v2.0.0 — Major Release: Audit Logging, Breaking Schema Parity, and Cross-Server Feature Completeness

Highlights

🔒 Audit Logging & DDL Backup Snapshots — Full JSONL audit trail with rotation, OAuth identity capture, and pre-mutation DDL snapshots for destructive operations
⚡ 5 New Core Convenience Tools — sqlite_upsert, sqlite_batch_insert, sqlite_count, sqlite_exists, sqlite_truncate for postgres-mcp parity
🔍 Anomaly Detection Suite — 3 new stats tools: detect anomalies (z-score), detect bloat (fragmentation scoring), detect schema risks (missing FK indexes, wide tables)
🛡️ JSON Security Scan — Scans JSON columns for sensitive keys, SQL injection patterns, and XSS attack vectors
💥 6 Breaking Changes — Transaction group split, vector/text output schema standardization, migration parameter rename, default behavior changes (see below)

Transaction Group Split: 8 transaction tools moved from admin → dedicated transactions group. OAuth scope changed from admin to write.
Text original field removed: 6 text tools no longer return the original string field in responses.
Vector output schema: sqlite.vector.search returns rows (was results); sqlite.vector.distance returns distance (was value).
Query pagination default: Unbounded SELECT safety limit lowered from 1000 → 50 rows.
Phonetic includeRowData default: Changed from true to false.
Migration SQL property: Standardized to migrationSql (was sql).

Audit Logging — JSONL audit trail with async-buffered writes, 10MB log rotation (5-file cascade), sqlite://audit resource, OAuth identity capture
DDL Backup Snapshots — Pre-mutation DDL capture for DROP/import/backup operations with gzip compression and retention policies
Token Burn-Rate — _meta.tokenEstimate on every tool response for agent token awareness
Convenience Tools — 5 core tools (upsert, batch_insert, count, exists, truncate)
Anomaly Detection — sqlite_stats_detect_anomalies, sqlite_stats_detect_bloat, sqlite_stats_detect_schema_risks
JSON Security Scan — sqlite_json_security_scan with SQL injection, XSS, and sensitive key detection
Text Sentiment — sqlite_text_sentiment keyword-based analysis
FTS5 Headline — sqlite_fts_headline highlighted search snippets (native only)
Introspection Resources — sqlite://compile_options and sqlite://pragma
Initialization SQL — initializationSql config for per-connection session setup
Progress Notifications — MCP progress events for backup, migration, and analysis operations
Test Coverage Milestone — 90.34% coverage with comprehensive new test suites

SLSA Build L3 — --provenance attestation on npm publish
CI/CD Hardening — TruffleHog + Gitleaks secrets scanning, Dependabot auto-merge, Trivy container scanning
Vulnerability Remediation — Resolved Vite, Hono, path-to-regexp, fast-uri, Picomatch, ip-address CVEs
Docker Image Hardening — Pinned Alpine edge packages, patched npm-bundled brace-expansion

40+ bug fixes across all tool groups including Zod validation leaks, Code Mode error handling, resource error quality, transaction execution, schema aliasing, payload optimization, and E2E test stability

Full Changelog: v1.1.1...v2.0.0

Install:

npm install db-mcp@2.0.0
# or
docker pull writenotenow/db-mcp:v2.0.0