sql-mini-mcp 1.0.0__tar.gz → 1.1.0__tar.gz

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/CHANGELOG.md

@@ -7,6 +7,20 @@ categories `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, and `Security`.
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-20
+
+### Changed
+
+- `QUERY_REJECTED` errors from `execute_sql` now come from a fixed catalog of reasons. The wording
+  for unsupported syntax names the construct as `unsupported construct: <Node>` or
+  `unsupported option: <Node>.<argument>`; other reasons keep their earlier text.
+
+### Security
+
+- `execute_sql` no longer forwards comments from the caller's SQL to the database. The executed
+  statement is generated only from the validated query, so comment text can never become
+  executable text.
+
 ## [1.0.0] - 2026-09-20
 
 ### Added

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sql-mini-mcp
-Version: 1.0.0
+Version: 1.1.0
 Summary: Minimal, read-only, PII-safe MCP server for SQL databases.
 License: MIT License
         
@@ -113,7 +113,7 @@ or
 pip install sql-mini-mcp
 ```
 
-Pin a version when you want a fixed surface: `uvx sql-mini-mcp==1.0.0`.
+Pin a version when you want a fixed surface: `uvx sql-mini-mcp==1.1.0`.
 
 Requires Python 3.12+, [uv](https://docs.astral.sh/uv/) (or `pip`), and
 [Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server).

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/README.md

@@ -76,7 +76,7 @@ or
 pip install sql-mini-mcp
 ```
 
-Pin a version when you want a fixed surface: `uvx sql-mini-mcp==1.0.0`.
+Pin a version when you want a fixed surface: `uvx sql-mini-mcp==1.1.0`.
 
 Requires Python 3.12+, [uv](https://docs.astral.sh/uv/) (or `pip`), and
 [Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server).

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-mini-mcp"
-version = "1.0.0"
+version = "1.1.0"
 description = "Minimal, read-only, PII-safe MCP server for SQL databases."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -51,11 +51,22 @@ include = [
 [tool.pytest.ini_options]
 addopts = "-ra --strict-markers"
 testpaths = ["tests"]
+pythonpath = ["tests/security"]
 markers = [
     "integration: requires a live database",
     "deep: expensive security verification",
 ]
 
+[tool.mutmut]
+source_paths = ["src/sql_mini_mcp"]
+also_copy = ["server.json", "README.md"]
+only_mutate = ["*security/*.py", "*config.py"]
+mutate_only_covered_lines = true
+pytest_add_cli_args = ["-q", "-m", "not integration and not deep", "-p", "no:cacheprovider"]
+pytest_add_cli_args_test_selection = ["tests/unit", "tests/security", "tests/contract"]
+timeout_multiplier = 3.0
+timeout_constant = 5.0
+
 [tool.coverage.run]
 branch = true
 source = ["sql_mini_mcp"]
@@ -72,3 +83,6 @@ quote-style = "double"
 
 [tool.ty.src]
 include = ["src", "tests"]
+
+[tool.ty.environment]
+extra-paths = ["tests/security"]

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/proprock/sql-mini-mcp",
     "source": "github"
   },
-  "version": "1.0.0",
+  "version": "1.1.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "sql-mini-mcp",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "transport": {
         "type": "stdio"
       }

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/__init__.py

@@ -1,3 +1,3 @@
 """Minimal, PII-safe MCP server for relational databases."""
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/config.py

@@ -181,8 +181,6 @@ def load_config(path: str | Path, environ: Mapping[str, str] | None = None) -> A
                     raise ValueError(f"PII key for server {alias!r} must decode to 32 bytes")
                 value["pii_key"] = env[key_env]
         return AppConfig.model_validate(raw)
-    except DomainError:
-        raise
     except ValidationError as exc:
         raise DomainError(
             ErrorCode.CONFIG_ERROR,

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/mcp_server.py

@@ -50,7 +50,7 @@ def create_server(config: AppConfig) -> MCPServer[AppContext]:
     server: MCPServer[AppContext] = MCPServer(
         "sql-mini-mcp",
         description="Minimal, read-only, PII-safe SQL database navigation.",
-        version="1.0.0",
+        version="1.1.0",
         lifespan=lifespan,
     )
 

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/lineage.py

@@ -15,6 +15,7 @@ from sql_mini_mcp.security.parser import (
     reject,
     validate_allowlist,
 )
+from sql_mini_mcp.security.reasons import Reason
 from sql_mini_mcp.security.schema import TableSchema
 
 _CASE_SENSITIVE_DIALECT = f"{DIALECT}, normalization_strategy = case_sensitive"
@@ -65,13 +66,13 @@ def _collect(query: exp.Select, schemas: Sequence[TableSchema]) -> list[_Binding
         nodes.append(from_.this)
     nodes += [join.this for join in query.args.get("joins") or []]
     if len(nodes) != len(schemas):
-        raise reject("table resolution does not match the query.")
+        raise reject(Reason.TABLE_RESOLUTION_MISMATCH)
     bindings: list[_Binding] = []
     seen: set[str] = set()
     for node, table in zip(nodes, schemas, strict=True):
         name = node.alias or table.name
         if name.casefold() in seen:
-            raise reject("table names and aliases must be unique.")
+            raise reject(Reason.DUPLICATE_BINDING)
         seen.add(name.casefold())
         bindings.append(_Binding(name, table))
     return bindings
@@ -88,10 +89,10 @@ def _resolve(column: exp.Column, bindings: Sequence[_Binding]) -> tuple[_Binding
     if qualifier:
         matching = [b for b in bindings if b.name.casefold() == qualifier.casefold()]
         if len(matching) != 1:
-            raise reject("a column qualifier does not match a table in the query.")
+            raise reject(Reason.QUALIFIER_UNKNOWN)
         canonical = _canonical_column(matching[0], name)
         if canonical is None:
-            raise reject("a referenced column was not found or is ambiguous.")
+            raise reject(Reason.COLUMN_NOT_FOUND)
         return matching[0], canonical
     candidates = [
         (binding, canonical)
@@ -99,7 +100,7 @@ def _resolve(column: exp.Column, bindings: Sequence[_Binding]) -> tuple[_Binding
         if (canonical := _canonical_column(binding, name)) is not None
     ]
     if len(candidates) != 1:
-        raise reject("a referenced column was not found or is ambiguous; qualify it.")
+        raise reject(Reason.COLUMN_AMBIGUOUS)
     return candidates[0]
 
 
@@ -117,7 +118,7 @@ def _expand_stars(query: exp.Select, bindings: Sequence[_Binding]) -> None:
         elif isinstance(projection, exp.Column) and isinstance(projection.this, exp.Star):
             chosen = [b for b in bindings if b.name.casefold() == projection.table.casefold()]
             if len(chosen) != 1:
-                raise reject("a column qualifier does not match a table in the query.")
+                raise reject(Reason.QUALIFIER_UNKNOWN)
         else:
             expanded.append(projection)
             continue
@@ -160,7 +161,7 @@ def _resolve_order_column(
         if matches:
             # SQL Server resolves an unqualified ORDER BY name against output labels first.
             if len(matches) != 1 or matches[0].source is None:
-                raise reject("ORDER BY refers to an ambiguous or non-column output.")
+                raise reject(Reason.ORDER_OUTPUT_AMBIGUOUS)
             source = matches[0].source
             binding = next(b for b in bindings if b.name == matches[0].binding)
             return _rewrite(column, binding, source.column)
@@ -181,7 +182,7 @@ def _cross_check(query: exp.Select, schemas: Sequence[TableSchema]) -> None:
             expand_stars=False,
         )
     except (OptimizeError, SqlglotError) as exc:
-        raise reject("the query references unknown or ambiguous columns.") from exc
+        raise reject(Reason.QUALIFY_FAILED) from exc
 
 
 def analyze_query(

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/parser.py

@@ -7,6 +7,7 @@ from sqlglot import exp
 
 from sql_mini_mcp.config import RuntimeConfig
 from sql_mini_mcp.errors import DomainError, ErrorCode
+from sql_mini_mcp.security.reasons import Reason
 
 DIALECT = "tsql"
 
@@ -28,24 +29,27 @@ class ParserLimits:
         )
 
 
-def reject(message: str) -> DomainError:
-    return DomainError(
-        ErrorCode.QUERY_REJECTED,
-        f"Query rejected: {message}",
-        "Rewrite the operation as a single, simpler SELECT query.",
-    )
+REJECT_HINT = "Rewrite the operation as a single, simpler SELECT query."
+
+
+def reject(reason: Reason, detail: str | None = None) -> DomainError:
+    """Build the QUERY_REJECTED error; only a fixed Reason (plus an optional name) is accepted."""
+    if not isinstance(reason, Reason):
+        raise TypeError("reject() takes a Reason")
+    text = str(reason) if detail is None else f"{reason}: {detail}"
+    return DomainError(ErrorCode.QUERY_REJECTED, f"Query rejected: {text}.", REJECT_HINT)
 
 
 def check_limits(query: exp.Expression, limits: ParserLimits) -> None:
     """Enforce AST size limits; also used again after transformations."""
     for count, _ in enumerate(query.walk(), start=1):
         if count > limits.max_ast_nodes:
-            raise reject("the query exceeds the configured complexity limit.")
+            raise reject(Reason.LIMIT_NODES)
     if sum(1 for _ in query.find_all(exp.Join)) > limits.max_joins:
-        raise reject("the query has too many joins.")
+        raise reject(Reason.LIMIT_JOINS)
     for node in query.find_all(exp.In):
         if len(node.expressions) > limits.max_in_list_items:
-            raise reject("an IN list exceeds the configured item limit.")
+            raise reject(Reason.LIMIT_IN_LIST)
 
 
 _COMPARISONS = (exp.EQ, exp.NEQ, exp.GT, exp.GTE, exp.LT, exp.LTE)
@@ -95,79 +99,86 @@ def _check_node(node: exp.Expr, allow_placeholders: bool) -> None:
     elif kind in _ALLOWED_ARGS:
         allowed_args = _ALLOWED_ARGS[kind]
     else:
-        raise reject(f"{kind.__name__} is not supported.")
+        raise reject(Reason.NODE_UNSUPPORTED, kind.__name__)
     for name, value in node.args.items():
         if name not in allowed_args and not _is_empty(value):
-            raise reject(f"{kind.__name__} option {name!r} is not supported.")
+            raise reject(Reason.OPTION_UNSUPPORTED, f"{kind.__name__}.{name}")
 
     if isinstance(node, exp.Table):
         name = node.this
         if not isinstance(name, exp.Identifier) or str(name.this).startswith(("#", "@")):
-            raise reject("only base tables of the current database are supported.")
+            raise reject(Reason.TABLE_UNSUPPORTED)
     elif isinstance(node, exp.Column):
         if not isinstance(node.this, (exp.Identifier, exp.Star)):
-            raise reject("unsupported column reference.")
+            raise reject(Reason.COLUMN_REFERENCE_UNSUPPORTED)
     elif isinstance(node, exp.Count):
         if not isinstance(node.this, exp.Star):
-            raise reject("only COUNT(*) is supported.")
+            raise reject(Reason.COUNT_STAR_ONLY)
     elif isinstance(node, exp.Star):
         if not isinstance(node.parent, (exp.Select, exp.Column, exp.Count)):
-            raise reject("* is supported only as a projection.")
+            raise reject(Reason.STAR_PROJECTION_ONLY)
     elif isinstance(node, exp.Join):
         if not isinstance(node.this, exp.Table) or node.args.get("on") is None:
-            raise reject("JOIN requires a table and an explicit ON expression.")
+            raise reject(Reason.JOIN_NEEDS_ON)
         if node.side not in {"", "LEFT"} or node.kind not in {"", "INNER"}:
-            raise reject("only INNER JOIN and LEFT JOIN are supported.")
+            raise reject(Reason.JOIN_TYPE_UNSUPPORTED)
     elif isinstance(node, exp.Is):
         if not isinstance(node.expression, exp.Null):
-            raise reject("IS is supported only with NULL.")
+            raise reject(Reason.IS_NULL_ONLY)
     elif isinstance(node, exp.Neg):
         if not _is_numeric_literal(node.this):
-            raise reject("negation is supported only for numeric literals.")
+            raise reject(Reason.NEGATION_NUMERIC_ONLY)
     elif isinstance(node, exp.Limit):
         value = node.expression
         if not _is_numeric_literal(value) or not str(value.this).isdigit():
-            raise reject("TOP must be a non-negative integer literal.")
+            raise reject(Reason.TOP_INTEGER_ONLY)
     elif isinstance(node, exp.Ordered):
         if not isinstance(node.this, exp.Column) or isinstance(node.this.this, exp.Star):
-            raise reject("ORDER BY supports only direct columns.")
+            raise reject(Reason.ORDER_DIRECT_COLUMNS_ONLY)
     elif isinstance(node, exp.In):
         if not isinstance(node.this, exp.Column) or not all(
             isinstance(item, (exp.Literal, exp.Neg, exp.Placeholder)) for item in node.expressions
         ):
-            raise reject("IN supports a column and a list of literals.")
+            raise reject(Reason.IN_LITERALS_ONLY)
     elif isinstance(node, _COMPARISONS):
         for side in (node.this, node.expression):
             if isinstance(side, exp.Star):
-                raise reject("* cannot be compared.")
+                raise reject(Reason.STAR_COMPARISON)
 
 
 def validate_allowlist(query: exp.Expression, *, allow_placeholders: bool = False) -> None:
     """Fail closed on any node type, argument, or shape outside the supported subset."""
     if not isinstance(query, exp.Select):
-        raise reject("only SELECT statements are supported.")
+        raise reject(Reason.SELECT_ONLY)
     for node in query.walk():
         _check_node(node, allow_placeholders)
     for projection in query.expressions:
         if not isinstance(projection, _PROJECTIONS):
-            raise reject("unsupported projection.")
+            raise reject(Reason.PROJECTION_UNSUPPORTED)
+
+
+def strip_comments(query: exp.Expression) -> None:
+    """Drop caller comments so no caller-controlled text is ever emitted into generated SQL."""
+    for node in query.walk():
+        node.pop_comments()
 
 
 def parse_select(sql: str, limits: ParserLimits) -> exp.Select:
     """Parse exactly one root SELECT; any failure becomes QUERY_REJECTED."""
     if len(sql) > limits.max_sql_chars:
-        raise reject("the SQL exceeds the configured length limit.")
+        raise reject(Reason.LIMIT_CHARS)
     try:
         statements = [s for s in sqlglot.parse(sql, dialect=DIALECT) if s is not None]
         if len(statements) != 1:
-            raise reject("exactly one statement is required.")
+            raise reject(Reason.ONE_STATEMENT)
         query = statements[0]
         if not isinstance(query, exp.Select):
-            raise reject("only SELECT statements are supported.")
+            raise reject(Reason.SELECT_ONLY)
         check_limits(query, limits)
         validate_allowlist(query)
+        strip_comments(query)
     except DomainError:
         raise
     except Exception as exc:
-        raise reject("the SQL could not be parsed.") from exc
+        raise reject(Reason.PARSE_FAILED) from exc
     return query

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/policy.py

@@ -7,6 +7,7 @@ from sqlglot import exp
 from sql_mini_mcp.config import PiiConfig
 from sql_mini_mcp.security.lineage import AnalyzedQuery, ColumnRef, SourceColumn
 from sql_mini_mcp.security.parser import reject
+from sql_mini_mcp.security.reasons import Reason
 from sql_mini_mcp.security.tokens import PREFIX, TokenCodec
 
 
@@ -57,7 +58,7 @@ class PiiPolicy:
                 and str(literal.this).startswith(PREFIX)
                 and id(literal) not in consumed
             ):
-                raise reject("a PII token can only be compared with a protected column.")
+                raise reject(Reason.TOKEN_OUTSIDE_PROTECTED)
         protected = tuple(
             output.source is not None and self.is_protected(output.source)
             for output in analyzed.outputs
@@ -72,12 +73,12 @@ class PiiPolicy:
         if isinstance(parent, exp.Alias) and isinstance(parent.parent, exp.Select):
             return []
         if not _in_where(column):
-            raise reject("a protected column can only be projected or compared with a token.")
+            raise reject(Reason.PROTECTED_POSITION)
         if isinstance(parent, exp.EQ) and parent.this is column:
             return [self._token_site(parent.expression)]
         if isinstance(parent, exp.In) and parent.this is column and parent.expressions:
             return [self._token_site(item) for item in parent.expressions]
-        raise reject("a protected column can only be projected or compared with a token.")
+        raise reject(Reason.PROTECTED_POSITION)
 
     def _token_site(self, node: exp.Expression) -> TokenSite:
         if (
@@ -85,7 +86,7 @@ class PiiPolicy:
             or not node.is_string
             or not str(node.this).startswith(PREFIX)
         ):
-            raise reject("a protected column can only be compared with a PII token.")
+            raise reject(Reason.PROTECTED_NEEDS_TOKEN)
         return TokenSite(node, self._codec.decrypt(str(node.this)))
 
 

sql_mini_mcp-1.1.0/src/sql_mini_mcp/security/reasons.py

@@ -0,0 +1,43 @@
+"""Fixed, reviewable reasons for QUERY_REJECTED. Free text never reaches reject()."""
+
+from enum import StrEnum
+
+
+class Reason(StrEnum):
+    TABLE_RESOLUTION_MISMATCH = "table resolution does not match the query"
+    DUPLICATE_BINDING = "table names and aliases must be unique"
+    QUALIFIER_UNKNOWN = "a column qualifier does not match a table in the query"
+    COLUMN_NOT_FOUND = "a referenced column was not found or is ambiguous"
+    COLUMN_AMBIGUOUS = "a referenced column was not found or is ambiguous; qualify it"
+    ORDER_OUTPUT_AMBIGUOUS = "ORDER BY refers to an ambiguous or non-column output"
+    QUALIFY_FAILED = "the query references unknown or ambiguous columns"
+    LIMIT_NODES = "the query exceeds the configured complexity limit"
+    LIMIT_JOINS = "the query has too many joins"
+    LIMIT_IN_LIST = "an IN list exceeds the configured item limit"
+    TABLE_UNSUPPORTED = "only base tables of the current database are supported"
+    COLUMN_REFERENCE_UNSUPPORTED = "unsupported column reference"
+    COUNT_STAR_ONLY = "only COUNT(*) is supported"
+    STAR_PROJECTION_ONLY = "* is supported only as a projection"
+    JOIN_NEEDS_ON = "JOIN requires a table and an explicit ON expression"
+    JOIN_TYPE_UNSUPPORTED = "only INNER JOIN and LEFT JOIN are supported"
+    IS_NULL_ONLY = "IS is supported only with NULL"
+    NEGATION_NUMERIC_ONLY = "negation is supported only for numeric literals"
+    TOP_INTEGER_ONLY = "TOP must be a non-negative integer literal"
+    ORDER_DIRECT_COLUMNS_ONLY = "ORDER BY supports only direct columns"
+    IN_LITERALS_ONLY = "IN supports a column and a list of literals"
+    STAR_COMPARISON = "* cannot be compared"
+    SELECT_ONLY = "only SELECT statements are supported"
+    PROJECTION_UNSUPPORTED = "unsupported projection"
+    LIMIT_CHARS = "the SQL exceeds the configured length limit"
+    ONE_STATEMENT = "exactly one statement is required"
+    PARSE_FAILED = "the SQL could not be parsed"
+    TOKEN_OUTSIDE_PROTECTED = "a PII token can only be compared with a protected column"
+    PROTECTED_POSITION = "a protected column can only be projected or compared with a token"
+    PROTECTED_NEEDS_TOKEN = "a protected column can only be compared with a PII token"
+    TABLE_GONE = "a referenced table no longer exists"
+    TABLE_NOT_FOUND = "a referenced table was not found or is ambiguous; qualify it with a schema"
+    TABLE_SCOPE = "only tables of the current database are supported"
+    BIND_UNSAFE = "bind parameters could not be generated safely"
+    TOKEN_NOT_REPLACED = "a PII token could not be replaced by a bind parameter"
+    NODE_UNSUPPORTED = "unsupported construct"
+    OPTION_UNSUPPORTED = "unsupported option"

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/schema.py

@@ -13,6 +13,7 @@ from sqlglot import exp
 
 from sql_mini_mcp.db.reflection import list_tables as reflect_tables
 from sql_mini_mcp.security.parser import reject
+from sql_mini_mcp.security.reasons import Reason
 
 
 @dataclass(frozen=True, slots=True)
@@ -92,7 +93,7 @@ class ReflectedCatalog:
             try:
                 reflected = inspect(self._connection).get_columns(table, schema=schema or None)
             except NoSuchTableError as exc:
-                raise reject("a referenced table no longer exists.") from exc
+                raise reject(Reason.TABLE_GONE) from exc
             cached = tuple(str(column["name"]) for column in reflected)
             self._cache.put(key, cached)
         return cached
@@ -108,7 +109,7 @@ def _match(tables: Sequence[tuple[str, str]], schema: str | None, name: str) ->
         and (folded_schema is None or table_schema.casefold() == folded_schema)
     ]
     if len(matches) != 1:
-        raise reject("a referenced table was not found or is ambiguous; qualify it with a schema.")
+        raise reject(Reason.TABLE_NOT_FOUND)
     return matches[0]
 
 
@@ -121,7 +122,7 @@ def resolve_tables(query: exp.Select, catalog: TableCatalog) -> tuple[TableSchem
     resolved: list[TableSchema] = []
     for table in query.find_all(exp.Table):
         if table.args.get("catalog") or not isinstance(table.this, exp.Identifier):
-            raise reject("only tables of the current database are supported.")
+            raise reject(Reason.TABLE_SCOPE)
         schema = table.db or None
         schema_name, table_name = _match(available, schema, table.name)
         resolved.append(

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/tokens.py

@@ -47,18 +47,6 @@ def _encode_float(value: float) -> float:
     return value
 
 
-def _decode_strict(kind: type, parse: Callable[[Any], Any], check: Callable[[Any, Any], bool]):
-    def decode(data: Any) -> Any:
-        if type(data) is not kind:
-            raise ValueError("wrong payload type")
-        value = parse(data)
-        if not check(value, data):
-            raise ValueError("non-canonical payload")
-        return value
-
-    return decode
-
-
 def _identity_check(_value: Any, _data: Any) -> bool:
     return True
 
@@ -84,20 +72,32 @@ _CODECS: dict[type, tuple[str, Callable[[Any], Any]]] = {
     UUID: ("uuid", str),
     bytes: ("bytes", lambda v: base64.b64encode(v).decode("ascii")),
 }
-_DECODERS: dict[str, Callable[[Any], Any]] = {
-    "str": _decode_strict(str, lambda d: d, _identity_check),
-    "bool": _decode_strict(bool, lambda d: d, _identity_check),
-    "int": _decode_strict(int, lambda d: d, _identity_check),
-    "float": _decode_strict(float, lambda d: d, _identity_check),
-    "decimal": _decode_strict(str, Decimal, _finite_decimal),
-    "date": _decode_strict(str, date.fromisoformat, lambda v, d: v.isoformat() == d),
-    "datetime": _decode_strict(str, datetime.fromisoformat, lambda v, d: v.isoformat() == d),
-    "time": _decode_strict(str, time.fromisoformat, lambda v, d: v.isoformat() == d),
-    "uuid": _decode_strict(str, UUID, lambda v, d: str(v) == d),
-    "bytes": _decode_strict(str, lambda d: base64.b64decode(d, validate=True), _bytes_check),
+# tag -> (JSON type of `d`, parser, canonical-form check); interpreted at decode time by
+# _decode_value so every branch runs (and can be verified) per call.
+_DECODERS: dict[str, tuple[type, Callable[[Any], Any], Callable[[Any, Any], bool]]] = {
+    "str": (str, lambda d: d, _identity_check),
+    "bool": (bool, lambda d: d, _identity_check),
+    "int": (int, lambda d: d, _identity_check),
+    "float": (float, lambda d: d, _identity_check),
+    "decimal": (str, Decimal, _finite_decimal),
+    "date": (str, date.fromisoformat, lambda v, d: v.isoformat() == d),
+    "datetime": (str, datetime.fromisoformat, lambda v, d: v.isoformat() == d),
+    "time": (str, time.fromisoformat, lambda v, d: v.isoformat() == d),
+    "uuid": (str, UUID, lambda v, d: str(v) == d),
+    "bytes": (str, lambda d: base64.b64decode(d, validate=True), _bytes_check),
 }
 
 
+def _decode_value(tag: str, data: Any) -> Any:
+    kind, parse, check = _DECODERS[tag]
+    if type(data) is not kind:
+        raise ValueError("wrong payload type")
+    value = parse(data)
+    if not check(value, data):
+        raise ValueError("non-canonical payload")
+    return value
+
+
 class TokenCodec:
     """AES-256-GCM tokens for one server alias; the alias is authenticated as AAD."""
 
@@ -173,7 +173,7 @@ class TokenCodec:
         version = document["v"]
         if type(version) is not int or version != _PAYLOAD_VERSION:
             raise ValueError
-        return _DECODERS[document["t"]](document["d"])
+        return _decode_value(document["t"], document["d"])
 
 
 class TokenKeyRegistry:

{sql_mini_mcp-1.0.0 → sql_mini_mcp-1.1.0}/src/sql_mini_mcp/security/validated_query.py

@@ -18,6 +18,7 @@ from sql_mini_mcp.security.parser import (
     validate_allowlist,
 )
 from sql_mini_mcp.security.policy import PolicyDecision
+from sql_mini_mcp.security.reasons import Reason
 from sql_mini_mcp.security.tokens import PREFIX
 
 _SEAL = object()
@@ -154,7 +155,7 @@ def _to_qmark(query: exp.Select, parameters: dict[str, Any]) -> tuple[str, tuple
     sql = rendered.sql(dialect=DIALECT)
     found = re.findall(rf"__bind_{nonce}_\d+__", sql)
     if len(found) != len(markers) or set(found) != set(markers):
-        raise reject("bind parameters could not be generated safely.")
+        raise reject(Reason.BIND_UNSAFE)
     for marker in found:
         sql = sql.replace(marker, "?", 1)
     return sql, tuple(parameters[markers[marker]] for marker in found)
@@ -186,7 +187,7 @@ def issue_validated_query(
     validate_allowlist(query, allow_placeholders=True)
     sql, ordered = _to_qmark(query, parameters)
     if PREFIX in sql:
-        raise reject("a PII token could not be replaced by a bind parameter.")
+        raise reject(Reason.TOKEN_NOT_REPLACED)
     outputs = tuple(
         OutputPlan(output.label, output.kind, output.source, protected)
         for output, protected in zip(analyzed.outputs, decision.protected, strict=True)