Skip to content

v0.2.0 - Security hardening and expanded tool catalogue

Latest
Latest

Choose a tag to compare

View all tags
@amineelkouhen amineelkouhen released this 15 Jun 16:47
v0.2.0
2a5eaa3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First release after the security and tool-expansion refactor (#9).

Highlights

  • Security: strict SQL identifier validation, parameterized values throughout, DSN redaction in responses. Closes #7.
  • Policy: new --read-only and --allow-destructive server flags; every destructive tool now requires per-call confirm=True.
  • Tool catalogue: 32 → 87 tools across 13 categories. New: User & Privilege Management, Vector Search (C-SPANN + similarity), Job Management, Backup & Restore, Statistics, Multi-Region, Changefeeds, Cluster Admin, Diagnostics.
  • Vector search for CockroachDB v25.2+: vector_similarity_search with cosine/l2/ip/auto (auto-detects index opclass), create_cspann_index, drop_cspann_index.
  • Operations: configurable pool sizing via CRDB_POOL_MIN/CRDB_POOL_MAX/CRDB_COMMAND_TIMEOUT, structured logging via MCP_LOG_LEVEL/MCP_LOG_JSON.
  • Testing: 197 unit tests covering identifier validation, serializers, URI parsing, output formatting, and tool gating. Ruff lint and format checks.
  • CI: GitHub Actions running on Python 3.12 and 3.13. Now required for merging to main.
  • Docker: non-root user, HEALTHCHECK, default compose command uses --read-only.

Breaking changes

  • All tools now return a consistent {success: bool, ...} shape. Tools that previously raised exceptions now return {success: false, error: ...}.
  • --read-only is the recommended default for assistant-style deployments. Destructive tools refuse without --allow-destructive + confirm=True.
  • Dependency dotenv renamed to python-dotenv in pyproject.toml.
  • Minimum Python is 3.12.

Recommended usage

# Read-only assistant agent (recommended default)
uvx --from git+https://github.com/amineelkouhen/mcp-cockroachdb.git@v0.2.0 \
  cockroachdb-mcp-server \
  --url postgresql://agent@host:26257/mydb \
  --read-only

# Administrative agent that can manage schema
uvx --from git+https://github.com/amineelkouhen/mcp-cockroachdb.git@v0.2.0 \
  cockroachdb-mcp-server \
  --url postgresql://admin@host:26257/mydb \
  --allow-destructive

What changed (numbers)

  • 38 files changed
  • +6,256 insertions, -1,706 deletions
  • 19 new files

See the full diff and per-file change list on the merged PR: #9

Assets 2
Loading