db-mcp 1.0.1

package/dist/utils/where-clause.d.ts

@@ -0,0 +1,41 @@
+/**
+ * db-mcp - WHERE Clause Validation
+ *
+ * Validates WHERE clause parameters to prevent SQL injection.
+ * Uses a blocklist approach to reject dangerous patterns while
+ * allowing legitimate complex conditions.
+ *
+ * Adapted from postgres-mcp reference implementation for SQLite.
+ */
+/**
+ * Error thrown when an unsafe WHERE clause is detected
+ */
+export declare class UnsafeWhereClauseError extends Error {
+    constructor(reason: string);
+}
+/**
+ * Validates a WHERE clause for dangerous SQL patterns.
+ *
+ * This function uses a blocklist approach to detect and reject
+ * common SQL injection patterns. It allows legitimate complex
+ * conditions while blocking obvious attack vectors.
+ *
+ * @param where - The WHERE clause to validate
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ *
+ * @example
+ * validateWhereClause("price > 10");                    // OK
+ * validateWhereClause("status = 'active' AND id < 100"); // OK
+ * validateWhereClause("1=1; DROP TABLE users;--");      // Throws
+ * validateWhereClause("1=1 UNION SELECT * FROM sqlite_master"); // Throws
+ */
+export declare function validateWhereClause(where: string): void;
+/**
+ * Validates and returns a safe WHERE clause.
+ *
+ * @param where - The WHERE clause to sanitize
+ * @returns The validated WHERE clause (unchanged if safe)
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ */
+export declare function sanitizeWhereClause(where: string): string;
+//# sourceMappingURL=where-clause.d.ts.map

package/dist/utils/where-clause.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"where-clause.d.ts","sourceRoot":"","sources":["../../src/utils/where-clause.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,MAAM,EAAE,MAAM;CAI3B;AAgED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAUvD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGzD"}

package/dist/utils/where-clause.js

@@ -0,0 +1,116 @@
+/**
+ * db-mcp - WHERE Clause Validation
+ *
+ * Validates WHERE clause parameters to prevent SQL injection.
+ * Uses a blocklist approach to reject dangerous patterns while
+ * allowing legitimate complex conditions.
+ *
+ * Adapted from postgres-mcp reference implementation for SQLite.
+ */
+/**
+ * Error thrown when an unsafe WHERE clause is detected
+ */
+export class UnsafeWhereClauseError extends Error {
+    constructor(reason) {
+        super(`Unsafe WHERE clause: ${reason}`);
+        this.name = "UnsafeWhereClauseError";
+    }
+}
+/**
+ * Dangerous SQL patterns that should never appear in WHERE clauses.
+ * These patterns indicate SQL injection attempts.
+ */
+const DANGEROUS_PATTERNS = [
+    // Statement terminators and new statements
+    {
+        pattern: /;\s*(DROP|DELETE|TRUNCATE|INSERT|UPDATE|CREATE|ALTER|ATTACH|DETACH)/i,
+        reason: "contains statement terminator followed by dangerous keyword",
+    },
+    // Trailing semicolons (potential statement injection)
+    {
+        pattern: /;\s*$/,
+        reason: "contains trailing semicolon",
+    },
+    // SQL comments (can be used to comment out security checks)
+    {
+        pattern: /--/,
+        reason: "contains SQL line comment",
+    },
+    {
+        pattern: /\/\*/,
+        reason: "contains SQL block comment",
+    },
+    // UNION injection (data exfiltration)
+    {
+        pattern: /\bUNION\s+(ALL\s+)?SELECT\b/i,
+        reason: "contains UNION SELECT",
+    },
+    // SQLite-specific: Extension loading (code execution)
+    {
+        pattern: /\bload_extension\s*\(/i,
+        reason: "contains load_extension (code execution)",
+    },
+    // SQLite-specific: ATTACH database (file system access)
+    {
+        pattern: /\bATTACH\s+(DATABASE\s+)?['"`]/i,
+        reason: "contains ATTACH DATABASE (file system access)",
+    },
+    // SQLite-specific: Pragma manipulation
+    {
+        pattern: /\bPRAGMA\s+/i,
+        reason: "contains PRAGMA statement",
+    },
+    // SQLite-specific: writefile/readfile (if using fileio extension)
+    {
+        pattern: /\b(writefile|readfile)\s*\(/i,
+        reason: "contains file I/O function",
+    },
+    // SQLite-specific: fts3_tokenizer (potential code execution)
+    {
+        pattern: /\bfts3_tokenizer\s*\(/i,
+        reason: "contains FTS tokenizer function",
+    },
+    // Generic: Hexadecimal string injection
+    {
+        pattern: /\bX'[0-9A-Fa-f]+'/,
+        reason: "contains hex string literal (potential binary injection)",
+    },
+];
+/**
+ * Validates a WHERE clause for dangerous SQL patterns.
+ *
+ * This function uses a blocklist approach to detect and reject
+ * common SQL injection patterns. It allows legitimate complex
+ * conditions while blocking obvious attack vectors.
+ *
+ * @param where - The WHERE clause to validate
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ *
+ * @example
+ * validateWhereClause("price > 10");                    // OK
+ * validateWhereClause("status = 'active' AND id < 100"); // OK
+ * validateWhereClause("1=1; DROP TABLE users;--");      // Throws
+ * validateWhereClause("1=1 UNION SELECT * FROM sqlite_master"); // Throws
+ */
+export function validateWhereClause(where) {
+    if (!where || typeof where !== "string") {
+        throw new UnsafeWhereClauseError("WHERE clause must be a non-empty string");
+    }
+    for (const { pattern, reason } of DANGEROUS_PATTERNS) {
+        if (pattern.test(where)) {
+            throw new UnsafeWhereClauseError(reason);
+        }
+    }
+}
+/**
+ * Validates and returns a safe WHERE clause.
+ *
+ * @param where - The WHERE clause to sanitize
+ * @returns The validated WHERE clause (unchanged if safe)
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ */
+export function sanitizeWhereClause(where) {
+    validateWhereClause(where);
+    return where;
+}
+//# sourceMappingURL=where-clause.js.map

package/dist/utils/where-clause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"where-clause.js","sourceRoot":"","sources":["../../src/utils/where-clause.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,MAAc;QACxB,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAA0C;IAChE,2CAA2C;IAC3C;QACE,OAAO,EACL,sEAAsE;QACxE,MAAM,EAAE,6DAA6D;KACtE;IACD,sDAAsD;IACtD;QACE,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,6BAA6B;KACtC;IACD,4DAA4D;IAC5D;QACE,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,2BAA2B;KACpC;IACD;QACE,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,4BAA4B;KACrC;IACD,sCAAsC;IACtC;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,uBAAuB;KAChC;IACD,sDAAsD;IACtD;QACE,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,0CAA0C;KACnD;IACD,wDAAwD;IACxD;QACE,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,+CAA+C;KACxD;IACD,uCAAuC;IACvC;QACE,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,2BAA2B;KACpC;IACD,kEAAkE;IAClE;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,4BAA4B;KACrC;IACD,6DAA6D;IAC7D;QACE,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,iCAAiC;KAC1C;IACD,wCAAwC;IACxC;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,0DAA0D;KACnE;CACF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,sBAAsB,CAAC,yCAAyC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "db-mcp",
+  "version": "1.0.1",
+  "description": "SQLite MCP server with OAuth 2.1 authentication, HTTP/SSE transport, and smart tool filtering",
+  "mcpName": "io.github.neverinfamous/db-mcp",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "db-mcp": "./dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "start:stdio": "node dist/cli.js --transport=stdio",
+    "start:http": "node dist/cli.js --transport=http",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "typecheck": "tsc --noEmit",
+    "check": "npm run lint && npm run typecheck",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "clean": "rimraf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "database",
+    "sqlite",
+    "oauth",
+    "ai",
+    "llm"
+  ],
+  "author": "neverinfamous",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/neverinfamous/db-mcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/neverinfamous/db-mcp/issues"
+  },
+  "homepage": "https://github.com/neverinfamous/db-mcp#readme",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.25.2",
+    "cors": "^2.8.5",
+    "dotenv": "^17.2.3",
+    "express": "^5.2.1",
+    "jose": "^6.1.3",
+    "pg": "^8.18.0",
+    "sql.js": "^1.13.0",
+    "zod": "^3.25.0 || ^4.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.2",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
+    "@types/node": "^25.2.0",
+    "@types/pg": "^8.16.0",
+    "@types/sql.js": "^1.4.9",
+    "@vitest/coverage-v8": "^4.0.18",
+    "eslint": "^9.39.2",
+    "globals": "^17.3.0",
+    "rimraf": "^6.1.2",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.54.0",
+    "vitest": "^4.0.17"
+  },
+  "peerDependencies": {
+    "zod": "^3.25.0 || ^4.0.0"
+  },
+  "optionalDependencies": {
+    "better-sqlite3": "^12.6.2"
+  }
+}

package/server.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.neverinfamous/db-mcp",
+  "title": "db-mcp (SQLite MCP Server)",
+  "description": "SQLite MCP server with OAuth 2.1, HTTP/SSE, 122 tools, and smart tool filtering",
+  "version": "1.0.1",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "db-mcp",
+      "version": "1.0.1",
+      "transport": {
+        "type": "stdio"
+      }
+    },
+    {
+      "registryType": "oci",
+      "identifier": "docker.io/writenotenow/db-mcp:v1.0.1",
+      "version": "1.0.1",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ],
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "database",
+    "sqlite",
+    "sql",
+    "oauth",
+    "ai",
+    "llm",
+    "developer-tools",
+    "json",
+    "fts5",
+    "vector-search",
+    "geospatial",
+    "spatialite",
+    "statistical-analysis"
+  ],
+  "author": {
+    "name": "Chris LeRoux",
+    "email": "writenotenow@gmail.com"
+  },
+  "homepage": "https://github.com/neverinfamous/db-mcp",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/neverinfamous/db-mcp.git",
+    "source": "github"
+  },
+  "license": "MIT"
+}