v0.1.1

Added

• npm run demo with a synthetic shop database (examples/): an MCP client walkthrough that CI also runs

Changed

• README rewritten around the problem, scope, layers and their trade-offs, setup, troubleshooting and limitations;
  SECURITY.md states that the database role, not this server, is the security boundary; package description no longer
  claims "safe" access

Fixed

• describe_table sent three queries to one client at once; node-postgres 8.23 warns about this and version 9 removes
  it. The catalog queries now run one after another

Security

• Functions that run SQL passed as text (ts_stat, ts_rewrite, crosstab, connectby) could read schemas outside
  PG_MCP_SCHEMAS; the guard now rejects them like the query_to_xml family (#7)

v0.1.0

First feature-complete release.

Added

• SQL guard built on PostgreSQL's own parser (libpg-query): exactly one SELECT, no data-modifying CTEs, SELECT INTO, row locks or dangerous functions, allowlisted schemas (#4)
• Read-only executor: READ ONLY transactions that are always rolled back, SET LOCAL statement and lock timeouts and search_path, cursor row cap, column masking; catalog queries; query-plan summaries with index hints (#5)
• MCP server over stdio with list_tables, describe_table, run_query and explain_query, structured output schemas and read-only annotations; container image; client setup docs (#6)

Verified in CI

Lint, typecheck, unit tests, integration tests against PostgreSQL 16, container build, and an MCP stdio smoke test against the image.