sqlguard-ninja 0.4.0__tar.gz → 0.6.0__tar.gz

{sqlguard_ninja-0.4.0 → sqlguard_ninja-0.6.0}/CHANGELOG.md

@@ -3,6 +3,48 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.6.0] — 2026-10-24
+
+### Added
+* **Observability** (`sqlguard_ninja.observability`, extras `[otel]` and `[prometheus]`):
+  * `Telemetry` and `InstrumentedGuard` emit OpenTelemetry spans `sqlguard.checkpoint` and
+    `sqlguard.validate`.
+  * `GuardMetrics` exports Prometheus counters and histograms for decisions, findings,
+    latency, errors, resource-limit rejections, checkpoint outcomes and policy identity.
+  * `SQLCheckpoint(telemetry=...)` instruments its guard automatically.
+* **SARIF 2.1.0**: `sqlninja scan PATH... --format sarif|json|text --fail-on deny|review|never`.
+  It validates every statement in SQL files, with stable fingerprints. Tests and CI validate the
+  output against the OASIS schema.
+* **Grafana dashboard** `deploy/grafana/sqlguard-ninja.json`, and a Prometheus + Grafana +
+  synthetic-traffic stack (`examples/observability/`). A new CI job runs that stack.
+* Audit events gain `schema_version` and `rate_limited`. New
+  `SQLCheckpoint(principal_hmac_key=...)` option to pseudonymise principals.
+
+### Security
+* `redact_sql` now redacts hex, bit, byte (`E''`), dollar-quoted, Unicode (`U&''`) and
+  national (`N''`) strings and whole `INTERVAL` expressions. Previously these could reach
+  `sql_redacted` in audit logs. Comments are dropped, and if any literal token survives,
+  redacted SQL is withheld. See threat model T19.
+
+## [0.5.0] — 2026-10-24
+
+### Added
+* **MySQL 8** as a tested dialect within a documented scope: `sqlguard_ninja.integrations.mysql`
+  (`mysql_executor`: read-only transaction, `MAX_EXECUTION_TIME`, rollback; `bind_placeholders`:
+  AST-based binding of named placeholders, ADR-013), extra `[mysql]` (PyMySQL), and a MySQL 8.4
+  service-container CI job that executes every MySQL `allow` case as a SELECT-only account.
+* Corpus **1.2.0**: 26 MySQL cases (`cases/09_mysql.yaml`); results in
+  `docs/benchmarks/RESULTS_v1.2.md`.
+* `docs/guides/DATABASE_COMPATIBILITY.md`: compatibility matrix. SQL Server and Oracle are
+  parser-level experimental with smoke tests; they are not accepted by the MCP server.
+* The MCP server accepts `mysql` as a dialect.
+
+### Security
+* MySQL identifiers are compared exactly and never case-folded (fail closed). String values
+  containing a backslash or NUL are refused at binding time. `mysql_executor` refuses sessions
+  whose `sql_mode` changes lexing (`ANSI_QUOTES`, `NO_BACKSLASH_ESCAPES`, `PIPES_AS_CONCAT`,
+  `HIGH_NOT_PRECEDENCE`, `ANSI`); threat model T18.
+
 ## [0.4.0] — 2026-10-24
 
 ### Added

{sqlguard_ninja-0.4.0 → sqlguard_ninja-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.4.0
+Version: 0.6.0
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -30,17 +30,25 @@ Requires-Dist: fastapi>=0.110; extra == 'all'
 Requires-Dist: langchain-core>=0.3; extra == 'all'
 Requires-Dist: langgraph>=0.2; extra == 'all'
 Requires-Dist: mcp<3,>=2.3; extra == 'all'
+Requires-Dist: opentelemetry-api>=1.25; extra == 'all'
+Requires-Dist: prometheus-client>=0.20; extra == 'all'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
+Requires-Dist: pymysql>=1.1; extra == 'all'
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
 Requires-Dist: fastapi>=0.110; extra == 'dev'
 Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: hypothesis>=6.100; extra == 'dev'
+Requires-Dist: jsonschema>=4.20; extra == 'dev'
 Requires-Dist: langchain-core>=0.3; extra == 'dev'
 Requires-Dist: langgraph>=0.2; extra == 'dev'
 Requires-Dist: mcp<3,>=2.3; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: opentelemetry-api>=1.25; extra == 'dev'
+Requires-Dist: opentelemetry-sdk>=1.25; extra == 'dev'
+Requires-Dist: prometheus-client>=0.20; extra == 'dev'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'dev'
+Requires-Dist: pymysql>=1.1; extra == 'dev'
 Requires-Dist: pytest-cov>=5.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
@@ -54,8 +62,14 @@ Requires-Dist: langchain-core>=0.3; extra == 'langgraph'
 Requires-Dist: langgraph>=0.2; extra == 'langgraph'
 Provides-Extra: mcp
 Requires-Dist: mcp<3,>=2.3; extra == 'mcp'
+Provides-Extra: mysql
+Requires-Dist: pymysql>=1.1; extra == 'mysql'
+Provides-Extra: otel
+Requires-Dist: opentelemetry-api>=1.25; extra == 'otel'
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Provides-Extra: prometheus
+Requires-Dist: prometheus-client>=0.20; extra == 'prometheus'
 Description-Content-Type: text/markdown
 
 # SQLGuard Ninja
@@ -181,8 +195,8 @@ result = guard.validate(
     role="hr_analyst",
     dialect="postgres",
 )
-result.allowed      # True
-result.findings     # () - structured Finding objects with rule_id, action, message, remediation
+result.allowed  # True
+result.findings  # () - structured Finding objects with rule_id, action, message, remediation
 
 guard.validate("SELECT full_name, salary FROM employees", role="hr_analyst").explain()
 # DENY:
@@ -195,16 +209,21 @@ guard.validate("SELECT full_name, salary FROM employees", role="hr_analyst").exp
 ```python
 from sqlguard_ninja.integrations import RequestContext, SQLCheckpoint
 from sqlguard_ninja.integrations.langgraph import (
-    CONTEXT_KEY, make_execute_node, make_guard_node, route_after_guard)
+    CONTEXT_KEY,
+    make_execute_node,
+    make_guard_node,
+    route_after_guard,
+)
 
 checkpoint = SQLCheckpoint(guard, mode="block", max_denied_attempts=3)
 graph.add_node("guard", make_guard_node(checkpoint))
-graph.add_node("execute", make_execute_node(checkpoint, executor))   # re-validates
-graph.add_conditional_edges("guard", route_after_guard(3),
-                            {"execute": "execute", "revise": "generate", "end": END})
+graph.add_node("execute", make_execute_node(checkpoint, executor))  # re-validates
+graph.add_conditional_edges(
+    "guard", route_after_guard(3), {"execute": "execute", "revise": "generate", "end": END}
+)
 
 ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id)
-app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
+app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})  # nodes cannot alter config
 ```
 
 More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
@@ -281,6 +300,20 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Observability and SARIF
+
+```bash
+python -m pip install "sqlguard-ninja[otel,prometheus]"
+sqlninja scan sql/ --policy policy.yaml --role reporting --tenant 1 --format sarif --output sqlninja.sarif
+```
+
+`Telemetry(tracer=..., metrics=GuardMetrics())` adds OpenTelemetry spans and Prometheus metrics
+to the checkpoint: decisions, findings by rule, latency, errors, resource-limit rejections and
+checkpoint outcomes. By default no signal contains SQL text, literals, request-context values,
+tenant ids or principals, and tests check this with canary values. A Grafana dashboard
+(`deploy/grafana/`) and a synthetic-traffic Prometheus/Grafana stack are included. SARIF output
+validates against the OASIS 2.1.0 schema. See [OBSERVABILITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -298,8 +331,10 @@ rolled-back transaction:
 
 ```python
 from sqlguard_ninja.query_cost.postgres import PostgresPlanInspector
+
 report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspect(
-    sql, role="support_analyst", context={"tenant_id": 1})
+    sql, role="support_analyst", context={"tenant_id": 1}
+)
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
@@ -314,16 +349,16 @@ sqlninja benchmark run --dataset builtin:v1 --adapter external:sql-guardrail
 sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candidate results/latest.json
 ```
 
-Results for corpus v1.1.0 (551 cases, 1,044 evaluations; SQLGuard Ninja 0.2.0; Windows 11,
+Results for corpus v1.2.0 (577 cases, 1,070 evaluations; SQLGuard Ninja 0.5.0; Windows 11,
 Python 3.11). Intervals are 95% Wilson intervals. Details, CSV and raw files:
-[RESULTS_v1.1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.1.md).
+[RESULTS_v1.2.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.2.md).
 
 | Validator | Recall (95% CI) | Precision | F1 | FPR (95% CI) | Recall / FPR within declared capability | p95 ms |
 |---|---:|---:|---:|---:|---:|---:|
-| SQLGuard Ninja 0.2.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.33 |
-| sql-guardrail 0.5.2 | 98.7% (97.4–99.3) | 85.1% | 0.914 | 24.1% (20.3–28.3) | 98.3% / 19.7% | 2.63 |
-| agent-sql-guard 0.2.0 | 67.3% (63.4–70.9) | 85.2% | 0.752 | 16.3% (13.1–20.0) | 89.4% / 17.7% | 1.87 |
-| krish2105/sqlguard 0.1.0 | 65.3% (61.4–69.0) | 89.6% | 0.755 | 10.5% (8.0–13.8) | 83.5% / 5.2% | 1.95 |
+| SQLGuard Ninja 0.5.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.36 |
+| sql-guardrail 0.5.2 | 98.2% (96.9–99.0) | 84.7% | 0.909 | 24.8% (21.1–29.0) | 98.3% / 19.7% | 1.84 |
+| agent-sql-guard 0.2.0 | 66.8% (63.0–70.4) | 85.1% | 0.748 | 16.3% (13.2–20.0) | 89.4% / 17.7% | 1.44 |
+| krish2105/sqlguard 0.1.0 | 64.8% (61.0–68.5) | 89.4% | 0.752 | 10.7% (8.2–14.0) | 83.5% / 5.2% | 1.42 |
 
 **All of these are internal results.** The corpus was written by this project, alongside the
 engine. The native 100% shows consistency with the documented semantics, not independent
@@ -360,9 +395,9 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 
 ## Roadmap
 
-Next: restricted-function and system-catalog benchmark cases, an independent held-out
-corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
+Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
+held-out corpus (issue #6), an interactive demo and a hardened deployment reference. Later:
+governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -380,6 +415,8 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
+* [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
 * [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
 * [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
@@ -390,8 +427,10 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 ## Supported versions
 
 * Python 3.11, 3.12, 3.13 (CI matrix on Linux and Windows).
-* SQL dialects: **PostgreSQL** (tested against PostgreSQL 16) and **SQLite**. Other sqlglot
-  dialects parse but are experimental and untested.
+* SQL dialects: **PostgreSQL** (tested against PostgreSQL 16), **SQLite**, and **MySQL 8**
+  (tested against MySQL 8.4 in CI, within the documented scope: identifier case is not folded,
+  named placeholders only). SQL Server and Oracle are parser-level **experimental**; others are
+  untested. See the [compatibility matrix](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md).
 
 ## Development
 

{sqlguard_ninja-0.4.0 → sqlguard_ninja-0.6.0}/README.md

@@ -121,8 +121,8 @@ result = guard.validate(
     role="hr_analyst",
     dialect="postgres",
 )
-result.allowed      # True
-result.findings     # () - structured Finding objects with rule_id, action, message, remediation
+result.allowed  # True
+result.findings  # () - structured Finding objects with rule_id, action, message, remediation
 
 guard.validate("SELECT full_name, salary FROM employees", role="hr_analyst").explain()
 # DENY:
@@ -135,16 +135,21 @@ guard.validate("SELECT full_name, salary FROM employees", role="hr_analyst").exp
 ```python
 from sqlguard_ninja.integrations import RequestContext, SQLCheckpoint
 from sqlguard_ninja.integrations.langgraph import (
-    CONTEXT_KEY, make_execute_node, make_guard_node, route_after_guard)
+    CONTEXT_KEY,
+    make_execute_node,
+    make_guard_node,
+    route_after_guard,
+)
 
 checkpoint = SQLCheckpoint(guard, mode="block", max_denied_attempts=3)
 graph.add_node("guard", make_guard_node(checkpoint))
-graph.add_node("execute", make_execute_node(checkpoint, executor))   # re-validates
-graph.add_conditional_edges("guard", route_after_guard(3),
-                            {"execute": "execute", "revise": "generate", "end": END})
+graph.add_node("execute", make_execute_node(checkpoint, executor))  # re-validates
+graph.add_conditional_edges(
+    "guard", route_after_guard(3), {"execute": "execute", "revise": "generate", "end": END}
+)
 
 ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id)
-app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
+app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})  # nodes cannot alter config
 ```
 
 More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
@@ -221,6 +226,20 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Observability and SARIF
+
+```bash
+python -m pip install "sqlguard-ninja[otel,prometheus]"
+sqlninja scan sql/ --policy policy.yaml --role reporting --tenant 1 --format sarif --output sqlninja.sarif
+```
+
+`Telemetry(tracer=..., metrics=GuardMetrics())` adds OpenTelemetry spans and Prometheus metrics
+to the checkpoint: decisions, findings by rule, latency, errors, resource-limit rejections and
+checkpoint outcomes. By default no signal contains SQL text, literals, request-context values,
+tenant ids or principals, and tests check this with canary values. A Grafana dashboard
+(`deploy/grafana/`) and a synthetic-traffic Prometheus/Grafana stack are included. SARIF output
+validates against the OASIS 2.1.0 schema. See [OBSERVABILITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -238,8 +257,10 @@ rolled-back transaction:
 
 ```python
 from sqlguard_ninja.query_cost.postgres import PostgresPlanInspector
+
 report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspect(
-    sql, role="support_analyst", context={"tenant_id": 1})
+    sql, role="support_analyst", context={"tenant_id": 1}
+)
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
@@ -254,16 +275,16 @@ sqlninja benchmark run --dataset builtin:v1 --adapter external:sql-guardrail
 sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candidate results/latest.json
 ```
 
-Results for corpus v1.1.0 (551 cases, 1,044 evaluations; SQLGuard Ninja 0.2.0; Windows 11,
+Results for corpus v1.2.0 (577 cases, 1,070 evaluations; SQLGuard Ninja 0.5.0; Windows 11,
 Python 3.11). Intervals are 95% Wilson intervals. Details, CSV and raw files:
-[RESULTS_v1.1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.1.md).
+[RESULTS_v1.2.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.2.md).
 
 | Validator | Recall (95% CI) | Precision | F1 | FPR (95% CI) | Recall / FPR within declared capability | p95 ms |
 |---|---:|---:|---:|---:|---:|---:|
-| SQLGuard Ninja 0.2.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.33 |
-| sql-guardrail 0.5.2 | 98.7% (97.4–99.3) | 85.1% | 0.914 | 24.1% (20.3–28.3) | 98.3% / 19.7% | 2.63 |
-| agent-sql-guard 0.2.0 | 67.3% (63.4–70.9) | 85.2% | 0.752 | 16.3% (13.1–20.0) | 89.4% / 17.7% | 1.87 |
-| krish2105/sqlguard 0.1.0 | 65.3% (61.4–69.0) | 89.6% | 0.755 | 10.5% (8.0–13.8) | 83.5% / 5.2% | 1.95 |
+| SQLGuard Ninja 0.5.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.36 |
+| sql-guardrail 0.5.2 | 98.2% (96.9–99.0) | 84.7% | 0.909 | 24.8% (21.1–29.0) | 98.3% / 19.7% | 1.84 |
+| agent-sql-guard 0.2.0 | 66.8% (63.0–70.4) | 85.1% | 0.748 | 16.3% (13.2–20.0) | 89.4% / 17.7% | 1.44 |
+| krish2105/sqlguard 0.1.0 | 64.8% (61.0–68.5) | 89.4% | 0.752 | 10.7% (8.2–14.0) | 83.5% / 5.2% | 1.42 |
 
 **All of these are internal results.** The corpus was written by this project, alongside the
 engine. The native 100% shows consistency with the documented semantics, not independent
@@ -300,9 +321,9 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 
 ## Roadmap
 
-Next: restricted-function and system-catalog benchmark cases, an independent held-out
-corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
+Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
+held-out corpus (issue #6), an interactive demo and a hardened deployment reference. Later:
+governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -320,6 +341,8 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
+* [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
 * [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
 * [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
@@ -330,8 +353,10 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 ## Supported versions
 
 * Python 3.11, 3.12, 3.13 (CI matrix on Linux and Windows).
-* SQL dialects: **PostgreSQL** (tested against PostgreSQL 16) and **SQLite**. Other sqlglot
-  dialects parse but are experimental and untested.
+* SQL dialects: **PostgreSQL** (tested against PostgreSQL 16), **SQLite**, and **MySQL 8**
+  (tested against MySQL 8.4 in CI, within the documented scope: identifier case is not folded,
+  named placeholders only). SQL Server and Oracle are parser-level **experimental**; others are
+  untested. See the [compatibility matrix](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md).
 
 ## Development
 

{sqlguard_ninja-0.4.0 → sqlguard_ninja-0.6.0}/THIRD_PARTY_NOTICES.md

@@ -1,7 +1,8 @@
 # Third-party notices
 
 SQLGuard Ninja is licensed under Apache-2.0. **It does not vendor or copy third-party source
-code.** The projects below are used as ordinary dependencies, installed by the package
+code.** The only third-party file in the repository is a test fixture, the SARIF schema
+(below). The projects below are used as ordinary dependencies, installed by the package
 manager under their own licences. Licences were read from installed package metadata on
 2026-10-24. Always check the version you install.
 
@@ -21,6 +22,10 @@ manager under their own licences. Licences were read from installed package meta
 | `langgraph` | langgraph | 1.2.17 | MIT |
 | `fastapi` | fastapi / starlette | 0.162.0 / 1.9.0 | MIT / BSD-3-Clause |
 | `postgres` | psycopg (+ psycopg-binary) | 3.3.6 | LGPL-3.0-only |
+| `mcp` | mcp (official MCP Python SDK) | 2.3.0 | MIT |
+| `mysql` | PyMySQL | 1.2.3 | MIT |
+| `otel` | opentelemetry-api | 1.45.1 | Apache-2.0 |
+| `prometheus` | prometheus-client | 0.26.0 | Apache-2.0 AND BSD-2-Clause |
 
 psycopg is LGPL-3.0. SQLGuard Ninja only imports it at runtime when the `postgres` extra is
 installed. It is not modified or bundled, which is compatible with distributing SQLGuard Ninja
@@ -33,6 +38,23 @@ mypy (MIT), build (MIT). `pgserver` is optionally used for local PostgreSQL test
 declared dependency, and its package metadata on PyPI does not declare a licence. It bundles
 PostgreSQL binaries (PostgreSQL License).
 
+Tests also use jsonschema (MIT) and opentelemetry-sdk (Apache-2.0).
+
+## Test fixture: SARIF 2.1.0 JSON schema
+
+`tests/data/sarif-schema-2.1.0.json` is the unmodified OASIS SARIF 2.1.0 (Errata 01) schema,
+downloaded from
+https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json
+(SHA-256 `c3b4bb2d6093897483348925aaa73af03b3e3f4bd4ca38cef26dcb4212a2682e`). It is used only to
+validate SARIF output in tests and is not part of the wheel.
+
+> Copyright © OASIS Open 2020. All Rights Reserved. This document and translations of it may be
+> copied and furnished to others, and derivative works that comment on or otherwise explain it
+> or assist in its implementation may be prepared, copied, published, and distributed, in whole
+> or in part, without restriction of any kind, provided that the above copyright notice and this
+> section are included on all such copies and derivative works. (OASIS IPR Policy notice; see
+> https://www.oasis-open.org/policies-guidelines/ipr/)
+
 ## External validators used for benchmarking only
 
 Installed into isolated virtual environments by `scripts/setup_external_adapters.py`, never