domain-rag-mcp-server 3.3.1 → 3.3.2

package/dist/index.mjs

@@ -1712,10 +1712,20 @@ async function handleRawSql(args) {
   if (!normalizedSql.startsWith("select")) {
     return "Error: Only SELECT queries are allowed. Use SELECT to query data.";
   }
-  const dangerousKeywords = ["insert", "update", "delete", "drop", "truncate", "alter", "create", "grant", "revoke"];
-  for (const keyword of dangerousKeywords) {
-    if (normalizedSql.includes(keyword)) {
-      return `Error: Query contains forbidden keyword "${keyword}". Only SELECT queries are allowed.`;
+  const dangerousPatterns = [
+    /\binsert\s+into\b/i,
+    /\bupdate\s+\w+\s+set\b/i,
+    /\bdelete\s+from\b/i,
+    /\bdrop\s+(table|index|database|schema)\b/i,
+    /\btruncate\b/i,
+    /\balter\s+(table|index|database|schema)\b/i,
+    /\bcreate\s+(table|index|database|schema|or)\b/i,
+    /\bgrant\b/i,
+    /\brevoke\b/i
+  ];
+  for (const pattern of dangerousPatterns) {
+    if (pattern.test(normalizedSql)) {
+      return `Error: Query contains forbidden SQL statement. Only SELECT queries are allowed.`;
     }
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domain-rag-mcp-server",
-  "version": "3.3.1",
+  "version": "3.3.2",
   "description": "MCP server for domain RAG search — connects to Qdrant + PostgreSQL + Code Search API for hybrid search across Jira, Confluence, Git commits, and server-side code repositories",
   "type": "module",
   "main": "dist/index.mjs",