@yawlabs/postgres-mcp 0.6.4 → 0.6.6

package/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.6] - 2026-05-16
+
+### Docs
+- `pg_table_privileges` description now flags the visibility caveat:
+  `information_schema.table_privileges` is filtered by what the calling role
+  can see, so a least-privileged role may miss grants involving unrelated
+  third-party roles. Recommends superuser or `pg_read_all_data` for a
+  complete picture.
+- `pg_inspect_locks` description now documents the row shape: one row per
+  (blocked_pid, blocking_pid) pair, so a session waiting on multiple
+  blockers appears on multiple rows. Suggests grouping by `blocked_pid`
+  for a per-blocked-session count.
+
+## [0.6.5] - 2026-05-15
+
+### Fixed
+- `pg_explain` now returns an explicit error if EXPLAIN comes back with zero
+  rows instead of a misleading `{plan: ""}` (text) or `{plan: undefined}`
+  (json) payload. Pathological in practice -- EXPLAIN always returns at least
+  one row -- but the response shape is now tight either way.
+
+### Docs
+- `pg_kill` description clarifies that `pg_signal_backend` does NOT authorize
+  signalling a superuser-owned backend; only a superuser can signal another
+  superuser's session. The `note` field already disambiguated post-hoc; the
+  description now matches.
+
 ## [0.6.3] - 2026-05-15
 
 ### Infrastructure

package/dist/index.js

@@ -36361,7 +36361,7 @@ var identSchema = external_exports.string().min(1).max(63).refine((v) => Buffer.
 var adminTools = [
   {
     name: "pg_inspect_locks",
-    description: "Show current lock contention: which sessions are blocked and who is blocking them. Returns blocked PID, blocking PID, lock types, relation being contested, and the queries involved. Use this first when a tool call hangs or the app feels stuck - it's the fastest way to identify a long-held transaction holding a lock.",
+    description: "Show current lock contention: which sessions are blocked and who is blocking them. Returns blocked PID, blocking PID, lock types, relation being contested, and the queries involved. Use this first when a tool call hangs or the app feels stuck - it's the fastest way to identify a long-held transaction holding a lock. Row shape: one row per (blocked_pid, blocking_pid) pair. A session waiting on multiple blockers appears on multiple rows -- group/deduplicate by `blocked_pid` if you want a per-blocked-session count.",
     annotations: {
       title: "Inspect blocking locks",
       readOnlyHint: true,
@@ -36447,7 +36447,7 @@ var adminTools = [
   },
   {
     name: "pg_table_privileges",
-    description: "Show which roles have which privileges (SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER) on a table or on every table in a schema. If `table` is omitted, the result spans every table in `schema`, ordered by table then grantee. Use this to answer 'who can write to this table?' or to audit schema-wide access before a migration.",
+    description: "Show which roles have which privileges (SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER) on a table or on every table in a schema. If `table` is omitted, the result spans every table in `schema`, ordered by table then grantee. Use this to answer 'who can write to this table?' or to audit schema-wide access before a migration. Visibility caveat: backed by `information_schema.table_privileges`, which postgres filters by what the calling role can see. A least-privileged role may not see grants involving unrelated third-party roles. For a complete picture, run as a superuser or a member of `pg_read_all_data`.",
     annotations: {
       title: "Show table privileges",
       readOnlyHint: true,
@@ -36480,7 +36480,7 @@ var adminTools = [
   },
   {
     name: "pg_kill",
-    description: "Cancel a running query (SIGINT-equivalent) or terminate a backend connection (SIGTERM-equivalent) by PID. Find the PID via `pg_health` active_queries or `pg_inspect_locks`. Requires ALLOW_WRITES=1 since this changes database session state. The role in DATABASE_URL must have permission - cancelling another user's query needs the `pg_signal_backend` role or superuser. Cancel is graceful; terminate is forceful.",
+    description: "Cancel a running query (SIGINT-equivalent) or terminate a backend connection (SIGTERM-equivalent) by PID. Find the PID via `pg_health` active_queries or `pg_inspect_locks`. Requires ALLOW_WRITES=1 since this changes database session state. The role in DATABASE_URL must have permission - cancelling another user's query needs the `pg_signal_backend` role or superuser. Note: `pg_signal_backend` does NOT cover superuser-owned backends - only a superuser can signal another superuser's session. Cancel is graceful; terminate is forceful.",
     annotations: {
       title: "Cancel or terminate a backend",
       readOnlyHint: false,
@@ -36833,6 +36833,9 @@ var explainTools = [
       if (!result.ok) return result;
       const data = result.data;
       const rows = data?.rows ?? [];
+      if (rows.length === 0) {
+        return { ok: false, error: "EXPLAIN returned no rows; unable to produce a plan." };
+      }
       if (format === "text") {
         const lines = rows.map((r) => String(r["QUERY PLAN"] ?? ""));
         return { ok: true, data: { plan: lines.join("\n") } };
@@ -37547,7 +37550,7 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.6.4" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.6.6" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "mcpName": "io.github.YawLabs/postgres-mcp",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",