@shibbirweb/mcp-db-read-only 0.1.0

package/dist/validation/sql/SqlDialect.js

@@ -0,0 +1,196 @@
+/** The five SQL dialects this server speaks. */
+export class SqlDialects {
+    static MYSQL = {
+        name: "mysql",
+        label: "MySQL",
+        lexical: {
+            singleQuote: "backslash",
+            doubleQuote: "backslash",
+            backtick: "plain",
+            escapeStringPrefix: false,
+            brackets: "none",
+            dollarQuotes: false,
+            hashComments: true,
+            dashCommentNeedsSpace: true,
+            executableComments: true,
+        },
+        allowedLeadingKeywords: ["SELECT", "WITH", "SHOW", "DESCRIBE", "DESC", "EXPLAIN"],
+        bodyScanKeywords: ["WITH"],
+        scanExplainAnalyze: true,
+        scanEveryStatement: false,
+        // MySQL 8 allows a CTE to prefix UPDATE and DELETE, and EXPLAIN ANALYZE
+        // runs what it explains. Nothing else can follow those two openings.
+        writeKeywords: /\b(INSERT|UPDATE|DELETE|REPLACE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|RENAME|CALL|LOAD|HANDLER|LOCK|UNLOCK|INSTALL|UNINSTALL|FLUSH|SHUTDOWN|KILL)\b/i,
+        forbiddenPatterns: [
+            { pattern: /INTO\s+OUTFILE/i, reason: "INTO OUTFILE writes a file on the database server" },
+            { pattern: /INTO\s+DUMPFILE/i, reason: "INTO DUMPFILE writes a file on the database server" },
+            { pattern: /LOAD\s+DATA/i, reason: "LOAD DATA reads files into a table" },
+            { pattern: /\bBENCHMARK\s*\(/i, reason: "BENCHMARK() can hang the conversation" },
+            { pattern: /\bSLEEP\s*\(/i, reason: "SLEEP() can hang the conversation" },
+        ],
+        quoteExample: "`name`",
+    };
+    static POSTGRES = {
+        name: "postgres",
+        label: "PostgreSQL",
+        lexical: {
+            // Plain strings take no backslash escapes, which is only true with
+            // standard_conforming_strings on. The driver sets it on every
+            // transaction so this is a fact rather than an assumption.
+            singleQuote: "plain",
+            doubleQuote: "plain",
+            backtick: "none",
+            escapeStringPrefix: true,
+            brackets: "none",
+            dollarQuotes: true,
+            hashComments: false,
+            dashCommentNeedsSpace: false,
+            executableComments: false,
+        },
+        allowedLeadingKeywords: ["SELECT", "WITH", "SHOW", "EXPLAIN", "VALUES", "TABLE"],
+        bodyScanKeywords: ["WITH"],
+        scanExplainAnalyze: true,
+        scanEveryStatement: false,
+        // What may follow WITH (data-modifying CTEs) or EXPLAIN ANALYZE, and no
+        // more: a longer list would reject ordinary queries over columns with
+        // names like "comment" for no gain in safety.
+        writeKeywords: /\b(INSERT|UPDATE|DELETE|MERGE|CREATE|DROP|ALTER|TRUNCATE|EXECUTE|DECLARE|REFRESH)\b/i,
+        forbiddenPatterns: [
+            { pattern: /\bINTO\b/i, reason: "SELECT ... INTO creates a table" },
+            {
+                pattern: /\b(set_config|pg_reload_conf|pg_rotate_logfile|pg_promote|pg_switch_wal|pg_create_restore_point|pg_logical_emit_message|pg_notify)\s*\(/i,
+                reason: "that function changes server or session state",
+            },
+            {
+                pattern: /\b(pg_terminate_backend|pg_cancel_backend)\s*\(/i,
+                reason: "that function stops other sessions",
+            },
+            {
+                // lo_export writes a file on the server, which a read-only
+                // transaction does not prevent.
+                pattern: /\b(lo_import|lo_export|pg_file_write|pg_read_file|pg_read_binary_file|pg_ls_dir)\s*\(/i,
+                reason: "that function reaches the server's filesystem",
+            },
+            {
+                // Each of these runs SQL passed as a string. The string is a literal,
+                // so it is invisible to every rule here, and dblink runs it on a
+                // separate connection that the read-only transaction does not cover.
+                pattern: /\b(dblink\w*|query_to_xml\w*|cursor_to_xml\w*|ts_stat|crosstab\w*)\s*\(/i,
+                reason: "that function runs SQL supplied as a string",
+            },
+            { pattern: /\bpg_sleep\w*\s*\(/i, reason: "pg_sleep() can hang the conversation" },
+            { pattern: /\bpg_advisory\w*\s*\(/i, reason: "advisory locks outlive the query" },
+        ],
+        quoteExample: '"name"',
+    };
+    static SQLITE = {
+        name: "sqlite",
+        label: "SQLite",
+        lexical: {
+            singleQuote: "plain",
+            doubleQuote: "plain",
+            backtick: "plain",
+            escapeStringPrefix: false,
+            brackets: "simple",
+            dollarQuotes: false,
+            hashComments: false,
+            dashCommentNeedsSpace: false,
+            executableComments: false,
+        },
+        allowedLeadingKeywords: ["SELECT", "WITH", "EXPLAIN", "VALUES"],
+        bodyScanKeywords: ["WITH"],
+        scanExplainAnalyze: false,
+        scanEveryStatement: false,
+        writeKeywords: /\b(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER)\b/i,
+        forbiddenPatterns: [
+            {
+                pattern: /\b(load_extension|writefile|readfile|edit|fts3_tokenizer)\s*\(/i,
+                reason: "that function reaches outside the database file",
+            },
+        ],
+        quoteExample: '"name"',
+    };
+    static MSSQL = {
+        name: "mssql",
+        label: "SQL Server",
+        lexical: {
+            singleQuote: "plain",
+            doubleQuote: "plain",
+            backtick: "none",
+            escapeStringPrefix: false,
+            brackets: "doubled",
+            dollarQuotes: false,
+            hashComments: false,
+            dashCommentNeedsSpace: false,
+            executableComments: false,
+        },
+        allowedLeadingKeywords: ["SELECT", "WITH"],
+        bodyScanKeywords: [],
+        scanExplainAnalyze: false,
+        scanEveryStatement: true,
+        // Every keyword that can start a statement with a side effect. OPEN,
+        // CLOSE, FETCH, DECLARE and similar are left out deliberately: they are
+        // harmless alone and common as column names in real schemas.
+        writeKeywords: /\b(INSERT|UPDATE|DELETE|MERGE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|DENY|EXEC|EXECUTE|DBCC|BACKUP|RESTORE|SHUTDOWN|KILL|BULK|WAITFOR|RECONFIGURE|CHECKPOINT|SET|BEGIN|COMMIT|ROLLBACK|SAVE|USE|UPDATETEXT|WRITETEXT|SETUSER|ENABLE|DISABLE|SEND|RECEIVE)\b/i,
+        forbiddenPatterns: [
+            { pattern: /\bINTO\b/i, reason: "SELECT ... INTO creates a table" },
+            {
+                pattern: /\b(OPENROWSET|OPENDATASOURCE|OPENQUERY)\b/i,
+                reason: "that function reaches another server and can run statements there",
+            },
+        ],
+        quoteExample: "[name]",
+    };
+    static CLICKHOUSE = {
+        name: "clickhouse",
+        label: "ClickHouse",
+        lexical: {
+            singleQuote: "backslash",
+            // Identifier escaping is the one ClickHouse rule not pinned down well
+            // enough to rely on, so a backslash inside an identifier is refused.
+            doubleQuote: "reject-backslash",
+            backtick: "reject-backslash",
+            escapeStringPrefix: false,
+            brackets: "none",
+            dollarQuotes: true,
+            hashComments: true,
+            dashCommentNeedsSpace: false,
+            executableComments: false,
+        },
+        allowedLeadingKeywords: ["SELECT", "WITH", "SHOW", "DESCRIBE", "DESC", "EXPLAIN", "EXISTS"],
+        bodyScanKeywords: ["WITH"],
+        scanExplainAnalyze: false,
+        scanEveryStatement: false,
+        writeKeywords: /\b(INSERT|ALTER|DROP|CREATE|TRUNCATE|RENAME|OPTIMIZE|ATTACH|DETACH|SYSTEM|KILL|DELETE|UPDATE|EXCHANGE|GRANT|REVOKE|SET|BACKUP|RESTORE)\b/i,
+        forbiddenPatterns: [
+            { pattern: /INTO\s+OUTFILE/i, reason: "INTO OUTFILE writes a file" },
+            {
+                // Table functions that fetch from outside the server: files on its
+                // disk, URLs, object stores, other databases, arbitrary executables.
+                // Reading through them turns a read-only analytics account into a
+                // way to reach anything the server can reach.
+                pattern: /\b(file|url|urlCluster|s3|s3Cluster|gcs|hdfs|hdfsCluster|azureBlobStorage|azureBlobStorageCluster|remote|remoteSecure|mysql|postgresql|mongodb|redis|sqlite|jdbc|odbc|executable|iceberg\w*|deltaLake\w*|hudi\w*)\s*\(/i,
+                reason: "that table function reaches outside the ClickHouse server",
+            },
+            { pattern: /\b(sleep|sleepEachRow)\s*\(/i, reason: "sleep() can hang the conversation" },
+        ],
+        quoteExample: "`name`",
+    };
+    static BY_NAME = new Map([
+        ["mysql", SqlDialects.MYSQL],
+        ["postgres", SqlDialects.POSTGRES],
+        ["sqlite", SqlDialects.SQLITE],
+        ["mssql", SqlDialects.MSSQL],
+        ["clickhouse", SqlDialects.CLICKHOUSE],
+    ]);
+    static get(name) {
+        const dialect = SqlDialects.BY_NAME.get(name);
+        if (!dialect) {
+            throw new Error(`Unknown SQL dialect "${name}".`);
+        }
+        return dialect;
+    }
+    static all() {
+        return Array.from(SqlDialects.BY_NAME.values());
+    }
+}

package/dist/validation/sql/SqlSkeletonizer.js

@@ -0,0 +1,197 @@
+/**
+ * Reduces a statement to its syntactic skeleton by blanking every string
+ * literal, quoted identifier and comment, following one dialect's rules.
+ *
+ * Its own class because every rule depends on it and none should re-implement
+ * it. It is the foundation of the whole read-only guard: rules inspecting the
+ * skeleton can never mistake user data for SQL.
+ *
+ * Written as a character scanner rather than regular expressions because these
+ * constructs nest and escape in ways regular expressions cannot express
+ * correctly. A regex version was tried in the MySQL-only predecessor and
+ * rejected; its failure mode was false rejections of ordinary queries.
+ *
+ * Where a construct could be read two ways, the scanner reports it instead of
+ * picking one. A nested block comment is the example: PostgreSQL and SQL
+ * Server nest them, MySQL and SQLite do not, and a validator that guesses
+ * wrong hides whatever follows the inner `*\/` from itself while the server
+ * runs it. Refusing the construct removes the question entirely.
+ */
+export class SqlSkeletonizer {
+    static NESTED_COMMENT = "a nested block comment";
+    static EXECUTABLE_COMMENT = "a MySQL executable comment (/*! ... */)";
+    static IDENTIFIER_BACKSLASH = "a backslash inside a quoted identifier";
+    /** Characters that can continue an identifier, which decides where `$tag$` may begin. */
+    static IDENTIFIER_CHAR = /[A-Za-z0-9_$\u0080-￿]/;
+    /** A dollar-quote delimiter: `$$` or `$tag$`, where a tag cannot start with a digit. */
+    static DOLLAR_TAG = /\$(?:[A-Za-z_\u0080-￿][A-Za-z0-9_\u0080-￿]*)?\$/y;
+    skeletonize(sql, rules) {
+        const ambiguities = new Set();
+        let out = "";
+        let index = 0;
+        while (index < sql.length) {
+            const char = sql[index];
+            const quoteMode = this.quoteModeAt(sql, index, rules);
+            if (quoteMode !== "none") {
+                index = this.skipQuoted(sql, index, quoteMode, ambiguities);
+                // Blanked to a single space, so a quoted column named after a keyword
+                // is invisible to the keyword rules, and `'a'OR` still separates.
+                out += " ";
+                continue;
+            }
+            if (char === "[" && rules.brackets !== "none") {
+                index = this.skipBracketed(sql, index, rules.brackets);
+                out += " ";
+                continue;
+            }
+            if (char === "$" && rules.dollarQuotes) {
+                const delimiter = this.dollarDelimiterAt(sql, index);
+                if (delimiter) {
+                    index = this.skipDollarQuoted(sql, index, delimiter);
+                    out += " ";
+                    continue;
+                }
+            }
+            if (this.startsLineComment(sql, index, rules)) {
+                index = this.skipToLineEnd(sql, index);
+                continue;
+            }
+            if (char === "/" && sql[index + 1] === "*") {
+                if (rules.executableComments && this.isExecutableComment(sql, index)) {
+                    ambiguities.add(SqlSkeletonizer.EXECUTABLE_COMMENT);
+                }
+                index = this.skipBlockComment(sql, index, ambiguities);
+                out += " ";
+                continue;
+            }
+            out += char;
+            index += 1;
+        }
+        return { text: out, ambiguities: Array.from(ambiguities) };
+    }
+    /** Which quoting applies to the character at `index`, if it opens one. */
+    quoteModeAt(sql, index, rules) {
+        const char = sql[index];
+        if (char === "'") {
+            return rules.escapeStringPrefix && this.isEscapeStringPrefix(sql, index)
+                ? "backslash"
+                : rules.singleQuote;
+        }
+        if (char === '"') {
+            return rules.doubleQuote;
+        }
+        if (char === "`") {
+            return rules.backtick;
+        }
+        return "none";
+    }
+    /**
+     * `E'...'` in PostgreSQL, where the `E` stands alone rather than ending an
+     * identifier: `E'\''` is an escape string, `name'...'` is not.
+     */
+    isEscapeStringPrefix(sql, quoteIndex) {
+        const prefix = sql[quoteIndex - 1];
+        if (prefix !== "E" && prefix !== "e") {
+            return false;
+        }
+        const before = sql[quoteIndex - 2];
+        return before === undefined || !SqlSkeletonizer.IDENTIFIER_CHAR.test(before);
+    }
+    skipQuoted(sql, start, mode, ambiguities) {
+        const quote = sql[start];
+        let index = start + 1;
+        while (index < sql.length) {
+            const char = sql[index];
+            if (char === "\\") {
+                if (mode === "backslash") {
+                    index += 2;
+                    continue;
+                }
+                if (mode === "reject-backslash") {
+                    ambiguities.add(SqlSkeletonizer.IDENTIFIER_BACKSLASH);
+                }
+            }
+            if (char === quote) {
+                if (sql[index + 1] === quote) {
+                    index += 2;
+                    continue;
+                }
+                return index + 1;
+            }
+            index += 1;
+        }
+        // Unterminated: blank to the end. The server rejects it as a syntax
+        // error, so treating the rest as literal cannot let anything through.
+        return index;
+    }
+    skipBracketed(sql, start, style) {
+        let index = start + 1;
+        while (index < sql.length) {
+            if (sql[index] === "]") {
+                if (style === "doubled" && sql[index + 1] === "]") {
+                    index += 2;
+                    continue;
+                }
+                return index + 1;
+            }
+            index += 1;
+        }
+        return index;
+    }
+    /**
+     * A `$` preceded by an identifier character is part of that identifier
+     * (`price$usd`), and `$1` is a parameter, so neither opens a quote.
+     */
+    dollarDelimiterAt(sql, index) {
+        const before = sql[index - 1];
+        if (before !== undefined && SqlSkeletonizer.IDENTIFIER_CHAR.test(before)) {
+            return null;
+        }
+        SqlSkeletonizer.DOLLAR_TAG.lastIndex = index;
+        const match = SqlSkeletonizer.DOLLAR_TAG.exec(sql);
+        return match ? match[0] : null;
+    }
+    skipDollarQuoted(sql, start, delimiter) {
+        const end = sql.indexOf(delimiter, start + delimiter.length);
+        return end === -1 ? sql.length : end + delimiter.length;
+    }
+    startsLineComment(sql, index, rules) {
+        if (sql[index] === "#" && rules.hashComments) {
+            return true;
+        }
+        if (sql[index] !== "-" || sql[index + 1] !== "-") {
+            return false;
+        }
+        if (!rules.dashCommentNeedsSpace) {
+            return true;
+        }
+        // MySQL requires whitespace after `--`, so `SELECT 1--2` stays an
+        // arithmetic expression rather than becoming a comment.
+        const after = sql[index + 2];
+        return after === undefined || /\s/.test(after);
+    }
+    skipToLineEnd(sql, start) {
+        let index = start;
+        while (index < sql.length && sql[index] !== "\n") {
+            index += 1;
+        }
+        return index;
+    }
+    /** `/*!` and MariaDB's `/*M!`, both of which MySQL executes. */
+    isExecutableComment(sql, start) {
+        return sql[start + 2] === "!" || (sql[start + 2] === "M" && sql[start + 3] === "!");
+    }
+    skipBlockComment(sql, start, ambiguities) {
+        let index = start + 2;
+        while (index < sql.length) {
+            if (sql[index] === "*" && sql[index + 1] === "/") {
+                return index + 2;
+            }
+            if (sql[index] === "/" && sql[index + 1] === "*") {
+                ambiguities.add(SqlSkeletonizer.NESTED_COMMENT);
+            }
+            index += 1;
+        }
+        return index;
+    }
+}

package/dist/validation/sql/SqlValidatorRegistry.js

@@ -0,0 +1,24 @@
+import { ReadOnlyQueryValidator } from "./ReadOnlyQueryValidator.js";
+import { SqlDialects } from "./SqlDialect.js";
+/**
+ * One validator per SQL dialect, built once.
+ *
+ * run_query learns the dialect from the driver it is about to use, so it
+ * needs a way to get the matching validator without constructing one on
+ * every call or knowing how validators are assembled.
+ */
+export class SqlValidatorRegistry {
+    validators = new Map();
+    constructor() {
+        for (const dialect of SqlDialects.all()) {
+            this.validators.set(dialect.name, new ReadOnlyQueryValidator(dialect));
+        }
+    }
+    for(dialect) {
+        const validator = this.validators.get(dialect);
+        if (!validator) {
+            throw new Error(`No validator for SQL dialect "${dialect}".`);
+        }
+        return validator;
+    }
+}

package/dist/validation/sql/rules/AmbiguousSyntaxRule.js

@@ -0,0 +1,23 @@
+/**
+ * Rejects statements containing a construct the skeletonizer could not read
+ * with certainty.
+ *
+ * Runs before every rule that inspects the skeleton, because those rules are
+ * only as trustworthy as the skeleton, and an ambiguous construct means the
+ * skeleton might not be what the server sees. The constructs involved (nested
+ * comments, MySQL executable comments, backslashes in quoted identifiers) are
+ * rare in hand-written reads, so the cost of refusing them is small and the
+ * message says exactly what to remove.
+ */
+export class AmbiguousSyntaxRule {
+    name = "ambiguous-syntax";
+    evaluate(inspection) {
+        if (inspection.ambiguities.length === 0) {
+            return null;
+        }
+        return {
+            valid: false,
+            error: `Query contains ${inspection.ambiguities.join(" and ")}, which ${inspection.dialect.label} could read differently from this validator. Rewrite the query without it.`,
+        };
+    }
+}

package/dist/validation/sql/rules/EmptyQueryRule.js

@@ -0,0 +1,16 @@
+/**
+ * Rejects a statement with no content.
+ *
+ * Runs first so later rules can assume a non-empty skeleton. Catches the empty
+ * string, whitespace, a bare semicolon, and a statement that was nothing but a
+ * comment, since all of them arrive here as an empty skeleton.
+ */
+export class EmptyQueryRule {
+    name = "empty-query";
+    evaluate(inspection) {
+        if (inspection.skeleton.length === 0) {
+            return { valid: false, error: "Empty query." };
+        }
+        return null;
+    }
+}

package/dist/validation/sql/rules/ForbiddenPatternRule.js

@@ -0,0 +1,30 @@
+/**
+ * Blocks constructs that are harmful even inside an otherwise read-only
+ * statement.
+ *
+ * These begin with SELECT and pass every rule above. They write files
+ * (`INTO OUTFILE`, PostgreSQL's `lo_export`), create tables (`SELECT ... INTO`
+ * in PostgreSQL and SQL Server), reach other servers (ClickHouse table
+ * functions, `OPENROWSET`), run SQL hidden inside a string literal (dblink,
+ * `query_to_xml`), or simply hang the conversation (`SLEEP`).
+ *
+ * The lists live in each dialect, since each engine has its own. This rule
+ * applies to every statement, so a sloppy pattern causes false rejections
+ * everywhere; each one matches a function call or a fixed phrase, not a bare
+ * word that could be a column name.
+ */
+export class ForbiddenPatternRule {
+    name = "forbidden-pattern";
+    evaluate(inspection) {
+        for (const forbidden of inspection.dialect.forbiddenPatterns) {
+            const match = forbidden.pattern.exec(inspection.skeleton);
+            if (match) {
+                return {
+                    valid: false,
+                    error: `Query contains "${match[0].trim()}", which is not allowed: ${forbidden.reason}.`,
+                };
+            }
+        }
+        return null;
+    }
+}

package/dist/validation/sql/rules/LeadingKeywordRule.js

@@ -0,0 +1,29 @@
+/**
+ * Requires the statement to begin with a keyword that reads rather than writes.
+ *
+ * The allowed set is per dialect, because the read statements differ: SHOW
+ * exists in MySQL and ClickHouse but not SQLite, and SQL Server has neither
+ * SHOW nor EXPLAIN. WITH is allowed everywhere, since rejecting CTEs is a real
+ * loss on an analysis tool, and that is exactly why SmuggledWriteRule exists.
+ */
+export class LeadingKeywordRule {
+    name = "leading-keyword";
+    evaluate(inspection) {
+        const allowed = inspection.dialect.allowedLeadingKeywords;
+        if (allowed.includes(inspection.leadingKeyword)) {
+            return null;
+        }
+        // Naming the offending keyword matters: a model told precisely what was
+        // wrong usually rewrites the query correctly without further prompting.
+        return {
+            valid: false,
+            error: `Only ${this.list(allowed)} are allowed on ${inspection.dialect.label}. Got: ${inspection.leadingKeyword}`,
+        };
+    }
+    list(keywords) {
+        if (keywords.length === 1) {
+            return keywords[0];
+        }
+        return `${keywords.slice(0, -1).join(", ")} and ${keywords[keywords.length - 1]}`;
+    }
+}

package/dist/validation/sql/rules/SingleStatementRule.js

@@ -0,0 +1,26 @@
+/**
+ * Rejects stacked statements.
+ *
+ * Because the skeleton has literals and comments blanked, any remaining `;` is
+ * a real separator. A trailing one is already stripped before rules run, since
+ * people routinely paste queries that way.
+ *
+ * On most engines this is a better error message rather than the actual
+ * protection, because the driver cannot send a second statement at all
+ * (mysql2 with multipleStatements off, pg in extended query mode, one query
+ * per ClickHouse HTTP request). SQLite is the exception worth knowing: its
+ * prepare silently ignores everything after the first statement, so without
+ * this rule `SELECT 1; DELETE FROM t` would run the SELECT and report success.
+ */
+export class SingleStatementRule {
+    name = "single-statement";
+    evaluate(inspection) {
+        if (inspection.skeleton.includes(";")) {
+            return {
+                valid: false,
+                error: "Multiple statements are not allowed. Send one query at a time.",
+            };
+        }
+        return null;
+    }
+}

package/dist/validation/sql/rules/SmuggledWriteRule.js

@@ -0,0 +1,50 @@
+/**
+ * Catches writes hidden behind an allowed first keyword.
+ *
+ * Three forms can do this:
+ *
+ * - `WITH c AS (...) DELETE FROM t` is a write whose first word is allowed,
+ *   in MySQL 8, PostgreSQL, SQLite and ClickHouse.
+ * - `EXPLAIN ANALYZE` genuinely executes the statement in MySQL and
+ *   PostgreSQL, unlike plain EXPLAIN, which only plans it and is left alone.
+ * - In T-SQL any statement can follow another with no separator at all, so on
+ *   SQL Server every statement is scanned.
+ *
+ * **Elsewhere the scan is deliberately not applied to plain SELECT.** A
+ * SELECT cannot become a write in those dialects, so scanning adds no safety,
+ * and it actively breaks ordinary queries: `SELECT start FROM sessions`
+ * contains START and `SELECT begin, end FROM ranges` contains BEGIN. The
+ * MySQL-only predecessor tried a global scan first and failed on exactly these.
+ *
+ * The residual cost is that a column named exactly like a write keyword must
+ * be quoted where the scan does run, which the message explains.
+ */
+export class SmuggledWriteRule {
+    name = "smuggled-write";
+    static ANALYZE = /\bANALYZE\b/i;
+    evaluate(inspection) {
+        if (!this.needsBodyScan(inspection)) {
+            return null;
+        }
+        const match = inspection.dialect.writeKeywords.exec(inspection.skeleton);
+        if (!match) {
+            return null;
+        }
+        return {
+            valid: false,
+            error: `This statement contains ${match[1].toUpperCase()}, which can modify data and is not allowed on a read-only connection. If ${match[1]} is a column or table name here, quote it as ${inspection.dialect.quoteExample}.`,
+        };
+    }
+    needsBodyScan(inspection) {
+        const dialect = inspection.dialect;
+        if (dialect.scanEveryStatement) {
+            return true;
+        }
+        if (dialect.bodyScanKeywords.includes(inspection.leadingKeyword)) {
+            return true;
+        }
+        return (dialect.scanExplainAnalyze &&
+            inspection.leadingKeyword === "EXPLAIN" &&
+            SmuggledWriteRule.ANALYZE.test(inspection.skeleton));
+    }
+}

package/dist/validation/sql/rules/index.js

@@ -0,0 +1,6 @@
+export { EmptyQueryRule } from "./EmptyQueryRule.js";
+export { AmbiguousSyntaxRule } from "./AmbiguousSyntaxRule.js";
+export { SingleStatementRule } from "./SingleStatementRule.js";
+export { LeadingKeywordRule } from "./LeadingKeywordRule.js";
+export { SmuggledWriteRule } from "./SmuggledWriteRule.js";
+export { ForbiddenPatternRule } from "./ForbiddenPatternRule.js";