mcp-db-analyzer 0.2.7 → 0.2.9

package/build/analyzers/connections.js

@@ -172,7 +172,8 @@ async function analyzeMysqlConnections() {
         lines.push("| ID | User | Duration (s) | State | Query |");
         lines.push("|-----|------|-------------|-------|-------|");
         for (const row of longQueries.rows) {
-            lines.push(`| ${row.id} | ${row.user} | ${row.time} | ${row.state} | ${row.info} |`);
+            const info = row.info ? row.info.replace(/\|/g, "\\|") : "-";
+            lines.push(`| ${row.id} | ${row.user} | ${row.time} | ${row.state} | ${info} |`);
         }
         lines.push("");
     }

package/build/analyzers/schema.js

@@ -56,7 +56,10 @@ async function listTablesSqlite() {
     lines.push("|-------|-------------|------------|");
     for (const row of result.rows) {
         // SQLite doesn't have built-in row count or size — use count
-        const countResult = await query(`SELECT count(*) as cnt FROM "${row.name}"`);
+        // Escape embedded double-quote characters so table names like `weird"table` don't
+        // break the identifier quoting (same convention used in inspectTableSqlite).
+        const escapedName = row.name.replace(/"/g, '""');
+        const countResult = await query(`SELECT count(*) as cnt FROM "${escapedName}"`);
         const cnt = countResult.rows[0]?.cnt ?? 0;
         lines.push(`| ${row.name} | ${cnt} | - |`);
     }

package/build/analyzers/vacuum.js

@@ -35,15 +35,29 @@ export async function analyzeVacuum(schema = "public") {
     if (stats.rows.length === 0) {
         return `No user tables found in schema '${schema}'.`;
     }
-    // Get autovacuum settings
-    const settings = await query(`
-    SELECT name, setting
-    FROM pg_settings
-    WHERE name LIKE 'autovacuum%'
-    ORDER BY name
-  `);
-    const findings = analyzeFindings(stats.rows, settings.rows);
-    return formatVacuumReport(schema, stats.rows, settings.rows, findings);
+    // Get autovacuum settings. pg_settings requires superuser or pg_read_all_settings
+    // in some PostgreSQL configurations — don't let a permission error discard the
+    // table stats we already fetched.
+    let settingsRows = [];
+    let settingsUnavailable = false;
+    try {
+        const settings = await query(`
+      SELECT name, setting
+      FROM pg_settings
+      WHERE name LIKE 'autovacuum%'
+      ORDER BY name
+    `);
+        settingsRows = settings.rows;
+    }
+    catch {
+        settingsUnavailable = true;
+    }
+    const findings = analyzeFindings(stats.rows, settingsRows);
+    const report = formatVacuumReport(schema, stats.rows, settingsRows, findings);
+    if (settingsUnavailable) {
+        return report + "\n\n*Note: Autovacuum configuration could not be read — the database user may need pg_read_all_settings or superuser privileges.*";
+    }
+    return report;
 }
 export function analyzeFindings(tables, settings) {
     const findings = [];

package/build/db-sqlite.js

@@ -11,6 +11,9 @@ export function createSqliteAdapter() {
             }
             db = new Database(dbPath, { readonly: true });
             db.pragma("journal_mode = WAL");
+            // Enforce read-only at the SQL engine level, not just at the file level.
+            // This prevents any write attempt from succeeding even if the OS permits it.
+            db.pragma("query_only = ON");
         }
         return db;
     }

package/build/errors.js

@@ -4,7 +4,11 @@
  */
 export function formatToolError(context, err) {
     const msg = err instanceof Error ? err.message : String(err);
-    const sanitized = msg.replace(/\/\/[^@]+@/g, "//****:****@");
+    // Sanitize URL-style credentials (postgresql://user:pass@host) and
+    // key-value style passwords (password=secret) used by libpq and JDBC.
+    const sanitized = msg
+        .replace(/\/\/[^@]+@/g, "//****:****@")
+        .replace(/\bpassword\s*=\s*\S+/gi, "password=****");
     const isConnectionError = /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|EHOSTUNREACH|getaddrinfo|connect ECONNRESET|password authentication failed|Access denied|no pg_hba\.conf|connection refused|Connection lost|SQLITE_CANTOPEN/i.test(msg);
     if (isConnectionError) {
         return `Error ${context}: ${sanitized}\n\nThis looks like a database connection issue. Check your configuration:\n- Set DATABASE_URL environment variable with a valid connection string\n- Or use driver-specific variables (PGHOST, MYSQL_HOST, SQLITE_PATH)\n- Ensure the database server is running and accessible`;

package/build/index.js

@@ -220,7 +220,7 @@ server.tool("suggest_missing_indexes", "Find tables with high sequential scan co
     }
 });
 // --- Tool: analyze_slow_queries ---
-server.tool("analyze_slow_queries", "Find the slowest queries using pg_stat_statements (PostgreSQL) or performance_schema (MySQL). Shows execution times, call counts, and optimization recommendations.", {
+server.tool("analyze_slow_queries", "Find the slowest queries using pg_stat_statements (PostgreSQL) or performance_schema (MySQL). Shows execution times, call counts, and optimization recommendations. PostgreSQL requires the pg_stat_statements extension to be installed and listed in shared_preload_libraries — the tool returns setup instructions if the extension is missing. Not available for SQLite.", {
     schema: z
         .string()
         .default("public")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-db-analyzer",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "MCP server for PostgreSQL, MySQL, and SQLite schema analysis, index optimization, and query plan inspection",
   "mcpName": "io.github.dmitriusan/mcp-db-analyzer",
   "author": "Dmytro Lisnichenko",
@@ -44,7 +44,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "repository": {
     "type": "git",
@@ -59,14 +59,14 @@
     "better-sqlite3": "^12.6.2",
     "mysql2": "^3.19.0",
     "pg": "^8.13.0",
-    "zod": "^3.24.2"
+    "zod": "^4.0.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/mysql": "^2.15.27",
-    "@types/node": "^22.0.0",
+    "@types/node": "^25.5.0",
     "@types/pg": "^8.11.0",
-    "typescript": "^5.8.2",
-    "vitest": "^4.0.18"
+    "typescript": "^6.0.0",
+    "vitest": "^4.1.0"
   }
 }