mcp-db-analyzer 0.2.7 → 0.2.8

package/build/analyzers/connections.js

@@ -172,7 +172,8 @@ async function analyzeMysqlConnections() {
         lines.push("| ID | User | Duration (s) | State | Query |");
         lines.push("|-----|------|-------------|-------|-------|");
         for (const row of longQueries.rows) {
-            lines.push(`| ${row.id} | ${row.user} | ${row.time} | ${row.state} | ${row.info} |`);
+            const info = row.info ? row.info.replace(/\|/g, "\\|") : "-";
+            lines.push(`| ${row.id} | ${row.user} | ${row.time} | ${row.state} | ${info} |`);
         }
         lines.push("");
     }

package/build/db-sqlite.js

@@ -11,6 +11,9 @@ export function createSqliteAdapter() {
             }
             db = new Database(dbPath, { readonly: true });
             db.pragma("journal_mode = WAL");
+            // Enforce read-only at the SQL engine level, not just at the file level.
+            // This prevents any write attempt from succeeding even if the OS permits it.
+            db.pragma("query_only = ON");
         }
         return db;
     }

package/build/errors.js

@@ -4,7 +4,11 @@
  */
 export function formatToolError(context, err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const sanitized = msg.replace(/\/\/[^@]+@/g, "//****:****@");
+    // Sanitize URL-style credentials (postgresql://user:pass@host) and
+    // key-value style passwords (password=secret) used by libpq and JDBC.
+    const sanitized = msg
+        .replace(/\/\/[^@]+@/g, "//****:****@")
+        .replace(/\bpassword\s*=\s*\S+/gi, "password=****");
     const isConnectionError = /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|EHOSTUNREACH|getaddrinfo|connect ECONNRESET|password authentication failed|Access denied|no pg_hba\.conf|connection refused|Connection lost|SQLITE_CANTOPEN/i.test(msg);
     if (isConnectionError) {
         return `Error ${context}: ${sanitized}\n\nThis looks like a database connection issue. Check your configuration:\n- Set DATABASE_URL environment variable with a valid connection string\n- Or use driver-specific variables (PGHOST, MYSQL_HOST, SQLITE_PATH)\n- Ensure the database server is running and accessible`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-db-analyzer",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "MCP server for PostgreSQL, MySQL, and SQLite schema analysis, index optimization, and query plan inspection",
   "mcpName": "io.github.dmitriusan/mcp-db-analyzer",
   "author": "Dmytro Lisnichenko",