MCPg v0.8.3

A feature release by content (new tools and opt-in flags, nothing removed or renamed), shipped as a patch per the maintainer's call: the default tool surface only gains five read-only tools, and every new write or admin tool needs an explicit MCPG_ALLOW_* flag. See release notes.

Added

• ALTER SYSTEM GUC tools. inspect_guc (read), plus alter_system, alter_system_reset_all and
  reload_config behind unrestricted mode + MCPG_ALLOW_ALTER_SYSTEM. Runs on an autocommit connection,
  requires confirm=true plus a per-statement confirmation_token, and blocks connectivity/preload GUCs and
  settings that run OS commands or hold credentials (archive_command, restore_command, primary_conninfo, …) by
  default (MCPG_ALTER_SYSTEM_ALLOWLIST / MCPG_ALTER_SYSTEM_DENYLIST). RESET ALL enforces that policy on every
  current override, inspect_guc redacts secret-bearing values, and the write tools refuse to run under
  MCPG_DEFAULT_ROLE / MCPG_ALLOWED_ROLES. See docs/alter-system.md. (PR #352)
• TimescaleDB read-only functions are now allowed in the SQL-safety kernel (#353): time_bucket, time_bucket_gapfill,
  first/last, locf, interpolate, histogram, the hypertable_*_size / *_compression_stats / *_columnstore_stats
  family, show_chunks, by_range/by_hash, the uuidv7 helpers and timescaledb_experimental.show_policies. Mutating
  functions, procedures, timescaledb_pre/post_restore and get_telemetry_report stay blocked.
• TimescaleDB tool family (design: docs/plans/timescaledb-tools.md, reference: docs/timescaledb.md): reads
  get_hypertable_stats, list_timescale_jobs, list_continuous_aggregates, get_timescaledb_telemetry_report;
  additive DDL add_dimension, set_chunk_time_interval, add_continuous_aggregate_policy, add_reorder_policy and four
  remove_*_policy tools; and, behind the new MCPG_ALLOW_TIMESCALEDB_ADMIN flag with a dry_run / confirm +
  confirmation_token flow, drop_chunks, compress_chunk, decompress_chunk, reorder_chunk, merge_chunks,
  refresh_continuous_aggregate, run_job, alter_job, delete_job. Behaviour was verified on TimescaleDB 2.30.2, and a
  new experimental TimescaleDB CI job runs the integration tests.

Security

• Bumped pyjwt to ≥ 2.15.0 (2.15.1 resolved) to clear the October 2026
  advisory cascade against 2.13.0 — thirteen PYSEC-2026-414x findings plus
  CVE-2026-102275, all flagged by pip-audit --strict and fixed in
  2.14.0 / 2.15.0. 2.15's PyJWKClient hardened its JWKS fetch against SSRF
  (own build_opener/no-redirect handler instead of the module-level
  urllib.request.urlopen); the OIDC verifier uses the stable public API so
  no source change was needed, but the test_oidc.py JWKS mock now patches
  pyjwt's PyJWKClient.fetch_data boundary rather than urllib internals.

Changed

• pglast 8.4 → 8.5 (PR #350; uv.lock updated). The SQL-safety kernel's adversarial and fuzz suites pass on 8.5.
• The contract fixtures now enable MCPG_ALLOW_ALTER_SYSTEM and MCPG_ALLOW_TIMESCALEDB_ADMIN, so the tool-surface
  snapshot (now 281 tools), annotations and return-shape contracts cover the ALTER SYSTEM and TimescaleDB admin tools.
• ORM exporters explain why they reject delimited names. generate_prisma_schema and the Drizzle,
  SQLAlchemy, sqlc, Diesel, jOOQ, Ent and Ecto exporters still accept only plain [A-Za-z_][A-Za-z0-9_]*
  names (the name becomes an identifier in generated source), but their errors and tool descriptions now
  say so and point at the SQL tools that accept delimited names.

Fixed

• docs/tools.md tool-index heading and the hand-written tool counts (README, tour, user guide) were stale; regenerated.
• SQL-safety fuzz harness now actually explores the validator. sql_safety_fuzzer decoded its input
  with ConsumeUnicodeNoSurrogates, which turns ASCII SQL into garbage code points, so pglast rejected
  nearly every input at the first token and coverage never grew. It now decodes bytes directly and ships a
  seed corpus and SQL dictionary (.clusterfuzzlite/); a 60 s run goes from cov: 4 to cov: 277. Roadmap 23.1.

Documentation

• New docs/identifier-policy.md: which names SQL tools accept
  (delimited identifiers via quote_identifier) versus the plain-identifier-only sinks and why.
• README "Safe by default" no longer claims identifiers go through a strict regex; adding-tools.md
  now recommends quote_identifier; the subscribe_channel description and a config.py comment no
  longer claim plain-identifier-only names.
• CODE_OF_CONDUCT.md (Contributor Covenant 2.1) is now linked from the README, CONTRIBUTING.md and
  the docs index.