Skip to content

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Nov 02:10
· 51 commits to main since this release
v2.0.0
b6b0872
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Strut Stack SQL v2.0.0

MCP SQL server with pluggable drivers — Postgres, MySQL, SQLite, DuckDB
(embedded analytics), SQL Server, ClickHouse — plus a policy engine, tool
profiles, and token thrift. All 29 Project Tracker V2 tasks (8 feat/v2 +
21 R1–R4) are complete, each with a merge/PR/tag URL as evidence in Notion.

What is new (per PR, verified)

  • PR #1 (feat/v2 → main, merged 2026-11-04 08:54 WIB, 9ff62ca): 18
    R1/R2/R4 tasks — the v2 foundation (pluggable drivers, tool profiles,
    schema intelligence, query advisor, OAuth 2.1 + policy engine, measured
    gates).
  • PR #2 (DuckDB R3-01 → main, merged 2026-11-04 21:13 WIB, 7f69c9a):
    embedded DuckDB driver (the real C++ engine via official Rust bindings),
    AST guard blocking read_csv/read_text/query_table/ATTACH/INSTALL/LOAD,
    normalized EXPLAIN/EXPLAIN ANALYZE. Gates: 403 tests pass, conformance
    51/0, CI all required PASS.
  • PR #3 (ClickHouse R3-03 → main, merged 2026-11-05 02:14 WIB, 63b650c):
    ClickHouse HTTP driver (reqwest, pooled client), clickhouse:// and
    clickhouses:// URLs, X-ClickHouse-User / X-ClickHouse-Key auth,
    JSONCompactEachRowWithNamesAndTypes, readonly=1 + max_execution_time,
    typed ? → {pN:Type} parameters, ClickHouseDialect guard + denylist,
    backtick DDL + MODIFY COLUMN + EXPLAIN PLAN. Gates: fmt 0, clippy 1.99 0,
    workspace tests 0, real-DB integration 5/5, conformance 51/0/3,
    audit 0. CI run 41892311748 all required PASS.
  • PR #4 (SQL Server R3-02 → main, merged 2026-11-05 08:08 WIB, a5a687b):
    SQL Server driver (Tiberius 0.13/Rustls, sqlserver:// + mssql:// alias,
    trust_server_certificate + encrypt, TOP/OFFSET FETCH, EXEC/SET/USE
    denylist, full-AST policy notes). Gates: fmt 0, clippy 1.99 0, workspace
    tests 0, live driver 6/6, live root 5/5, BUILD 0, conformance 51/0/3,
    audit 0. CI run 41945395064 all required PASS.

Breaking changes

  • Version 2.0.0; there is NO V1 runtime compatibility layer.
  • The mcp-sql-rust alias was removed (per PR #1).
  • jsonwebtoken patch: crypto-bigint 0.5.5 → 0.7.10 via [patch.crates-io]
    to upstream PR #551 rev 3739623a (not yet merged upstream) — fixing
    RUSTSEC-2026-0387, with NO audit ignore.
  • DuckDB, ClickHouse, SQL Server: additive, no breaking changes.

Honest limitations

  • DuckDB: row_cap limits decoded rows (not native materialization);
    UUID/JSON parameters need explicit casts; :memory: read-only relies on
    the guard.
  • ClickHouse: HTTP-only driver (not the native protocol); keyset treats
    ClickHouse PKs as NOT unique; Binary → hex.
  • SQL Server: live verification ran only against a disposable SQL Server
    2022 container, not production SQL Server; no production install or
    deploy is included in this release.
  • Still-open PRD gaps (not claimed done): full tools/list token
    measurement, cursor pagination, further masking/row-filter policy,
    approval + migration tools, doctor/migrate CLI, HTTP benchmark misses.

This release is the tag + notes. Production install/deploy needs a
separate go-ahead.

Release mechanics note

  • PR #5 (release workflow fix → main, merged 2026-11-05 08:53 WIB,
    b6b0872): workflow-only, no product code changed. It unblocked this
    release after run 41947059951 failed two Linux builds: Linux x64 size
    budget 16,000,000 → 50,000,000 (the v2 binary embeds DuckDB, ~45MB) and
    Linux arm64 builds moved from the cross-rs image (whose g++ lacks C++
    headers) to Ubuntu host cross toolchain. The tag points to
    b6b0872; product code is identical to a5a687b plus this workflow fix.
Assets 15
Loading