sqlguard-ninja 0.2.0__tar.gz → 0.4.0__tar.gz

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/CHANGELOG.md

@@ -3,6 +3,38 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.4.0] — 2026-10-24
+
+### Added
+* **MCP server** (`sqlninja mcp`, `sqlguard_ninja.mcp_server`, extra `[mcp]` on the official
+  MCP Python SDK 2.x). Tools: `validate_sql`, `explain_policy_decision`,
+  `inspect_query_cost`, `get_policy_capabilities`. The role and tenant are fixed server-side,
+  there is no execution and no database connection, internal detail is withheld, ungranted
+  tables and columns are not disclosed, input is size-capped, and calls are rate-limited.
+* An end-to-end test drives the real server over stdio with the SDK's `ClientSession`.
+* Docs: `docs/guides/MCP_INTEGRATION.md`; threat model T17.
+
+## [0.3.0] — 2026-10-24
+
+### Added
+* **Role inheritance** (`extends`): grants merge, explicit denies are sticky, and conflicts,
+  unknown parents and cycles are load errors.
+* **Policy metadata and identity:** `metadata.revision/owner/change_ticket`, a policy
+  fingerprint, and a per-decision `decision_id`. Audit events add `policy_revision`,
+  `policy_fingerprint`, `decision_id`, `correlation_id`, a literal-insensitive
+  `query_fingerprint`, and `tenant_filter_rewrite`.
+* **Policy CLI:** `policy template`, `policy diff` (effect classification,
+  `--fail-on-relaxation`), `policy simulate` (`--against`, `--fail-on-change`),
+  `policy explain` (decision or column access, with inheritance source).
+* **Templates:** `minimal`, `multi_tenant_saas`, `analytics_readonly`.
+* **Opt-in AST tenant-filter rewrite** (`sqlguard_ninja.tenancy`,
+  `SQLCheckpoint(rewrite_tenant_filters=True)`) with re-validation and refusal rules (ADR-011).
+* Docs: `docs/guides/POLICY_AS_CODE.md`; ADR-011, ADR-012; threat model T6a/T6b.
+
+### Compatibility
+* Policy files without the new fields behave exactly as before. `ValidationResult` gains
+  fields with defaults.
+
 ## [0.2.0] — 2026-10-24
 
 ### Added

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.2.0
+Version: 0.4.0
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -29,6 +29,7 @@ Provides-Extra: all
 Requires-Dist: fastapi>=0.110; extra == 'all'
 Requires-Dist: langchain-core>=0.3; extra == 'all'
 Requires-Dist: langgraph>=0.2; extra == 'all'
+Requires-Dist: mcp<3,>=2.3; extra == 'all'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
@@ -37,6 +38,7 @@ Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: hypothesis>=6.100; extra == 'dev'
 Requires-Dist: langchain-core>=0.3; extra == 'dev'
 Requires-Dist: langgraph>=0.2; extra == 'dev'
+Requires-Dist: mcp<3,>=2.3; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'dev'
 Requires-Dist: pytest-cov>=5.0; extra == 'dev'
@@ -50,6 +52,8 @@ Requires-Dist: langchain-core>=0.3; extra == 'langchain'
 Provides-Extra: langgraph
 Requires-Dist: langchain-core>=0.3; extra == 'langgraph'
 Requires-Dist: langgraph>=0.2; extra == 'langgraph'
+Provides-Extra: mcp
+Requires-Dist: mcp<3,>=2.3; extra == 'mcp'
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
 Description-Content-Type: text/markdown
@@ -246,6 +250,37 @@ Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'
 suggestions are never enforced. This is a technical control, not a certification of GDPR
 compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
+## Policy as code
+
+Roles can inherit (`extends`), and explicit denies cannot be relaxed by a child. Every decision
+carries the policy revision, the policy fingerprint and a decision id. Review changes before
+activating them:
+
+```bash
+sqlninja policy template multi_tenant_saas --output policy.yaml
+sqlninja policy diff old.yaml policy.yaml --fail-on-relaxation
+sqlninja policy simulate --policy old.yaml --against policy.yaml --cases cases.yaml
+sqlninja policy explain --policy policy.yaml --role support --column customers.email
+```
+
+Optional: `SQLCheckpoint(..., rewrite_tenant_filters=True)` adds missing tenant filters
+through the AST and executes only the re-validated rewrite. See
+[POLICY_AS_CODE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_AS_CODE.md).
+
+## MCP server
+
+Let MCP-compatible agents check SQL against your policy before running it anywhere:
+
+```bash
+python -m pip install "sqlguard-ninja[mcp]"
+sqlninja mcp --policy builtin:retail_saas --role support_analyst --tenant 1
+```
+
+The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cost` and
+`get_policy_capabilities`. The role and tenant are fixed server-side, the server never connects
+to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
+client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -340,6 +375,8 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 ## Documentation
 
 * [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Policy as code](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_AS_CODE.md)
+* [MCP integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md)
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/README.md

@@ -190,6 +190,37 @@ Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'
 suggestions are never enforced. This is a technical control, not a certification of GDPR
 compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
+## Policy as code
+
+Roles can inherit (`extends`), and explicit denies cannot be relaxed by a child. Every decision
+carries the policy revision, the policy fingerprint and a decision id. Review changes before
+activating them:
+
+```bash
+sqlninja policy template multi_tenant_saas --output policy.yaml
+sqlninja policy diff old.yaml policy.yaml --fail-on-relaxation
+sqlninja policy simulate --policy old.yaml --against policy.yaml --cases cases.yaml
+sqlninja policy explain --policy policy.yaml --role support --column customers.email
+```
+
+Optional: `SQLCheckpoint(..., rewrite_tenant_filters=True)` adds missing tenant filters
+through the AST and executes only the re-validated rewrite. See
+[POLICY_AS_CODE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_AS_CODE.md).
+
+## MCP server
+
+Let MCP-compatible agents check SQL against your policy before running it anywhere:
+
+```bash
+python -m pip install "sqlguard-ninja[mcp]"
+sqlninja mcp --policy builtin:retail_saas --role support_analyst --tenant 1
+```
+
+The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cost` and
+`get_policy_capabilities`. The role and tenant are fixed server-side, the server never connects
+to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
+client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -284,6 +315,8 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 ## Documentation
 
 * [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Policy as code](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_AS_CODE.md)
+* [MCP integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md)
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/docs/architecture/ARCHITECTURE_DECISIONS.md

@@ -122,6 +122,25 @@ Extras: `langchain`, `langgraph`, `fastapi`, `postgres` (`psycopg`), `dev`.
 Apache-2.0 provides an explicit patent grant, which matters to enterprise adopters. It is
 compatible with all dependencies we use (MIT, BSD, Apache-2.0). No third-party code is vendored.
 
+## ADR-011 — Opt-in tenant-filter rewrite (refines ADR-005)
+
+**Context.** Enterprise users want missing tenant filters added rather than rejected.
+
+**Decision.** `sqlguard_ninja.tenancy.apply_tenant_filters` may add tenant predicates through
+the AST. It is opt-in (`rewrite_tenant_filters=True`), uses bind parameters only, refuses on any
+non-tenant problem or ambiguous ownership, and **re-validates** the rewritten SQL, which is the
+exact string executed. ADR-005's invariant still holds: the validated string and the executed
+string are identical.
+
+**Consequences.** The rewritten SQL is the qualified form produced by sqlglot. It is equivalent
+but may look different from the input. Database RLS remains the authoritative control.
+
+## ADR-012 — Role inheritance with sticky explicit denies
+
+**Decision.** `extends` merges grants. A child cannot relax an inherited explicit deny, and an
+attempt is a load error. `policy diff` works on the effective (inherited) policy and classifies
+relaxations so reviewers and CI can gate them.
+
 ## ADR-010 — Read-only scope for v0.1
 
 **Decision.** v0.1 validates read-only workloads only. All writes are denied. Supporting governed

sqlguard_ninja-0.4.0/docs/development/IMPLEMENTATION_PROGRESS.md

@@ -0,0 +1,12 @@
+# Implementation progress
+
+| Phase | Status | Commit | Tests | Notes |
+|---|---|---|---|---|
+| 0 Audit and checkpoint files | IMPLEMENTED | 375c52f^ | — | baseline v0.1.1 verified: clean tree, main@5206e96, PyPI 0.1.1 |
+| 1a Benchmark tiers, basis, F1, Wilson CIs, throughput, CSV, hashes | RELEASED v0.2.0 | 375c52f | focused + full gate | |
+| 1b Lineage: aggregate-only through CTEs, tenant push-down, small-cohort through derived scopes | RELEASED v0.2.0 | 8b59a38 | corpus 1.1.0 (21 boundary cases), 11 unit tests | LIN-012 found a real bypass of the small-cohort rule before release; fixed |
+| 2a Role inheritance (sticky denies), revision/fingerprint, decision ids, audit fields | VERIFIED (local) | 2f1919c | test_policy_inheritance (11) | |
+| 2b Policy diff/simulate/explain/templates CLI | VERIFIED (local) | e64859a | test_policy_tools (21) | |
+| 2c Opt-in AST tenant-filter rewrite + checkpoint | VERIFIED (local) | b0b5ade | test_tenant_rewrite (32, executes on SQLite, tenants 1-3) | |
+| 2d Docs, ADR-011/012, v0.3.0 bump | RELEASED v0.3.0 | 198a308 | full gate 1,804 passed, 94% | |
+| 3 MCP server (stdio, validation-only) | VERIFIED (local) | see PR | 9 tests incl. real SDK client | released as v0.4.0 (version targets adapted) |

sqlguard_ninja-0.4.0/docs/development/NEXT_ACTIONS.md

@@ -0,0 +1,6 @@
+# Next actions (development program)
+
+1. Merge the v0.4.0 (MCP) PR, tag, release, verify PyPI and a fresh install including the `[mcp]` extra and a stdio session.
+2. Phase 4 (v0.5.0): make MySQL a tested dialect against a MySQL 8 service container in CI (#11); SQL Server and Oracle parser-level experimental only; publish a compatibility matrix.
+3. Phase 5: OpenTelemetry/Prometheus extras, SARIF output (#14), Grafana dashboard JSON.
+4. Phases 6-8: playground UI on the FastAPI backend, Docker/Kubernetes reference, public demo (hosting needs maintainer authorization).

sqlguard_ninja-0.4.0/docs/development/TEST_EVIDENCE.md

@@ -0,0 +1,15 @@
+# Test evidence
+
+| Date | Scope | Command | Result |
+|---|---|---|---|
+| 2026-10-24 | Baseline (v0.1.1) | `pytest --cov` | 1,655 passed, 95% (local, Python 3.11) |
+| 2026-10-24 | v0.2.0 candidate | full gate (`ruff`, `mypy`, corpus `--check`, `pytest --cov`, build, `twine check`) | 1,738 passed, 94% branch coverage; twine PASSED |
+| 2026-10-24 | Benchmark, corpus 1.1.0 | `sqlninja benchmark run --dataset builtin:v1` (4 adapters) | see docs/benchmarks/RESULTS_v1.1.md |
+| 2026-10-24 | v0.2.0 PR #17 | CI run on PR | 12/12 jobs green; gate: baseline from main, 4 approved relabels, 0 regressions |
+| 2026-10-24 | v0.2.0 main | CI run 40107938223 on 8b59a38 | success |
+| 2026-10-24 | v0.2.0 publish | release.yml run 40108113801 | build + publish success; wheel and sdist with PEP 740 provenance; 0.1.0 and 0.1.1 unchanged |
+| 2026-10-24 | v0.2.0 fresh install | `pip install --no-cache-dir --index-url https://pypi.org/simple sqlguard-ninja==0.2.0` (Python 3.13, outside repo) | import from site-packages; lineage allow/deny and tenant push-down via CLI; bundled benchmark 1,044 evaluations with CSV, tiers, 14 file hashes |
+| 2026-10-24 | v0.3.0 candidate | full gate | 1,804 passed, 94%; build + twine PASSED; 3 templates in wheel |
+| 2026-10-24 | v0.3.0 release | PR #19 12/12; main CI on 198a308 success; release.yml run 40115952065 success | PyPI files with provenance |
+| 2026-10-24 | v0.3.0 fresh install | pip from PyPI, Python 3.13, outside repo (3rd attempt; CDN lag) | templates, policy check/explain (inheritance), tenant rewrite, decision metadata OK |
+| 2026-10-24 | v0.4.0 candidate (MCP) | tests/integration/test_mcp_server.py | 9 passed, including a real stdio ClientSession |

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/docs/development/progress.json

@@ -13,7 +13,8 @@
       ],
       "evidence": [
         "tiers, basis, F1, Wilson CIs, CSV, hashes: VERIFIED locally",
-        "no independent dataset yet (#6); function/catalog cases absent (#5)"
+        "no independent dataset yet (#6); function/catalog cases absent (#5)",
+        "v0.2.0 released: tiers/CIs/CSV/hashes; still no independent data"
       ],
       "blockers": [
         "external dataset needs licensed independent source (#6)"
@@ -22,33 +23,39 @@
     {
       "id": 2,
       "name": "Lineage-aware privacy",
-      "status": "VERIFIED",
+      "status": "RELEASED",
       "release": "v0.2.0",
       "issues": [
         8,
         9
       ],
       "evidence": [
-        "corpus 1.1.0 lineage cases + tests/unit/test_lineage.py; full gate 1,738 passed"
+        "corpus 1.1.0 lineage cases + tests/unit/test_lineage.py; full gate 1,738 passed",
+        "v0.2.0 on PyPI; fresh install verified"
       ],
       "blockers": []
     },
     {
       "id": 3,
       "name": "Policy-as-code and multitenancy",
-      "status": "NOT_STARTED",
+      "status": "RELEASED",
       "release": "v0.3.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "inheritance, diff/simulate/explain/templates, tenant rewrite, audit metadata; 1,804 tests pass locally",
+        "v0.3.0 on PyPI; fresh install verified"
+      ],
       "blockers": []
     },
     {
       "id": 4,
       "name": "MCP server",
-      "status": "NOT_STARTED",
-      "release": "v0.3.0",
+      "status": "VERIFIED",
+      "release": "v0.4.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "stdio server; 9 tests incl. official SDK ClientSession"
+      ],
       "blockers": []
     },
     {
@@ -103,4 +110,4 @@
       ]
     }
   ]
-}
+}

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/docs/guides/AGENT_INTEGRATION.md

@@ -19,6 +19,9 @@ LLM ──SQL──▶ SQLCheckpoint.evaluate(sql, RequestContext) ──▶ aut
 | `review` | not run | run only with an approval bound to the SQL hash, trace and principal (single use, TTL, no self-approval) | run |
 | `audit` | run, recorded `enforced=False` | run, recorded | run |
 
+`rewrite_tenant_filters=True` (off by default) adds missing tenant filters through the AST and
+executes the re-validated rewrite. See [POLICY_AS_CODE.md](POLICY_AS_CODE.md).
+
 `max_denied_attempts` (default 5) locks a trace after repeated denials, so a retry loop
 cannot grind through rephrasings.
 

sqlguard_ninja-0.4.0/docs/guides/MCP_INTEGRATION.md

@@ -0,0 +1,77 @@
+# MCP integration
+
+SQLGuard Ninja ships a [Model Context Protocol](https://modelcontextprotocol.io/) server that
+lets MCP-compatible agents check SQL against your policy **before** they run it anywhere.
+
+```bash
+python -m pip install "sqlguard-ninja[mcp]"
+sqlninja mcp --policy policy.yaml --role support --tenant 42          # stdio transport
+```
+
+Built on the official MCP Python SDK (`mcp` 2.x, `MCPServer`). The bundled reference policy
+works out of the box: `--policy builtin:retail_saas --role support_analyst --tenant 1`.
+
+## Tools
+
+| Tool | Arguments | Returns |
+|---|---|---|
+| `validate_sql` | `sql`, optional `dialect` (`postgres` or `sqlite`) | `decision` (allow/review/deny), findings (rule id, action, message, remediation), `decision_id`, policy revision |
+| `explain_policy_decision` | `sql`, optional `dialect` | the decision plus per-finding lineage (base column, JSON path, labels) and how-to-fix hints |
+| `inspect_query_cost` | `sql`, optional `dialect` | static cost score, thresholds and factors (no execution plan, no database) |
+| `get_policy_capabilities` | — | the tables and columns this identity may use, their access mode (`allow`, `aggregate_only`, `review`), required tenant filter, limits, supported dialects |
+
+No tool accepts a role, a tenant, credentials or a connection string. The server has **no
+execution tool** and never connects to a database.
+
+## Security model
+
+* **Identity is server-side.** `--role` and `--tenant` are fixed when the server starts, by
+  whoever writes the client configuration. A model cannot choose its own permissions. Extra
+  arguments such as `role` are rejected or ignored, and the end-to-end test checks this.
+* **Least disclosure.** `get_policy_capabilities` lists only tables and columns the role may
+  use. Denied tables and columns are not revealed. Internal finding detail is never returned,
+  and with `disclosure: generic` lineage is omitted as well.
+* **Limits.** A hard cap of 100,000 characters applies before parsing, the policy's own length
+  and AST-size limits still apply, and a per-process rate limit (120 calls per minute by
+  default) is enforced. Errors are structured (`{"error": ..., "message": ...}`) and carry no
+  stack traces.
+* **Fail closed.** A tenant-scoped role started without `--tenant` gets every tenant-table
+  query denied.
+* The server is a validation service. Running the SQL remains your application's job, with a
+  least-privilege, read-only database role and row-level security.
+
+## Client configuration (stdio)
+
+Most MCP clients accept a JSON server definition of this shape. Adapt the command path to
+your environment:
+
+```json
+{
+  "mcpServers": {
+    "sqlguard-ninja": {
+      "command": "sqlninja",
+      "args": ["mcp", "--policy", "/absolute/path/policy.yaml", "--role", "support", "--tenant", "42"]
+    }
+  }
+}
+```
+
+One server process serves one identity. To give different users different permissions, start
+one server per identity from your trusted configuration. Never let the model write the client
+configuration.
+
+## Remote transports
+
+The SDK also supports Streamable HTTP. SQLGuard Ninja does **not** enable it by default,
+because a remote endpoint needs authentication that binds each caller to a role and tenant.
+If you expose it remotely, put it behind your own authenticated gateway, derive the identity
+from the authenticated caller, and keep one identity per server process or route. This setup
+is not covered by the test suite.
+
+## Verification
+
+`tests/integration/test_mcp_server.py` starts the real server as a subprocess and connects
+with the official SDK's `stdio_client` and `ClientSession`. It checks tool discovery,
+allowed and denied validations, a forged `role` argument, and capability listing. It also
+unit-tests malformed input, oversized input, unsupported dialects, rate limiting, the
+missing-tenant fail-closed path and least disclosure.

sqlguard_ninja-0.4.0/docs/guides/POLICY_AS_CODE.md

@@ -0,0 +1,97 @@
+# Policy as code
+
+Policies are versioned files reviewed like code. This guide covers inheritance, metadata,
+templates and the review workflow. Field reference:
+[POLICY_REFERENCE.md](POLICY_REFERENCE.md).
+
+## Metadata and identity
+
+```yaml
+version: 1                      # schema version
+name: shop
+metadata:
+  revision: "2026.10.2"         # your revision; recorded in every decision and audit event
+  owner: data-governance
+  change_ticket: SEC-1234
+```
+
+Every `ValidationResult` and audit event records:
+- `decision_id`: unique per decision
+- `policy_revision`
+- `policy_fingerprint`: a 16-hex-character content hash that changes with any semantic change
+Audit events also record the `correlation_id` (the request trace id) and a `query_fingerprint`,
+which is the SHA-256 of the literal-redacted SQL. Queries that differ only in literal values
+share a fingerprint, and literal values themselves are never logged.
+
+## Role inheritance
+
+```yaml
+roles:
+  tenant_base:
+    tenant_scoped: true
+    labels: {payment_card: deny}
+  support:
+    extends: [tenant_base]
+    tables: {customers: "*", orders: [id, tenant_id, status]}
+    labels: {contact: allow}
+```
+
+* Grants are merged. Column lists are unioned, and `"*"` wins.
+* Label access and `column_access` override per key, and `limits` come from the nearest role
+  that sets them.
+* **Explicit denies are sticky.** A child cannot relax an inherited deny label, deny column
+  rule, `deny_columns` entry, or `tenant_scoped: true`. The attempt is a load error (a
+  *conflict*), not a silent override.
+* Unknown parents and cycles are load errors. Grants inherited from parents are validated
+  against the catalog just like direct grants.
+
+`sqlninja policy explain --policy P --role R --column table.column` shows the effective access
+and which role in the chain set each label.
+
+## Templates
+
+```bash
+sqlninja policy template                         # list: minimal, multi_tenant_saas, analytics_readonly
+sqlninja policy template multi_tenant_saas --output policies/policy.yaml
+```
+
+## Reviewing a change before activation
+
+```bash
+sqlninja policy diff policies/old.yaml policies/new.yaml            # every change, classified
+sqlninja policy diff old.yaml new.yaml --fail-on-relaxation         # CI: block silent relaxations
+sqlninja policy simulate --policy old.yaml --against new.yaml --cases examples.yaml
+sqlninja policy explain --policy new.yaml --role support --tenant 1 --sql "SELECT ..."
+```
+
+* `diff` compares the **effective** policies, after inheritance. It classifies each change as
+  `relaxes` (can only allow more), `restricts` or `neutral`. Covered areas: roles, table and
+  column grants, `deny_columns`, column rules, label access, `tenant_scoped`, catalog labels
+  and tenant columns, function policy, limits, defaults, cost thresholds and disclosure.
+* `simulate` evaluates example queries (`{id, sql, role, context, expect}`) under the current
+  policy and, optionally, a candidate. It reports decision changes and expectation mismatches,
+  and exits 1 on mismatch, or with `--fail-on-change` when any decision changes.
+* `explain` prints the structured decision: rule ids, messages, internal detail and lineage.
+  Use it for operators. Agent-facing messages remain the redacted `agent_message`.
+
+Suggested CI step for policy repositories:
+
+```yaml
+- run: sqlninja policy diff "$BASE_POLICY" policies/policy.yaml --fail-on-relaxation
+- run: sqlninja policy simulate --policy policies/policy.yaml --cases policies/cases.yaml
+```
+
+## Tenant isolation: inspection, rewrite, and the database
+
+1. **Inspection (default).** Every scope reading a tenant table must pin it to the context
+   tenant. Otherwise the query is denied (see the methodology for the exact semantics).
+2. **Opt-in rewrite.** `SQLCheckpoint(..., rewrite_tenant_filters=True)` or
+   `sqlguard_ninja.tenancy.apply_tenant_filters()` adds the missing
+   `alias.tenant_column = <bind parameter>` predicates through the AST, then **re-validates**.
+   The rewritten string is what gets executed. It refuses when the query has any other
+   problem (a forbidden column, another tenant's id, a write), when ownership is ambiguous
+   (the preserved side of a RIGHT/FULL join), or when the rewritten SQL fails validation. The
+   tenant value is always a bind parameter, never inlined.
+3. **The database (authoritative).** Use PostgreSQL row-level security, or per-tenant
+   credentials, as the real boundary. SQL inspection and rewriting are defence in depth. They
+   cannot see views, functions or data an attacker reaches by other means.

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/docs/guides/POLICY_REFERENCE.md

@@ -9,6 +9,7 @@ start-up instead of silently changing behaviour. Run `sqlninja policy check --po
 ```yaml
 version: 1
 name: shop
+metadata: {revision: "2026.10.1", owner: data-governance}   # recorded in every decision
 dialect: postgres            # default dialect for validate()
 disclosure: names            # or "generic": agent messages never name tables/columns
 
@@ -35,6 +36,7 @@ catalog:
 
 roles:
   support:
+    # extends: [base_role]          # inherit grants; inherited explicit denies cannot be relaxed
     tables:
       customers: [id, tenant_id, email, email_domain]   # or "*", or {columns, deny_columns, column_access}
     labels: {contact: allow, health: deny}
@@ -83,6 +85,9 @@ cost: {enabled: true, review_score: 50, deny_score: 80, large_table_rows: 100000
 
 Without roles, an implicit role grants every catalog table and denies every labelled column.
 
+Inheritance, templates, `policy diff` / `simulate` / `explain` and the tenant-filter rewrite
+are described in [POLICY_AS_CODE.md](POLICY_AS_CODE.md).
+
 ## Decisions
 
 Each rule emits findings with an action (`deny`, `review`, `warn`). Any deny → **DENY**,

sqlguard_ninja-0.4.0/docs/releases/v0.3.0.md

@@ -0,0 +1,29 @@
+# SQLGuard Ninja v0.3.0
+
+Enterprise policy-as-code and tenant enforcement.
+
+## Highlights
+
+* **Role inheritance** with sticky explicit denies: a child role can add permissions, but cannot undo an inherited deny. Conflicts, unknown parents and cycles fail at load time.
+* **Review before activation:** `sqlninja policy diff` classifies every change as relaxes / restricts / neutral (`--fail-on-relaxation` for CI). `policy simulate --against` shows decision changes on example queries, and `policy explain` traces effective access through the inheritance chain.
+* **Auditability:** every decision has a `decision_id`, the policy revision and fingerprint. Audit events add a correlation id, a literal-insensitive query fingerprint and a tenant-rewrite flag.
+* **Templates:** `minimal`, `multi_tenant_saas`, `analytics_readonly`.
+* **Opt-in AST tenant-filter rewrite:** missing tenant pins are added as bind-parameter predicates and the rewrite is re-validated. It is refused on any other problem or on RIGHT/FULL-join ownership ambiguity.
+
+## Compatibility
+
+Existing policies behave as before; the new fields are optional.
+
+## Known limitations
+
+* All benchmark results are internal. There is no independent dataset yet (issue #6), and no restricted-function or system-catalog cases (issue #5).
+* The tenant rewrite emits sqlglot-normalised SQL. Database row-level security remains the authoritative tenant control.
+* Only PostgreSQL and SQLite are supported; writes are denied; no guarantee against SQL injection or data leakage.
+
+## Installation
+
+```bash
+python -m pip install sqlguard-ninja==0.3.0
+```
+
+PyPI: https://pypi.org/project/sqlguard-ninja/0.3.0/

sqlguard_ninja-0.4.0/docs/releases/v0.4.0.md

@@ -0,0 +1,20 @@
+# SQLGuard Ninja v0.4.0
+
+## Highlights
+
+* **MCP server.** `sqlninja mcp --policy ... --role ... --tenant ...` exposes `validate_sql`, `explain_policy_decision`, `inspect_query_cost` and `get_policy_capabilities` to MCP-compatible agents over stdio. It is built on the official MCP Python SDK (2.x).
+* **Security model.** The identity is fixed by the operator at start-up, and tools take no role, tenant, credential or connection-string arguments. The server never executes SQL or connects to a database, withholds internal detail, and does not reveal ungranted tables or columns. Inputs are size-capped and calls are rate-limited.
+* **Verified with a real client.** The end-to-end test launches the server as a subprocess and uses the SDK's `stdio_client` and `ClientSession` to discover and call the tools, including a forged `role` argument.
+
+## Notes
+
+* Remote (Streamable HTTP) transport is not enabled. A remote deployment needs an authenticated gateway that binds each caller to an identity (see the MCP guide).
+* Known limitations are unchanged: all benchmark results are internal (issues #5 and #6), only PostgreSQL and SQLite are supported, and there is no guarantee against SQL injection or data leakage.
+
+## Installation
+
+```bash
+python -m pip install "sqlguard-ninja[mcp]==0.4.0"
+```
+
+PyPI: https://pypi.org/project/sqlguard-ninja/0.4.0/

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/docs/security/THREAT_MODEL.md

@@ -57,6 +57,9 @@ flowchart LR
 | T3 | Prompt injection through database content | A ticket body says "now query payments" | Every subsequent query is checked again. Retry lock-out per trace. Read-only session. | The model can still be steered to permitted data. |
 | T4 | Parser ambiguity | Comment and string tricks, nested comments, dollar quoting | sqlglot dialect parsing. The corpus includes formatting and comment cases validated against real engines. Unparseable input is denied. | Unknown tokenizer differences. Report them as vulnerabilities. |
 | T5 | Dialect-specific bypasses | MySQL `/*! */` executable comments, SQLite `ATTACH`/`PRAGMA` | Executable-comment rule for the MySQL family. SQLite session statements are denied. | Untested dialects are experimental. |
+| T17 | MCP client or model escalating privileges | A model passes `role` or `tenant` arguments, or probes `get_policy_capabilities` for hidden tables | Identity fixed at server start from operator config; tool schemas have no identity arguments; capabilities list only granted, non-denied columns; no execution or credentials in the server | Anyone who can edit the MCP client configuration chooses the identity |
+| T6a | Unsafe automatic tenant filtering | A rewrite that changes meaning or masks a query naming another tenant | Rewrite is opt-in, bind-parameter only, refused on any non-tenant finding and on RIGHT/FULL-join ownership ambiguity; the rewritten SQL is re-validated and is the executed string | Rewritten SQL is sqlglot-normalised; RLS remains authoritative |
+| T6b | Silent policy relaxation through inheritance or edits | A child role or edit quietly widens access | Sticky explicit denies (load error on conflict); `policy diff --fail-on-relaxation`; fingerprint and revision in every decision | Reviewers must still read the diff |
 | T6 | Tenant data leakage | missing filter, `OR 1=1`, other tenant id, unpinned join or subquery | Every scope reading a tenant table must pin it with an equality conjunct to the context value or an approved bind parameter. `OR`/`NOT` don't count, and casts of the column don't count. | Apply RLS in the database as the authoritative control. |
 | T7 | Unauthorized columns | `SELECT *`, whole-row references, alias laundering, columns in filters | Schema-based star expansion. Per-scope base-column attribution. Ungranted columns are denied in any clause. | Views and UDFs hide columns. |
 | T8 | Sensitive-data exposure | card numbers, health data in JSON, salary per person | Explicit labels. Deny / aggregate-only / review per role. JSON path labels. Window aggregates count as value-revealing. Small-cohort review. | Inference attacks across queries. |

{sqlguard_ninja-0.2.0 → sqlguard_ninja-0.4.0}/pyproject.toml

@@ -36,8 +36,10 @@ dependencies = [
 langchain = ["langchain-core>=0.3"]
 langgraph = ["langgraph>=0.2", "langchain-core>=0.3"]
 fastapi = ["fastapi>=0.110"]
+# Official MCP Python SDK; 2.x renamed FastMCP to MCPServer.
+mcp = ["mcp>=2.3,<3"]
 postgres = ["psycopg[binary]>=3.1"]
-all = ["sqlguard-ninja[langchain,langgraph,fastapi,postgres]"]
+all = ["sqlguard-ninja[langchain,langgraph,fastapi,postgres,mcp]"]
 dev = [
     "sqlguard-ninja[all]",
     "pytest>=8.0",
@@ -118,5 +120,5 @@ exclude = ["src/sqlguard_ninja/benchmarking/workers/"]
 plugins = ["pydantic.mypy"]
 
 [[tool.mypy.overrides]]
-module = ["langgraph.*", "langchain_core.*", "psycopg.*", "pgserver.*"]
+module = ["langgraph.*", "langchain_core.*", "psycopg.*", "pgserver.*", "mcp.*"]
 ignore_missing_imports = true

sqlguard_ninja-0.4.0/src/sqlguard_ninja/_version.py

@@ -0,0 +1 @@
+__version__ = "0.4.0"