github · mcp-server-mysqld17bd4ec895e

Evidence

try {

    // Create database if it doesn't exist

    await connection.query(`CREATE DATABASE IF NOT EXISTS ${dbName}`);

    // Switch to the test database

    await connection.query(`USE ${dbName}`);

Remediation

Use placeholder bindings (cursor.execute(sql, params), connection. query(sql, params), sequelize.query(sql, { replacements })) and never interpolate untrusted values into SQL text. For dynamic identifiers (table / column names), map user input to a fixed allowlist before substitution.

Evidence

await connection.query(`CREATE DATABASE IF NOT EXISTS ${dbName}`);

    // Switch to the test database

    await connection.query(`USE ${dbName}`);

    // Temporarily disable foreign key checks to allow dropping tables

    await connection.query('SET FOREIGN_KEY_CHECKS = 0');

Remediation

Use placeholder bindings (cursor.execute(sql, params), connection. query(sql, params), sequelize.query(sql, { replacements })) and never interpolate untrusted values into SQL text. For dynamic identifiers (table / column names), map user input to a fixed allowlist before substitution.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Evidence

// SSE notifications not supported in stateless mode

        app.get("/mcp", async (req: Request, res: Response) => {

          console.log("Received GET MCP request");

          res.writeHead(405).end(

            JSON.stringify({

              jsonrpc: "2.0",

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

// Session termination not needed in stateless mode

        app.delete("/mcp", async (req: Request, res: Response) => {

          console.log("Received DELETE MCP request");

          res.writeHead(405).end(

            JSON.stringify({

              jsonrpc: "2.0",

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

"start": "node dist/index.js",

    "dev": "ts-node index.ts",

    "build": "tsc && shx chmod +x dist/*.js",

    "prepare": "npm run build",

    "watch": "tsc --watch",

    "setup:test:db": "tsx scripts/setup-test-db.ts",

    "pretest": "pnpm run setup:test:db",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

# Generated by https://smithery.ai. See: https://smithery.ai/docs/config#dockerfile

# Use a Node.js Alpine image as the base

FROM node:22-alpine AS builder

# Install pnpm

RUN npm install -g pnpm

# Set the working directory

WORKDIR /app

# Copy the package.json and pnpm-lock.yaml if present

COPY package.json pnpm-lock.yaml* /app/

# Install the dependencies

RUN pnpm install --frozen-lockfile --ignore-scripts

# Copy the rest of the application code

COPY . /app

# Build the application

RUN pnpm 

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

# Multi-DB Mode and Schema-Specific Permissions

This document describes the new multi-database mode and schema-specific permissions features added to the MCP-Server-MySQL.

## Multi-DB Mode

MCP-Server-MySQL now supports working with multiple databases simultaneously when no specific database is set in the configuration.

### How to Enable Multi-DB Mode

To enable multi-DB mode, simply leave the `MYSQL_DB` environment variable empty:

```json

{

  "mcpServers": {

    "mcp_server_mysql": {

Remediation

Declare a real authentication mechanism in the manifest, matching what the running server actually enforces: - `"auth": "bearer"` with a token scheme documented for callers - `"auth": "oauth"` / `"oauth2": { ... }` for delegated flows - `"apiKey": { "header": "X-API-Key", "prefix": "..." }` - `"mtls": true` when client certificates are required If the server is intentionally unauthenticated (stdio-only, local developer tool, trusted-host network), document the assumption in the manifest via a `"

Evidence

#!/usr/bin/env node

import { Server } from "@modelcontextprotocol/sdk/server/index.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

import {

  CallToolRequestSchema,

  ListResourcesRequestSchema,

  ListToolsRequestSchema,

  ReadResourceRequestSchema,

} from "@modelcontextprotocol/sdk/types.js";

import { z } from "zod";

import { log } from "./src/utils/index.j

Remediation

Apply CSRF middleware at the route or router level: - Express: `app.use(csurf())` / `csrf-csrf` package - FastAPI: `fastapi-csrf-protect` with `Depends(...)` - Flask: `CSRFProtect(app)` from `flask_wtf.csrf` Or move to bearer-token auth and set `SameSite=Strict` / `SameSite=Lax` on any session cookies. Document the choice in the project README so reviewers can confirm intent.

Evidence

- uses: actions/checkout@v4

      - name: Install pnpm

        uses: pnpm/action-setup@v2

        with:

          version: 8

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@v4

      - name: Set up Node.js

        uses: actions/setup-node@v4

        with:

          node-version: '22'

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

version: 8

      - name: Setup Node.js

        uses: actions/setup-node@v4

        with:

          node-version: "22"

          cache: "pnpm"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

--health-retries=3

    steps:

      - uses: actions/checkout@v4

      - name: Install pnpm

        uses: pnpm/action-setup@v2

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

- uses: actions/checkout@v4

      - name: Install pnpm

        uses: pnpm/action-setup@v2

        with:

          version: 8

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

      - name: Set up Node.js

        uses: actions/setup-node@v4

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@v4

      - name: Set up Node.js

        uses: actions/setup-node@v4

        with:

          node-version: '22'

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

      - name: Set up Node.js

        uses: actions/setup-node@v4

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

version: 8

      - name: Setup Node.js

        uses: actions/setup-node@v4

        with:

          node-version: "22"

          registry-url: "https://registry.npmjs.org"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

publish:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4

      - name: Install pnpm

        uses: pnpm/action-setup@v2

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

import * as dotenv from "dotenv";

import * as fs from "fs";

import { SchemaPermissions } from "../types/index.js";

import { parseSchemaPermissions, parseMySQLConnectionString } from "../utils/index.js";

/**

 * Read and validate an SSL file (certificate, key, or CA) for SSL connections.

 * @param filePath - Path to the SSL file (PEM format)

 * @param label - Human-readable label for error messages (e.g. "CA certificate", "client certificate")

 * @returns Buffer containing the file data

 * @throw

Remediation

Replace check-then-use with action-then-handle: Python: `try: with open(p) as f: ... except FileNotFoundError: ...` Node: `try { fs.readFileSync(p); } catch (e) { if (e.code === "ENOENT") ... }` For atomic file creation: Python: `os.open(p, os.O_RDWR | os.O_CREAT | os.O_EXCL)` Node: `fs.open(p, "wx")` — fails if file exists, no race. When you genuinely must check first, use `flock` (Python `fcntl`) or a similar per-process advisory lock to make the window uninteresting to a