mcpg 0.8.2__tar.gz → 0.8.4__tar.gz

mcpg-0.8.4/.oss-scanner/README.md

@@ -0,0 +1,43 @@
+# OSS Scanner enrollment
+
+Artifacts for enrolling MCPg in [Anthropic's OSS
+Scanner](https://github.com/anthropics/oss-scanner), a service that builds a
+project in an isolated, no-network VM and runs a Claude-powered security scan,
+emailing findings (with reproduction steps and proposed patches) privately to
+the `primary_contact`.
+
+Files here:
+
+- **`Dockerfile`** — the build image the scanner uses. MCPg is pure Python, so
+  it just installs the full source + dependency environment (runtime + dev,
+  for the adversarial test suites) at build time; the checkout lands at `/src`
+  per the scanner contract.
+- **`threat_model.md`** — steers the scan at MCPg's real surface: the SQL-safety
+  allowlist, access-mode / tenancy gates, OIDC auth, and the shell tools, with
+  app-security severity tiers.
+- **`project.yaml`** — the enrollment manifest (reference copy; see below).
+
+## How to enroll (maintainer, one-time)
+
+The scanner is enrolled by a pull request **to the `anthropics/oss-scanner`
+repo** — which is separate from this one, so it must be opened by a maintainer
+(fork + PR):
+
+1. Fork `anthropics/oss-scanner`.
+2. Add `projects/mcpg/project.yaml` with the contents of
+   [`project.yaml`](project.yaml) in this directory (it already points
+   `dockerfile` / `threat_model` at the paths here in `devopam/MCPg`, so the
+   scanner pulls them from this repo — nothing else to copy).
+3. Optionally run their local checks first: `tools/validate.py` then
+   `tools/check mcpg` (needs Docker + Python + PyYAML).
+4. Open the PR. After Anthropic merges it, scans run and findings are emailed
+   to `primary_contact`.
+
+## Notes
+
+- Enrollment is reviewed/merged by Anthropic and targets "critical" OSS —
+  acceptance is their call.
+- Reports are model-generated and not human-reviewed (no public disclosure);
+  treat findings as leads to verify, per the project's adversarial-test
+  discipline.
+- To pin the scanned revision, add `#<tag>` to `repo` in `project.yaml`.

{mcpg-0.8.2 → mcpg-0.8.4}/CHANGELOG.md

@@ -6,6 +6,118 @@ adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.8.4] - 2026-11-03
+
+A patch release: no tool added, removed or renamed (tool surface unchanged). It carries the `mcp` 2.2.0 security bump, tool-error-message fixes for `mcp` 2.x, and the Cursor Marketplace plugin sources. See [release notes](docs/release-notes-0.8.4.md).
+
+### Added
+
+- **MCP ServerList tutorial badge** next to the existing listing badge in the README
+  ([mcp-serverlist.com/mcp/mcpg](https://mcp-serverlist.com/mcp/mcpg); GH #365).
+- **Cursor Marketplace plugin sources.** `.cursor-plugin/plugin.json` plus
+  `packaging/cursor/mcp.json` package MCPg as a Cursor plugin (`uvx mcpg@X.Y.Z`, DSN
+  and access mode as `${VAR}` placeholders). Version is synced by
+  `packaging/cursor/sync_plugin_version.py` and guarded by `tests/unit/test_cursor_plugin.py`.
+  Submit the public repo at [cursor.com/marketplace/publish](https://cursor.com/marketplace/publish);
+  listing is a manual Cursor review, not a publish-workflow step.
+
+### Security
+
+- **`pyasn1` ≥ 0.6.5** (`gcp` extra, via google-auth; GHSA-9m75-vc3g-4x39, GHSA-mm57-4v3p-rchx, GHSA-fm9c-5rcf-2q5p,
+  GHSA-2qm8-x737-gmw5: quadratic-time DoS in BER/CER/DER decoding).
+- **`mcp` 2.0.0 → 2.2.0** (GHSA-84m7-p3x7-pcfv, CVE-2026-59951: unbounded session accumulation in the StreamableHTTP
+  transport). (Dependabot #356)
+- **`certifi` ≥ 2026.10.19** (GHSA-6q48-6c7w-9gw2 / PYSEC-2026-4320: bundled emSign roots with compromised
+  intermediate CA keys). Floor declared next to `httpx`.
+- **OpenTelemetry `api`/`sdk`/`exporter-otlp-proto-http` ≥ 1.45.1** (GHSA-xcq7-p3pf-p88h: unbounded tracestate
+  parsing in `opentelemetry-api`).
+- **`virtualenv` ≥ 21.14.9** (dev extra; pre-commit's dependency) to clear CVE-2026-113716–113776
+  (activation scripts, symlink-following file creation).
+- **`filelock` ≥ 4.2.1** (dev; CVE-2026-112940 and Windows ReadWriteLock / oplock GHSAs) and
+  **`msgpack` ≥ 1.2.3** (dev; CVE-2026-114613).
+
+### Fixed
+
+- **Tool error messages survive `mcp` 2.2.0.** The SDK now replaces the message of any exception that is not a
+  `ToolError` with a generic "Error executing tool <name>". MCPg's own errors (`MCPgError` subclasses, e.g. an
+  unconfigured NL→SQL provider that names the env var to set) are re-raised as `ToolError` by the call wrapper, and the
+  audit log records their text; the heavy-diagnostics gate raises `ToolError`. Unexpected exceptions keep the SDK's
+  generic message. The wrapper reads the `MCPgError` from the exception's `__cause__` or, failing that, its `__context__`
+  (CodeRabbit on #356).
+- **`run_select` keeps the validator's inner verdict** (GH #364). `Error validating query: <sql>` now includes the
+  cause (`Function pg_read_file is not allowed`, …) so mcp 2.x `ToolError` wrapping does not leave the client with
+  only the SQL text. Client-session tests cover a disallowed function and an undefined-column error. Disallowed-statement
+  messages no longer append `str(stmt)` AST dumps (those can render literal passwords).
+
+### Changed
+
+- **SQL allowlist: `jsonb_exists`, `jsonb_exists_any`, `jsonb_exists_all`.** These are the function spellings of the
+  already-allowed jsonb operators `?` / `?|` / `?&` (GH #364).
+
+## [0.8.3] - 2026-10-14
+
+A feature release by content (new tools and opt-in flags, nothing removed or renamed), shipped as a patch per the maintainer's call: the default tool surface only gains five read-only tools, and every new write or admin tool needs an explicit `MCPG_ALLOW_*` flag. See [release notes](docs/release-notes-0.8.3.md).
+
+### Added
+
+- **`ALTER SYSTEM` GUC tools.** `inspect_guc` (read), plus `alter_system`, `alter_system_reset_all` and
+  `reload_config` behind unrestricted mode + `MCPG_ALLOW_ALTER_SYSTEM`. Runs on an autocommit connection,
+  requires `confirm=true` plus a per-statement `confirmation_token`, and blocks connectivity/preload GUCs and
+  settings that run OS commands or hold credentials (`archive_command`, `restore_command`, `primary_conninfo`, …) by
+  default (`MCPG_ALTER_SYSTEM_ALLOWLIST` / `MCPG_ALTER_SYSTEM_DENYLIST`). `RESET ALL` enforces that policy on every
+  current override, `inspect_guc` redacts secret-bearing values, and the write tools refuse to run under
+  `MCPG_DEFAULT_ROLE` / `MCPG_ALLOWED_ROLES`. See `docs/alter-system.md`. (PR #352)
+- **TimescaleDB read-only functions are now allowed in the SQL-safety kernel** (#353): `time_bucket`, `time_bucket_gapfill`,
+  `first`/`last`, `locf`, `interpolate`, `histogram`, the `hypertable_*_size` / `*_compression_stats` / `*_columnstore_stats`
+  family, `show_chunks`, `by_range`/`by_hash`, the uuidv7 helpers and `timescaledb_experimental.show_policies`. Mutating
+  functions, procedures, `timescaledb_pre/post_restore` and `get_telemetry_report` stay blocked.
+- **TimescaleDB tool family** (design: `docs/plans/timescaledb-tools.md`, reference: `docs/timescaledb.md`): reads
+  `get_hypertable_stats`, `list_timescale_jobs`, `list_continuous_aggregates`, `get_timescaledb_telemetry_report`;
+  additive DDL `add_dimension`, `set_chunk_time_interval`, `add_continuous_aggregate_policy`, `add_reorder_policy` and four
+  `remove_*_policy` tools; and, behind the new `MCPG_ALLOW_TIMESCALEDB_ADMIN` flag with a `dry_run` / `confirm` +
+  `confirmation_token` flow, `drop_chunks`, `compress_chunk`, `decompress_chunk`, `reorder_chunk`, `merge_chunks`,
+  `refresh_continuous_aggregate`, `run_job`, `alter_job`, `delete_job`. Behaviour was verified on TimescaleDB 2.30.2, and a
+  new experimental `TimescaleDB` CI job runs the integration tests.
+
+### Security
+
+- **Bumped `pyjwt` to ≥ 2.15.0 (2.15.1 resolved)** to clear the October 2026
+  advisory cascade against 2.13.0 — thirteen `PYSEC-2026-414x` findings plus
+  `CVE-2026-102275`, all flagged by `pip-audit --strict` and fixed in
+  2.14.0 / 2.15.0. 2.15's `PyJWKClient` hardened its JWKS fetch against SSRF
+  (own `build_opener`/no-redirect handler instead of the module-level
+  `urllib.request.urlopen`); the OIDC verifier uses the stable public API so
+  no source change was needed, but the `test_oidc.py` JWKS mock now patches
+  pyjwt's `PyJWKClient.fetch_data` boundary rather than urllib internals.
+
+### Changed
+
+- **`pglast` 8.4 → 8.5** (PR #350; `uv.lock` updated). The SQL-safety kernel's adversarial and fuzz suites pass on 8.5.
+- **The contract fixtures now enable `MCPG_ALLOW_ALTER_SYSTEM` and `MCPG_ALLOW_TIMESCALEDB_ADMIN`**, so the tool-surface
+  snapshot (now 281 tools), annotations and return-shape contracts cover the ALTER SYSTEM and TimescaleDB admin tools.
+- **ORM exporters explain why they reject delimited names.** `generate_prisma_schema` and the Drizzle,
+  SQLAlchemy, sqlc, Diesel, jOOQ, Ent and Ecto exporters still accept only plain `[A-Za-z_][A-Za-z0-9_]*`
+  names (the name becomes an identifier in generated source), but their errors and tool descriptions now
+  say so and point at the SQL tools that accept delimited names.
+
+### Fixed
+
+- `docs/tools.md` tool-index heading and the hand-written tool counts (README, tour, user guide) were stale; regenerated.
+- **SQL-safety fuzz harness now actually explores the validator.** `sql_safety_fuzzer` decoded its input
+  with `ConsumeUnicodeNoSurrogates`, which turns ASCII SQL into garbage code points, so `pglast` rejected
+  nearly every input at the first token and coverage never grew. It now decodes bytes directly and ships a
+  seed corpus and SQL dictionary (`.clusterfuzzlite/`); a 60 s run goes from `cov: 4` to `cov: 277`. Roadmap 23.1.
+
+### Documentation
+
+- New [`docs/identifier-policy.md`](docs/identifier-policy.md): which names SQL tools accept
+  (delimited identifiers via `quote_identifier`) versus the plain-identifier-only sinks and why.
+- README "Safe by default" no longer claims identifiers go through a strict regex; `adding-tools.md`
+  now recommends `quote_identifier`; the `subscribe_channel` description and a `config.py` comment no
+  longer claim plain-identifier-only names.
+- `CODE_OF_CONDUCT.md` (Contributor Covenant 2.1) is now linked from the README, `CONTRIBUTING.md` and
+  the docs index.
+
 ## [0.8.2] - 2026-09-04
 
 ### Added

{mcpg-0.8.2 → mcpg-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpg
-Version: 0.8.2
+Version: 0.8.4
 Summary: A production-grade PostgreSQL Model Context Protocol (MCP) server.
 Project-URL: Homepage, https://github.com/devopam/MCPg
 Project-URL: Documentation, https://github.com/devopam/MCPg#documentation
@@ -31,24 +31,26 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Systems Administration
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: circuitbreaker>=2.1.3
 Requires-Dist: httpx>=0.27
 Requires-Dist: mcp-types>=2.0.0
-Requires-Dist: mcp[cli]>=2.0.0
-Requires-Dist: pglast==8.4
+Requires-Dist: mcp[cli]>=2.2.0
+Requires-Dist: pglast==8.5
 Requires-Dist: psycopg-pool>=3.3.0
 Requires-Dist: psycopg[binary]>=3.3.2
-Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: pyjwt[crypto]>=2.15.0
 Requires-Dist: tenacity>=9.1.4
 Requires-Dist: typing-extensions>=4.12
 Provides-Extra: aws
 Requires-Dist: boto3>=1.28; extra == 'aws'
 Provides-Extra: gcp
 Requires-Dist: google-cloud-secret-manager>=2.16; extra == 'gcp'
+Requires-Dist: pyasn1>=0.6.5; extra == 'gcp'
 Provides-Extra: otel
-Requires-Dist: opentelemetry-api>=1.27; extra == 'otel'
-Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.27; extra == 'otel'
-Requires-Dist: opentelemetry-sdk>=1.27; extra == 'otel'
+Requires-Dist: opentelemetry-api>=1.45.1; extra == 'otel'
+Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.45.1; extra == 'otel'
+Requires-Dist: opentelemetry-sdk>=1.45.1; extra == 'otel'
 Provides-Extra: vault
 Requires-Dist: hvac>=1.0; extra == 'vault'
 Description-Content-Type: text/markdown
@@ -61,7 +63,7 @@ Description-Content-Type: text/markdown
 
 **A production-grade [Model Context Protocol](https://modelcontextprotocol.io)
 server for PostgreSQL.** It lets AI agents safely inspect, query, operate, and
-tune a Postgres database — 254 tools spanning catalog introspection,
+tune a Postgres database — 279 tools spanning catalog introspection,
 query intelligence, natural-language SQL, structural diffs, hybrid search,
 graph queries, data movement, live ops, and more.
 
@@ -77,6 +79,8 @@ graph queries, data movement, live ops, and more.
 [![MCPg MCP server](https://glama.ai/mcp/servers/devopam/MCPg/badges/score.svg)](https://glama.ai/mcp/servers/devopam/MCPg)
 [![AllMCPs Verified](https://allmcps.com/api/badge/devopam-mcpg)](https://allmcps.com/mcp/devopam-mcpg?verify=63d9d537-be6b-4e07-a720-77dd0c41411b)
 [![MCPVault: claimed](https://mcpvault.io/badge/mcpg.svg?theme=dark)](https://mcpvault.io/servers/mcpg/health?utm_source=external_badge&utm_medium=referral&utm_campaign=mcp_health_report)
+[![Listed on MCP ServerList](https://mcp-serverlist.com/api/badge/mcpg)](https://mcp-serverlist.com/mcp/mcpg)
+[![MCP Tutorial](https://mcp-serverlist.com/api/badge/mcpg/tutorial)](https://mcp-serverlist.com/mcp/mcpg/tutorial)
 
 > **Try it live:** point an MCP client — or the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) — at the hosted, read-only demo endpoint `https://devopam-mcpg-demo.hf.space/mcp`. It serves read tools against throwaway demo data; for real use, run MCPg next to your own database (see [Quick start](#quick-start)).
 
@@ -87,6 +91,7 @@ graph queries, data movement, live ops, and more.
 - **[mcpservers.org](https://mcpservers.org/servers/devopam/mcpg)**
 - **[Smithery](https://smithery.ai/servers/devopam/mcpg)**
 - **[Glama](https://glama.ai/mcp/servers/devopam/MCPg)**
+- **[MCP ServerList](https://mcp-serverlist.com/mcp/mcpg)**
 
 ---
 
@@ -102,9 +107,9 @@ graph queries, data movement, live ops, and more.
 
 - **Safe by default.** Read-only access mode. Every user-supplied SQL
   statement parses through a validated AST allowlist before execution.
-  Identifier interpolation flows through a strict
-  `[A-Za-z_][A-Za-z0-9_]*` regex — a design constraint that means
-  user input never reaches the database through string concatenation.
+  Names that reach PostgreSQL as SQL identifiers are encoded with
+  delimited-identifier quoting (see [Identifier policy](docs/identifier-policy.md)),
+  not rejected merely for containing hyphens or other legal characters.
   Capabilities like DDL, shell, and `LISTEN/NOTIFY` are off until you
   opt in. Every tool publishes MCP `ToolAnnotations` (`readOnlyHint`,
   `openWorldHint`) derived from those same gates, so clients can
@@ -313,6 +318,8 @@ are one-shot commands, not configuration). The only required one is
 |---|---|---|
 | `MCPG_ALLOW_DDL` | `false` | Expose DDL tools (`run_ddl`, `create_graph`, `drop_graph`, hypertable tools, migration tools). Requires `MCPG_ACCESS_MODE=unrestricted`. |
 | `MCPG_ALLOW_SHELL` | `false` | Expose subprocess-backed tools (`dump_database`, `restore_database`, `run_pg_binary`). Required PG client binaries must be on `PATH`. |
+| `MCPG_ALLOW_TIMESCALEDB_ADMIN` | `false` | With unrestricted mode + `MCPG_ALLOW_DDL`, expose the destructive / heavy TimescaleDB tools (`drop_chunks`, `compress_chunk`, `decompress_chunk`, `reorder_chunk`, `merge_chunks`, `refresh_continuous_aggregate`, `run_job`, `alter_job`, `delete_job`); each needs `dry_run` then `confirm=true` + `confirmation_token`. See [docs/timescaledb.md](docs/timescaledb.md). |
+| `MCPG_ALLOW_ALTER_SYSTEM` | `false` | Expose `alter_system`, `alter_system_reset_all`, `reload_config` (unrestricted mode only; two-step `confirm=true` flow — see [docs/alter-system.md](docs/alter-system.md)). `MCPG_ALTER_SYSTEM_ALLOWLIST` / `MCPG_ALTER_SYSTEM_DENYLIST` (comma-separated GUC names) narrow or extend the built-in denylist. |
 | `MCPG_ALLOW_LISTEN` | `false` | Expose `LISTEN/NOTIFY` tools (`subscribe_channel`, `poll_notifications`, `unsubscribe_channel`, `list_notification_subscriptions`). |
 
 #### Authentication (HTTP transports only)
@@ -597,9 +604,11 @@ Compact category list. For the full, current tool reference see
 - **Server-side cursors** — `open_cursor`, `fetch_cursor`,
   `close_cursor`, `list_cursors` for pageable reads over millions
   of rows.
-- **TimescaleDB** — `list_hypertables`, `list_chunks`,
-  `create_hypertable`, `add_compression_policy`,
-  `add_retention_policy`.
+- **TimescaleDB** — hypertable / chunk / job / continuous-aggregate
+  introspection and stats, policy and dimension management, and gated
+  chunk / job administration (`drop_chunks`, `compress_chunk`,
+  `refresh_continuous_aggregate`, `run_job`, …). See
+  [docs/timescaledb.md](docs/timescaledb.md).
 - **ORM schema exporters** — Prisma, Drizzle, SQLAlchemy, sqlc,
   Diesel, jOOQ, Ent, Ecto.
 - **Event streams** — `subscribe_channel`, `poll_notifications`,
@@ -661,7 +670,9 @@ page for downloadable artifacts.
 
 Pull requests welcome — see [`CONTRIBUTING.md`](https://github.com/devopam/MCPg/blob/main/CONTRIBUTING.md) for
 the dev-loop setup, test conventions, and the per-PR review
-checklist.
+checklist. Participation is governed by the
+[Code of Conduct](https://github.com/devopam/MCPg/blob/main/CODE_OF_CONDUCT.md)
+(Contributor Covenant 2.1).
 
 ---
 

{mcpg-0.8.2 → mcpg-0.8.4}/README.md

@@ -6,7 +6,7 @@
 
 **A production-grade [Model Context Protocol](https://modelcontextprotocol.io)
 server for PostgreSQL.** It lets AI agents safely inspect, query, operate, and
-tune a Postgres database — 254 tools spanning catalog introspection,
+tune a Postgres database — 279 tools spanning catalog introspection,
 query intelligence, natural-language SQL, structural diffs, hybrid search,
 graph queries, data movement, live ops, and more.
 
@@ -22,6 +22,8 @@ graph queries, data movement, live ops, and more.
 [![MCPg MCP server](https://glama.ai/mcp/servers/devopam/MCPg/badges/score.svg)](https://glama.ai/mcp/servers/devopam/MCPg)
 [![AllMCPs Verified](https://allmcps.com/api/badge/devopam-mcpg)](https://allmcps.com/mcp/devopam-mcpg?verify=63d9d537-be6b-4e07-a720-77dd0c41411b)
 [![MCPVault: claimed](https://mcpvault.io/badge/mcpg.svg?theme=dark)](https://mcpvault.io/servers/mcpg/health?utm_source=external_badge&utm_medium=referral&utm_campaign=mcp_health_report)
+[![Listed on MCP ServerList](https://mcp-serverlist.com/api/badge/mcpg)](https://mcp-serverlist.com/mcp/mcpg)
+[![MCP Tutorial](https://mcp-serverlist.com/api/badge/mcpg/tutorial)](https://mcp-serverlist.com/mcp/mcpg/tutorial)
 
 > **Try it live:** point an MCP client — or the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) — at the hosted, read-only demo endpoint `https://devopam-mcpg-demo.hf.space/mcp`. It serves read tools against throwaway demo data; for real use, run MCPg next to your own database (see [Quick start](#quick-start)).
 
@@ -32,6 +34,7 @@ graph queries, data movement, live ops, and more.
 - **[mcpservers.org](https://mcpservers.org/servers/devopam/mcpg)**
 - **[Smithery](https://smithery.ai/servers/devopam/mcpg)**
 - **[Glama](https://glama.ai/mcp/servers/devopam/MCPg)**
+- **[MCP ServerList](https://mcp-serverlist.com/mcp/mcpg)**
 
 ---
 
@@ -47,9 +50,9 @@ graph queries, data movement, live ops, and more.
 
 - **Safe by default.** Read-only access mode. Every user-supplied SQL
   statement parses through a validated AST allowlist before execution.
-  Identifier interpolation flows through a strict
-  `[A-Za-z_][A-Za-z0-9_]*` regex — a design constraint that means
-  user input never reaches the database through string concatenation.
+  Names that reach PostgreSQL as SQL identifiers are encoded with
+  delimited-identifier quoting (see [Identifier policy](docs/identifier-policy.md)),
+  not rejected merely for containing hyphens or other legal characters.
   Capabilities like DDL, shell, and `LISTEN/NOTIFY` are off until you
   opt in. Every tool publishes MCP `ToolAnnotations` (`readOnlyHint`,
   `openWorldHint`) derived from those same gates, so clients can
@@ -258,6 +261,8 @@ are one-shot commands, not configuration). The only required one is
 |---|---|---|
 | `MCPG_ALLOW_DDL` | `false` | Expose DDL tools (`run_ddl`, `create_graph`, `drop_graph`, hypertable tools, migration tools). Requires `MCPG_ACCESS_MODE=unrestricted`. |
 | `MCPG_ALLOW_SHELL` | `false` | Expose subprocess-backed tools (`dump_database`, `restore_database`, `run_pg_binary`). Required PG client binaries must be on `PATH`. |
+| `MCPG_ALLOW_TIMESCALEDB_ADMIN` | `false` | With unrestricted mode + `MCPG_ALLOW_DDL`, expose the destructive / heavy TimescaleDB tools (`drop_chunks`, `compress_chunk`, `decompress_chunk`, `reorder_chunk`, `merge_chunks`, `refresh_continuous_aggregate`, `run_job`, `alter_job`, `delete_job`); each needs `dry_run` then `confirm=true` + `confirmation_token`. See [docs/timescaledb.md](docs/timescaledb.md). |
+| `MCPG_ALLOW_ALTER_SYSTEM` | `false` | Expose `alter_system`, `alter_system_reset_all`, `reload_config` (unrestricted mode only; two-step `confirm=true` flow — see [docs/alter-system.md](docs/alter-system.md)). `MCPG_ALTER_SYSTEM_ALLOWLIST` / `MCPG_ALTER_SYSTEM_DENYLIST` (comma-separated GUC names) narrow or extend the built-in denylist. |
 | `MCPG_ALLOW_LISTEN` | `false` | Expose `LISTEN/NOTIFY` tools (`subscribe_channel`, `poll_notifications`, `unsubscribe_channel`, `list_notification_subscriptions`). |
 
 #### Authentication (HTTP transports only)
@@ -542,9 +547,11 @@ Compact category list. For the full, current tool reference see
 - **Server-side cursors** — `open_cursor`, `fetch_cursor`,
   `close_cursor`, `list_cursors` for pageable reads over millions
   of rows.
-- **TimescaleDB** — `list_hypertables`, `list_chunks`,
-  `create_hypertable`, `add_compression_policy`,
-  `add_retention_policy`.
+- **TimescaleDB** — hypertable / chunk / job / continuous-aggregate
+  introspection and stats, policy and dimension management, and gated
+  chunk / job administration (`drop_chunks`, `compress_chunk`,
+  `refresh_continuous_aggregate`, `run_job`, …). See
+  [docs/timescaledb.md](docs/timescaledb.md).
 - **ORM schema exporters** — Prisma, Drizzle, SQLAlchemy, sqlc,
   Diesel, jOOQ, Ent, Ecto.
 - **Event streams** — `subscribe_channel`, `poll_notifications`,
@@ -606,7 +613,9 @@ page for downloadable artifacts.
 
 Pull requests welcome — see [`CONTRIBUTING.md`](https://github.com/devopam/MCPg/blob/main/CONTRIBUTING.md) for
 the dev-loop setup, test conventions, and the per-PR review
-checklist.
+checklist. Participation is governed by the
+[Code of Conduct](https://github.com/devopam/MCPg/blob/main/CODE_OF_CONDUCT.md)
+(Contributor Covenant 2.1).
 
 ---
 

{mcpg-0.8.2 → mcpg-0.8.4}/packaging/mcpb/pyproject.toml

@@ -5,9 +5,9 @@
 # to the release tag by the publish workflow, exactly like server.json.
 [project]
 name = "mcpg-desktop-extension"
-version = "0.8.2"
+version = "0.8.4"
 description = "MCPB launcher shim for the MCPg PostgreSQL MCP server."
 requires-python = ">=3.12"
 dependencies = [
-    "mcpg==0.8.2",
+    "mcpg==0.8.4",
 ]

{mcpg-0.8.2 → mcpg-0.8.4}/pyproject.toml

@@ -50,20 +50,26 @@ classifiers = [
 ]
 
 dependencies = [
-    "mcp[cli]>=2.0.0",
+    "mcp[cli]>=2.2.0",
     "psycopg[binary]>=3.3.2",
     "psycopg-pool>=3.3.0",
-    "pglast==8.4",
+    "pglast==8.5",
     "typing-extensions>=4.12",
     # httpx ships transitively via mcp; declare it explicitly so the
     # NL→SQL providers in mcpg.nl2sql have a guaranteed surface.
     "httpx>=0.27",
+    # httpx pulls certifi; floor raised to 2026.10.19 to drop the
+    # bundled emSign roots with compromised intermediate CA keys
+    # (GHSA-6q48-6c7w-9gw2 / PYSEC-2026-4320).
+    "certifi>=2026.10.19",
     # mcp-types ships transitively via mcp; declare it explicitly so
     # mcpg.dynamic_session_intent has a guaranteed surface.
     "mcp-types>=2.0.0",
     # JWT validation for the OIDC auth path. ``[crypto]`` pulls in
-    # ``cryptography`` so RS256 / ES256 signature checks work.
-    "pyjwt[crypto]>=2.8",
+    # ``cryptography`` so RS256 / ES256 signature checks work. Floor raised
+    # to 2.15.0 to clear the 2026 pyjwt advisories (PYSEC-2026-414x +
+    # CVE-2026-102275), all fixed in 2.14.0 / 2.15.0.
+    "pyjwt[crypto]>=2.15.0",
     "circuitbreaker>=2.1.3",
     "tenacity>=9.1.4",
 ]
@@ -75,9 +81,9 @@ dependencies = [
 # collector over HTTP/protobuf.
 [project.optional-dependencies]
 otel = [
-    "opentelemetry-api>=1.27",
-    "opentelemetry-sdk>=1.27",
-    "opentelemetry-exporter-otlp-proto-http>=1.27",
+    "opentelemetry-api>=1.45.1",
+    "opentelemetry-sdk>=1.45.1",
+    "opentelemetry-exporter-otlp-proto-http>=1.45.1",
 ]
 # Cloud secrets backends — selected by ``MCPG_SECRETS_BACKEND=vault|aws|gcp``.
 # Each is its own extra so a deployment doesn't pay for every cloud SDK
@@ -87,7 +93,10 @@ otel = [
 # selected a backend but forgot the extra.
 vault = ["hvac>=1.0"]
 aws = ["boto3>=1.28"]
-gcp = ["google-cloud-secret-manager>=2.16"]
+# pyasn1 arrives via google-auth -> pyasn1-modules; floor 0.6.5 clears the
+# quadratic-time DoS advisories (GHSA-9m75-vc3g-4x39, GHSA-mm57-4v3p-rchx,
+# GHSA-fm9c-5rcf-2q5p, GHSA-2qm8-x737-gmw5).
+gcp = ["google-cloud-secret-manager>=2.16", "pyasn1>=0.6.5"]
 
 # Powers the "Project links" sidebar on https://pypi.org/project/mcpg/.
 # Order is preserved on the page; first entry doubles as the page header
@@ -142,6 +151,15 @@ dev = [
     "ruff>=0.14.0",
     "mypy>=1.15.0",
     "pre-commit>=4.0.0",
+    # pre-commit pulls virtualenv; floor raised to 21.14.9 to clear
+    # the 2026 activation-script / symlink CVEs (CVE-2026-113716 … 113776).
+    "virtualenv>=21.14.9",
+    # virtualenv / python-discovery pull filelock; 4.2.1 clears
+    # CVE-2026-112940 and the Windows ReadWriteLock / oplock GHSAs.
+    "filelock>=4.2.1",
+    # cachecontrol (pip-audit) pulls msgpack; 1.2.3 clears
+    # CVE-2026-114613 (unbounded leak on strict_map_key failure).
+    "msgpack>=1.2.3",
     "bandit>=1.7.8",
     "pip-audit>=2.7",
     # PyPI packaging toolchain — build the sdist/wheel, lint the
@@ -155,9 +173,9 @@ dev = [
     # otel-tracing unit tests can use the InMemorySpanExporter and so
     # `mcpg[otel]` round-trips through CI. Production deployments
     # opt in via the ``mcpg[otel]`` extra rather than dev install.
-    "opentelemetry-api>=1.27",
-    "opentelemetry-sdk>=1.27",
-    "opentelemetry-exporter-otlp-proto-http>=1.27",
+    "opentelemetry-api>=1.45.1",
+    "opentelemetry-sdk>=1.45.1",
+    "opentelemetry-exporter-otlp-proto-http>=1.45.1",
     "pip-licenses>=5.5.5",
     "pytest-mock>=3.15.1",
     "pytest-randomly>=4.1.0",

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/__init__.py

@@ -2,7 +2,7 @@
 
 import warnings
 
-__version__ = "0.8.2"
+__version__ = "0.8.4"
 
 # ``schema`` is the natural field name for "which Postgres schema" across
 # ~180 tool-return dataclasses. The ``mcp`` SDK dynamically builds a

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/about.py

@@ -253,7 +253,11 @@ CAPABILITIES: tuple[Capability, ...] = (
         detail=(
             "If TimescaleDB is installed: `create_hypertable`, "
             "`add_compression_policy`, `add_retention_policy`, `list_hypertables`, "
-            "`list_chunks`. For PostgreSQL native partitioning managed by "
+            "`list_chunks`, `get_hypertable_stats`, `list_timescale_jobs`, "
+            "`list_continuous_aggregates`, dimension / policy management, and "
+            "(with `MCPG_ALLOW_TIMESCALEDB_ADMIN`) `drop_chunks`, chunk compression / "
+            "merge / reorder, continuous-aggregate refresh and job control. "
+            "For PostgreSQL native partitioning managed by "
             "pg_partman: `partman_create_parent`, `partman_run_maintenance`, "
             "`partman_drop_partition`, `list_partitions`. Both backends are "
             "first-class for the audit / RAG telemetry tables (see PR-4 / PR-5 "
@@ -540,6 +544,28 @@ _TOOL_TO_BUCKET_OVERRIDES: dict[str, str] = {
     # list_hypertables / list_chunks / list_partitions are time-series.
     "list_hypertables": "timeseries_partitioning",
     "list_chunks": "timeseries_partitioning",
+    # TimescaleDB stats / jobs / policies / chunk + job admin (docs/plans/timescaledb-tools.md).
+    "get_hypertable_stats": "timeseries_partitioning",
+    "list_timescale_jobs": "timeseries_partitioning",
+    "list_continuous_aggregates": "timeseries_partitioning",
+    "get_timescaledb_telemetry_report": "timeseries_partitioning",
+    "add_dimension": "timeseries_partitioning",
+    "set_chunk_time_interval": "timeseries_partitioning",
+    "add_continuous_aggregate_policy": "timeseries_partitioning",
+    "add_reorder_policy": "timeseries_partitioning",
+    "remove_retention_policy": "timeseries_partitioning",
+    "remove_compression_policy": "timeseries_partitioning",
+    "remove_continuous_aggregate_policy": "timeseries_partitioning",
+    "remove_reorder_policy": "timeseries_partitioning",
+    "drop_chunks": "timeseries_partitioning",
+    "compress_chunk": "timeseries_partitioning",
+    "decompress_chunk": "timeseries_partitioning",
+    "reorder_chunk": "timeseries_partitioning",
+    "merge_chunks": "timeseries_partitioning",
+    "refresh_continuous_aggregate": "timeseries_partitioning",
+    "run_job": "timeseries_partitioning",
+    "alter_job": "timeseries_partitioning",
+    "delete_job": "timeseries_partitioning",
     "list_partitions": "timeseries_partitioning",
     # list_turboquant_indexes / list_pg_search_indexes are search-bucket.
     "list_turboquant_indexes": "vector_search",
@@ -711,6 +737,11 @@ _TOOL_TO_BUCKET_OVERRIDES: dict[str, str] = {
     "drop_property_graph": "property_graph_queries",
     # PG 19 in-server REPACK — operational maintenance, sits next to
     # run_maintenance / check_database_health.
+    # inspect_guc / alter_system family (ALTER SYSTEM tools, docs/alter-system.md).
+    "inspect_guc": "operations_and_health",
+    "alter_system": "operations_and_health",
+    "alter_system_reset_all": "operations_and_health",
+    "reload_config": "operations_and_health",
     "get_repack_status": "operations_and_health",
     "repack_table": "operations_and_health",
     # PG 19 async-I/O subsystem — observability + advisor; sits in the

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/config.py

@@ -66,6 +66,10 @@ class Settings:
     allow_ddl: bool = False
     allow_shell: bool = False
     allow_listen: bool = False
+    allow_timescaledb_admin: bool = False
+    allow_alter_system: bool = False
+    alter_system_allowlist: tuple[str, ...] = ()
+    alter_system_denylist: tuple[str, ...] = ()
     elicit_confirm_writes: bool = False
     shell_timeout_sec: int = 60
     shell_max_output_bytes: int = 64 * 1024 * 1024
@@ -131,7 +135,8 @@ class Settings:
     # query when set. HTTP requests can override per-request by sending
     # ``X-MCPG-Role: <role>``; when ``allowed_roles`` is set the header
     # value must appear in it (otherwise a 403 is returned). Role names
-    # are validated against ``[A-Za-z_][A-Za-z0-9_]*`` regardless.
+    # must be addressable identifiers (non-empty, no NUL, <= 63 bytes);
+    # delimited names (hyphens, spaces, mixed case) are quoted safely.
     default_role: str | None = None
     allowed_roles: tuple[str, ...] = ()
     # Read-replica routing. When ``replica_urls`` is non-empty, every
@@ -314,6 +319,8 @@ class Settings:
             f"allow_ddl={self.allow_ddl}, "
             f"allow_shell={self.allow_shell}, "
             f"allow_listen={self.allow_listen}, "
+            f"allow_timescaledb_admin={self.allow_timescaledb_admin}, "
+            f"allow_alter_system={self.allow_alter_system}, "
             f"elicit_confirm_writes={self.elicit_confirm_writes}, "
             f"shell_timeout_sec={self.shell_timeout_sec}, "
             f"shell_max_output_bytes={self.shell_max_output_bytes}, "
@@ -553,6 +560,21 @@ def load_settings(env: Mapping[str, str] | None = None) -> Settings:  # noqa: C9
     if (raw := env.get("MCPG_ALLOW_DDL")) is not None:
         allow_ddl = _parse_bool("MCPG_ALLOW_DDL", raw)
 
+    allow_timescaledb_admin = False
+    if (raw := env.get("MCPG_ALLOW_TIMESCALEDB_ADMIN")) is not None:
+        allow_timescaledb_admin = _parse_bool("MCPG_ALLOW_TIMESCALEDB_ADMIN", raw)
+    allow_alter_system = False
+    if (raw := env.get("MCPG_ALLOW_ALTER_SYSTEM")) is not None:
+        allow_alter_system = _parse_bool("MCPG_ALLOW_ALTER_SYSTEM", raw)
+
+    alter_system_allowlist: tuple[str, ...] = ()
+    if (raw := env.get("MCPG_ALTER_SYSTEM_ALLOWLIST")) is not None:
+        alter_system_allowlist = tuple(n.strip().lower() for n in raw.split(",") if n.strip())
+
+    alter_system_denylist: tuple[str, ...] = ()
+    if (raw := env.get("MCPG_ALTER_SYSTEM_DENYLIST")) is not None:
+        alter_system_denylist = tuple(n.strip().lower() for n in raw.split(",") if n.strip())
+
     allow_shell = False
     if (raw := env.get("MCPG_ALLOW_SHELL")) is not None:
         allow_shell = _parse_bool("MCPG_ALLOW_SHELL", raw)
@@ -1279,6 +1301,10 @@ def load_settings(env: Mapping[str, str] | None = None) -> Settings:  # noqa: C9
         allow_ddl=allow_ddl,
         allow_shell=allow_shell,
         allow_listen=allow_listen,
+        allow_timescaledb_admin=allow_timescaledb_admin,
+        allow_alter_system=allow_alter_system,
+        alter_system_allowlist=alter_system_allowlist,
+        alter_system_denylist=alter_system_denylist,
         elicit_confirm_writes=elicit_confirm_writes,
         shell_timeout_sec=shell_timeout_sec,
         shell_max_output_bytes=shell_max_output_bytes,

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/diesel.py

@@ -43,7 +43,12 @@ class DieselExportError(MCPgError):
 
 def _check_identifier(name: str, kind: str) -> None:
     if not _IDENTIFIER.match(name):
-        raise DieselExportError(f"invalid {kind} name: {name!r}")
+        raise DieselExportError(
+            f"invalid {kind} name {name!r}; this exporter only accepts plain "
+            f"identifiers [A-Za-z_][A-Za-z0-9_]* because the name becomes a source "
+            f"identifier in generated code. SQL tools (export_table, dump_database, …) "
+            f"accept delimited names via quoting — see docs/identifier-policy.md."
+        )
 
 
 def _strip_type_params(data_type: str) -> str:

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/drizzle.py

@@ -40,7 +40,12 @@ class DrizzleError(MCPgError):
 
 def _check_identifier(name: str, kind: str) -> None:
     if not _IDENTIFIER.match(name):
-        raise DrizzleError(f"invalid {kind} name: {name!r}")
+        raise DrizzleError(
+            f"invalid {kind} name {name!r}; this exporter only accepts plain "
+            f"identifiers [A-Za-z_][A-Za-z0-9_]* because the name becomes a source "
+            f"identifier in generated code. SQL tools (export_table, dump_database, …) "
+            f"accept delimited names via quoting — see docs/identifier-policy.md."
+        )
 
 
 _SNAKE_BOUNDARY = re.compile(r"_+([a-z0-9])")

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/ecto.py

@@ -41,7 +41,12 @@ class EctoExportError(MCPgError):
 
 def _check_identifier(name: str, kind: str) -> None:
     if not _IDENTIFIER.match(name):
-        raise EctoExportError(f"invalid {kind} name: {name!r}")
+        raise EctoExportError(
+            f"invalid {kind} name {name!r}; this exporter only accepts plain "
+            f"identifiers [A-Za-z_][A-Za-z0-9_]* because the name becomes a source "
+            f"identifier in generated code. SQL tools (export_table, dump_database, …) "
+            f"accept delimited names via quoting — see docs/identifier-policy.md."
+        )
 
 
 def _strip_type_params(data_type: str) -> str:

{mcpg-0.8.2 → mcpg-0.8.4}/src/mcpg/ent.py

@@ -37,7 +37,12 @@ class EntExportError(MCPgError):
 
 def _check_identifier(name: str, kind: str) -> None:
     if not _IDENTIFIER.match(name):
-        raise EntExportError(f"invalid {kind} name: {name!r}")
+        raise EntExportError(
+            f"invalid {kind} name {name!r}; this exporter only accepts plain "
+            f"identifiers [A-Za-z_][A-Za-z0-9_]* because the name becomes a source "
+            f"identifier in generated code. SQL tools (export_table, dump_database, …) "
+            f"accept delimited names via quoting — see docs/identifier-policy.md."
+        )
 
 
 def _pascal(snake: str) -> str: