taurusdb-mcp 0.2.0 → 0.4.0

package/README.md

@@ -38,7 +38,7 @@ claude mcp add huaweicloud-taurusdb \
   -e TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
   -e TAURUSDB_SQL_DATABASE=<your-database> \
   -e TAURUSDB_SQL_USER=<your-readonly-user> \
-  -e TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  -e TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -51,7 +51,7 @@ codex mcp add huaweicloud-taurusdb \
   --env TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
   --env TAURUSDB_SQL_DATABASE=<your-database> \
   --env TAURUSDB_SQL_USER=<your-readonly-user> \
-  --env TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  --env TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -63,7 +63,17 @@ npx taurusdb-mcp init --client cursor
 npx taurusdb-mcp init --client vscode
 ```
 
+Configure and verify the operating-system credential store:
+
+```bash
+npx taurusdb-mcp credentials configure
+npx taurusdb-mcp credentials check
+```
+
 ## Notes
 
 - Requires Node.js `>= 20`
 - Depends on `taurusdb-core`
+- Database passwords support `env:`, `file:`, `hw-csms:`, `hw-kms:`, and `hw-kms-file:` references
+- Huawei DEW CSMS is recommended when the database password should be stored and retrieved from Huawei Cloud
+- macOS Keychain, Linux Secret Service, or Windows Credential Manager cloud identity is enabled with `TAURUSDB_CLOUD_KEYCHAIN_SERVICE`

package/dist/commands/credentials.d.ts

@@ -0,0 +1,3 @@
+export declare function runCredentialsConfigure(args: string[]): number;
+export declare function runCredentialsCheck(args: string[]): Promise<number>;
+export declare function runCredentials(args: string[]): Promise<number>;

package/dist/commands/credentials.js

@@ -0,0 +1,190 @@
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { canAuthenticateHuaweiCloudRequests, createConfigFromEnv, createHuaweiCsmsSecretResolver, createHuaweiKmsSecretResolver, createSqlProfileLoader, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "taurusdb-core";
+function readOption(args, name, fallback) {
+    const index = args.indexOf(name);
+    if (index === -1) {
+        return fallback;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    return value;
+}
+function configureUsage() {
+    return `Usage: taurusdb-mcp credentials configure [options]
+
+Options:
+  --service <name>         Credential service prefix (default: taurusdb-mcp/huaweicloud)
+  --account <name>         Credential account (default: default)
+  --with-security-token    Also store a temporary security token`;
+}
+function checkUsage() {
+    return `Usage: taurusdb-mcp credentials check
+
+Checks the configured Huawei Cloud identity and cloud-backed database password
+references without printing or connecting with any secret values.`;
+}
+function runCommand(command, args, errorMessage) {
+    const result = spawnSync(command, args, { stdio: "inherit" });
+    if (result.error && "code" in result.error && result.error.code === "ENOENT") {
+        throw new Error(`${command} was not found.`);
+    }
+    if (result.status !== 0) {
+        throw new Error(errorMessage);
+    }
+}
+function storeMacOsSecret(service, account, label) {
+    process.stderr.write(`Enter ${label} in the macOS Keychain prompt.\n`);
+    runCommand("security", ["add-generic-password", "-U", "-s", service, "-a", account, "-w"], `Failed to store ${label} in macOS Keychain.`);
+}
+function storeLinuxSecret(service, account, key, label) {
+    process.stderr.write(`Enter ${label} when prompted by Linux Secret Service.\n`);
+    runCommand("secret-tool", [
+        "store",
+        `--label=TaurusDB MCP Huawei Cloud ${label}`,
+        "service",
+        service,
+        "account",
+        account,
+        "key",
+        key,
+    ], `Failed to store ${label} in Linux Secret Service.`);
+}
+function configureWindows(service, account, withSecurityToken) {
+    const scriptPath = fileURLToPath(new URL("../../scripts/windows-credential-configure.ps1", import.meta.url));
+    const args = [
+        "-NoLogo",
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        path.normalize(scriptPath),
+        "-Service",
+        service,
+        "-Account",
+        account,
+    ];
+    if (withSecurityToken) {
+        args.push("-WithSecurityToken");
+    }
+    runCommand("powershell.exe", args, "Failed to store credentials in Windows Credential Manager.");
+}
+export function runCredentialsConfigure(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${configureUsage()}\n`);
+        return 0;
+    }
+    const service = readOption(args, "--service", "taurusdb-mcp/huaweicloud");
+    const account = readOption(args, "--account", "default");
+    const withSecurityToken = args.includes("--with-security-token");
+    if (process.platform === "darwin") {
+        storeMacOsSecret(`${service}/access-key-id`, account, "Huawei Cloud access key ID");
+        storeMacOsSecret(`${service}/secret-access-key`, account, "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeMacOsSecret(`${service}/security-token`, account, "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "linux") {
+        storeLinuxSecret(service, account, "access-key-id", "Huawei Cloud access key ID");
+        storeLinuxSecret(service, account, "secret-access-key", "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeLinuxSecret(service, account, "security-token", "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "win32") {
+        configureWindows(service, account, withSecurityToken);
+    }
+    else {
+        throw new Error(`System credential storage is not supported on platform "${process.platform}".`);
+    }
+    process.stdout.write(`Stored Huawei Cloud credentials in service "${service}" for account "${account}".\n`);
+    return 0;
+}
+function printResult(ok, title, details) {
+    process.stdout.write(`${ok ? "[ok]" : "[fail]"} ${title}${details ? `: ${details}` : ""}\n`);
+}
+async function check(title, action) {
+    try {
+        printResult(true, title, await action());
+        return true;
+    }
+    catch (error) {
+        printResult(false, title, error instanceof Error ? error.message : String(error));
+        return false;
+    }
+}
+function getCloudResolver(uri, config) {
+    const normalized = uri.startsWith("uri:") ? uri.slice("uri:".length) : uri;
+    if (normalized.startsWith("hw-csms:")) {
+        return { kind: "CSMS", resolve: () => createHuaweiCsmsSecretResolver({ config })(normalized) };
+    }
+    if (normalized.startsWith("hw-kms:") || normalized.startsWith("hw-kms-file:")) {
+        return { kind: "KMS", resolve: () => createHuaweiKmsSecretResolver({ config })(normalized) };
+    }
+    return undefined;
+}
+export async function runCredentialsCheck(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${checkUsage()}\n`);
+        return 0;
+    }
+    const config = createConfigFromEnv(process.env);
+    const auth = getHuaweiCloudAuthFromConfig(config);
+    let failed = false;
+    failed ||= !(await check("Huawei Cloud identity source", async () => {
+        if (auth.authToken)
+            return "IAM token configured";
+        if (auth.accessKeyId && auth.secretAccessKey)
+            return "AK/SK configured in environment";
+        if (auth.credentialProvider) {
+            await auth.credentialProvider();
+            return "system credential store readable";
+        }
+        if (!canAuthenticateHuaweiCloudRequests(auth)) {
+            throw new Error("No IAM token, AK/SK, or system credential store is configured.");
+        }
+        return "configured";
+    }));
+    if (!failed) {
+        failed ||= !(await check("Huawei Cloud project", async () => {
+            const projectId = await resolveHuaweiCloudProjectId(auth);
+            if (!projectId) {
+                throw new Error("Project ID could not be resolved.");
+            }
+            return config.cloud.projectId ? "configured" : "resolved through IAM";
+        }));
+    }
+    const profiles = await createSqlProfileLoader({ config }).load();
+    const cloudRefs = [...profiles.values()]
+        .map((profile) => profile.user?.password)
+        .filter((ref) => ref?.type === "uri")
+        .map((ref) => getCloudResolver(ref.uri, config))
+        .filter((resolver) => resolver !== undefined);
+    if (cloudRefs.length === 0) {
+        printResult(true, "Cloud-backed database password references", "none configured; skipped");
+    }
+    else if (!failed) {
+        for (const resolver of cloudRefs) {
+            const readable = await check(`${resolver.kind} database password reference`, async () => {
+                await resolver.resolve();
+                return "readable";
+            });
+            failed ||= !readable;
+        }
+    }
+    return failed ? 1 : 0;
+}
+export async function runCredentials(args) {
+    const command = args[0];
+    if (command === "configure") {
+        return runCredentialsConfigure(args.slice(1));
+    }
+    if (command === "check") {
+        return runCredentialsCheck(args.slice(1));
+    }
+    process.stderr.write("Usage: taurusdb-mcp credentials <configure|check>\n");
+    return 1;
+}

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { runInit } from "./commands/init.js";
+import { runCredentials } from "./commands/credentials.js";
 import { startMcpServer } from "./server.js";
 import { VERSION } from "./version.js";
 async function main() {
@@ -9,6 +10,10 @@ async function main() {
         process.exitCode = await runInit(args.slice(1));
         return;
     }
+    if (firstArg === "credentials") {
+        process.exitCode = await runCredentials(args.slice(1));
+        return;
+    }
     if (firstArg === "--version" || firstArg === "-v") {
         process.stdout.write(`${VERSION}\n`);
         return;

package/dist/server.d.ts

@@ -1,11 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { TaurusDBEngine, type CapabilitySnapshot, type Config, type RuntimeTargetProfileLoader } from "taurusdb-core";
+import { TaurusDBEngine, type Config, type RuntimeTargetProfileLoader } from "taurusdb-core";
 export interface ServerDeps {
     config: Config;
     profileLoader: RuntimeTargetProfileLoader;
     engine: TaurusDBEngine;
     pingResponse: string;
-    startupProbe?: CapabilitySnapshot;
 }
 export declare function bootstrapDependencies(): Promise<ServerDeps>;
 export declare function createServer(deps: ServerDeps): McpServer;

package/dist/server.js

@@ -8,29 +8,11 @@ export async function bootstrapDependencies() {
     const config = getConfig();
     const profileLoader = new RuntimeOverrideProfileLoader(createSqlProfileLoader({ config }));
     const engine = await TaurusDBEngine.create({ config, profileLoader });
-    const defaultDatasource = await engine.getDefaultDataSource();
-    let startupProbe;
-    if (defaultDatasource) {
-        try {
-            const bootstrapContext = await engine.resolveContext({
-                datasource: defaultDatasource,
-                readonly: true,
-            }, "task_bootstrap_probe");
-            startupProbe = await engine.probeCapabilities(bootstrapContext);
-        }
-        catch (error) {
-            logger.warn({
-                err: error,
-                defaultDatasource,
-            }, "Capability probe failed during bootstrap; TaurusDB-specific tools will stay disabled");
-        }
-    }
     return {
         config,
         profileLoader,
         engine,
         pingResponse: "pong",
-        startupProbe,
     };
 }
 export function createServer(deps) {
@@ -38,7 +20,22 @@ export function createServer(deps) {
         name: "huaweicloud-taurusdb",
         version: VERSION,
     });
-    registerTools(server, deps, deps.config, deps.startupProbe);
+    let cleanupPromise;
+    const cleanup = () => {
+        cleanupPromise ??= deps.engine.close();
+        return cleanupPromise;
+    };
+    server.server.onclose = () => {
+        void cleanup().catch((error) => {
+            logger.error({ err: error }, "Failed to close MCP session dependencies");
+        });
+    };
+    const closeServer = server.close.bind(server);
+    server.close = async () => {
+        await closeServer();
+        await cleanup();
+    };
+    registerTools(server, deps, deps.config);
     return server;
 }
 export async function startMcpServer() {
@@ -52,7 +49,6 @@ export async function startMcpServer() {
     logger.info({
         profileCount: datasources.length,
         defaultDatasource: defaultDatasource ?? null,
-        taurusdbProbe: deps.startupProbe?.kernelInfo?.isTaurusDB ?? null,
     }, "SQL profiles resolved");
     logger.info({ server: "huaweicloud-taurusdb", version: VERSION }, "Starting MCP server");
     await server.connect(new StdioServerTransport());

package/dist/tools/error-handling.js

@@ -1,4 +1,4 @@
-import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
+import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, logger, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
 import { ErrorCode, formatError, } from "../utils/formatter.js";
 export class ToolInputError extends Error {
     constructor(message) {
@@ -116,11 +116,11 @@ export function formatToolError(error, context) {
             metadata: context.metadata,
         });
     }
+    logger.error({ err: error, action: context.action }, "Tool execution failed unexpectedly");
     return formatError({
         code: ErrorCode.CONNECTION_FAILED,
-        message: messageOf(error),
+        message: `${context.action} failed unexpectedly.`,
         summary: `${context.action} failed unexpectedly.`,
         metadata: context.metadata,
-        details: detailsOf(error),
     });
 }

package/dist/tools/query.js

@@ -12,16 +12,16 @@ async function inspectSql(toolName, sql, ctx, deps) {
         context: ctx,
     });
 }
-async function ensureConfirmation(sql, decision, ctx, deps, taskId, confirmationToken) {
+async function ensureConfirmation(decision, ctx, deps, taskId, confirmationToken) {
     if (!decision.requiresConfirmation) {
         return undefined;
     }
     const responseMetadata = metadata(taskId, {
         sql_hash: decision.sqlHash,
-        statement_type: statementTypeFromSql(sql),
+        statement_type: statementTypeFromSql(decision.normalizedSql),
     });
     if (confirmationToken) {
-        const validation = await deps.engine.validateConfirmation(confirmationToken, sql, ctx);
+        const validation = await deps.engine.validateConfirmation(confirmationToken, decision.normalizedSql, ctx);
         if (validation.valid) {
             return undefined;
         }
@@ -76,11 +76,11 @@ export const executeReadonlySqlTool = {
                     },
                 });
             }
-            const confirmationResponse = await ensureConfirmation(sql, decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
+            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
             if (confirmationResponse) {
                 return confirmationResponse;
             }
-            const result = await deps.engine.executeReadonly(sql, ctx, {
+            const result = await deps.engine.executeReadonly(decision.normalizedSql, ctx, {
                 timeoutMs: decision.runtimeLimits.timeoutMs,
                 maxRows: decision.runtimeLimits.maxRows,
                 maxColumns: decision.runtimeLimits.maxColumns,
@@ -133,7 +133,7 @@ export const explainSqlTool = {
                     },
                 });
             }
-            const result = await deps.engine.explain(sql, ctx);
+            const result = await deps.engine.explain(decision.normalizedSql, ctx);
             return formatSuccess(toPublicExplainResult(result, decision), {
                 summary: decision.requiresConfirmation
                     ? "Explain generated. Executing this SQL would require explicit confirmation."
@@ -184,11 +184,11 @@ export const executeSqlTool = {
                     },
                 });
             }
-            const confirmationResponse = await ensureConfirmation(sql, decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
+            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
             if (confirmationResponse) {
                 return confirmationResponse;
             }
-            const result = await deps.engine.executeMutation(sql, ctx, {
+            const result = await deps.engine.executeMutation(decision.normalizedSql, ctx, {
                 timeoutMs: decision.runtimeLimits.timeoutMs,
             });
             return formatSuccess(toPublicMutationResult(result), {

package/dist/tools/registry.d.ts

@@ -1,12 +1,8 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { type FeatureMatrix, type KernelInfo, type Config } from "taurusdb-core";
+import { type Config } from "taurusdb-core";
 import type { ServerDeps } from "../server.js";
 import { type ToolResponse } from "../utils/formatter.js";
 export type ToolDeps = ServerDeps;
-export interface ToolRegistrationProbe {
-    kernelInfo?: KernelInfo;
-    features?: FeatureMatrix;
-}
 export type ToolInvokeContext = {
     taskId: string;
 };
@@ -15,9 +11,8 @@ export interface ToolDefinition<I extends Record<string, unknown> = Record<strin
     description: string;
     inputSchema: Record<string, unknown>;
     handler: (input: I, deps: ToolDeps, context: ToolInvokeContext) => Promise<ToolResponse<O>>;
-    exposeWhen?: (config: Config) => boolean;
 }
 export declare const commonToolDefinitions: ToolDefinition[];
 export declare const capabilityToolDefinitions: ToolDefinition[];
 export declare const taurusToolDefinitions: ToolDefinition[];
-export declare function registerTools(server: McpServer, deps: ToolDeps, config: Config, probeOrTools?: ToolRegistrationProbe | ToolDefinition[], maybeTools?: ToolDefinition[]): void;
+export declare function registerTools(server: McpServer, deps: ToolDeps, config: Config, tools?: ToolDefinition[]): void;

package/dist/tools/registry.js

@@ -4,7 +4,7 @@ import { describeTableTool, listDatabasesTool, listTablesTool, } from "./discove
 import { showProcesslistTool } from "./processlist.js";
 import { pingTool } from "./ping.js";
 import { getKernelInfoTool, listTaurusFeaturesTool } from "./taurus/capability.js";
-import { clearSqlCredentialsTool, getSessionBindingTool, selectCloudTaurusInstanceTool, setCloudAccessKeysTool, setCloudRegionTool, setDefaultDatabaseTool, setSqlCredentialsTool, } from "./taurus/cloud-context.js";
+import { getSessionBindingTool, selectCloudTaurusInstanceTool, setCloudRegionTool, setDefaultDatabaseTool, } from "./taurus/cloud-context.js";
 import { listCloudTaurusInstancesTool } from "./taurus/cloud-instances.js";
 import { diagnosticToolDefinitions } from "./taurus/diagnostics.js";
 import { explainSqlEnhancedTool } from "./taurus/explain.js";
@@ -12,10 +12,10 @@ import { flashbackQueryTool } from "./taurus/flashback.js";
 import { listRecycleBinTool, restoreRecycleBinTableTool } from "./taurus/recycle-bin.js";
 import { ErrorCode, formatError, toMcpToolResult, } from "../utils/formatter.js";
 function formatUnhandledToolError(error, taskId) {
-    const message = error instanceof Error ? error.message : String(error);
+    void error;
     const response = formatError({
         code: ErrorCode.CONNECTION_FAILED,
-        message,
+        message: "Tool execution failed unexpectedly.",
         summary: "Tool execution failed unexpectedly.",
         metadata: { task_id: taskId },
         retryable: false,
@@ -67,10 +67,7 @@ export const capabilityToolDefinitions = [
     getKernelInfoTool,
     listTaurusFeaturesTool,
     setCloudRegionTool,
-    setCloudAccessKeysTool,
     getSessionBindingTool,
-    setSqlCredentialsTool,
-    clearSqlCredentialsTool,
     setDefaultDatabaseTool,
     listCloudTaurusInstancesTool,
     selectCloudTaurusInstanceTool,
@@ -81,8 +78,7 @@ export const taurusToolDefinitions = [
     listRecycleBinTool,
     restoreRecycleBinTableTool,
 ];
-function buildDefaultToolDefinitions(_config, probe) {
-    void probe;
+function buildDefaultToolDefinitions(_config) {
     return [
         ...commonToolDefinitions,
         ...capabilityToolDefinitions,
@@ -90,17 +86,8 @@ function buildDefaultToolDefinitions(_config, probe) {
         ...taurusToolDefinitions,
     ];
 }
-function isToolDefinitionArray(value) {
-    return Array.isArray(value);
-}
-export function registerTools(server, deps, config, probeOrTools, maybeTools) {
-    const probe = isToolDefinitionArray(probeOrTools) ? undefined : probeOrTools;
-    const tools = maybeTools
-        ?? (isToolDefinitionArray(probeOrTools) ? probeOrTools : buildDefaultToolDefinitions(config, probe));
+export function registerTools(server, deps, config, tools = buildDefaultToolDefinitions(config)) {
     for (const tool of tools) {
-        if (tool.exposeWhen && !tool.exposeWhen(config)) {
-            continue;
-        }
         registerOneTool(server, tool, deps);
     }
 }

package/dist/tools/taurus/cloud-context.d.ts

@@ -1,8 +1,5 @@
 import type { ToolDefinition } from "../registry.js";
 export declare const setCloudRegionTool: ToolDefinition;
-export declare const setCloudAccessKeysTool: ToolDefinition;
 export declare const setDefaultDatabaseTool: ToolDefinition;
-export declare const setSqlCredentialsTool: ToolDefinition;
-export declare const clearSqlCredentialsTool: ToolDefinition;
 export declare const getSessionBindingTool: ToolDefinition;
 export declare const selectCloudTaurusInstanceTool: ToolDefinition;

package/dist/tools/taurus/cloud-context.js

@@ -75,6 +75,7 @@ export const setCloudRegionTool = {
             deps.config.cloud.region = region;
             deps.config.cloud.apiEndpoint = buildHuaweiCloudEndpoint("gaussdb", region, domainSuffix);
             deps.config.cloud.iamEndpoint = buildHuaweiCloudEndpoint("iam", region, domainSuffix);
+            deps.config.cloud.kmsEndpoint = buildHuaweiCloudEndpoint("kms", region, domainSuffix);
             deps.config.slowSqlSource.taurusApi.endpoint = buildHuaweiCloudEndpoint("gaussdb", region, domainSuffix);
             deps.config.slowSqlSource.das.endpoint = buildHuaweiCloudEndpoint("das", region, domainSuffix);
             deps.config.metricsSource.ces.endpoint = buildHuaweiCloudEndpoint("ces", region, domainSuffix);
@@ -84,6 +85,7 @@ export const setCloudRegionTool = {
                 region,
                 api_endpoint: deps.config.cloud.apiEndpoint,
                 iam_endpoint: deps.config.cloud.iamEndpoint,
+                kms_endpoint: deps.config.cloud.kmsEndpoint,
             }, {
                 summary: `Cloud region switched to ${region}.`,
                 metadata: metadata(context.taskId),
@@ -97,47 +99,6 @@ export const setCloudRegionTool = {
         }
     },
 };
-export const setCloudAccessKeysTool = {
-    name: "set_cloud_access_keys",
-    description: "Update the active Huawei Cloud AK/SK for the current MCP session and clear stale token or instance bindings.",
-    inputSchema: {
-        access_key_id: z.string().trim().min(1).describe("Huawei Cloud access key id."),
-        secret_access_key: z.string().trim().min(1).describe("Huawei Cloud secret access key."),
-        security_token: z.string().trim().min(1).optional().describe("Optional temporary security token when using temporary AK/SK."),
-    },
-    async handler(input, deps, context) {
-        try {
-            const accessKeyId = typeof input.access_key_id === "string" ? input.access_key_id.trim() : "";
-            const secretAccessKey = typeof input.secret_access_key === "string" ? input.secret_access_key.trim() : "";
-            const securityToken = typeof input.security_token === "string" ? input.security_token.trim() : undefined;
-            if (!accessKeyId || !secretAccessKey) {
-                throw new ToolInputError("access_key_id and secret_access_key are required.");
-            }
-            deps.config.cloud.accessKeyId = accessKeyId;
-            deps.config.cloud.secretAccessKey = secretAccessKey;
-            deps.config.cloud.securityToken = securityToken;
-            deps.config.cloud.authToken = undefined;
-            deps.config.slowSqlSource.taurusApi.authToken = undefined;
-            deps.config.slowSqlSource.das.authToken = undefined;
-            deps.config.metricsSource.ces.authToken = undefined;
-            clearCloudSelection(deps);
-            await reloadEngine(deps);
-            return formatSuccess({
-                access_key_id_suffix: accessKeyId.slice(-4),
-                uses_security_token: Boolean(securityToken),
-            }, {
-                summary: "Cloud access keys updated for the current session.",
-                metadata: metadata(context.taskId),
-            });
-        }
-        catch (error) {
-            return formatToolError(error, {
-                action: "set_cloud_access_keys",
-                metadata: metadata(context.taskId),
-            });
-        }
-    },
-};
 export const setDefaultDatabaseTool = {
     name: "set_default_database",
     description: "Set the default database for a datasource in the current MCP session so later tool calls can omit input.database.",
@@ -201,120 +162,9 @@ export const setDefaultDatabaseTool = {
         }
     },
 };
-export const setSqlCredentialsTool = {
-    name: "set_sql_credentials",
-    description: "Set the SQL username and password for a datasource in the current MCP session without writing credentials to disk.",
-    inputSchema: {
-        username: z
-            .string()
-            .trim()
-            .min(1)
-            .describe("Database username to use for the selected datasource in this session."),
-        password: z
-            .string()
-            .trim()
-            .min(1)
-            .describe("Database password to use for the selected datasource in this session."),
-        datasource: z
-            .string()
-            .trim()
-            .min(1)
-            .optional()
-            .describe("Optional datasource template to bind. Defaults to the current default datasource."),
-    },
-    async handler(input, deps, context) {
-        try {
-            const username = typeof input.username === "string" ? input.username.trim() : "";
-            const password = typeof input.password === "string" ? input.password.trim() : "";
-            if (!username || !password) {
-                throw new ToolInputError("username and password are required.");
-            }
-            const datasource = await resolveBindingDatasource(deps, typeof input.datasource === "string" ? input.datasource : undefined);
-            if (!datasource) {
-                throw new ToolInputError("No datasource selected. Configure a default datasource or pass datasource explicitly.");
-            }
-            const profile = await deps.profileLoader.get(datasource);
-            if (!profile) {
-                throw new ToolInputError(`Datasource "${datasource}" was not found.`);
-            }
-            const currentTarget = deps.profileLoader.getRuntimeTarget(datasource);
-            deps.profileLoader.setRuntimeTarget(datasource, {
-                host: currentTarget?.host ?? profile.host,
-                port: currentTarget?.port ?? profile.port,
-                database: currentTarget?.database ?? profile.database,
-                instanceId: currentTarget?.instanceId,
-                nodeId: currentTarget?.nodeId,
-                user: {
-                    username,
-                    password: { type: "plain", value: password },
-                },
-            });
-            await reloadEngine(deps);
-            return formatSuccess({
-                datasource,
-                username,
-            }, {
-                summary: `SQL credentials for ${datasource} updated in the current session.`,
-                metadata: metadata(context.taskId),
-            });
-        }
-        catch (error) {
-            return formatToolError(error, {
-                action: "set_sql_credentials",
-                metadata: metadata(context.taskId),
-            });
-        }
-    },
-};
-export const clearSqlCredentialsTool = {
-    name: "clear_sql_credentials",
-    description: "Clear any session-scoped SQL credential override for a datasource and fall back to the configured profile credentials.",
-    inputSchema: {
-        datasource: z
-            .string()
-            .trim()
-            .min(1)
-            .optional()
-            .describe("Optional datasource template to clear. Defaults to the current default datasource."),
-    },
-    async handler(input, deps, context) {
-        try {
-            const datasource = await resolveBindingDatasource(deps, typeof input.datasource === "string" ? input.datasource : undefined);
-            if (!datasource) {
-                throw new ToolInputError("No datasource selected. Configure a default datasource or pass datasource explicitly.");
-            }
-            const profile = await deps.profileLoader.get(datasource);
-            if (!profile) {
-                throw new ToolInputError(`Datasource "${datasource}" was not found.`);
-            }
-            const currentTarget = deps.profileLoader.getRuntimeTarget(datasource);
-            deps.profileLoader.setRuntimeTarget(datasource, {
-                host: currentTarget?.host ?? profile.host,
-                port: currentTarget?.port ?? profile.port,
-                database: currentTarget?.database ?? profile.database,
-                instanceId: currentTarget?.instanceId,
-                nodeId: currentTarget?.nodeId,
-                user: profile.user,
-            });
-            await reloadEngine(deps);
-            return formatSuccess({
-                datasource,
-            }, {
-                summary: `Session SQL credential override cleared for ${datasource}.`,
-                metadata: metadata(context.taskId),
-            });
-        }
-        catch (error) {
-            return formatToolError(error, {
-                action: "clear_sql_credentials",
-                metadata: metadata(context.taskId),
-            });
-        }
-    },
-};
 export const getSessionBindingTool = {
     name: "get_session_binding",
-    description: "Return the current session binding for a datasource, including selected instance, host, database, and whether SQL credentials are overridden in memory.",
+    description: "Return the current session binding for a datasource, including selected instance, host, database, and configured database username.",
     inputSchema: {
         datasource: z
             .string()
@@ -339,15 +189,13 @@ export const getSessionBindingTool = {
                 host: profile.host,
                 port: profile.port,
                 database: profile.database,
-                username_masked: maskUsername(profile.user.username),
+                username_masked: maskUsername(profile.user?.username),
                 runtime_override: {
                     instance_id: target?.instanceId,
                     node_id: target?.nodeId,
                     host: target?.host,
                     port: target?.port,
                     database: target?.database,
-                    has_sql_credentials_override: Boolean(target?.user),
-                    username_masked: maskUsername(target?.user?.username),
                 },
             }, {
                 summary: `Returned current session binding for ${datasource}.`,

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.4.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.0";
+export const VERSION = "0.4.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-mcp",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "TaurusDB MCP server for Claude, Cursor, VS Code, and other MCP clients.",
   "type": "module",
   "main": "dist/index.js",
@@ -22,17 +22,18 @@
     "taurusdb-mcp": "dist/index.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "scripts"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "taurusdb-core": "0.2.0",
+    "taurusdb-core": "0.4.0",
     "@modelcontextprotocol/sdk": "^1.17.0",
     "mysql2": "^3.22.1",
     "zod": "^3.24.1"

package/scripts/windows-credential-configure.ps1

@@ -0,0 +1,51 @@
+param(
+  [Parameter(Mandatory = $true)][string]$Service,
+  [Parameter(Mandatory = $true)][string]$Account,
+  [switch]$WithSecurityToken
+)
+
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class TaurusCredentialWriter {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Credential {
+    public UInt32 Flags; public UInt32 Type; public string TargetName; public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist;
+    public UInt32 AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredWrite(ref Credential credential, UInt32 flags);
+}
+'@
+
+function Save-CredentialValue([string]$Key, [string]$Label) {
+  $secure = Read-Host "Enter $Label" -AsSecureString
+  $pointer = [Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($secure)
+  try {
+    $value = [Runtime.InteropServices.Marshal]::PtrToStringUni($pointer)
+    $bytes = [Text.Encoding]::Unicode.GetBytes($value)
+    $blob = [Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length)
+    try {
+      [Runtime.InteropServices.Marshal]::Copy($bytes, 0, $blob, $bytes.Length)
+      $credential = New-Object TaurusCredentialWriter+Credential
+      $credential.Type = 1
+      $credential.TargetName = "$Service/$Account/$Key"
+      $credential.CredentialBlobSize = $bytes.Length
+      $credential.CredentialBlob = $blob
+      $credential.Persist = 2
+      $credential.UserName = $Account
+      if (-not [TaurusCredentialWriter]::CredWrite([ref]$credential, 0)) { throw "CredWriteW failed." }
+    } finally {
+      [Runtime.InteropServices.Marshal]::FreeHGlobal($blob)
+      [Array]::Clear($bytes, 0, $bytes.Length)
+    }
+  } finally {
+    [Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($pointer)
+  }
+}
+
+Save-CredentialValue "access-key-id" "Huawei Cloud access key ID"
+Save-CredentialValue "secret-access-key" "Huawei Cloud secret access key"
+if ($WithSecurityToken) { Save-CredentialValue "security-token" "Huawei Cloud security token" }