgroupsTool() {
-    return {
-        name: "proxysql_hostgroups",
-        title: "ProxySQL Hostgroups",
-        description: "List hostgroup configurations with connection pool statistics. Shows connections used/free, query counts, and latency.",
-        group: "proxysql",
-        inputSchema: ProxySQLBaseInputSchema,
-        requiredScopes: ["read"],
-        annotations: {
-            readOnlyHint: true,
-            idempotentHint: true,
-            openWorldHint: true,
-        },
-        handler: async (_params, _context) => {
-            const rows = await proxySQLQuery("SELECT * FROM stats_mysql_connection_pool");
-            return {
-                success: true,
-                hostgroups: rows,
-                count: rows.length,
-            };
         },
     };
 }
@@ -262,7 +280,7 @@ function createProxySQLQueryRulesTool() {
         title: "ProxySQL Query Rules",
         description: "List query routing rules from mysql_query_rules table. Shows rule IDs, match patterns, destination hostgroups, and cache settings.",
         group: "proxysql",
-        inputSchema: ProxySQLLimitInputSchema,
+        inputSchema: ProxySQLLimitInputSchemaBase,
         requiredScopes: ["read"],
         annotations: {
             readOnlyHint: true,
@@ -270,14 +288,25 @@ function createProxySQLQueryRulesTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { limit } = ProxySQLLimitInputSchema.parse(params);
-            const maxRows = limit ?? 100;
-            const rows = await proxySQLQuery(`SELECT * FROM mysql_query_rules LIMIT ${maxRows}`);
-            return {
-                success: true,
-                queryRules: rows,
-                count: rows.length,
-            };
+            try {
+                const { limit } = ProxySQLLimitInputSchema.parse(params);
+                const maxRows = Math.max(0, Math.floor(limit ?? 100));
+                const rows = await proxySQLQuery(`SELECT * FROM mysql_query_rules LIMIT ${maxRows}`);
+                return {
+                    success: true,
+                    queryRules: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -290,7 +319,7 @@ function createProxySQLQueryDigestTool() {
         title: "ProxySQL Query Digest",
         description: "Get query digest statistics showing top queries by execution count. Useful for identifying queries for routing, rewriting, or caching.",
         group: "proxysql",
-        inputSchema: ProxySQLLimitInputSchema,
+        inputSchema: ProxySQLLimitInputSchemaBase,
         requiredScopes: ["read"],
         annotations: {
             readOnlyHint: true,
@@ -298,14 +327,25 @@ function createProxySQLQueryDigestTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { limit } = ProxySQLLimitInputSchema.parse(params);
-            const maxRows = limit ?? 50;
-            const rows = await proxySQLQuery(`SELECT hostgroup, schemaname, username, digest, digest_text, count_star, sum_time, min_time, max_time FROM stats_mysql_query_digest ORDER BY count_star DESC LIMIT ${maxRows}`);
-            return {
-                success: true,
-                queryDigests: rows,
-                count: rows.length,
-            };
+            try {
+                const { limit } = ProxySQLLimitInputSchema.parse(params);
+                const maxRows = Math.max(0, Math.floor(limit ?? 50));
+                const rows = await proxySQLQuery(`SELECT hostgroup, schemaname, username, digest, digest_text, count_star, sum_time, min_time, max_time FROM stats_mysql_query_digest ORDER BY count_star DESC LIMIT ${maxRows}`);
+                return {
+                    success: true,
+                    queryDigests: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -321,7 +361,7 @@ function createProxySQLConnectionPoolTool() {
         title: "ProxySQL Connection Pool",
         description: "Get connection pool statistics per backend server. Shows connections used/free, errors, queries, bytes transferred, and latency.",
         group: "proxysql",
-        inputSchema: ProxySQLHostgroupInputSchema,
+        inputSchema: ProxySQLHostgroupInputSchemaBase,
         requiredScopes: ["read"],
         annotations: {
             readOnlyHint: true,
@@ -329,17 +369,29 @@ function createProxySQLConnectionPoolTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
-            let sql = "SELECT * FROM stats_mysql_connection_pool";
-            if (hostgroup_id !== undefined) {
-                sql += ` WHERE hostgroup = ${hostgroup_id}`;
+            try {
+                const { hostgroup_id } = ProxySQLHostgroupInputSchema.parse(params);
+                let sql = "SELECT * FROM stats_mysql_connection_pool";
+                if (hostgroup_id !== undefined) {
+                    const safeId = Math.max(0, Math.floor(hostgroup_id));
+                    sql += ` WHERE hostgroup = ${safeId}`;
+                }
+                const rows = await proxySQLQuery(sql);
+                return {
+                    success: true,
+                    connectionPools: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
             }
-            const rows = await proxySQLQuery(sql);
-            return {
-                success: true,
-                connectionPools: rows,
-                count: rows.length,
-            };
         },
     };
 }
@@ -363,13 +415,24 @@ function createProxySQLUsersTool() {
             openWorldHint: true,
         },
         handler: async (_params, _context) => {
-            // Don't expose passwords, select specific columns
-            const rows = await proxySQLQuery("SELECT username, active, use_ssl, default_hostgroup, default_schema, transaction_persistent, max_connections, comment FROM mysql_users");
-            return {
-                success: true,
-                users: rows,
-                count: rows.length,
-            };
+            try {
+                // Don't expose passwords, select specific columns
+                const rows = await proxySQLQuery("SELECT username, active, use_ssl, default_hostgroup, default_schema, transaction_persistent, max_connections, comment FROM mysql_users");
+                return {
+                    success: true,
+                    users: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -385,7 +448,7 @@ function createProxySQLGlobalVariablesTool() {
         title: "ProxySQL Global Variables",
         description: "Get ProxySQL global variables. Filter by prefix: mysql (MySQL proxy settings), admin (admin interface settings), or all. Use like parameter for pattern matching.",
         group: "proxysql",
-        inputSchema: ProxySQLVariableFilterSchema,
+        inputSchema: ProxySQLVariableFilterSchemaBase,
         requiredScopes: ["read"],
         annotations: {
             readOnlyHint: true,
@@ -393,35 +456,52 @@ function createProxySQLGlobalVariablesTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { prefix, like, limit } = ProxySQLVariableFilterSchema.parse(params);
-            const conditions = [];
-            // Apply prefix filter
-            if (prefix === "mysql") {
-                conditions.push("variable_name LIKE 'mysql-%'");
-            }
-            else if (prefix === "admin") {
-                conditions.push("variable_name LIKE 'admin-%'");
+            try {
+                const { prefix, like, limit } = ProxySQLVariableFilterSchema.parse(params);
+                const conditions = [];
+                // Apply prefix filter
+                if (prefix === "mysql") {
+                    conditions.push("variable_name LIKE 'mysql-%'");
+                }
+                else if (prefix === "admin") {
+                    conditions.push("variable_name LIKE 'admin-%'");
+                }
+                // Validate like pattern against safe character set
+                if (like) {
+                    if (!LIKE_SAFE_RE.test(like)) {
+                        return {
+                            success: false,
+                            error: `Invalid like pattern: '${like}' — only alphanumeric, underscore, dash, dot, percent (%), and space characters are allowed`,
+                        };
+                    }
+                    const sanitizedLike = like.replace(/'/g, "''");
+                    conditions.push(`variable_name LIKE '${sanitizedLike}'`);
+                }
+                const whereClause = conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
+                // Get total count (without LIMIT) for truncation awareness
+                const countRows = await proxySQLQuery(`SELECT COUNT(*) AS cnt FROM global_variables${whereClause}`);
+                const countRow = countRows[0] ?? { cnt: 0 };
+                const totalVarsAvailable = Number(countRow["cnt"]);
+                const maxRows = Math.max(0, Math.floor(limit ?? 50));
+                const rows = await proxySQLQuery(`SELECT * FROM global_variables${whereClause} LIMIT ${maxRows}`);
+                // Redact sensitive credential values (passwords, credentials)
+                const redactedRows = redactSensitiveVariables(rows);
+                return {
+                    success: true,
+                    variables: redactedRows,
+                    count: redactedRows.length,
+                    totalVarsAvailable,
+                };
             }
-            // Apply like pattern filter (sanitize input)
-            if (like) {
-                const sanitizedLike = like.replace(/'/g, "''");
-                conditions.push(`variable_name LIKE '${sanitizedLike}'`);
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
             }
-            const whereClause = conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
-            // Get total count (without LIMIT) for truncation awareness
-            const countRows = await proxySQLQuery(`SELECT COUNT(*) AS cnt FROM global_variables${whereClause}`);
-            const countRow = countRows[0] ?? { cnt: 0 };
-            const totalVarsAvailable = Number(countRow["cnt"]);
-            const maxRows = limit ?? 50;
-            const rows = await proxySQLQuery(`SELECT * FROM global_variables${whereClause} LIMIT ${maxRows}`);
-            // Redact sensitive credential values (passwords, credentials)
-            const redactedRows = redactSensitiveVariables(rows);
-            return {
-                success: true,
-                variables: redactedRows,
-                count: redactedRows.length,
-                totalVarsAvailable,
-            };
         },
     };
 }
@@ -445,12 +525,23 @@ function createProxySQLMemoryStatsTool() {
             openWorldHint: true,
         },
         handler: async (_params, _context) => {
-            const rows = await proxySQLQuery("SELECT * FROM stats_memory_metrics");
-            return {
-                success: true,
-                memoryStats: rows,
-                count: rows.length,
-            };
+            try {
+                const rows = await proxySQLQuery("SELECT * FROM stats_memory_metrics");
+                return {
+                    success: true,
+                    memoryStats: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -473,13 +564,24 @@ function createProxySQLCommandsTool() {
             openWorldHint: true,
         },
         handler: async (params, _context) => {
-            const { command } = ProxySQLCommandInputSchema.parse(params);
-            await proxySQLQuery(command);
-            return {
-                success: true,
-                command,
-                message: `Command executed: ${command}`,
-            };
+            try {
+                const { command } = ProxySQLCommandInputSchema.parse(params);
+                await proxySQLQuery(command);
+                return {
+                    success: true,
+                    command,
+                    message: `Command executed: ${command}`,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }
@@ -503,12 +605,23 @@ function createProxySQLProcessListTool() {
             openWorldHint: true,
         },
         handler: async (_params, _context) => {
-            const rows = await proxySQLQuery("SELECT * FROM stats_mysql_processlist");
-            return {
-                success: true,
-                processes: rows,
-                count: rows.length,
-            };
+            try {
+                const rows = await proxySQLQuery("SELECT * FROM stats_mysql_processlist");
+                return {
+                    success: true,
+                    processes: rows,
+                    count: rows.length,
+                };
+            }
+            catch (error) {
+                if (error instanceof ZodError) {
+                    return { success: false, error: formatZodError(error) };
+                }
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
         },
     };
 }