v0.6.2

IBM i MCP Server v0.6.2

Overview

• Read-only SQL bypass fixed (Server, CLI) — SELECT statements can no longer run CL commands through QSYS2.QCMDEXC when read-only mode is on
• Dependency security alerts remediated — Clears the Dependabot alerts tracked in #180

This is a security patch. All deployments that run with read-only mode on (the default) should upgrade. No configuration changes.

npx -y @ibm/ibmi-mcp-server@0.6.2 --transport http --tools ./tools
npm install -g @ibm/ibmi-cli@0.6.2

---

Bug Fixes

Read-only mode no longer allows QCMDEXC inside SELECT

The fix applies to execute_sql, read-only YAML tools, and the ibmi sql command.

Read-only validation checked only the outer statement type. A SELECT that called the QSYS2.QCMDEXC scalar function passed validation, and Db2 for i executed the embedded CL command:

SELECT QSYS2.QCMDEXC('DLTLIB LIB(TESTLIB)') AS RC FROM SYSIBM.SYSDUMMY1

The validator now scans every token of SELECT and WITH statements and rejects calls to QCMDEXC and the other blocked operations, wherever they appear: the select list, subqueries, CTEs, CASE expressions, ORDER BY, and function arguments. The delimited-identifier form QSYS2."QCMDEXC"(...) is also rejected. These queries now fail with:

Write operations detected: Write operation 'QCMDEXC' detected

Queries that read from QSYS2 views and table functions, such as TABLE(QSYS2.ACTIVE_JOB_INFO()), are unaffected.

Thanks to @william-xiang for the report and the initial fix.

Dependency alerts

• Dependabot alerts from #180 remediated — The published packages pick up only transitive lockfile bumps (including fast-uri 3.1.8); the remaining fixes are in the example apps and Python agents (#185)

---

What's Changed

• fix(deps): remediate security alerts from #180 (#CVE-2026-35002 #CVE-2026-75604 #GHSA-2xp9-vwfh-vxw4 #CVE-2026-32871) by @ajshedivy in #185
• docs: fix scoped package name references across docs and source by @william-xiang in #191
• fix(security): detect dangerous scalar fn calls inside read-only SQL by @william-xiang in #192
• fix(security): block QCMDEXC called as a delimited identifier in read-only SQL by @ajshedivy in #214

Full Changelog: v0.6.1...v0.6.2