v0.0.5

Per-caller bearer tokens

server.auth_token is replaced by server.auth_tokens, a map of caller name to token. Every query the server logs now leads with "caller":"<name>", so the audit trail names who ran what. One person's token can be rotated or revoked without touching anyone else's.

server:
  auth_tokens:
    alice: ${MYSQL_MCP_TOKEN_ALICE}
    bob: ${MYSQL_MCP_TOKEN_BOB}

Breaking: a config still carrying server.auth_token fails at startup with the rename spelled out. There is no compatibility path. A team that wants one shared token defines one name.

• Names use the request id's charset (1–64 of letters, digits, ., _, -); tokens must be unique and free of whitespace. Startup refuses anything else and reports "callers":N.
• A token outside the set gets 401 invalid token and an auth warning with the address the server saw, at most once a minute per address. A missing header gets 401 no bearer token.
• Under --stdio nothing checks a token and the query line carries no caller.
• The client side keeps its shape: .mcp.json sends Authorization: Bearer ${MYSQL_MCP_AUTH_TOKEN}, and each person exports their own token under it.

Fixes

• The JSON masking integration test assumed which row holds id 1 in the seeded big table, which differs between MariaDB and MySQL 8.4; CI on MySQL is green again.
• The Local Development command in the README and CLAUDE.md now works from a fresh clone (config.yaml is gitignored).

Changelog

• 49f9ba5: Issue bearer tokens per caller and log the caller on every query line (@mshddev)
• eda8cc9: Rate-limit the unknown-token warning per address (@mshddev)
• cb7eb0b: Show the upcoming version in the README startup sample (@mshddev)
• f3959ae: Stop the JSON masking tests assuming which row holds id 1 (@mshddev)
• 461da2a: Tighten the token checks and fix the dev command after review (@mshddev)

v0.0.4

Changelog

• 5e8c786: Add --stdio as a secondary, single-user transport (@mshddev)
• 468d89e: Add database.tls: encrypt the hop to the database, verified by default (@mshddev)
• 0060133: Add masking.values: a shape-based second masking layer (@mshddev)
• 75fd25f: Annotate the query tool per mode and drain in-flight queries on SIGTERM (@mshddev)
• ffe24cc: Apply the column mask rules to keys inside JSON cells (@mshddev)
• ae19172: Don't report masked_values for a JSON cell where only keys matched (@mshddev)
• 01887a8: Drop the bare name rule from the shipped masking defaults (@mshddev)
• 0ace62f: Log a request id on every query line (@mshddev)
• 235e44c: README: clarify the connection cap and a second instance (@mshddev)
• 80f1327: README: deployment runbook details lifted from a comparison (@mshddev)
• 1109a1f: Refine project descriptions in CLAUDE.md and README.md for clarity and consistency (@mshddev)
• f6d00d0: Run the dev database and integration tests in a container (@mshddev)
• e81679d: Scrub email and phone shapes from the logged SQL and error text (@mshddev)
• 5eb54cc: Warn at startup when server.listen binds beyond loopback (@mshddev)

v0.0.3

Changelog

• be7d512: Add unauthenticated /healthz and /readyz probes (@mshddev)
• aaee452: Drop the strategy lead-in from the masking tool description (@mshddev)
• 3ebc730: Reframe the docs around remote-first deployment (@mshddev)

v0.0.2

Changelog

• 2395e01: Ship prebuilt binaries with a curl installer (@mshddev)