taurusdb-mcp 0.4.0 → 0.5.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TaurusDB MCP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -28,14 +28,24 @@ Use this command in MCP client configs:
 }
 ```
 
+Configure Huawei Cloud identity through the operating-system credential store
+before adding the server. AK/SK values should not be copied into MCP client
+configuration:
+
+```bash
+npx -y taurusdb-mcp credentials configure
+TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  npx -y taurusdb-mcp credentials check
+```
+
 Claude Code:
 
 ```bash
 claude mcp add huaweicloud-taurusdb \
   --transport stdio \
   -e TAURUSDB_CLOUD_REGION=<your-region> \
-  -e TAURUSDB_CLOUD_ACCESS_KEY_ID=<your-ak> \
-  -e TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
+  -e TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  -e TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
   -e TAURUSDB_SQL_DATABASE=<your-database> \
   -e TAURUSDB_SQL_USER=<your-readonly-user> \
   -e TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
@@ -47,8 +57,8 @@ Codex:
 ```bash
 codex mcp add huaweicloud-taurusdb \
   --env TAURUSDB_CLOUD_REGION=<your-region> \
-  --env TAURUSDB_CLOUD_ACCESS_KEY_ID=<your-ak> \
-  --env TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
+  --env TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  --env TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
   --env TAURUSDB_SQL_DATABASE=<your-database> \
   --env TAURUSDB_SQL_USER=<your-readonly-user> \
   --env TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
@@ -77,3 +87,29 @@ npx taurusdb-mcp credentials check
 - Database passwords support `env:`, `file:`, `hw-csms:`, `hw-kms:`, and `hw-kms-file:` references
 - Huawei DEW CSMS is recommended when the database password should be stored and retrieved from Huawei Cloud
 - macOS Keychain, Linux Secret Service, or Windows Credential Manager cloud identity is enabled with `TAURUSDB_CLOUD_KEYCHAIN_SERVICE`
+- SQL TLS with certificate verification is required by default
+- Mutation and dynamic-target tools are disabled by default
+- Mutation tools require a dedicated `TAURUSDB_SQL_MUTATION_USER` /
+  `TAURUSDB_SQL_MUTATION_PASSWORD` pair and an external operator-signed approval
+- MCP audit events are written to `~/.taurusdb-mcp/audit.jsonl` by default, with
+  configurable size rotation for collection into centralized immutable storage
+- Run one stdio process per customer/client trust boundary; this package is not
+  a shared multi-tenant HTTP service
+
+Enable mutations only when required:
+
+```bash
+export TAURUSDB_ENABLE_MUTATIONS=true
+export TAURUSDB_SQL_MUTATION_USER='<dedicated-writer>'
+export TAURUSDB_SQL_MUTATION_PASSWORD='hw-csms:<writer-secret-name>'
+export TAURUSDB_MUTATION_APPROVAL_SECRET_FILE='/run/secrets/taurusdb-approval'
+```
+
+Sign a returned `approval_request` outside the MCP client:
+
+```bash
+npx taurusdb-mcp approve \
+  --request '<approval_request>' \
+  --actor '<operator-identity>' \
+  --secret-file /run/secrets/taurusdb-approval
+```

package/dist/commands/approve.d.ts

@@ -0,0 +1 @@
+export declare function runApprove(args: string[]): Promise<number>;

package/dist/commands/approve.js

@@ -0,0 +1,66 @@
+import { readFile, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { signApprovalRequest } from "taurusdb-core";
+function readOption(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1) {
+        return undefined;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    return value;
+}
+function expandTilde(input) {
+    if (input === "~") {
+        return os.homedir();
+    }
+    return input.startsWith("~/") ? path.join(os.homedir(), input.slice(2)) : input;
+}
+function usage() {
+    return `Usage: taurusdb-mcp approve --request <approval-request> --actor <identity> [options]
+
+Options:
+  --secret-file <path>  Approval secret file; defaults to
+                        TAURUSDB_MUTATION_APPROVAL_SECRET_FILE
+  --request <value>     approval_request returned by a mutation tool
+  --actor <identity>    Human approver identity recorded in the signed token
+
+The command prints a one-time approval_token. Run it outside the MCP client
+after reviewing the SQL hash, datasource, database, risk, and expiry encoded
+in approval_request.`;
+}
+async function readProtectedSecret(filePath) {
+    const resolved = expandTilde(filePath);
+    const info = await stat(resolved);
+    if (!info.isFile()) {
+        throw new Error("Mutation approval secret path must reference a regular file.");
+    }
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0) {
+        throw new Error("Mutation approval secret file must not be accessible by group or other users.");
+    }
+    const secret = (await readFile(resolved, "utf8")).trim();
+    if (Buffer.byteLength(secret, "utf8") < 32) {
+        throw new Error("Mutation approval secret must contain at least 32 bytes.");
+    }
+    return secret;
+}
+export async function runApprove(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${usage()}\n`);
+        return 0;
+    }
+    const request = readOption(args, "--request");
+    const actor = readOption(args, "--actor");
+    const secretFile = readOption(args, "--secret-file") ??
+        process.env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE?.trim();
+    if (!request || !actor || !secretFile) {
+        process.stderr.write(`${usage()}\n`);
+        return 2;
+    }
+    const secret = await readProtectedSecret(secretFile);
+    process.stdout.write(`${signApprovalRequest(request, actor, secret)}\n`);
+    return 0;
+}

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { runInit } from "./commands/init.js";
 import { runCredentials } from "./commands/credentials.js";
+import { runApprove } from "./commands/approve.js";
 import { startMcpServer } from "./server.js";
 import { VERSION } from "./version.js";
 async function main() {
@@ -14,6 +15,10 @@ async function main() {
         process.exitCode = await runCredentials(args.slice(1));
         return;
     }
+    if (firstArg === "approve") {
+        process.exitCode = await runApprove(args.slice(1));
+        return;
+    }
     if (firstArg === "--version" || firstArg === "-v") {
         process.stdout.write(`${VERSION}\n`);
         return;

package/dist/security/local-credential-login.d.ts

@@ -0,0 +1,33 @@
+export type SqlLoginCredentials = {
+    datasource: string;
+    username: string;
+    password: string;
+};
+export type SqlLoginRequest = {
+    datasource: string;
+    bind: (credentials: SqlLoginCredentials) => Promise<void>;
+};
+export type IssuedSqlLogin = {
+    loginUrl: string;
+    expiresAt: string;
+};
+export interface CredentialLoginService {
+    issueSqlLogin(request: SqlLoginRequest): Promise<IssuedSqlLogin>;
+    close(): Promise<void>;
+}
+export type LocalCredentialLoginServiceOptions = {
+    now?: () => number;
+    tokenTtlMs?: number;
+};
+export declare class LocalCredentialLoginService implements CredentialLoginService {
+    private readonly now;
+    private readonly tokenTtlMs;
+    private readonly pending;
+    private server;
+    private port;
+    constructor(options?: LocalCredentialLoginServiceOptions);
+    issueSqlLogin(request: SqlLoginRequest): Promise<IssuedSqlLogin>;
+    close(): Promise<void>;
+    private ensureStarted;
+    private handle;
+}

package/dist/security/local-credential-login.js

@@ -0,0 +1,156 @@
+import { randomBytes } from "node:crypto";
+import { createServer, } from "node:http";
+const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000;
+const MAX_REQUEST_BODY_BYTES = 16 * 1024;
+function page(title, message, form = false) {
+    const formHtml = form
+        ? `<form method="post">
+  <label>Database username <input name="username" autocomplete="username" required></label>
+  <label>Database password <input name="password" type="password" autocomplete="current-password" required></label>
+  <button type="submit">Connect</button>
+</form>`
+        : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto; padding: 0 1rem; }
+    form { display: grid; gap: 1rem; }
+    label { display: grid; gap: .35rem; }
+    input, button { font: inherit; padding: .65rem; }
+  </style>
+</head>
+<body>
+  <h1>${title}</h1>
+  <p>${message}</p>
+  ${formHtml}
+</body>
+</html>`;
+}
+function respond(res, status, body) {
+    res.writeHead(status, {
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
+        "content-type": "text/html; charset=utf-8",
+        "referrer-policy": "no-referrer",
+        "x-content-type-options": "nosniff",
+    });
+    res.end(body);
+}
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > MAX_REQUEST_BODY_BYTES) {
+            throw new Error("Request body is too large.");
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+export class LocalCredentialLoginService {
+    now;
+    tokenTtlMs;
+    pending = new Map();
+    server;
+    port;
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+        this.tokenTtlMs = options.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+    }
+    async issueSqlLogin(request) {
+        await this.ensureStarted();
+        const token = randomBytes(32).toString("base64url");
+        const expiresAtMs = this.now() + this.tokenTtlMs;
+        this.pending.set(token, { ...request, expiresAtMs });
+        return {
+            loginUrl: `http://127.0.0.1:${this.port}/sql-login/${token}`,
+            expiresAt: new Date(expiresAtMs).toISOString(),
+        };
+    }
+    async close() {
+        this.pending.clear();
+        const server = this.server;
+        this.server = undefined;
+        this.port = undefined;
+        if (!server) {
+            return;
+        }
+        await new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+        });
+    }
+    async ensureStarted() {
+        if (this.server) {
+            return;
+        }
+        const server = createServer((req, res) => {
+            void this.handle(req, res);
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", () => {
+                server.off("error", reject);
+                resolve();
+            });
+        });
+        const address = server.address();
+        if (!address || typeof address === "string") {
+            await new Promise((resolve) => server.close(() => resolve()));
+            throw new Error("Unable to resolve local credential login address.");
+        }
+        this.server = server;
+        this.port = address.port;
+    }
+    async handle(req, res) {
+        try {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            const match = url.pathname.match(/^\/sql-login\/([^/]+)$/);
+            const token = match?.[1];
+            const pending = token ? this.pending.get(token) : undefined;
+            if (!token || !pending || pending.expiresAtMs <= this.now()) {
+                if (token) {
+                    this.pending.delete(token);
+                }
+                respond(res, 410, page("Invalid login link", "This login link is invalid or has expired."));
+                return;
+            }
+            if (req.method === "GET") {
+                respond(res, 200, page("Connect to TaurusDB", "Enter your database credentials.", true));
+                return;
+            }
+            if (req.method !== "POST") {
+                respond(res, 405, page("Unsupported request", "Use the login form to continue."));
+                return;
+            }
+            const form = new URLSearchParams(await readBody(req));
+            const username = form.get("username")?.trim() ?? "";
+            const password = form.get("password") ?? "";
+            if (!username || !password) {
+                respond(res, 400, page("Connect to TaurusDB", "Username and password are required.", true));
+                return;
+            }
+            this.pending.delete(token);
+            try {
+                await pending.bind({
+                    datasource: pending.datasource,
+                    username,
+                    password,
+                });
+            }
+            catch {
+                respond(res, 500, page("Connection failed", "Credentials could not be bound to this session."));
+                return;
+            }
+            respond(res, 200, page("Connected", "Database credentials are now active for this MCP session."));
+        }
+        catch {
+            respond(res, 400, page("Invalid request", "The login request could not be processed."));
+        }
+    }
+}

package/dist/security/session-coordinator.d.ts

@@ -0,0 +1,9 @@
+export declare class SessionCoordinator {
+    private readers;
+    private writerActive;
+    private readonly readerQueue;
+    private readonly writerQueue;
+    runShared<T>(operation: () => Promise<T>): Promise<T>;
+    runExclusive<T>(operation: () => Promise<T>): Promise<T>;
+    private drain;
+}

package/dist/security/session-coordinator.js

@@ -0,0 +1,46 @@
+export class SessionCoordinator {
+    readers = 0;
+    writerActive = false;
+    readerQueue = [];
+    writerQueue = [];
+    async runShared(operation) {
+        if (this.writerActive || this.writerQueue.length > 0) {
+            await new Promise((resolve) => this.readerQueue.push(resolve));
+        }
+        this.readers += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            this.readers -= 1;
+            this.drain();
+        }
+    }
+    runExclusive(operation) {
+        return new Promise((resolve, reject) => {
+            this.writerQueue.push({
+                operation,
+                resolve: resolve,
+                reject,
+            });
+            this.drain();
+        });
+    }
+    drain() {
+        if (this.writerActive || this.readers > 0) {
+            return;
+        }
+        const writer = this.writerQueue.shift();
+        if (writer) {
+            this.writerActive = true;
+            void writer.operation().then(writer.resolve, writer.reject).finally(() => {
+                this.writerActive = false;
+                this.drain();
+            });
+            return;
+        }
+        for (const resolve of this.readerQueue.splice(0)) {
+            resolve();
+        }
+    }
+}

package/dist/server.d.ts

@@ -1,9 +1,18 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { TaurusDBEngine, type Config, type RuntimeTargetProfileLoader } from "taurusdb-core";
+import { TaurusDBEngine, type Config, type AuditWriter, type RuntimeTargetProfileLoader } from "taurusdb-core";
+import { type CredentialLoginService } from "./security/local-credential-login.js";
+import { SessionCoordinator } from "./security/session-coordinator.js";
 export interface ServerDeps {
     config: Config;
     profileLoader: RuntimeTargetProfileLoader;
     engine: TaurusDBEngine;
+    credentialLogin: CredentialLoginService;
+    auditWriter?: AuditWriter;
+    sessionCoordinator?: SessionCoordinator;
+    clientIdentityProvider?: () => {
+        name: string;
+        version: string;
+    } | undefined;
     pingResponse: string;
 }
 export declare function bootstrapDependencies(): Promise<ServerDeps>;

package/dist/server.js

@@ -1,17 +1,27 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createSqlProfileLoader, getConfig, RuntimeOverrideProfileLoader, redactConfigForLog, TaurusDBEngine, } from "taurusdb-core";
+import { createSqlProfileLoader, createJsonlAuditWriter, getConfig, RuntimeOverrideProfileLoader, redactConfigForLog, TaurusDBEngine, } from "taurusdb-core";
 import { registerTools } from "./tools/registry.js";
 import { logger } from "taurusdb-core";
 import { VERSION } from "./version.js";
+import { LocalCredentialLoginService, } from "./security/local-credential-login.js";
+import { SessionCoordinator } from "./security/session-coordinator.js";
 export async function bootstrapDependencies() {
     const config = getConfig();
     const profileLoader = new RuntimeOverrideProfileLoader(createSqlProfileLoader({ config }));
     const engine = await TaurusDBEngine.create({ config, profileLoader });
+    const auditWriter = await createJsonlAuditWriter({
+        logPath: config.audit.logPath,
+        maxBytes: config.audit.maxBytes,
+        maxFiles: config.audit.maxFiles,
+    });
     return {
         config,
         profileLoader,
         engine,
+        credentialLogin: new LocalCredentialLoginService(),
+        auditWriter,
+        sessionCoordinator: new SessionCoordinator(),
         pingResponse: "pong",
     };
 }
@@ -20,9 +30,14 @@ export function createServer(deps) {
         name: "huaweicloud-taurusdb",
         version: VERSION,
     });
+    deps.clientIdentityProvider = () => server.server.getClientVersion();
     let cleanupPromise;
     const cleanup = () => {
-        cleanupPromise ??= deps.engine.close();
+        cleanupPromise ??= Promise.all([
+            deps.credentialLogin.close(),
+            deps.engine.close(),
+            deps.auditWriter?.close() ?? Promise.resolve(),
+        ]).then(() => undefined);
         return cleanupPromise;
     };
     server.server.onclose = () => {

package/dist/tools/common/public-formatters.d.ts

@@ -57,6 +57,8 @@ export declare function toPublicQueryResult(result: QueryResult): {
     row_truncated: boolean;
     column_truncated: boolean;
     field_truncated: boolean;
+    byte_truncated: boolean;
+    returned_bytes: number;
     redacted_columns: string[];
     dropped_columns: string[];
     truncated_columns: string[];
@@ -78,6 +80,8 @@ export declare function toPublicGuardrailDecision(decision: GuardrailDecision):
         max_rows: number;
         max_columns: number;
         max_field_chars: number;
+        max_result_bytes: number;
+        max_blob_bytes: number;
     };
 };
 export declare function toPublicExplainResult(result: ExplainResult, decision: GuardrailDecision): {
@@ -105,6 +109,8 @@ export declare function toPublicExplainResult(result: ExplainResult, decision: G
             max_rows: number;
             max_columns: number;
             max_field_chars: number;
+            max_result_bytes: number;
+            max_blob_bytes: number;
         };
     };
 };
@@ -146,6 +152,8 @@ export declare function toPublicEnhancedExplainResult(result: EnhancedExplainRes
                 max_rows: number;
                 max_columns: number;
                 max_field_chars: number;
+                max_result_bytes: number;
+                max_blob_bytes: number;
             };
         };
     };

package/dist/tools/common/public-formatters.js

@@ -67,6 +67,8 @@ export function toPublicQueryResult(result) {
         row_truncated: result.rowTruncated,
         column_truncated: result.columnTruncated,
         field_truncated: result.fieldTruncated,
+        byte_truncated: result.byteTruncated,
+        returned_bytes: result.returnedBytes,
         redacted_columns: result.redactedColumns,
         dropped_columns: result.droppedColumns,
         truncated_columns: result.truncatedColumns,
@@ -92,6 +94,8 @@ export function toPublicGuardrailDecision(decision) {
             max_rows: decision.runtimeLimits.maxRows,
             max_columns: decision.runtimeLimits.maxColumns,
             max_field_chars: decision.runtimeLimits.maxFieldChars,
+            max_result_bytes: decision.runtimeLimits.maxResultBytes,
+            max_blob_bytes: decision.runtimeLimits.maxBlobBytes,
         },
     };
 }

package/dist/tools/error-handling.js

@@ -1,4 +1,4 @@
-import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, logger, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
+import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, logger, QueryConcurrencyError, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
 import { ErrorCode, formatError, } from "../utils/formatter.js";
 export class ToolInputError extends Error {
     constructor(message) {
@@ -100,6 +100,15 @@ export function formatToolError(error, context) {
             details: detailsOf(error),
         });
     }
+    if (error instanceof QueryConcurrencyError) {
+        return formatError({
+            code: ErrorCode.SERVER_BUSY,
+            message: error.message,
+            summary: `${context.action} could not start because query capacity is exhausted.`,
+            metadata: context.metadata,
+            retryable: true,
+        });
+    }
     if (cancelledLikely(error)) {
         return formatError({
             code: ErrorCode.QUERY_CANCELLED,

package/dist/tools/query.js

@@ -12,23 +12,24 @@ async function inspectSql(toolName, sql, ctx, deps) {
         context: ctx,
     });
 }
-async function ensureConfirmation(decision, ctx, deps, taskId, confirmationToken) {
+async function ensureConfirmation(decision, ctx, deps, invokeContext, approvalToken) {
     if (!decision.requiresConfirmation) {
         return undefined;
     }
-    const responseMetadata = metadata(taskId, {
+    const responseMetadata = metadata(invokeContext.taskId, {
         sql_hash: decision.sqlHash,
         statement_type: statementTypeFromSql(decision.normalizedSql),
     });
-    if (confirmationToken) {
-        const validation = await deps.engine.validateConfirmation(confirmationToken, decision.normalizedSql, ctx);
+    if (approvalToken) {
+        const validation = await deps.engine.validateConfirmation(approvalToken, decision.normalizedSql, ctx);
         if (validation.valid) {
+            invokeContext.approvalActor = validation.actor;
             return undefined;
         }
         return formatError({
             code: ErrorCode.CONFIRMATION_INVALID,
-            message: validation.reason ?? "Confirmation token validation failed.",
-            summary: "The provided confirmation token is invalid for this SQL statement.",
+            message: validation.reason ?? "Approval token validation failed.",
+            summary: "The provided external approval is invalid for this SQL statement.",
             metadata: responseMetadata,
             details: {
                 reason_codes: validation.reasonCodes,
@@ -37,9 +38,10 @@ async function ensureConfirmation(decision, ctx, deps, taskId, confirmationToken
         });
     }
     const outcome = await deps.engine.handleConfirmation(decision, ctx);
-    if (outcome.status === "token_issued") {
+    if (outcome.status === "approval_required") {
         return formatConfirmationRequired({
-            confirmationToken: outcome.token,
+            approvalRequest: outcome.request,
+            requestId: outcome.requestId,
             metadata: responseMetadata,
             riskLevel: decision.riskLevel,
             sqlHash: decision.sqlHash,
@@ -53,7 +55,7 @@ export const executeReadonlySqlTool = {
     inputSchema: {
         ...contextInputShape,
         sql: requiredSqlSchema("Readonly SQL to execute."),
-        confirmation_token: optionalTokenSchema(),
+        approval_token: optionalTokenSchema(),
     },
     async handler(input, deps, context) {
         const sql = asRequiredString(input.sql, "sql");
@@ -76,7 +78,7 @@ export const executeReadonlySqlTool = {
                     },
                 });
             }
-            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
+            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context, asOptionalString(input.approval_token, "approval_token"));
             if (confirmationResponse) {
                 return confirmationResponse;
             }
@@ -85,6 +87,9 @@ export const executeReadonlySqlTool = {
                 maxRows: decision.runtimeLimits.maxRows,
                 maxColumns: decision.runtimeLimits.maxColumns,
                 maxFieldChars: decision.runtimeLimits.maxFieldChars,
+                maxResultBytes: decision.runtimeLimits.maxResultBytes,
+                maxBlobBytes: decision.runtimeLimits.maxBlobBytes,
+                maskAllColumns: decision.runtimeLimits.maskAllColumns,
             });
             return formatSuccess(toPublicQueryResult(result), {
                 summary: summarizeRows(result.rowCount, result.truncated),
@@ -161,7 +166,7 @@ export const executeSqlTool = {
     inputSchema: {
         ...contextInputShape,
         sql: requiredSqlSchema("Mutation SQL to execute."),
-        confirmation_token: optionalTokenSchema(),
+        approval_token: optionalTokenSchema(),
     },
     async handler(input, deps, context) {
         const sql = asRequiredString(input.sql, "sql");
@@ -184,7 +189,7 @@ export const executeSqlTool = {
                     },
                 });
             }
-            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context.taskId, asOptionalString(input.confirmation_token, "confirmation_token"));
+            const confirmationResponse = await ensureConfirmation(decision, ctx, deps, context, asOptionalString(input.approval_token, "approval_token"));
             if (confirmationResponse) {
                 return confirmationResponse;
             }
@@ -219,5 +224,5 @@ function optionalTokenSchema() {
         .trim()
         .min(1)
         .optional()
-        .describe("Confirmation token returned by a previous guarded call when required.");
+        .describe("Externally signed approval token produced by `taurusdb-mcp approve`.");
 }