@yawlabs/postgres-mcp 0.6.18 → 0.6.20

package/CHANGELOG.md

@@ -7,6 +7,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.20] - 2026-06-04
+
+### Fixed
+- `wrapToolHandler` now distinguishes a handler that returned a non-`ApiResponse`
+  value (null, a primitive, a raw object) from a handler that returned
+  `{ok: false}`. The former surfaces `"Error: tool handler returned a malformed
+  result (missing ok)"`; the latter still surfaces `"Error: <error>"`. A
+  misbehaving handler no longer collapses into the generic `Unknown error` path.
+  `wrapToolHandler` is also now exported from `mcp-wrapper.ts` and covered by
+  a dedicated unit test (`mcp-wrapper.test.ts`), so the production mapping is
+  exercised without standing up `index.ts` and the stdio transport.
+- `index.ts` resolves `package.json` by walking up from the emitted module path
+  rather than via a hard-coded `"../package.json"`. A non-trivial `tsc` emit
+  layout (e.g. `dist/src/index.js`) used to crash startup with an unresolvable
+  require. Verified against the current `outDir: "dist"` layout; future layout
+  changes don't need an `index.ts` patch.
+- Shutdown is now idempotent. SIGINT, SIGTERM, and `stdin.end` can all fire
+  near-simultaneously when a client closes the connection while the shell also
+  sends a signal. An `exiting` flag short-circuits the second and third so
+  `shutdown()` and `process.exit()` don't race.
+- `index.ts` no longer fakes a `version` string when `__VERSION__` is unset
+  (which only happens on a plain `tsc` build, not the esbuild bundled output).
+  The new `readPackageVersion()` throws a clear error if it can't find
+  `package.json` rather than silently emitting a malformed banner.
+
+### Security
+- `paramValue` (used by `pg_query`, `pg_readonly`, `pg_explain` for positional
+  parameters) now uses `.finite()` on the number member, so `NaN`, `Infinity`,
+  and `-Infinity` are rejected at the MCP boundary. Without `.finite()`, pg
+  serializes the JS number to the literal string `'NaN'` / `'Infinity'`, which
+  the server happily accepts on a text column and rejects opaquely on a numeric
+  one. Now the request is rejected before it ever hits the database.
+- `identSchema` dropped its redundant `.max(63)` so the byte-length `.refine`
+  is the sole length guard. A 64-ASCII-char string now surfaces the tailored
+  "exceeds PostgreSQL's 63-byte NAMEDATALEN limit" message instead of Zod's
+  generic "at most 63 character(s)" -- agents that read the message act on it
+  correctly.
+
+### Added
+- `pg_explain` rejects pre-wrapped `EXPLAIN ...` SQL with a clear hint. An LLM
+  that calls the tool with `sql: "EXPLAIN ANALYZE SELECT ..."` no longer
+  becomes the double-`EXPLAIN` syntax error from the server; the handler
+  short-circuits with "the `sql` parameter should be the query to explain, not
+  an EXPLAIN statement." Also re-applies Zod defaults (`analyze`, `format`,
+  `using`) on the direct-call path so unit tests that bypass Zod still hit
+  the documented behavior.
+- `pg_explain` hypothetical_indexes pre-flight rejects over-qualified
+  `schema.table.extra` table names, not just pre-quoted / over-63-byte ones.
+  An `a.b.c` form previously rendered as `"a"."b"."c"` and surfaced a
+  confusing planner error; now it's rejected with a clear message.
+- `pg_describe_table` populates `_warnings` even when the `kind` sub-query
+  returned zero rows (not just when it errored). The `?? "table"` default
+  would otherwise silently mislabel a relation that was dropped between the
+  `columns` and `kind` fetches.
+- `pg_health` warns when the version sub-query returned zero rows (rather
+  than silently emitting `version: undefined`). Symmetric with the other
+  four sub-queries.
+- Per-tool `inputSchema parses a type-correct sample input` test in
+  `tools.test.ts`. Catches drift between the schema's declared shape and
+  the keys the handler destructures at runtime. Uses public Zod 4
+  constructors (`instanceof z.ZodString`, etc.) -- the `_def` introspection
+  path is brittle across Zod majors.
+
+### Docs
+- `pg_query` description now leads with "Postgres itself is the primary
+  safety gate" and presents `ALLOW_WRITES=1` as a secondary belt-and-braces.
+  Pre-0.6.20 the order implied `ALLOW_WRITES` was the primary control, which
+  is the opposite of the recommended posture (a least-privileged role in
+  `DATABASE_URL`).
+- `getPool()` env-var snapshot comment now leads with which two values
+  (`getMaxRows`, `isWritesAllowed`) are intentionally re-read per request,
+  with rationale, instead of burying the re-read list at the end of a
+  paragraph about the snapshot.
+
+### Infrastructure
+- `release.sh` accepts `REQUIRE_MATRIX=1`. When set, the existing "WSL Ubuntu
+  not detected" warning becomes a hard `fail`; default behavior is unchanged
+  (warn-only so contributors without WSL can still tag). The matrix remains
+  a local-only pre-tag gate; this is just an opt-in fail-fast.
+- `package.json` `package-lock.json` and `server.json` all bumped to 0.6.20.
+
 ## [0.6.16] - 2026-05-18
 
 ### Tests

package/README.md

@@ -7,7 +7,7 @@
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
-[![Add to Yaw MCP](https://yaw.sh/yaw-mcp-button.svg)](yaw://install?name=Postgres&command=npx&args=-y%2C%40yawlabs%2Fpostgres-mcp&description=Query%20PostgreSQL%20-%20schema%20introspection%2C%20EXPLAIN%20plans%2C%20health%20diagnostics%2C%20read-only%20by%20default&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Fpostgres-mcp)
+[![Add to Yaw MCP](https://yaw.sh/yaw-mcp-button.svg)](https://yaw.sh/mcp/install?name=Postgres&command=npx&args=-y%2C%40yawlabs%2Fpostgres-mcp&description=Query%20PostgreSQL%20-%20schema%20introspection%2C%20EXPLAIN%20plans%2C%20health%20diagnostics%2C%20read-only%20by%20default&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Fpostgres-mcp)
 
 One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
 

package/dist/index.js

@@ -36349,9 +36349,62 @@ async function shutdown() {
   }
 }
 
+// src/mcp-wrapper.ts
+function wrapToolHandler(handler) {
+  return async (input) => {
+    try {
+      const result = await handler(input);
+      if (result === null || typeof result !== "object" || !("ok" in result)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Error: tool handler returned a malformed result (missing ok)"
+            }
+          ],
+          isError: true
+        };
+      }
+      const response = result;
+      if (!response.ok) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${response.error || "Unknown error"}`
+            }
+          ],
+          isError: true
+        };
+      }
+      const text = JSON.stringify(
+        response.data ?? { success: true },
+        (_k, v) => typeof v === "bigint" ? v.toString() : v,
+        2
+      );
+      return {
+        content: [{ type: "text", text }]
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true
+      };
+    }
+  };
+}
+
 // src/tools/params.ts
 var paramValue = external_exports.lazy(
-  () => external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null(), external_exports.array(paramValue), external_exports.record(external_exports.string(), paramValue)])
+  () => external_exports.union([
+    external_exports.string(),
+    external_exports.number().finite(),
+    external_exports.boolean(),
+    external_exports.null(),
+    external_exports.array(paramValue),
+    external_exports.record(external_exports.string(), paramValue)
+  ])
 );
 var MAX_PARAM_DEPTH = 32;
 function isWithinDepth(value, maxDepth) {
@@ -36372,7 +36425,7 @@ function isWithinDepth(value, maxDepth) {
 var paramsArray = external_exports.array(paramValue).refine((arr) => arr.every((v) => isWithinDepth(v, MAX_PARAM_DEPTH)), {
   message: `Parameter value exceeds maximum nesting depth of ${MAX_PARAM_DEPTH}`
 });
-var identSchema = external_exports.string().min(1).max(63).refine((v) => Buffer.byteLength(v, "utf8") <= 63, {
+var identSchema = external_exports.string().min(1).refine((v) => Buffer.byteLength(v, "utf8") <= 63, {
   message: "Identifier exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes)."
 });
 
@@ -36380,7 +36433,7 @@ var identSchema = external_exports.string().min(1).max(63).refine((v) => Buffer.
 var adminTools = [
   {
     name: "pg_inspect_locks",
-    description: "Show current lock contention: which sessions are blocked and who is blocking them. Returns blocked PID, blocking PID, lock types, relation being contested, and the queries involved. Use this first when a tool call hangs or the app feels stuck - it's the fastest way to identify a long-held transaction holding a lock. Row shape: one row per (blocked_pid, blocking_pid) pair. A session waiting on multiple blockers appears on multiple rows -- group/deduplicate by `blocked_pid` if you want a per-blocked-session count.",
+    description: "Show current lock contention: which sessions are blocked and who is blocking them. Returns blocked PID, blocking PID, lock types, relation being contested, and the queries involved. Use this first when a tool call hangs or the app feels stuck - it's the fastest way to identify a long-held transaction holding a lock. Row shape: one row per (blocked_pid, blocking_pid) pair. A session waiting on multiple blockers appears on multiple rows -- group/deduplicate by `blocked_pid` if you want a per-blocked-session count. Caveat on `relation`: for non-relation waits (transactionid/virtualxid, where the wait is on the blocker's xid rather than a table) `relation` is a best-effort hint -- an alphabetical guess among the blocker's held write-intent locks -- not authoritative. Use the blocked/blocking query text to disambiguate which table is actually contested.",
     annotations: {
       title: "Inspect blocking locks",
       readOnlyHint: true,
@@ -36516,7 +36569,7 @@ var adminTools = [
            table_name AS "table",
            grantee,
            privilege_type,
-           is_grantable::boolean AS is_grantable
+           (is_grantable = 'YES') AS is_grantable
          FROM information_schema.table_privileges
          WHERE table_schema = $1
            ${tableFilter}
@@ -36661,6 +36714,11 @@ var adminTools = [
             // Divide in `numeric`, not `float8`: BIGINT sequences past 2^53 lose
             // precision in float8, and the danger zone (>= threshold) is exactly
             // where the reported pct_used must stay accurate.
+            // Filter vs display precision differ on purpose: the WHERE clause
+            // tests the full-precision ratio while the SELECT rounds pct_used
+            // to numeric(6,4) for display. So a displayed 0.5000 may correspond
+            // to a true ratio slightly above the threshold -- the filter is
+            // correct, the display is rounded.
             `SELECT
                schemaname AS schema,
                sequencename AS sequence,
@@ -36797,7 +36855,11 @@ function quoteQualifiedTable(name) {
   return name.split(".").map((p) => quoteIdent(p)).join(".");
 }
 function validateHypoIndex(idx) {
-  for (const piece of idx.table.split(".")) {
+  const pieces = idx.table.split(".");
+  if (pieces.length > 2) {
+    return `Hypothetical index table ${JSON.stringify(idx.table)} is over-qualified; use only \`schema.table\` or \`table\`.`;
+  }
+  for (const piece of pieces) {
     if (piece.includes('"')) {
       return `Hypothetical index table ${JSON.stringify(idx.table)} contains a double-quote; pass plain identifier names without pre-quoting.`;
     }
@@ -36858,7 +36920,15 @@ var explainTools = [
       )
     }),
     handler: async (input) => {
-      const { sql, analyze, format, params, hypothetical_indexes } = input;
+      const {
+        sql,
+        analyze: rawAnalyze,
+        format: rawFormat,
+        params,
+        hypothetical_indexes
+      } = input;
+      const analyze = rawAnalyze ?? false;
+      const format = rawFormat ?? "text";
       if (/^\s*EXPLAIN\b/i.test(sql)) {
         return {
           ok: false,
@@ -36898,6 +36968,9 @@ var explainTools = [
       }
       if (format === "text") {
         const lines = rows.map((r) => String(r["QUERY PLAN"] ?? ""));
+        if (result.data.truncated) {
+          lines.push(`... [plan truncated at ${rows.length} lines; raise POSTGRES_MAX_ROWS to see the full plan]`);
+        }
         return { ok: true, data: { plan: lines.join("\n") } };
       }
       const jsonPlan = rows[0]?.["QUERY PLAN"];
@@ -36969,6 +37042,9 @@ var healthTools = [
         ]);
         if (!versionRes.ok) return versionRes;
         const warnings = [];
+        if (versionRes.data?.[0]?.version === void 0) {
+          warnings.push(`version unavailable despite successful query`);
+        }
         if (!sizeRes.ok) warnings.push(`database fetch failed: ${sizeRes.error}`);
         if (!connsRes.ok) warnings.push(`connections fetch failed: ${connsRes.error}`);
         if (!activeRes.ok) warnings.push(`active_queries fetch failed: ${activeRes.error}`);
@@ -37013,7 +37089,7 @@ var queryTools = [
   },
   {
     name: "pg_query",
-    description: "Run a SQL query against the configured PostgreSQL database. Writes are gated by the role in `DATABASE_URL` first and `ALLOW_WRITES` second: a role created with `GRANT pg_read_all_data` makes writes server-rejected regardless of `ALLOW_WRITES`, and is the recommended way to scope agent access. `ALLOW_WRITES=1` is a secondary belt-and-braces gate - useful for managed databases where creating a second role is awkward. For read-only access where you want the guarantee in the tool name, prefer `pg_readonly`. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Dates and UUIDs can be passed as ISO strings. Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
+    description: "Run a SQL query against the configured PostgreSQL database. Postgres itself is the primary safety gate: the role in `DATABASE_URL` enforces what queries can succeed. The recommended posture is a least-privileged role (e.g. one granted `pg_read_all_data`), which makes writes server-rejected regardless of any env var. `ALLOW_WRITES=1` is a secondary belt-and-braces gate - it lifts the in-server `BEGIN READ ONLY` wrapper, but it cannot grant privileges the role lacks. Useful for managed databases where creating a second role is awkward. For read-only access where you want the guarantee in the tool name, prefer `pg_readonly`. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Dates and UUIDs can be passed as ISO strings. Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
     annotations: {
       title: "Run SQL query",
       readOnlyHint: false,
@@ -37173,6 +37249,10 @@ var schemaTools = [
         JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
         JOIN pg_catalog.pg_class cl ON cl.oid = con.confrelid
         JOIN pg_catalog.pg_namespace fn ON fn.oid = cl.relnamespace
+        -- Pairing local conkey[i] to foreign confkey[i] by ordinality relies on
+        -- the postgres invariant that conkey[i] references confkey[i]. unnest
+        -- WITH ORDINALITY preserves array order; reordering or dropping
+        -- WITH ORDINALITY would silently mispair composite-FK columns.
         JOIN LATERAL unnest(con.conkey) WITH ORDINALITY AS u(attnum, attposition) ON TRUE
         JOIN pg_catalog.pg_attribute att ON att.attrelid = con.conrelid AND att.attnum = u.attnum
         JOIN LATERAL unnest(con.confkey) WITH ORDINALITY AS fu(attnum, attposition) ON fu.attposition = u.attposition
@@ -37227,6 +37307,10 @@ var schemaTools = [
         JOIN pg_catalog.pg_namespace srcn ON srcn.oid = src.relnamespace
         JOIN pg_catalog.pg_class ref ON ref.oid = con.confrelid
         JOIN pg_catalog.pg_namespace refn ON refn.oid = ref.relnamespace
+        -- Pairing local conkey[i] to foreign confkey[i] by ordinality relies on
+        -- the postgres invariant that conkey[i] references confkey[i]. unnest
+        -- WITH ORDINALITY preserves array order; reordering or dropping
+        -- WITH ORDINALITY would silently mispair composite-FK columns.
         JOIN LATERAL unnest(con.conkey) WITH ORDINALITY AS u(attnum, attposition) ON TRUE
         JOIN pg_catalog.pg_attribute srcatt ON srcatt.attrelid = con.conrelid AND srcatt.attnum = u.attnum
         JOIN LATERAL unnest(con.confkey) WITH ORDINALITY AS fu(attnum, attposition) ON fu.attposition = u.attposition
@@ -37287,6 +37371,7 @@ var schemaTools = [
         const kind = kindRes.ok ? kindRes.data?.[0]?.kind ?? "table" : "table";
         const warnings = [];
         if (!kindRes.ok) warnings.push(`kind fetch failed, reported as "table": ${kindRes.error}`);
+        else if ((kindRes.data?.length ?? 0) === 0) warnings.push(`kind unavailable, reported as "table"`);
         if (!pk.ok) warnings.push(`primary_key fetch failed: ${pk.error}`);
         if (!fks.ok) warnings.push(`foreign_keys fetch failed: ${fks.error}`);
         if (!idxs.ok) warnings.push(`indexes fetch failed: ${idxs.error}`);
@@ -37610,7 +37695,7 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.6.18" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.6.20" : await readPackageVersion();
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -37627,40 +37712,17 @@ for (const tool of allTools) {
     tool.description,
     tool.inputSchema.shape,
     tool.annotations,
-    async (input) => {
-      try {
-        const result = await tool.handler(input);
-        const response = result;
-        if (!response.ok) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Error: ${response.error || "Unknown error"}`
-              }
-            ],
-            isError: true
-          };
-        }
-        const text = JSON.stringify(response.data ?? { success: true }, null, 2);
-        return {
-          content: [{ type: "text", text }]
-        };
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return {
-          content: [{ type: "text", text: `Error: ${message}` }],
-          isError: true
-        };
-      }
-    }
+    wrapToolHandler(tool.handler)
   );
 }
 var transport = new StdioServerTransport();
 await server.connect(transport);
 var writesNote = isWritesAllowed() ? "writes ENABLED" : "read-only";
 console.error(`@yawlabs/postgres-mcp v${version2} ready (${allTools.length} tools, ${writesNote})`);
+var exiting = false;
 var cleanup = async () => {
+  if (exiting) return;
+  exiting = true;
   try {
     await shutdown();
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.6.18",
+  "version": "0.6.20",
   "mcpName": "io.github.YawLabs/postgres-mcp",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",