Skip to content

v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 23:46
v0.3.1
ae885e7

v0.3.1 (2026-07-18)

This release is published under the MIT License.

Bug Fixes

  • mcp: Block filesystem, SSRF and dynamic-SQL access from the query tool (65aeda7)

The query tool gated SQL only with is_read_only(), an advisory check on the leading keyword. A SELECT could still read local files via read_text() / read_csv() / glob() / ST_Read(), reach internal endpoints (read_csv('http://169.254.169.254/...')), or smuggle any of these past inspection with query('...'). An MCP client driven by untrusted data could be made to exfiltrate secrets (e.g. ~/.ssh/id_rsa) through the tool result.

Reject these functions in the query tool. core.unsafe_function() parses the SQL with DuckDB's own parser (json_serialize_sql) and walks the AST, so a call is found regardless of nesting, with a lexical scan as a fail-closed fallback for statements the parser refuses. The CLI keeps unrestricted SQL: it is run by a trusted local user, not an untrusted agent.

Also correct the tool docstring and server instructions, which described the tool as plain "read-only" and implied it was safe.

Continuous Integration

  • release: Docs.queria.io デプロイフックのステップを削除 (9471d9b)

Documentation

  • Describe query tool sandboxing in the README (4a21782)

Note that the MCP query tool runs SELECT-only over the catalogs and blocks file/URL readers and dynamic SQL, and point users at the CLI when they need unrestricted SQL.

Detailed Changes: v0.3.0...v0.3.1

Assets 2
Loading