taurusdb-mcp 0.5.0-rc.6 → 0.5.0-rc.7

package/README.md

@@ -94,6 +94,7 @@ npx taurusdb-mcp credentials check
 - Recycle-bin request/status tools are visible by default: `prepare_recycle_bin_restore` performs readonly preflight and the loopback-only operator page requires the Agent-invisible HttpOnly browser session established by database login before executing one target-bound native restore with the active in-memory SQL session; no secret file, direct restore tool, or Agent-held execution token is required
 - `analyze_mutation_sql` returns evidence-backed SQL Advice with `execution_status: not_executed`
 - Selecting a cloud instance returns a local SQL login link immediately; login validates the connection before binding credentials, allows at most three attempts per five-minute link, and never sends the password through Agent-visible tool arguments
+- Interactive instance selection binds the read/write public IP and fails immediately when the instance has no public IP; it never falls back to a VPC-private address that a local MCP client cannot route to
 - Instance selection and local login tools are enabled by default; fixed static deployments may set `TAURUSDB_ENABLE_DYNAMIC_TARGETS=false`
 - Session SQL credentials expire after 30 idle minutes and eight absolute hours; administrators may shorten these limits with `TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES` and `TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES`
 - MCP audit events are written to `~/.taurusdb-mcp/audit.jsonl` by default, with

package/dist/tools/taurus/cloud-context.js

@@ -66,7 +66,7 @@ async function resolveBindingDatasource(deps, explicit) {
     return deps.engine.getDefaultDataSource();
 }
 function selectInstanceAddress(input) {
-    return input.privateIps[0] ?? input.hostnames[0] ?? input.publicIps[0];
+    return input.publicIps[0];
 }
 function normalizePort(port) {
     if (typeof port === "number" && Number.isFinite(port)) {
@@ -327,7 +327,7 @@ export const selectCloudTaurusInstanceTool = {
                 throw new ToolInputError("No datasource template is available for SQL login. Configure TAURUSDB_DEFAULT_DATASOURCE or pass datasource explicitly.");
             }
             if (!selectedHost) {
-                throw new ToolInputError(`Cloud instance ${matched.id} does not expose a database address that can be bound for SQL login.`);
+                throw new ToolInputError(`Cloud instance ${matched.id} does not have a public database IP. Enable a read/write public IP and restrict port ${selectedPort ?? 3306} to the MCP client's egress IP before using local SQL login.`);
             }
             await updateSessionState(deps, (nextConfig) => {
                 nextConfig.cloud.projectId = projectId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-mcp",
-  "version": "0.5.0-rc.6",
+  "version": "0.5.0-rc.7",
   "description": "TaurusDB MCP server for Claude, Cursor, VS Code, and other MCP clients.",
   "license": "MIT",
   "repository": {
@@ -44,7 +44,7 @@
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "taurusdb-core": "0.5.0-rc.6",
+    "taurusdb-core": "0.5.0-rc.7",
     "@modelcontextprotocol/sdk": "^1.17.0",
     "mysql2": "^3.22.1",
     "zod": "^3.24.1"