sql-safe-mcp 1.2.0__tar.gz

sql_safe_mcp-1.2.0/.gitignore

@@ -0,0 +1,19 @@
+/.serena/
+/*.agents.md
+/.coverage
+/.coverage.*
+/coverage.xml
+/htmlcov/
+.venv/
+__pycache__/
+*.egg-info/
+/dist/
+/.pytest_cache/
+/.ruff_cache/
+.env
+.env.*
+/.hypothesis/
+/.mutmut-cache
+/mutants/
+/.cbm-cache/
+/.cbm-runtime/

sql_safe_mcp-1.2.0/CHANGELOG.md

@@ -0,0 +1,79 @@
+# Changelog
+
+All notable externally observable changes to this project are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and uses the
+categories `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, and `Security`.
+
+## [Unreleased]
+
+## [1.2.0] - 2026-09-20
+
+### Added
+
+- MySQL and MariaDB support: `engine: mysql` or `engine: mariadb` with a `mysql+pymysql://` URL.
+  All seven tools work on them. MySQL and MariaDB have no schema level, so `schema` is always
+  `null` in responses and a `db.table` name is rejected as a cross-database reference.
+- `execute_sql` and `pii_safe` on MySQL and MariaDB, with `LIMIT` in place of `TOP`. A `pii` rule
+  for these engines must not set `schema`. `TIME` results are returned as `time` values within a
+  day; longer values fail with `DATABASE_ERROR`.
+- Stored procedures on MySQL and MariaDB report the body from `information_schema.ROUTINES`, which
+  is `null` when the login may not see it.
+- `COUNT(*)` is accepted on the `mysql` dialect.
+
+### Changed
+
+- **Breaking:** the project is renamed from `sql-mini-mcp` to `sql-safe-mcp`. The package, the
+  Python module (`sql_safe_mcp`), the command (`sql-safe-mcp`), the example configuration file, and
+  every environment variable (`SQL_MINI_MCP_CONFIG` is now `SQL_SAFE_MCP_CONFIG`) change; the old
+  names are not kept as aliases. The `sql-mini-mcp` package on PyPI becomes a deprecated shim that
+  depends on `sql-safe-mcp`.
+- The `QUERY_REJECTED` reason for a non-integer row limit now reads
+  `TOP/LIMIT must be a non-negative integer literal`.
+
+### Security
+
+- MySQL and MariaDB sessions drop `NO_BACKSLASH_ESCAPES`, so the string escaping in the generated
+  SQL always means what the validated query means, even if the server enables that mode.
+- The validation pipeline takes its SQL dialect only from the trusted server configuration and
+  requires it explicitly; policy, tokens, and the validated query are shared by every engine.
+
+## [1.1.0] - 2026-09-20
+
+### Changed
+
+- `QUERY_REJECTED` errors from `execute_sql` now come from a fixed catalog of reasons. The wording
+  for unsupported syntax names the construct as `unsupported construct: <Node>` or
+  `unsupported option: <Node>.<argument>`; other reasons keep their earlier text.
+
+### Security
+
+- `execute_sql` no longer forwards comments from the caller's SQL to the database. The executed
+  statement is generated only from the validated query, so comment text can never become
+  executable text.
+
+## [1.0.0] - 2026-09-20
+
+### Added
+
+- `execute_sql` tool for `pii_safe` SQL Server aliases. It runs one restricted `SELECT`, returns
+  configured PII columns as alias-bound tokens, accepts those tokens only in `=` and `IN`
+  predicates, and returns at most `max_rows` rows with a `truncated` flag. Servers with
+  `access_level: metadata` return `ACCESS_LEVEL_DENIED`.
+
+## [0.9.1] - 2026-09-20
+
+### Added
+
+- Publishing of release-tag packages to PyPI and their metadata to the MCP Registry.
+
+### Fixed
+
+- Source distributions now include only release files, excluding local development caches.
+
+## [0.9.0] - 2026-09-20
+
+### Added
+
+- Read-only SQL Server metadata tools for configured server aliases, databases, tables, and
+  stored procedures.

sql_safe_mcp-1.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anton Padapryhara
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sql_safe_mcp-1.2.0/PKG-INFO

@@ -0,0 +1,259 @@
+Metadata-Version: 2.5
+Name: sql-safe-mcp
+Version: 1.2.0
+Summary: Minimal, read-only, PII-safe MCP server for SQL databases.
+License: MIT License
+        
+        Copyright (c) 2026 Anton Padapryhara
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Requires-Python: <3.15,>=3.12
+Requires-Dist: anyio<5,>=4.8
+Requires-Dist: cryptography<47,>=46.0.7
+Requires-Dist: mcp<3,>=2
+Requires-Dist: pydantic<3,>=2.10
+Requires-Dist: pymysql>=1.2.3
+Requires-Dist: pyodbc<6,>=5.2
+Requires-Dist: pyyaml<7,>=6
+Requires-Dist: sqlalchemy<3,>=2.0
+Requires-Dist: sqlglot<31,>=30.18
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+# sql-safe-mcp
+
+A read-only, PII-safe SQL Server, MySQL and MariaDB MCP server for coding agents: schema knowledge and safe queries, with no way to change or leak data.
+
+[![CI](https://github.com/proprock/sql-safe-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/proprock/sql-safe-mcp/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/proprock/sql-safe-mcp)](https://github.com/proprock/sql-safe-mcp/releases)
+[![PyPI Version](https://img.shields.io/pypi/v/sql-safe-mcp)](https://pypi.org/project/sql-safe-mcp/)
+[![Python](https://img.shields.io/badge/python-3.12%2B-blue)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+
+[![Model Context Protocol compatible](https://img.shields.io/badge/Model_Context_Protocol-compatible-000000?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io)
+[![MCP Registry: io.github.proprock/sql-safe-mcp](https://img.shields.io/badge/MCP_Registry-io.github.proprock%2Fsql--mini--mcp-000000?logo=modelcontextprotocol&logoColor=white)](server.json)
+
+<img src="https://raw.githubusercontent.com/proprock/sql-safe-mcp/master/images/luna-guard.jpg" alt="Read the data. Protect the identity." width="760">
+
+<i>Read the data. Protect the identity.</i>
+
+</div>
+
+<!-- mcp-name: io.github.proprock/sql-safe-mcp -->
+
+General-purpose database MCP servers hand the agent a raw SQL prompt and dozens of tools. This
+server gives a coding agent the schema knowledge it needs to write correct code - servers,
+databases, tables, columns, keys, indexes, stored procedures - and, on servers you mark
+`pii_safe`, a way to look at real rows without ever seeing the personal data in them.
+
+## Read-only by design. PII-safe by default
+
+- **Read-only by construction** - seven tools, all annotated read-only. No tool writes data, and
+  the server never executes SQL an agent wrote: metadata comes from SQLAlchemy Inspector and fixed
+  catalog queries, and `execute_sql` runs only a validated, regenerated `SELECT`.
+- **PII-safe by default** - on a `pii_safe` server, the columns you configure come back as
+  alias-bound, authenticated tokens (`pii:v1:...`), never as plaintext. An agent can still
+  project, count, and filter on them with `=` and `IN` using tokens it was given, so it can follow
+  a record without reading it. Tokens do not work on another server alias or with another key.
+- **Fails closed** - SQL validation is an allowlist. Unknown syntax, unresolved lineage, and
+  unsupported protected-value types are refused, not guessed at. The verification evidence is in
+  the [security model](SECURITY-MODEL.md).
+- **Least access first** - `access_level: metadata` (the default) exposes schema only;
+  `execute_sql` needs an explicit `pii_safe` alias with its own key. Database permissions stay the
+  primary control, so use a least-privilege login.
+
+## Also
+
+- **Your aliases, not your network** - the agent sees only the server aliases you configure. There
+  is no network discovery, and the catalog is not published as MCP resources.
+- **Secrets stay out of sight** - connection URLs live in YAML with `${NAME}` placeholders resolved
+  from the environment. They never appear in logs or model-visible errors.
+- **Compact, predictable output** - object-rooted results with stable sorting, literal
+  case-insensitive name filters, and stored procedure lists that do not expand definitions.
+- **Errors an agent can act on** - an ambiguous name lists the candidate schemas. Errors never
+  contain connection details, credentials, keys, tokens, or rows.
+- **On PyPI** - `uvx sql-safe-mcp`, no repo clone required.
+
+| Tool | Access | Purpose |
+|---|---|---|
+| `list_servers` | 🟢 read | Configured server aliases |
+| `list_databases` | 🟢 read | Databases visible to the credentials |
+| `list_tables` | 🟢 read | Base tables, filtered by schema or name |
+| `get_table_definition` | 🟢 read | Columns, keys, constraints, and indexes of one table |
+| `list_stored_procedures` | 🟢 read | Stored procedures, without definitions |
+| `get_stored_procedure` | 🟢 read | The definition of one stored procedure |
+| `execute_sql` | 🟢 read | One restricted `SELECT` on a `pii_safe` server; protected columns return tokens |
+
+> [!NOTE]
+> **Status:** SQL Server supports every tool. MySQL and MariaDB (`engine: mysql` or `mariadb`,
+> `mysql+pymysql` URLs) support every tool too. `schema` is always `null` there because the
+> database is the catalog, and `execute_sql` uses `LIMIT` instead of `TOP`. See
+> [ARCHITECTURE.md](ARCHITECTURE.md).
+
+- [Install](#install)
+- [Configure](#configure)
+- [PII-safe queries](#pii-safe-queries)
+- [Security](#security)
+- [Contributing](#contributing)
+
+More detail lives in [`docs/`](docs): the [configuration reference](docs/configuration.md),
+[what the tools return](docs/tools.md), and the [security model](SECURITY-MODEL.md).
+
+## Install
+
+```bash
+uvx sql-safe-mcp
+```
+
+or
+
+```bash
+pip install sql-safe-mcp
+```
+
+Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.2.0`.
+
+Requires Python 3.12+, [uv](https://docs.astral.sh/uv/) (or `pip`), and
+[Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server)
+when you connect to SQL Server. MySQL and MariaDB use the bundled PyMySQL driver and need nothing
+else.
+
+Verified against SQL Server 2022, MySQL 8.4, and MariaDB 11.4 (see [CHECKS.md](CHECKS.md)).
+
+## Configure
+
+Copy [sql-safe-mcp.example.yaml](sql-safe-mcp.example.yaml) to `sql-safe-mcp.yaml`, list your
+servers, and keep credentials in environment variables:
+
+```yaml
+version: 1
+servers:
+  reporting:
+    engine: sqlserver
+    access_level: metadata
+    connection_url: "${REPORTING_SQL_URL}"
+```
+
+Point the server at the file with `SQL_SAFE_MCP_CONFIG` (or `--config`), and check it without
+connecting to any database:
+
+```bash
+SQL_SAFE_MCP_CONFIG=sql-safe-mcp.yaml uvx sql-safe-mcp --check-config
+```
+
+Configuration is validated at startup, and an error names the problem without printing a URL or
+secret. Keep credentials in the host's own configuration and never commit them. The server acts
+with the database account's permissions, so use a dedicated login with the least access the job
+needs. Every setting, including the runtime limits, is in
+[configuration.md](docs/configuration.md).
+
+<details>
+<summary><b>Claude Code</b></summary>
+
+```bash
+claude mcp add --env SQL_SAFE_MCP_CONFIG=/path/to/sql-safe-mcp.yaml --env REPORTING_SQL_URL=mssql+pyodbc://... --transport stdio sql-safe -- uvx sql-safe-mcp
+```
+
+Put at least one other option between the last `--env` and the server name, as above - the CLI
+otherwise reads the name as another `KEY=value` pair.
+
+</details>
+
+<details>
+<summary><b>Claude Desktop</b></summary>
+
+In `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "sql-safe": {
+      "command": "uvx",
+      "args": ["sql-safe-mcp"],
+      "env": {
+        "SQL_SAFE_MCP_CONFIG": "/path/to/sql-safe-mcp.yaml",
+        "REPORTING_SQL_URL": "mssql+pyodbc://..."
+      }
+    }
+  }
+}
+```
+
+</details>
+
+<details>
+<summary><b>Codex CLI</b></summary>
+
+```bash
+codex mcp add sql-safe --env SQL_SAFE_MCP_CONFIG=/path/to/sql-safe-mcp.yaml --env REPORTING_SQL_URL=mssql+pyodbc://... -- uvx sql-safe-mcp
+```
+
+</details>
+
+<details>
+<summary><b>Any other stdio host</b></summary>
+
+Command `uvx`, argument `sql-safe-mcp`, and the environment variables your configuration
+references, plus `SQL_SAFE_MCP_CONFIG`. The server speaks MCP over stdio and logs only to stderr.
+
+</details>
+
+## PII-safe queries
+
+Mark an alias `access_level: pii_safe`, give it its own key, and list the protected columns:
+
+```yaml
+servers:
+  legacy_prod:
+    engine: sqlserver
+    access_level: pii_safe
+    connection_url: "${LEGACY_PROD_SQL_URL}"
+    pii_key_env: LEGACY_PROD_PII_KEY
+    pii:
+      rules:
+        - database: "*"
+          schema: dbo
+          table: Users
+          columns: [Email, FirstName, LastName]
+```
+
+`execute_sql` then accepts one restricted `SELECT`. Protected cells come back as tokens, and a
+token is accepted only in `=` and `IN` predicates on the same alias. Protection covers the columns
+you list, so list every column that holds personal data. The rule format, key generation, and the
+accepted SQL are in [configuration.md](docs/configuration.md) and [tools.md](docs/tools.md).
+
+## Security
+
+The MCP caller, SQL input, database metadata, rows, and tokens are untrusted; the operator, the
+process environment, and the database credentials are the trusted boundary. Database permissions
+remain the primary authorization control - this server never widens them. The full model and its
+verification are in [SECURITY-MODEL.md](SECURITY-MODEL.md). To report a vulnerability,
+use the private channel in [SECURITY.md](SECURITY.md).
+
+## Contributing
+
+Setup, checks, the test commands, the branch and commit conventions, and the release model are in
+[CONTRIBUTING.md](CONTRIBUTING.md). Changes that affect someone running the server are recorded in
+[CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+[MIT](LICENSE).

sql_safe_mcp-1.2.0/README.md

@@ -0,0 +1,221 @@
+<div align="center">
+
+# sql-safe-mcp
+
+A read-only, PII-safe SQL Server, MySQL and MariaDB MCP server for coding agents: schema knowledge and safe queries, with no way to change or leak data.
+
+[![CI](https://github.com/proprock/sql-safe-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/proprock/sql-safe-mcp/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/proprock/sql-safe-mcp)](https://github.com/proprock/sql-safe-mcp/releases)
+[![PyPI Version](https://img.shields.io/pypi/v/sql-safe-mcp)](https://pypi.org/project/sql-safe-mcp/)
+[![Python](https://img.shields.io/badge/python-3.12%2B-blue)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+
+[![Model Context Protocol compatible](https://img.shields.io/badge/Model_Context_Protocol-compatible-000000?logo=modelcontextprotocol&logoColor=white)](https://modelcontextprotocol.io)
+[![MCP Registry: io.github.proprock/sql-safe-mcp](https://img.shields.io/badge/MCP_Registry-io.github.proprock%2Fsql--mini--mcp-000000?logo=modelcontextprotocol&logoColor=white)](server.json)
+
+<img src="https://raw.githubusercontent.com/proprock/sql-safe-mcp/master/images/luna-guard.jpg" alt="Read the data. Protect the identity." width="760">
+
+<i>Read the data. Protect the identity.</i>
+
+</div>
+
+<!-- mcp-name: io.github.proprock/sql-safe-mcp -->
+
+General-purpose database MCP servers hand the agent a raw SQL prompt and dozens of tools. This
+server gives a coding agent the schema knowledge it needs to write correct code - servers,
+databases, tables, columns, keys, indexes, stored procedures - and, on servers you mark
+`pii_safe`, a way to look at real rows without ever seeing the personal data in them.
+
+## Read-only by design. PII-safe by default
+
+- **Read-only by construction** - seven tools, all annotated read-only. No tool writes data, and
+  the server never executes SQL an agent wrote: metadata comes from SQLAlchemy Inspector and fixed
+  catalog queries, and `execute_sql` runs only a validated, regenerated `SELECT`.
+- **PII-safe by default** - on a `pii_safe` server, the columns you configure come back as
+  alias-bound, authenticated tokens (`pii:v1:...`), never as plaintext. An agent can still
+  project, count, and filter on them with `=` and `IN` using tokens it was given, so it can follow
+  a record without reading it. Tokens do not work on another server alias or with another key.
+- **Fails closed** - SQL validation is an allowlist. Unknown syntax, unresolved lineage, and
+  unsupported protected-value types are refused, not guessed at. The verification evidence is in
+  the [security model](SECURITY-MODEL.md).
+- **Least access first** - `access_level: metadata` (the default) exposes schema only;
+  `execute_sql` needs an explicit `pii_safe` alias with its own key. Database permissions stay the
+  primary control, so use a least-privilege login.
+
+## Also
+
+- **Your aliases, not your network** - the agent sees only the server aliases you configure. There
+  is no network discovery, and the catalog is not published as MCP resources.
+- **Secrets stay out of sight** - connection URLs live in YAML with `${NAME}` placeholders resolved
+  from the environment. They never appear in logs or model-visible errors.
+- **Compact, predictable output** - object-rooted results with stable sorting, literal
+  case-insensitive name filters, and stored procedure lists that do not expand definitions.
+- **Errors an agent can act on** - an ambiguous name lists the candidate schemas. Errors never
+  contain connection details, credentials, keys, tokens, or rows.
+- **On PyPI** - `uvx sql-safe-mcp`, no repo clone required.
+
+| Tool | Access | Purpose |
+|---|---|---|
+| `list_servers` | 🟢 read | Configured server aliases |
+| `list_databases` | 🟢 read | Databases visible to the credentials |
+| `list_tables` | 🟢 read | Base tables, filtered by schema or name |
+| `get_table_definition` | 🟢 read | Columns, keys, constraints, and indexes of one table |
+| `list_stored_procedures` | 🟢 read | Stored procedures, without definitions |
+| `get_stored_procedure` | 🟢 read | The definition of one stored procedure |
+| `execute_sql` | 🟢 read | One restricted `SELECT` on a `pii_safe` server; protected columns return tokens |
+
+> [!NOTE]
+> **Status:** SQL Server supports every tool. MySQL and MariaDB (`engine: mysql` or `mariadb`,
+> `mysql+pymysql` URLs) support every tool too. `schema` is always `null` there because the
+> database is the catalog, and `execute_sql` uses `LIMIT` instead of `TOP`. See
+> [ARCHITECTURE.md](ARCHITECTURE.md).
+
+- [Install](#install)
+- [Configure](#configure)
+- [PII-safe queries](#pii-safe-queries)
+- [Security](#security)
+- [Contributing](#contributing)
+
+More detail lives in [`docs/`](docs): the [configuration reference](docs/configuration.md),
+[what the tools return](docs/tools.md), and the [security model](SECURITY-MODEL.md).
+
+## Install
+
+```bash
+uvx sql-safe-mcp
+```
+
+or
+
+```bash
+pip install sql-safe-mcp
+```
+
+Pin a version when you want a fixed surface: `uvx sql-safe-mcp==1.2.0`.
+
+Requires Python 3.12+, [uv](https://docs.astral.sh/uv/) (or `pip`), and
+[Microsoft ODBC Driver 18 for SQL Server](https://learn.microsoft.com/sql/connect/odbc/download-odbc-driver-for-sql-server)
+when you connect to SQL Server. MySQL and MariaDB use the bundled PyMySQL driver and need nothing
+else.
+
+Verified against SQL Server 2022, MySQL 8.4, and MariaDB 11.4 (see [CHECKS.md](CHECKS.md)).
+
+## Configure
+
+Copy [sql-safe-mcp.example.yaml](sql-safe-mcp.example.yaml) to `sql-safe-mcp.yaml`, list your
+servers, and keep credentials in environment variables:
+
+```yaml
+version: 1
+servers:
+  reporting:
+    engine: sqlserver
+    access_level: metadata
+    connection_url: "${REPORTING_SQL_URL}"
+```
+
+Point the server at the file with `SQL_SAFE_MCP_CONFIG` (or `--config`), and check it without
+connecting to any database:
+
+```bash
+SQL_SAFE_MCP_CONFIG=sql-safe-mcp.yaml uvx sql-safe-mcp --check-config
+```
+
+Configuration is validated at startup, and an error names the problem without printing a URL or
+secret. Keep credentials in the host's own configuration and never commit them. The server acts
+with the database account's permissions, so use a dedicated login with the least access the job
+needs. Every setting, including the runtime limits, is in
+[configuration.md](docs/configuration.md).
+
+<details>
+<summary><b>Claude Code</b></summary>
+
+```bash
+claude mcp add --env SQL_SAFE_MCP_CONFIG=/path/to/sql-safe-mcp.yaml --env REPORTING_SQL_URL=mssql+pyodbc://... --transport stdio sql-safe -- uvx sql-safe-mcp
+```
+
+Put at least one other option between the last `--env` and the server name, as above - the CLI
+otherwise reads the name as another `KEY=value` pair.
+
+</details>
+
+<details>
+<summary><b>Claude Desktop</b></summary>
+
+In `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "sql-safe": {
+      "command": "uvx",
+      "args": ["sql-safe-mcp"],
+      "env": {
+        "SQL_SAFE_MCP_CONFIG": "/path/to/sql-safe-mcp.yaml",
+        "REPORTING_SQL_URL": "mssql+pyodbc://..."
+      }
+    }
+  }
+}
+```
+
+</details>
+
+<details>
+<summary><b>Codex CLI</b></summary>
+
+```bash
+codex mcp add sql-safe --env SQL_SAFE_MCP_CONFIG=/path/to/sql-safe-mcp.yaml --env REPORTING_SQL_URL=mssql+pyodbc://... -- uvx sql-safe-mcp
+```
+
+</details>
+
+<details>
+<summary><b>Any other stdio host</b></summary>
+
+Command `uvx`, argument `sql-safe-mcp`, and the environment variables your configuration
+references, plus `SQL_SAFE_MCP_CONFIG`. The server speaks MCP over stdio and logs only to stderr.
+
+</details>
+
+## PII-safe queries
+
+Mark an alias `access_level: pii_safe`, give it its own key, and list the protected columns:
+
+```yaml
+servers:
+  legacy_prod:
+    engine: sqlserver
+    access_level: pii_safe
+    connection_url: "${LEGACY_PROD_SQL_URL}"
+    pii_key_env: LEGACY_PROD_PII_KEY
+    pii:
+      rules:
+        - database: "*"
+          schema: dbo
+          table: Users
+          columns: [Email, FirstName, LastName]
+```
+
+`execute_sql` then accepts one restricted `SELECT`. Protected cells come back as tokens, and a
+token is accepted only in `=` and `IN` predicates on the same alias. Protection covers the columns
+you list, so list every column that holds personal data. The rule format, key generation, and the
+accepted SQL are in [configuration.md](docs/configuration.md) and [tools.md](docs/tools.md).
+
+## Security
+
+The MCP caller, SQL input, database metadata, rows, and tokens are untrusted; the operator, the
+process environment, and the database credentials are the trusted boundary. Database permissions
+remain the primary authorization control - this server never widens them. The full model and its
+verification are in [SECURITY-MODEL.md](SECURITY-MODEL.md). To report a vulnerability,
+use the private channel in [SECURITY.md](SECURITY.md).
+
+## Contributing
+
+Setup, checks, the test commands, the branch and commit conventions, and the release model are in
+[CONTRIBUTING.md](CONTRIBUTING.md). Changes that affect someone running the server are recorded in
+[CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+[MIT](LICENSE).

sql_safe_mcp-1.2.0/pyproject.toml

@@ -0,0 +1,89 @@
+[project]
+name = "sql-safe-mcp"
+version = "1.2.0"
+description = "Minimal, read-only, PII-safe MCP server for SQL databases."
+readme = "README.md"
+requires-python = ">=3.12,<3.15"
+license = { file = "LICENSE" }
+dependencies = [
+    "anyio>=4.8,<5",
+    "cryptography>=46.0.7,<47",
+    "mcp>=2,<3",
+    "pydantic>=2.10,<3",
+    "pymysql>=1.2.3",
+    "pyodbc>=5.2,<6",
+    "pyyaml>=6,<7",
+    "sqlalchemy>=2.0,<3",
+    "sqlglot>=30.18,<31",
+]
+
+[project.scripts]
+sql-safe-mcp = "sql_safe_mcp.__main__:main"
+
+[dependency-groups]
+dev = [
+    "hypothesis>=6.168,<7",
+    "mutmut>=3.8,<4 ; sys_platform != 'win32'",
+    "prek>=0.2",
+    "pytest>=8.3,<10",
+    "pytest-cov>=6,<8",
+    "ruff>=0.11",
+    "ty>=0.0.1a20",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/sql_safe_mcp"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "/CHANGELOG.md",
+    "/LICENSE",
+    "/README.md",
+    "/pyproject.toml",
+    "/server.json",
+    "/sql-safe-mcp.example.yaml",
+    "/src",
+]
+
+[tool.pytest.ini_options]
+addopts = "-ra --strict-markers"
+testpaths = ["tests"]
+pythonpath = ["tests/security", "tests/integration/sqlserver", "tests/integration/mysql"]
+markers = [
+    "integration: requires a live database",
+    "deep: expensive security verification",
+]
+
+[tool.mutmut]
+source_paths = ["src/sql_safe_mcp"]
+also_copy = ["server.json", "README.md"]
+only_mutate = ["*security/*.py", "*config.py"]
+mutate_only_covered_lines = true
+pytest_add_cli_args = ["-q", "-m", "not integration and not deep", "-p", "no:cacheprovider"]
+pytest_add_cli_args_test_selection = ["tests/unit", "tests/security", "tests/contract"]
+timeout_multiplier = 3.0
+timeout_constant = 5.0
+
+[tool.coverage.run]
+branch = true
+source = ["sql_safe_mcp"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP", "SIM", "RUF"]
+
+[tool.ruff.format]
+quote-style = "double"
+
+[tool.ty.src]
+include = ["src", "tests"]
+
+[tool.ty.environment]
+extra-paths = ["tests/security", "tests/integration/sqlserver", "tests/integration/mysql"]