3.0.0 — Direct setup, private metadata and safe defaults

OmniSQL now sets up direct database instances in one MCP server. DBeaver is an optional connection importer. This release also ships the database, metadata, result-handling and performance fixes merged since 2.2.0.

What changed

Area	Behavior
Setup	Guided direct instances, existing config or selected saved workspace connections; native Claude Code/Codex/OpenCode registration
Access	Read-only and strict SSH verification by default; per-instance policies and explicit operator write grants
Privacy	Logical connection metadata and resource IDs; sanitized native/IAM/startup/cleanup errors and debug logs
Correctness	Quoted table names (#79), qualified DROP targets, PostgreSQL array guards, exact JSON/numeric handling and explicit timestamp-precision limitations
Database paths	PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite, DuckDB and ClickHouse, with documented capability differences
Large results	Private scoped handles, row/column/cell pages, compressed exports and bounded catalog comparisons

Upgrade notes

• Requires Bun 1.4.3+, Node 22.15+ within 22.x, or Node 24+.
• Writes require OMNISQL_READ_ONLY=false; direct JSON instances also need readOnly: false. Database grants and operator policies still apply.
• Verify and record SSH host keys in known_hosts. The explicit legacy opt-out is OMNISQL_SSH_STRICT_HOST_KEY=false.
• An explicit config file excludes unrelated saved workspace connections. Set OMNISQL_DISCOVER_WORKSPACE=true only when you intentionally need both sources.
• Use connection IDs returned by list_connections; unsafe discovered IDs are represented by opaque aliases.
• Oracle/SQL Server timestamp precision above milliseconds may require selecting exact text; see the database guide.

Verification and measurements

381 unit tests passed locally; the Windows-only shim test passed in CI. All 25 PR checks passed, including real engine/runtime/TLS, Rust/WASM, package, privacy and site checks. Actual isolated Claude/Codex/OpenCode registration/readback was verified. Oracle rejected an untrusted certificate in a TLS fixture; a live Oracle TCPS database login is not claimed.

Local Node 24.7 / macOS ARM64, 12 samples	2.2.0	3.0.0 candidate
CLI startup p50	161.54 ms	22.89 ms
MCP initialize + tools p50	167.47 ms	112.51 ms

Tarball: 743,919 bytes; unpacked app: 2,858,449 bytes. Drivers/runtime/optional database CLIs are additional. Nine direct production dependencies; none added by the release hardening work. Source changes replace 341 lines and add 1,289 lines (net +948); this is not a full Rust-server migration.

Full changes, tests, raw measurements and actual screenshot · Remaining roadmap · Documentation

Published and verified on npm: latest resolves to 3.0.0. Fresh registry installation, npx @latest, two-database MCP read-only smoke checks and the update notice in published 2.2.0 passed. The standalone installer also passed with a manifest-cache refresh; #81 merged the permanent upgrade fix after all 25 checks passed. GitHub and npm archives contain byte-identical files/tar streams; their outer gzip sizes differ.

Documentation redirects in #82 are merged and live, including links embedded in the already-published npm README. Final main aeb2d5a passed all 25 checks.