github · dbhubHEAD

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";

import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

import express from "express";

import path from "path";

import { readFileSync } from "fs";

import { fileURLToPath } from "url";

import { ConnectorManager } from "./connectors/manager.js";

import { ConnectorRegistry } from "./connectors/interface.js

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

if (value === "disable") {

            connectionConfig.ssl = undefined;

          } else if (value === "require") {

            connectionConfig.ssl = { rejectUnauthorized: false };

          } else {

            connectionConfig.ssl = {};

          }

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

it('should set rejectUnauthorized = false for sslmode=require', async () => {

    const config = await parser.parse('postgres://user:pass@localhost:5432/db?sslmode=require');

    expect(config.ssl).toEqual({ rejectUnauthorized: false });

  });

  it('should set rejectUnauthorized = true and skip hostname check for sslmode=verify-ca', async () => {

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

if (value === "disable") {

            config.ssl = undefined;

          } else if (value === "require") {

            config.ssl = { rejectUnauthorized: false };

          } else {

            config.ssl = {};

          }

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

if (url.password && url.password.includes("X-Amz-Credential")) {

        // AWS IAM authentication requires SSL, enable if not already configured

        if (connectionConfig.ssl === undefined) {

          connectionConfig.ssl = { rejectUnauthorized: false };

        }

      }

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

};

        // AWS IAM authentication requires SSL, enable if not already configured

        if (config.ssl === undefined) {

          config.ssl = { rejectUnauthorized: false };

        }

      }

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

it('should ignore sslrootcert when sslmode=require', async () => {

    const dsn = `postgres://user:pass@localhost:5432/db?sslmode=require&sslrootcert=${encodeURIComponent(certPath)}`;

    const config = await parser.parse(dsn);

    expect(config.ssl).toEqual({ rejectUnauthorized: false });

  });

  it('should ignore sslrootcert when sslmode=disable', async () => {

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

// SSL should be auto-enabled for AWS IAM auth

      // MariaDB connector includes mysql_clear_password in default permitted plugins

      expect(config.ssl).toEqual({ rejectUnauthorized: false });

    });

    it('should not auto-enable SSL for normal passwords', async () => {

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

expect(config.authPlugins?.mysql_clear_password).toBeDefined();

      // Should auto-enable SSL for AWS IAM authentication

      expect(config.ssl).toEqual({ rejectUnauthorized: false });

      // Plugin should return password with null terminator

      if (config.authPlugins?.mysql_clear_password) {

TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA

if (sslmode === "disable") {

        poolConfig.ssl = false;

      } else if (sslmode === "require") {

        poolConfig.ssl = { rejectUnauthorized: false };

      } else if (sslmode === "verify-ca" || sslmode === "verify-full") {

        const sslConfig: pg.ConnectionOptions["ssl"] & object = { rejectUnauthorized: true };

        // verify-ca checks the certificate chain but does not verify the server hostname,

Hardcoded secret detected in source. MCP servers often proxy between the model and a third-party API, so any committed credential grants that access to anyone who can read the repo. Move to an environment variable or secret manager and rotate the leaked value.

const parser = connector.dsnParser;

    it('should detect AWS IAM token and auto-enable SSL', async () => {

      const awsToken = 'mydb.abc123.us-east-1.rds.amazonaws.com:3306/?Action=connect&DBUser=myuser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE/20240101/us-east-1/rds-db/aws4_request&X-Amz-Date=20240101T000000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=abc123def456';

      const dsn = `mariadb://myuser:${encodeURIComponent(awsToken)}@mydb.abc123.us-east-1.rds.amaz

Hardcoded secret detected in source. MCP servers often proxy between the model and a third-party API, so any committed credential grants that access to anyone who can read the repo. Move to an environment variable or secret manager and rotate the leaked value.

const parser = connector.dsnParser;

    it('should detect AWS IAM token and configure cleartext plugin with SSL', async () => {

      const awsToken = 'mydb.abc123.us-east-1.rds.amazonaws.com:3306/?Action=connect&DBUser=myuser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE/20240101/us-east-1/rds-db/aws4_request&X-Amz-Date=20240101T000000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=abc123def456';

      const dsn = `mysql://myuser:${encodeURIComponent(awsToken)}@mydb.abc123.

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

}

      // Start the HTTP server

      app.listen(port, '0.0.0.0', () => {

        // In development mode, suggest using the Vite dev server for hot reloading

        if (process.env.NODE_ENV === 'development') {

          console.error('Development mode detected!');

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

await server.connect(transport);

          await transport.handleRequest(req, res, req.body);

        } catch (error) {

          console.error("Error handling request:", error);

          if (!res.headersSent) {

            res.status(500).json({ error: 'Internal server error' });

          }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

const rowCount = extractAffectedRows(firstResult);

      return { rows, rowCount };

    } catch (error) {

      console.error("Error executing query:", error);

      throw error;

    } finally {

      // Always release the connection back to the pool

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

const dataSource = transformSourceConfig(sourceConfig);

    res.json(dataSource);

  } catch (error) {

    console.error(`Error getting source ${req.params.sourceId}:`, error);

    const errorResponse: ErrorResponse = {

      error: error instanceof Error ? error.message : "Internal server error",

    };

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

const rowCount = extractAffectedRows(results);

      return { rows, rowCount };

    } catch (error) {

      console.error("Error executing query:", error);

      throw error;

    } finally {

      // Always release the connection back to the pool

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include execute_sql tools with correct naming', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      // Find sources by ID to avoid relying on array order

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it("should return correct content-type header", async () => {

      const response = await fetch(`${BASE_URL}/api/requests`);

      expect(response.headers.get("content-type")).toContain("application/json");

    });

  });

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should return 404 for non-existent source', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/nonexistent_source`);

      expect(response.status).toBe(404);

      const error = (await response.json()) as ErrorResponse;

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should return correct data for another source', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/writable_limited`);

      expect(response.status).toBe(200);

      const source = (await response.json()) as DataSource;

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

describe("Response Format", () => {

    it("should return consistent response structure", async () => {

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data).toHaveProperty("requests");

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

})

      );

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(4);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include sql parameter in execute_sql tool', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

requestStore.add(createRequest({ id: "req2", timestamp: sameTime }));

      requestStore.add(createRequest({ id: "req3", timestamp: sameTime }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      // Should return all 3 requests

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

requestStore.add(createRequest({ sourceId: "db2" }));

      requestStore.add(createRequest({ sourceId: "db1" }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.total).toBe(data.requests.length);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include complete tool metadata in single source response', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/readonly_limited`);

      const source = (await response.json()) as DataSource;

      const tool = source.tools[0];

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

const longSql = "SELECT " + "a, ".repeat(1000) + "z FROM table";

      requestStore.add(createRequest({ sql: longSql }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests[0].sql).toBe(longSql);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

describe('Error Handling', () => {

    it('should return proper error format for 404', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/invalid_id`);

      expect(response.status).toBe(404);

      expect(response.headers.get('content-type')).toContain('application/json');

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it("should return only requests for specified source", async () => {

      const response = await fetch(`${BASE_URL}/api/requests?source_id=db2`);

      const data = await response.json();

      expect(data.requests).toHaveLength(1);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

requestStore.add(createRequest({ sourceId: "db2", id: "req2" }));

      requestStore.add(createRequest({ sourceId: "db1", id: "req3" }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      expect(response.status).toBe(200);

      const data = await response.json();

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

export async function fetchSources(): Promise<DataSource[]> {

  try {

    const response = await fetch(`${API_BASE}/sources`);

    if (!response.ok) {

      const errorMessage = await parseJsonResponse<{ error: string }>(response)

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

})

      );

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests[0].sql).toBe(

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

it("should handle zero duration requests", async () => {

      requestStore.add(createRequest({ durationMs: 0 }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests[0].durationMs).toBe(0);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include correct tool metadata structure', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

throw new ApiError('Invalid source ID format', 400);

    }

    const response = await fetch(`${API_BASE}/sources/${encodeURIComponent(sourceId)}`);

    if (!response.ok) {

      const errorMessage = await parseJsonResponse<{ error: string }>(response)

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

})

      );

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(1);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

describe('GET /api/sources', () => {

    it('should return array of all data sources', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      expect(response.status).toBe(200);

      expect(response.headers.get('content-type')).toContain('application/json');

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include database type for all sources', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

})

      );

      const response = await fetch(`${BASE_URL}/api/requests?source_id=db1`);

      const data = await response.json();

      expect(data.requests).toHaveLength(2);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include correct source IDs', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      const ids = sources.map((s) => s.id);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

requestStore.add(createRequest({ id: `req-${idx}`, client }));

      });

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(4);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should not include sensitive fields in single source response', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/readonly_limited`);

      const source = (await response.json()) as DataSource;

      expect(source).not.toHaveProperty('password');

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include tools array in single source response', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/readonly_limited`);

      const source = (await response.json()) as DataSource;

      expect(source.tools).toBeDefined();

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

it("should return empty array for unknown source_id", async () => {

      requestStore.add(createRequest({ sourceId: "db1" }));

      const response = await fetch(`${BASE_URL}/api/requests?source_id=nonexistent`);

      expect(response.status).toBe(200);

      const data = await response.json();

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

? `${API_BASE}/requests?source_id=${encodeURIComponent(sourceId)}`

      : `${API_BASE}/requests`;

    const response = await fetch(url);

    if (!response.ok) {

      const errorMessage = await response

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

);

      });

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(4);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

describe("Empty State", () => {

    it("should return empty array when no requests tracked", async () => {

      const response = await fetch(`${BASE_URL}/api/requests`);

      expect(response.status).toBe(200);

      expect(response.headers.get("content-type")).toContain("application/json");

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

describe('GET /api/sources/{source-id}', () => {

    it('should return specific source by ID', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/readonly_limited`);

      expect(response.status).toBe(200);

      const source = (await response.json()) as DataSource;

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

requestStore.add(createRequest({ sourceId: "db3", id: `db3-${i}` }));

      }

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(150);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include database connection details', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

createRequest({ id: "older", timestamp: new Date(now - 2000).toISOString() })

      );

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(4);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

it('should handle special characters in source ID for 404', async () => {

      const specialId = 'test@#$%';

      const response = await fetch(`${BASE_URL}/api/sources/${encodeURIComponent(specialId)}`);

      expect(response.status).toBe(404);

      const error = (await response.json()) as ErrorResponse;

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should not include sensitive fields like passwords', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

})

      );

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(1);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it("should return all requests when source_id not provided", async () => {

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(5);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include correct tool name for specific source', async () => {

      const response = await fetch(`${BASE_URL}/api/sources/writable_limited`);

      const source = (await response.json()) as DataSource;

      expect(source.tools[0].name).toBe('execute_sql_writable_limited');

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

it('should handle URL-encoded source IDs', async () => {

      // Test with underscores in ID

      const response = await fetch(`${BASE_URL}/api/sources/${encodeURIComponent('readonly_limited')}`);

      expect(response.status).toBe(200);

      const source = (await response.json()) as DataSource;

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

it("should handle very high duration requests", async () => {

      requestStore.add(createRequest({ durationMs: 999999 }));

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests[0].durationMs).toBe(999999);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

      requestStore.add(testRequest);

      const response = await fetch(`${BASE_URL}/api/requests`);

      const data = await response.json();

      expect(data.requests).toHaveLength(1);

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include source ID and type in tool descriptions', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include execution options on tools', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      // First source has execute_sql tool with readonly and max_rows

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include description when present', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      // First source has a description

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it('should include tools array for all sources', async () => {

      const response = await fetch(`${BASE_URL}/api/sources`);

      const sources = (await response.json()) as DataSource[];

      sources.forEach((source) => {

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

});

    it("should filter requests by source_id parameter", async () => {

      const response = await fetch(`${BASE_URL}/api/requests?source_id=db1`);

      expect(response.status).toBe(200);

      const data = await response.json();

MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.

// Schema for execute_sql tool

export const executeSqlSchema = {

  sql: z.string().describe("SQL to execute (multiple statements separated by ;)"),

};

/**

MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.

/**

 * Convert a Zod schema object to simplified parameter list

 * @param schema - Zod schema object (e.g., { sql: z.string().describe("...") })

 * @returns Array of tool parameters

 */

export function zodToParameters(schema: Record<string, z.ZodType<any>>): ToolParameter[] {

Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.

# ============================================================================

# Builder Stage: Build application and prepare dependencies

# ============================================================================

FROM node:22-alpine AS builder

WORKDIR /app

# Copy workspace configuration and all package.json files

# This is required for pnpm workspaces to resolve dependencies correctly

# for both the root package and the frontend package

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache

        uses: actions/cache@v3

        with:

          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}

          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

      - name: Setup Node.js

        uses: actions/setup-node@v4

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

fi

      - name: Set up Docker Buildx

        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub

        uses: docker/login-action@v3

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

      - name: Install MCP Publisher

        run: |

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

# Install pnpm for faster and more reliable package management

      - name: Install pnpm

        uses: pnpm/action-setup@v3

        with:

          version: latest

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

steps:

      - name: Checkout code

        uses: actions/checkout@v3

      - name: Verify Docker is available

        run: |

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

docker info

      - name: Install pnpm

        uses: pnpm/action-setup@v2

        with:

          version: 8

          run_install: false

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache

        uses: actions/cache@v3

        with:

          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}

          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

run_install: false

      - name: Setup Node.js

        uses: actions/setup-node@v3

        with:

          node-version: '20'

          cache: 'pnpm'

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

echo "TAGS=$TAGS" >> $GITHUB_OUTPUT

      - name: Build and push Docker image

        uses: docker/build-push-action@v5

        with:

          context: .

          push: true

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub

        uses: docker/login-action@v3

        with:

          username: ${{ secrets.DOCKERHUB_USERNAME }}

          password: ${{ secrets.DOCKERHUB_TOKEN }}

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

# Set up Node.js (no registry-url needed for OIDC trusted publishing)

      - name: Setup Node.js

        uses: actions/setup-node@v4

        with:

          node-version: "22"

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

uses: actions/checkout@v3