@yanzhang123/readonly-db-mcp 0.9.5 → 0.9.7

package/README.md

@@ -256,6 +256,8 @@ MYSQL_USE_PURE=false
 MYSQL_RAISE_ON_WARNINGS=false
 ```
 
+`MYSQL_SQL_MODE` 与命名配置的 `sql_mode` 会在每次查询的会话中显式设置（空值即设为空模式）。会改变引号或反斜杠语义的模式会被拒绝：`ANSI_QUOTES`、`NO_BACKSLASH_ESCAPES`，以及包含它们的组合模式 `ANSI`、`DB2`、`MAXDB`、`MSSQL`、`ORACLE`、`POSTGRESQL`，因为只读 SQL 闸门按 MySQL 默认规则识别字符串边界。
+
 ### Streamable HTTP 传输（推荐）
 
 DeepSeek Harness 等新客户端可直接连接标准 MCP Streamable HTTP 端点：
@@ -599,7 +601,7 @@ npm test
 - **企业审计**：UTC JSONL 事件包含事件 ID、MCP 请求 ID、操作、调用方归因、策略决定、目标库、无字面量查询指纹、耗时、结果大小和结果状态；不记录 SQL 原文和结果数据
 - **两阶段审计**：失败关闭模式下，建立连接前先 fsync 写入 `started` 事件，随后记录终态事件
 - **默认加密**：数据库 TLS 默认 `REQUIRED`；生产配置建议使用 `VERIFY_CA` 或 `VERIFY_IDENTITY`
-- **解析器加固**：拒绝 MySQL `/*!...*/` 和 MariaDB `/*M!...*/` 可执行注释；未限定到允许数据库的全局 `SHOW` 被拦截
+- **解析器加固**：拒绝 MySQL `/*!...*/` 和 MariaDB `/*M!...*/` 可执行注释；未限定到允许数据库的全局 `SHOW` 被拦截；每次查询显式设置已校验的 `sql_mode`，不接受改变字符串边界的 `ANSI_QUOTES`、`NO_BACKSLASH_ESCAPES` 等模式
 - **诊断隐私**：连接诊断只公开不可逆账号指纹和权限摘要，不返回用户名、授权原文、配置路径或数据库错误原文
 - **SSE 安全边界**：默认仅绑定回环地址；非回环部署必须配置 Bearer 认证或由唯一入口的认证反向代理保护
 

package/SECURITY.md

@@ -144,6 +144,11 @@ The MCP server includes built-in protection against SQL injection for administra
   built-in or their reviewed name is explicitly listed in `allowed_functions`.
   Sequence advancement, lock functions and other known side-effecting functions
   remain blocked even inside `SELECT`.
+- The guard tokenizes strings with MySQL's default quote and backslash rules.
+  Profiles therefore reject `sql_mode` values that change them (`ANSI_QUOTES`,
+  `NO_BACKSLASH_ESCAPES`, and the combination modes `ANSI`, `DB2`, `MAXDB`,
+  `MSSQL`, `ORACLE`, `POSTGRESQL`), and every query session explicitly applies
+  the validated `sql_mode` instead of inheriting the server's global value.
 - All exposed SQL then runs inside a MySQL read-only transaction. Normal completion rolls back; cancellation or result truncation closes the socket, forcing rollback and stopping unread-row production.
 - Every MCP tool is advertised as read-only and non-destructive.
 - Named profiles can define `allowed_databases`; SQL table/function qualifiers and resource URIs are checked against it with a MySQL AST parser.

package/npm/lib/launcher.cjs

@@ -147,8 +147,11 @@ function sleep(milliseconds) {
   );
 }
 
-function acquireInstallLock(lockPath, markerPath) {
-  const deadline = Date.now() + 180_000;
+// Returns null when another process finished an installation that matches
+// this package. A stale marker alone is not enough: the lock holder may be
+// replacing that runtime right now.
+function acquireInstallLock(lockPath, isReady, { timeoutMs = 180_000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
   while (true) {
     try {
       return fs.openSync(lockPath, "wx");
@@ -156,7 +159,7 @@ function acquireInstallLock(lockPath, markerPath) {
       if (!error || error.code !== "EEXIST") {
         throw error;
       }
-      if (fs.existsSync(markerPath)) {
+      if (isReady()) {
         return null;
       }
       const age = Date.now() - fs.statSync(lockPath).mtimeMs;
@@ -187,7 +190,9 @@ function ensureRuntime() {
   }
 
   fs.mkdirSync(runtimeRoot, { recursive: true });
-  const lockHandle = acquireInstallLock(lock, marker);
+  const lockHandle = acquireInstallLock(lock, () =>
+    runtimeIsReady(marker, runtimePython, fingerprint),
+  );
   if (lockHandle === null) {
     return runtimePython;
   }
@@ -284,6 +289,7 @@ async function main(argv = process.argv.slice(2)) {
 }
 
 module.exports = {
+  acquireInstallLock,
   bundledWheel,
   cacheBase,
   dependencyLock,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanzhang123/readonly-db-mcp",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Enterprise-auditable, strictly read-only MySQL MCP server with multi-environment profiles.",
   "license": "MIT",
   "type": "commonjs",