Skip to content

mcp-firebird 2.12.0

Choose a tag to compare

View all tags
@PuroDelphi PuroDelphi released this 07 Oct 15:02
· 17 commits to main since this release
v2.12.0
056e1d8

MCP Firebird 2.12.0

Released October 7, 2026. This stable release promotes all changes from 2.12.0-alpha.1 through alpha.5, accumulated since stable 2.11.0.

Protocol and transport improvements

  • Support MCP 2026-07-28 through SDK v2 while retaining 2025 clients, SDK 1 clients and legacy HTTP+SSE. All executable entry points now share one server implementation.
  • Publish structured tool results, explicit output schemas, accurate annotations and consistent protocol errors while preserving legacy text payloads.
  • Add opt-in strict HTTP binding, Host/Origin validation, protected-resource OAuth discovery and audience validation. Historical HTTP/CORS/OAuth defaults remain available in compat mode.
  • Isolate event subscribers and release listeners on disconnect; retain real Firebird event delivery and reconnect behavior.

Fixes accumulated from alpha

  • #38: observe asynchronous driver promises and drain pending query/BLOB/cleanup work before disconnecting an attachment. Late errors no longer cause unhandled promise rejections. Timed-out connections remain checked out until cleanup finishes and are then discarded.
  • Honor QUERY_TIMEOUT as an environment fallback, with explicit policy deadlines taking precedence and the lower legacy maxQueryCpuTime cap still applying.
  • #39 / #40: correct table-list schemas, explicit recursive JSON value schemas and statistics metadata. Drain asynchronous connection-probe cleanup before disconnecting, including late probe errors and deadlines.
  • #41 / #42: recognize derived FROM (SELECT ...), JOIN (SELECT ...) and JOIN ... USING (...) syntax without treating SQL keywords as functions. Continue checking nested relations and opaque/package-qualified functions; preserve the conservative single-table boundary for scoped policies.
  • Expand driver-boundary fixtures across database/metadata tools and clients, add a 230-case SQL syntax/policy matrix, and require local release validation through prepublishOnly. Temporary review copies are excluded from Jest discovery and development artifacts from npm packaging.
  • Retain the Hono 4.13.12 lockfile refresh from alpha.5. Refresh the compatible locked proxy-addr dependency to 2.0.8 for GHSA-jqcg-44mw-7w3h. Firebird driver dependencies are unchanged.

Upgrade and migration

Node.js 20.19+ is required. Stay on mcp-firebird@2.11.0 until upgrading older Node runtimes.

npm install -g mcp-firebird@latest

For an npx-based MCP launcher, use mcp-firebird@2.12.0 to pin this release, or mcp-firebird@latest. Keep your connection/transport/policy settings and restart the MCP process.

  • Advanced SQL restrictions and HTTP strict mode remain opt-in. No implicit query deadline is introduced, but existing nonempty QUERY_TIMEOUT values now take effect, including 30000 in examples. Values are milliseconds from 1 to 2147483647; unset/blank disables this fallback. Explicit security.queryTimeout wins; configured maxQueryCpuTime can impose a lower cap. Zero is not a disable switch.
  • Deadlines are wall-clock limits, not Firebird CPU accounting or guaranteed server-side cancellation. Timed-out operations can retain pool slots until completion; a timed-out write may still commit and must not be retried automatically.
  • MCP_HTTP_SECURITY_MODE=compat retains historical binding and non-cookie CORS behavior. For strict mode, review Host/Origin allowlists, remote binding and OAuth resourceUrl/authorizationServers in the migration guide. Strict mode is not enabled automatically.
  • An empty table denylist does not activate table scoping; adding an entry does. Complex SQL with table/row/masking/role restrictions still requires a database-enforced view. Do not remove required controls to bypass this limit. This release does not implement a complete Firebird SQL parser.

Validation

  • The final verify:release gate passed: 735 unit tests, 88 protocol/regression tests without skips, typecheck, build, lint error checks and compiled security smoke checks.
  • One initial protocol run failed; the standalone rerun and subsequent full release gate passed. The initial failure's cause was not established; it is not presented as a fixed runtime defect.
  • Production dependency audit reports zero known vulnerabilities in the tested locked tree after the proxy-addr refresh. Development/build dependencies still have audit findings; this is not an all-dependencies clean-audit claim.
  • Live integration was attempted on October 7 but could not create the disposable local Firebird database (local port 3050 was unavailable). The successful alpha.5 Firebird 2.5.9 run on October 2 is historical evidence, not a fresh stable-version or native-driver integration test.
  • GitHub Actions remains disabled; validation runs locally.

Full changelog · Migration guide · English security guide · Guía en español

Assets 2
Loading