Skip to content

mcp-firebird 2.12.1

Choose a tag to compare

View all tags
@PuroDelphi PuroDelphi released this 17 Oct 04:48
· 3 commits to main since this release
v2.12.1
8dab667

MCP Firebird 2.12.1

October 16, 2026. This stable release promotes all changes from 2.12.1-alpha.1 and 2.12.1-alpha.2, accumulated since stable 2.12.0. It includes the adjusted contributions from PR #43 and PR #46 and the SQL compatibility fix for #44.

BLOB and transaction safety (PR #43)

  • Execute pure-JavaScript SQL once in an explicit transaction and resolve BLOB columns before that transaction closes, including LIST() results and columns whose first value is NULL. Do not replay SQL after inspecting its result.
  • Preserve the pure driver's existing repeatable-read/read-write transaction mode, authorized writes and internal audit inserts. No FIREBIRD_READ_ONLY flag or implicit timeout is introduced. Firebird driver dependencies and native-adapter behavior are unchanged.
  • Propagate commit failures, wait for transaction callbacks and adapter cleanup before releasing pooled attachments, and do not start query/BLOB work after a configured deadline has already expired.

Dates, statistics and prompts

  • Pure-JS database Date columns retain their stored wall-clock fields as YYYY-MM-DD HH:mm:ss.SSS, without conversion to UTC or a misleading trailing Z. Precision is limited to JavaScript milliseconds. Generic Date/Buffer serialization and native-driver representation are unchanged.
  • Correct the statistics count alias for Firebird 2.5 while retaining the public rowCount field.
  • Normalize omitted, string/array and placeholder prompt arguments to recognized values and documented defaults. Prompt normalization does not grant SQL permissions or execute migrations.

Date migration: clients that interpreted the former pure-JS values as UTC instants must review their parsing and apply their application's intended timezone. This is not support for timezone-aware Firebird types. Read the date/BLOB compatibility guide.

SQL syntax without permission bypasses (#44)

Separate parenthesis grammar from builtin routine recognition. Grouped ORDER/GROUP/PARTITION clauses, predicates such as LIKE/CONTAINING/STARTING WITH/SIMILAR TO, IS DISTINCT FROM and analytic window calls no longer produce the former false routine denials. Window-function recognition requires an analytic OVER context; actual availability depends on the connected Firebird version, and Firebird 2.5 cannot execute these window functions.

Nested routines and relations are still inspected. Quoted/package-qualified names and standalone routines do not become builtin exemptions. Explicit operation/table/catalog/row/masking/role restrictions remain enforced, including the conservative scoped-query boundary. No policy relaxation or new flag is required. This remains a limited SQL parser, not a guarantee of support for every valid Firebird statement.

Complete descriptions and accurate capability status (#45 / PR #46)

  • describe-table, describe-batch-tables and get-field-descriptions read full column-description BLOBs instead of casting them to VARCHAR(500). Long descriptions alone no longer trigger that SQL truncation failure. Existing BLOB handling, authorization, deadlines and configured response-size limits still apply.
  • An unavailable execution plan now returns success: false, plan: "", planDetails: [], an explicit error and MCP isError: true, while retaining manual-tool guidance. This is an intentional status correction: clients must not treat the old successful placeholder as a retrieved plan.
  • Plan requests do not execute submitted SQL. This release does not add Firebird 4/5 monitoring-table plan retrieval or improve the separate missing-index heuristic; index suggestions still require review against existing metadata.
  • Server-information and health tool counts derive from the registered catalog, including simple tools and event tools when permitted. The additive tools.other category reconciles the health categories with the total.

See the English/Spanish tool contract.

Install and compatibility

Node.js 20.19+ is required, unchanged from 2.12.0.

npm install -g mcp-firebird@latest

For an existing npx MCP launcher, select mcp-firebird@2.12.1 to pin this release, or mcp-firebird@latest. Keep the transport, connection and security configuration and restart the MCP process. There is no need to install alpha for these fixes. The npm alpha tag remains at 2.12.1-alpha.2; publishing stable does not move it.

Advanced security controls and strict HTTP mode remain opt-in. Explicit policies remain enforced. The effective QUERY_TIMEOUT fallback from 2.12.0 is retained: unset/blank means no environment fallback, explicit policy deadlines win, and a configured lower maxQueryCpuTime cap still applies. Deadlines are wall-clock limits, not guaranteed server-side cancellation: pending operations retain pool slots until they settle, and timed-out writes must not be retried automatically.

Validation

  • The local release gate passed type checking, a fresh build, lint error checks, 1,281 unit tests, 92 protocol/Node regressions with no skips, and compiled security-runtime checks. The same gate runs again through prepublishOnly when publishing the stable package; it is not bypassed.
  • Fresh live integration passed on local Firebird 2.5.9 with the pure-JavaScript driver on October 16: SQL grouping/predicate result comparisons, nested denials, BLOB/NULL/LIST, wall-clock dates, statistics, 514/10,000-character Unicode metadata, unavailable-plan non-execution, legacy writes, opt-in filtering/masking/auditing and real event delivery/reconnect. The UUID-named disposable database and audit file were removed afterwards.
  • The production dependency audit reports zero known vulnerabilities in the tested lockfile. This is not an all-development-dependencies or no-future-vulnerabilities claim.
  • Controlled-driver tests include native-labelled adapters and multiple client/protocol/timezone paths; they do not establish live native-driver, Firebird 3/4/5, WIN1254 or all deployment coverage.
  • GitHub Actions remains disabled. Release validation runs locally; no workflow is added or reactivated. Private marketplace skill files, temporary tests and credentials are excluded from npm packaging.

Full changelog · English security guide · Guía en español

Assets 2
Loading