easy-mysql-admin-mcp 0.1.0

package/README.md

@@ -0,0 +1,126 @@
+# easy-mysql-admin-mcp
+
+High-privilege MySQL admin MCP server for database and user/grant management.
+
+## Features
+
+- List, create, and inspect databases
+- List, create, and update users
+- Grant and revoke privileges at database scope
+- Protect destructive actions with short-lived confirmation tokens
+
+## Available Tools
+
+| Tool | Description |
+| --- | --- |
+| `mysql_list_databases` | List databases in the current MySQL instance |
+| `mysql_create_database` | Create a database |
+| `mysql_describe_database` | Inspect database charset and collation settings |
+| `mysql_drop_database` | Request database deletion and return a confirmation token |
+| `mysql_list_users` | List MySQL users |
+| `mysql_create_user` | Create a MySQL user |
+| `mysql_alter_user_password` | Change a MySQL user password |
+| `mysql_grant_privileges` | Grant database privileges to a user |
+| `mysql_revoke_privileges` | Revoke database privileges from a user |
+| `mysql_show_grants` | Show grants for a user |
+| `mysql_drop_user` | Request user deletion and return a confirmation token |
+| `mysql_confirm_task` | Confirm and execute a destructive action token |
+
+## Safety
+
+- No raw SQL passthrough
+- No table, view, index, or trigger management
+- `DROP DATABASE` and `DROP USER` require `mysql_confirm_task`
+- Confirmation tokens are random, single-use, and expire quickly
+
+## Configuration
+
+Use environment variables, matching the rest of the `easy-*-mcp` family.
+
+| Variable | Required | Default | Description |
+| --- | --- | --- | --- |
+| `MYSQL_HOST` | Yes | - | MySQL host name or IP address |
+| `MYSQL_PORT` | No | `3306` | MySQL port |
+| `MYSQL_USER` | Yes | - | MySQL user name |
+| `MYSQL_PASSWORD` | Yes | - | MySQL password |
+| `MYSQL_DATABASE` | Yes | - | Default database/schema used for the admin connection |
+| `MYSQL_CONNECTION_LIMIT` | No | `10` | Maximum number of active pool connections |
+| `MYSQL_MAX_IDLE` | No | `10` | Maximum number of idle pool connections |
+| `MYSQL_IDLE_TIMEOUT` | No | `60000` | Idle connection timeout in milliseconds |
+| `MYSQL_QUEUE_LIMIT` | No | `0` | Maximum queued connection requests |
+| `MYSQL_WAIT_FOR_CONNECTIONS` | No | `true` | Whether the pool waits when all connections are busy |
+| `MYSQL_ENABLE_KEEP_ALIVE` | No | `true` | Whether TCP keep-alive is enabled |
+| `MYSQL_KEEP_ALIVE_INITIAL_DELAY` | No | `0` | Initial TCP keep-alive delay in milliseconds |
+| `MYSQL_ADMIN_TOKEN_TTL_SECONDS` | No | `120` | Confirmation token lifetime in seconds |
+
+## Example
+
+```env
+MYSQL_HOST=localhost
+MYSQL_PORT=3306
+MYSQL_USER=root
+MYSQL_PASSWORD=your_password
+MYSQL_DATABASE=mysql
+MYSQL_ADMIN_TOKEN_TTL_SECONDS=120
+```
+
+## Claude Desktop Example
+
+```json
+{
+  "mcpServers": {
+    "easy-mysql-admin-mcp": {
+      "command": "npx",
+      "args": ["-y", "easy-mysql-admin-mcp"],
+      "env": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_PORT": "3306",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "your_password",
+        "MYSQL_DATABASE": "mysql",
+        "MYSQL_ADMIN_TOKEN_TTL_SECONDS": "120"
+      }
+    }
+  }
+}
+```
+
+## Codex config.toml Example
+
+```
+[mcp_servers.easy-mysql-admin-mcp]
+args = ["-y", "easy-mysql-admin-mcp"]
+command = "npx"
+enabled = true
+
+[mcp_servers.easy-mysql-admin-mcp.env]
+MYSQL_HOST = "localhost"
+MYSQL_PORT = "3306"
+MYSQL_USER = "root"
+MYSQL_PASSWORD = "your_password"
+MYSQL_DATABASE = "mysql"
+MYSQL_ADMIN_TOKEN_TTL_SECONDS = "120"
+```
+
+## OpenCode opencode.jsonc Example
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "easy-mysql-admin-mcp": {
+      "type": "local",
+      "command": ["npx", "-y", "easy-mysql-admin-mcp"],
+      "enabled": true,
+      "environment": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_PORT": "3306",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "your_password",
+        "MYSQL_DATABASE": "mysql",
+        "MYSQL_ADMIN_TOKEN_TTL_SECONDS": "120",
+      },
+    },
+  },
+}
+```

package/README.zh-TW.md

@@ -0,0 +1,96 @@
+# easy-mysql-admin-mcp
+
+一個高權限的 MySQL 管理型 MCP server，專門處理 database 與使用者/權限管理。
+
+這個專案的定位是 DBA 類工具，不提供任意 SQL 執行，也不重複處理 table、view、index、trigger 這些已由 `easy-mysql-mcp` 提供的能力。
+
+## 功能
+
+- 列出、建立、檢視 database
+- 列出、建立、修改 MySQL 使用者
+- 授權與撤權
+- 對危險刪除操作提供短效確認 token
+
+## 可用工具
+
+| 工具 | 說明 |
+| --- | --- |
+| `mysql_list_databases` | 列出目前 MySQL instance 內的 databases |
+| `mysql_create_database` | 建立 database |
+| `mysql_describe_database` | 檢視 database 的 charset 與 collation 設定 |
+| `mysql_drop_database` | 提出刪除 database 的請求並回傳確認 token |
+| `mysql_list_users` | 列出 MySQL users |
+| `mysql_create_user` | 建立 MySQL user |
+| `mysql_alter_user_password` | 修改 MySQL user 密碼 |
+| `mysql_grant_privileges` | 對 user 授權 database privileges |
+| `mysql_revoke_privileges` | 取消 user 的 database privileges |
+| `mysql_show_grants` | 顯示指定 user 的 grants |
+| `mysql_drop_user` | 提出刪除 user 的請求並回傳確認 token |
+| `mysql_confirm_task` | 確認並執行先前產生的危險操作 token |
+
+## 安全性
+
+- 不提供原始 SQL passthrough
+- 不處理 table、view、index、trigger 管理
+- `DROP DATABASE` 與 `DROP USER` 一律要經過 `mysql_confirm_task`
+- confirmation token 是隨機產生、只能使用一次、且會在短時間後過期
+
+## 設定
+
+請使用環境變數設定，風格與其他 `easy-*-mcp` 專案一致。
+
+| 變數 | 必填 | 預設值 | 說明 |
+| --- | --- | --- | --- |
+| `MYSQL_HOST` | 是 | - | MySQL host name 或 IP address |
+| `MYSQL_PORT` | 否 | `3306` | MySQL port |
+| `MYSQL_USER` | 是 | - | MySQL 使用者名稱 |
+| `MYSQL_PASSWORD` | 是 | - | MySQL 密碼 |
+| `MYSQL_DATABASE` | 是 | - | 管理連線所使用的預設 database/schema |
+| `MYSQL_CONNECTION_LIMIT` | 否 | `10` | pool 最大 active connections |
+| `MYSQL_MAX_IDLE` | 否 | `10` | pool 最大 idle connections |
+| `MYSQL_IDLE_TIMEOUT` | 否 | `60000` | idle connection timeout，單位毫秒 |
+| `MYSQL_QUEUE_LIMIT` | 否 | `0` | 最大 queued connection requests |
+| `MYSQL_WAIT_FOR_CONNECTIONS` | 否 | `true` | connection 滿時是否等待 |
+| `MYSQL_ENABLE_KEEP_ALIVE` | 否 | `true` | 是否啟用 TCP keep-alive |
+| `MYSQL_KEEP_ALIVE_INITIAL_DELAY` | 否 | `0` | TCP keep-alive 初始延遲，單位毫秒 |
+| `MYSQL_ADMIN_TOKEN_TTL_SECONDS` | 否 | `120` | confirmation token 的有效秒數 |
+
+## 範例
+
+```env
+MYSQL_HOST=localhost
+MYSQL_PORT=3306
+MYSQL_USER=root
+MYSQL_PASSWORD=your_password
+MYSQL_DATABASE=mysql
+MYSQL_ADMIN_TOKEN_TTL_SECONDS=120
+```
+
+## Claude Desktop 範例
+
+```json
+{
+  "mcpServers": {
+    "easy-mysql-admin-mcp": {
+      "command": "npx",
+      "args": ["-y", "easy-mysql-admin-mcp"],
+      "env": {
+        "MYSQL_HOST": "localhost",
+        "MYSQL_PORT": "3306",
+        "MYSQL_USER": "root",
+        "MYSQL_PASSWORD": "your_password",
+        "MYSQL_DATABASE": "mysql",
+        "MYSQL_ADMIN_TOKEN_TTL_SECONDS": "120"
+      }
+    }
+  }
+}
+```
+
+更新設定後，請重新啟動 Claude Desktop。
+
+## 備註
+
+- `mysql_drop_database` 與 `mysql_drop_user` 不會直接執行
+- 這兩個動作會先產生 token，使用者確認後才會透過 `mysql_confirm_task` 真正執行
+- token 是短效且單次使用，不會保留成長期 pending queue

package/build/config.d.ts

@@ -0,0 +1,18 @@
+export type AdminConfig = {
+    mysql: {
+        host: string;
+        port: number;
+        user: string;
+        password: string;
+        database: string;
+        connectionLimit: number;
+        maxIdle: number;
+        idleTimeout: number;
+        queueLimit: number;
+        waitForConnections: boolean;
+        enableKeepAlive: boolean;
+        keepAliveInitialDelay: number;
+    };
+    tokenTtlSeconds: number;
+};
+export declare function parseAdminConfig(env: NodeJS.ProcessEnv): AdminConfig;

package/build/config.js

@@ -0,0 +1,28 @@
+function parsePositiveInt(value, defaultValue) {
+    const parsed = value ? Number.parseInt(value, 10) : NaN;
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : defaultValue;
+}
+function parseBoolean(value, defaultValue = true) {
+    if (value === undefined)
+        return defaultValue;
+    return value.toLowerCase() !== 'false';
+}
+export function parseAdminConfig(env) {
+    return {
+        mysql: {
+            host: env.MYSQL_HOST ?? '',
+            port: parsePositiveInt(env.MYSQL_PORT, 3306),
+            user: env.MYSQL_USER ?? '',
+            password: env.MYSQL_PASSWORD ?? '',
+            database: env.MYSQL_DATABASE ?? '',
+            connectionLimit: parsePositiveInt(env.MYSQL_CONNECTION_LIMIT, 10),
+            maxIdle: parsePositiveInt(env.MYSQL_MAX_IDLE, 10),
+            idleTimeout: parsePositiveInt(env.MYSQL_IDLE_TIMEOUT, 60000),
+            queueLimit: env.MYSQL_QUEUE_LIMIT ? Number.parseInt(env.MYSQL_QUEUE_LIMIT, 10) : 0,
+            waitForConnections: parseBoolean(env.MYSQL_WAIT_FOR_CONNECTIONS, true),
+            enableKeepAlive: parseBoolean(env.MYSQL_ENABLE_KEEP_ALIVE, true),
+            keepAliveInitialDelay: env.MYSQL_KEEP_ALIVE_INITIAL_DELAY ? Number.parseInt(env.MYSQL_KEEP_ALIVE_INITIAL_DELAY, 10) : 0,
+        },
+        tokenTtlSeconds: parsePositiveInt(env.MYSQL_ADMIN_TOKEN_TTL_SECONDS, 120),
+    };
+}

package/build/confirmationStore.d.ts

@@ -0,0 +1,18 @@
+export type ConfirmationAction = 'drop_database' | 'drop_user';
+export type ConfirmationTask = {
+    action: ConfirmationAction;
+    target: string;
+    createdAt: number;
+    expiresAt: number;
+    used: boolean;
+};
+export type ConfirmationStore = {
+    create(task: {
+        action: ConfirmationAction;
+        target: string;
+    }): string;
+    consume(token: string): ConfirmationTask | undefined;
+};
+export declare function createConfirmationStore(options: {
+    defaultTtlMs: number;
+}): ConfirmationStore;

package/build/confirmationStore.js

@@ -0,0 +1,31 @@
+import { randomUUID } from 'node:crypto';
+export function createConfirmationStore(options) {
+    const tasks = new Map();
+    return {
+        create(task) {
+            const token = randomUUID();
+            const now = Date.now();
+            tasks.set(token, {
+                action: task.action,
+                target: task.target,
+                createdAt: now,
+                expiresAt: now + options.defaultTtlMs,
+                used: false,
+            });
+            return token;
+        },
+        consume(token) {
+            const task = tasks.get(token);
+            if (!task) {
+                return undefined;
+            }
+            if (task.used || task.expiresAt <= Date.now()) {
+                tasks.delete(token);
+                return undefined;
+            }
+            task.used = true;
+            tasks.delete(token);
+            return task;
+        },
+    };
+}

package/build/databaseTools.d.ts

@@ -0,0 +1,5 @@
+export type DatabaseInfo = {
+    name: string;
+    defaultCharacterSetName?: string;
+    defaultCollationName?: string;
+};

package/build/databaseTools.js

@@ -0,0 +1 @@
+export {};

package/build/db.d.ts

@@ -0,0 +1,2 @@
+import { type Pool } from 'mysql2/promise';
+export declare function getPool(): Pool;

package/build/db.js

@@ -0,0 +1,28 @@
+import mysql from 'mysql2/promise';
+import { parseAdminConfig } from './config.js';
+let pool;
+export function getPool() {
+    if (pool) {
+        return pool;
+    }
+    const config = parseAdminConfig(process.env);
+    if (!config.mysql.host || !config.mysql.user || !config.mysql.password || !config.mysql.database) {
+        throw new Error('Missing required environment variables for MySQL admin connection.');
+    }
+    pool = mysql.createPool({
+        host: config.mysql.host,
+        port: config.mysql.port,
+        user: config.mysql.user,
+        password: config.mysql.password,
+        database: config.mysql.database,
+        multipleStatements: false,
+        waitForConnections: config.mysql.waitForConnections,
+        connectionLimit: config.mysql.connectionLimit,
+        maxIdle: config.mysql.maxIdle,
+        idleTimeout: config.mysql.idleTimeout,
+        queueLimit: config.mysql.queueLimit,
+        enableKeepAlive: config.mysql.enableKeepAlive,
+        keepAliveInitialDelay: config.mysql.keepAliveInitialDelay,
+    });
+    return pool;
+}

package/build/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/build/index.js

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { parseAdminConfig } from './config.js';
+import { createConfirmationStore } from './confirmationStore.js';
+import { getPool } from './db.js';
+import { createAdminHandlers } from './toolHandlers.js';
+const config = parseAdminConfig(process.env);
+const store = createConfirmationStore({ defaultTtlMs: config.tokenTtlSeconds * 1000 });
+getPool();
+const handlers = createAdminHandlers(store, config.tokenTtlSeconds);
+const server = new McpServer({
+    name: 'easy-mysql-admin-mcp',
+    version: '0.1.0',
+    description: `MySQL Admin: ${config.mysql.host}:${config.mysql.port}/${config.mysql.database}`,
+});
+server.registerTool('mysql_list_databases', {
+    description: 'List databases in the current MySQL instance.',
+    inputSchema: z.object({}),
+}, async () => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.listDatabases(), null, 2) }],
+}));
+server.registerTool('mysql_create_database', {
+    description: 'Create a database.',
+    inputSchema: z.object({
+        database: z.string().min(1),
+    }),
+}, async ({ database }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.createDatabase(database), null, 2) }],
+}));
+server.registerTool('mysql_describe_database', {
+    description: 'Inspect a database definition.',
+    inputSchema: z.object({
+        database: z.string().min(1),
+    }),
+}, async ({ database }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.describeDatabase(database), null, 2) }],
+}));
+server.registerTool('mysql_drop_database', {
+    description: 'Request database deletion and return a short-lived confirmation token.',
+    inputSchema: z.object({
+        database: z.string().min(1),
+    }),
+}, async ({ database }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.dropDatabase(database), null, 2) }],
+}));
+server.registerTool('mysql_list_users', {
+    description: 'List MySQL users.',
+    inputSchema: z.object({}),
+}, async () => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.listUsers(), null, 2) }],
+}));
+server.registerTool('mysql_create_user', {
+    description: 'Create a MySQL user.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+        password: z.string().min(1),
+    }),
+}, async ({ user, host, password }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.createUser({ user, host, password }), null, 2) }],
+}));
+server.registerTool('mysql_alter_user_password', {
+    description: 'Change a MySQL user password.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+        password: z.string().min(1),
+    }),
+}, async ({ user, host, password }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.alterUserPassword({ user, host, password }), null, 2) }],
+}));
+server.registerTool('mysql_grant_privileges', {
+    description: 'Grant privileges on a database to a user.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+        database: z.string().min(1),
+        privileges: z.array(z.string().min(1)).min(1),
+        withGrantOption: z.boolean().optional(),
+    }),
+}, async ({ user, host, database, privileges, withGrantOption }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.grantPrivileges({ user, host, database, privileges, withGrantOption }), null, 2) }],
+}));
+server.registerTool('mysql_revoke_privileges', {
+    description: 'Revoke privileges on a database from a user.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+        database: z.string().min(1),
+        privileges: z.array(z.string().min(1)).min(1),
+    }),
+}, async ({ user, host, database, privileges }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.revokePrivileges({ user, host, database, privileges }), null, 2) }],
+}));
+server.registerTool('mysql_show_grants', {
+    description: 'Show grants for a user.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+    }),
+}, async ({ user, host }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.showGrants({ user, host }), null, 2) }],
+}));
+server.registerTool('mysql_drop_user', {
+    description: 'Request user deletion and return a short-lived confirmation token.',
+    inputSchema: z.object({
+        user: z.string().min(1),
+        host: z.string().min(1),
+    }),
+}, async ({ user, host }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.dropUser({ user, host }), null, 2) }],
+}));
+server.registerTool('mysql_confirm_task', {
+    description: 'Confirm and execute a previously issued destructive action token.',
+    inputSchema: z.object({
+        token: z.string().min(1),
+    }),
+}, async ({ token }) => ({
+    content: [{ type: 'text', text: JSON.stringify(await handlers.confirmTask(token), null, 2) }],
+}));
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('easy-mysql-admin-mcp running on stdio');
+}
+main().catch((error) => {
+    console.error('Fatal error in main():', error);
+    process.exit(1);
+});

package/build/toolHandlers.d.ts

@@ -0,0 +1,107 @@
+import type { ConfirmationStore } from './confirmationStore.js';
+export type ErrorPayload = {
+    error: string;
+    code?: string;
+};
+export type DatabaseRecord = {
+    name: string;
+    defaultCharacterSetName: string | null;
+    defaultCollationName: string | null;
+};
+export type UserRecord = {
+    user: string;
+    host: string;
+};
+export declare function formatError(error: unknown, code?: string): ErrorPayload;
+export declare function createAdminHandlers(store: ConfirmationStore, tokenTtlSeconds: number): {
+    listDatabases: () => Promise<DatabaseRecord[]>;
+    createDatabase: (database: string) => Promise<{
+        ok: boolean;
+        database: string;
+    }>;
+    describeDatabase: (database: string) => Promise<DatabaseRecord[]>;
+    dropDatabase: (database: string) => Promise<{
+        status: string;
+        token: string;
+        expiresInSeconds: number;
+    }>;
+    listUsers: () => Promise<UserRecord[]>;
+    createUser: (input: {
+        user: string;
+        host: string;
+        password: string;
+    }) => Promise<{
+        ok: boolean;
+        user: string;
+        host: string;
+    }>;
+    alterUserPassword: (input: {
+        user: string;
+        host: string;
+        password: string;
+    }) => Promise<{
+        ok: boolean;
+        user: string;
+        host: string;
+    }>;
+    grantPrivileges: (input: {
+        user: string;
+        host: string;
+        database: string;
+        privileges: string[];
+        withGrantOption?: boolean;
+    }) => Promise<{
+        database: string;
+        privileges: string[];
+        withGrantOption: boolean;
+        user: string;
+        host: string;
+        ok: boolean;
+    }>;
+    revokePrivileges: (input: {
+        user: string;
+        host: string;
+        database: string;
+        privileges: string[];
+    }) => Promise<{
+        database: string;
+        privileges: string[];
+        user: string;
+        host: string;
+        ok: boolean;
+    }>;
+    showGrants: (input: {
+        user: string;
+        host: string;
+    }) => Promise<Record<string, string>[]>;
+    dropUser: (input: {
+        user: string;
+        host: string;
+    }) => Promise<{
+        status: string;
+        token: string;
+        expiresInSeconds: number;
+    }>;
+    confirmTask: (token: string) => Promise<{
+        status: string;
+        error: string;
+        code: string;
+        ok?: undefined;
+        action?: undefined;
+        target?: undefined;
+    } | {
+        status: string;
+        ok: boolean;
+        action: "drop_database";
+        target: string;
+        error?: undefined;
+        code?: undefined;
+    } | {
+        status: string;
+        ok: boolean;
+        action: "drop_user";
+        target: string;
+        error?: undefined;
+        code?: undefined;
+    }>;
+};

package/build/toolHandlers.js

@@ -0,0 +1,95 @@
+import mysql from 'mysql2';
+import { getPool } from './db.js';
+import { formatUserHost, parsePrivilegeList, parseUserIdentity, validateDatabaseName } from './validation.js';
+export function formatError(error, code = 'ADMIN_OPERATION_FAILED') {
+    return {
+        error: error instanceof Error ? error.message : String(error),
+        code,
+    };
+}
+export function createAdminHandlers(store, tokenTtlSeconds) {
+    const pool = getPool();
+    return {
+        listDatabases: async () => {
+            const [rows] = await pool.execute(`
+        SELECT schema_name AS name, default_character_set_name AS defaultCharacterSetName, default_collation_name AS defaultCollationName
+        FROM information_schema.schemata
+        ORDER BY schema_name
+      `);
+            return rows;
+        },
+        createDatabase: async (database) => {
+            const safeName = validateDatabaseName(database);
+            await pool.execute(`CREATE DATABASE ${pool.escapeId(safeName)}`);
+            return { ok: true, database: safeName };
+        },
+        describeDatabase: async (database) => {
+            const safeName = validateDatabaseName(database);
+            const [rows] = await pool.execute(`SELECT schema_name AS name, default_character_set_name AS defaultCharacterSetName, default_collation_name AS defaultCollationName
+         FROM information_schema.schemata
+         WHERE schema_name = ?`, [safeName]);
+            return rows;
+        },
+        dropDatabase: async (database) => {
+            const safeName = validateDatabaseName(database);
+            const token = store.create({ action: 'drop_database', target: safeName });
+            return { status: 'confirmation_required', token, expiresInSeconds: tokenTtlSeconds };
+        },
+        listUsers: async () => {
+            const [rows] = await pool.execute(`
+        SELECT user, host
+        FROM mysql.user
+        ORDER BY user, host
+      `);
+            return rows;
+        },
+        createUser: async (input) => {
+            const { user, host } = parseUserIdentity(input);
+            await pool.execute(`CREATE USER ${formatUserHost(user, host)} IDENTIFIED BY ${mysql.escape(input.password)}`);
+            return { ok: true, user, host };
+        },
+        alterUserPassword: async (input) => {
+            const { user, host } = parseUserIdentity(input);
+            await pool.execute(`ALTER USER ${formatUserHost(user, host)} IDENTIFIED BY ${mysql.escape(input.password)}`);
+            return { ok: true, user, host };
+        },
+        grantPrivileges: async (input) => {
+            const identity = parseUserIdentity(input);
+            const safeDatabase = validateDatabaseName(input.database);
+            const privileges = parsePrivilegeList(input.privileges).join(', ');
+            const grantOption = input.withGrantOption ? ' WITH GRANT OPTION' : '';
+            await pool.execute(`GRANT ${privileges} ON ${pool.escapeId(safeDatabase)}.* TO ${formatUserHost(identity.user, identity.host)}${grantOption}`);
+            return { ok: true, ...identity, database: safeDatabase, privileges: input.privileges, withGrantOption: Boolean(input.withGrantOption) };
+        },
+        revokePrivileges: async (input) => {
+            const identity = parseUserIdentity(input);
+            const safeDatabase = validateDatabaseName(input.database);
+            const privileges = parsePrivilegeList(input.privileges).join(', ');
+            await pool.execute(`REVOKE ${privileges} ON ${pool.escapeId(safeDatabase)}.* FROM ${formatUserHost(identity.user, identity.host)}`);
+            return { ok: true, ...identity, database: safeDatabase, privileges: input.privileges };
+        },
+        showGrants: async (input) => {
+            const { user, host } = parseUserIdentity(input);
+            const [rows] = await pool.execute(`SHOW GRANTS FOR ${formatUserHost(user, host)}`);
+            return rows;
+        },
+        dropUser: async (input) => {
+            const { user, host } = parseUserIdentity(input);
+            const token = store.create({ action: 'drop_user', target: `${user}@${host}` });
+            return { status: 'confirmation_required', token, expiresInSeconds: tokenTtlSeconds };
+        },
+        confirmTask: async (token) => {
+            const task = store.consume(token);
+            if (!task) {
+                return { status: 'error', error: 'token not found or expired', code: 'TOKEN_INVALID' };
+            }
+            if (task.action === 'drop_database') {
+                await pool.execute(`DROP DATABASE ${pool.escapeId(task.target)}`);
+                return { status: 'confirmed', ok: true, action: task.action, target: task.target };
+            }
+            const [user, host] = task.target.split('@');
+            await pool.execute(`DROP USER ${formatUserHost(user, host)}`);
+            return { status: 'confirmed', ok: true, action: task.action, target: task.target };
+        },
+    };
+}

package/build/userTools.d.ts

@@ -0,0 +1,4 @@
+export type UserIdentity = {
+    user: string;
+    host: string;
+};

package/build/userTools.js

@@ -0,0 +1 @@
+export {};

package/build/validation.d.ts

@@ -0,0 +1,10 @@
+export declare function validateDatabaseName(name: string): string;
+export declare function parseUserIdentity(input: {
+    user: string;
+    host: string;
+}): {
+    user: string;
+    host: string;
+};
+export declare function parsePrivilegeList(input: string[]): string[];
+export declare function formatUserHost(user: string, host: string): string;

package/build/validation.js

@@ -0,0 +1,25 @@
+import mysql from 'mysql2';
+const VALID_PRIVILEGES = new Set(['SELECT', 'INSERT', 'UPDATE', 'DELETE', 'CREATE', 'ALTER', 'DROP', 'INDEX', 'EXECUTE', 'REFERENCES']);
+export function validateDatabaseName(name) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error('invalid database name');
+    }
+    return name;
+}
+export function parseUserIdentity(input) {
+    if (!input.user || !input.host) {
+        throw new Error('invalid user identity');
+    }
+    return { user: input.user, host: input.host };
+}
+export function parsePrivilegeList(input) {
+    for (const privilege of input) {
+        if (!VALID_PRIVILEGES.has(privilege)) {
+            throw new Error(`invalid privilege: ${privilege}`);
+        }
+    }
+    return input;
+}
+export function formatUserHost(user, host) {
+    return `${mysql.escape(user)}@${mysql.escape(host)}`;
+}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "easy-mysql-admin-mcp",
+  "version": "0.1.0",
+  "description": "High privilege MySQL admin MCP server for database and user management",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "mysql",
+    "database",
+    "admin",
+    "dba",
+    "claude",
+    "codex",
+    "opencode"
+  ],
+  "homepage": "https://github.com/chenkumi/easy-mysql-admin-mcp#readme",
+  "bugs": {
+    "url": "https://github.com/chenkumi/easy-mysql-admin-mcp/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chenkumi/easy-mysql-admin-mcp.git"
+  },
+  "license": "MIT",
+  "author": "Chenkumi",
+  "type": "module",
+  "main": "build/index.js",
+  "types": "./build/index.d.ts",
+  "bin": {
+    "easy-mysql-admin-mcp": "build/index.js"
+  },
+  "directories": {
+    "test": "test"
+  },
+  "files": [
+    "build",
+    "README.md",
+    "README.zh-TW.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node build/index.js",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "mysql2": "^3.22.5",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.3",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}