Security Governance

Security Governance

hs-sql-agent keeps resource limits and SQL safety rules on the server. The Admin Panel can update the runtime policy without restarting the application, and the same rules apply to built-in and custom SQL tools.

Runtime security policy

Open Runtime > Security Policy in the Admin Panel. Reading the page requires /runtime/security.view; saving changes requires /runtime/security.edit.

Setting	Default	Valid range	Enforcement
Maximum returned rows	1,000	1-100,000	Applies a server-side query limit
SQL timeout	30 seconds	1-600	Applies to query and DML execution
Require WHERE for UPDATE	Enabled	Boolean	Rejects unscoped updates
Require WHERE for DELETE	Enabled	Boolean	Rejects unscoped deletes
Allow full-table UPDATE	Disabled	Boolean	Must be enabled, with the WHERE requirement disabled, to permit an unscoped update
Allow full-table DELETE	Disabled	Boolean	Must be enabled, with the WHERE requirement disabled, to permit an unscoped delete
Maximum affected DML rows	100	1-1,000,000	Rolls back a dry run that exceeds the limit
Default MCP-key requests	120	1-1,000,000	Default authenticated-key quota
MCP-key window	60 seconds	1-86,400	Default authenticated-key window
Maximum concurrent SQL	16	1-10,000	Limits active built-in and custom SQL operations

The Admin database is authoritative. Each process keeps a runtime copy for fast checks. In a distributed deployment, Redis publication provides immediate propagation and Admin database polling repairs missed notifications. See Distributed Deployment.

Enforcement order

MCP request
  -> pre-authentication IP rate limit
  -> MCP key validation and tool/table restrictions
  -> authenticated per-key rate limit
  -> SQL concurrency lease
  -> SQL parsing and validation
  -> query/DML runtime policy
  -> user database execution
  -> structured audit event

The IP limit is startup configuration under RateLimiting. Authenticated-key defaults and SQL policies are runtime settings stored in the Admin database.

Query protection

• The server applies QueryMaxRows even when a client omits a limit or requests a larger result.
• QueryTimeoutSeconds is passed to the database query executor.
• Table whitelists and tool allowlists remain independent checks.
• MaxConcurrentSql covers built-in tools and custom SQL tools.

DML protection and human approval

DML guardrails run before and during the dry run:

1. Parse and validate the statement.
2. Reject an unscoped UPDATE or DELETE unless the policy explicitly permits it.
3. Execute inside a transaction.
4. Roll back and reject the operation if affected rows exceed DmlMaxAffectedRows.
5. Roll back the dry run.
6. Ask the human user through MCP Elicitation.
7. Execute and commit only after explicit acceptance.

Human acceptance cannot override a server-side policy rejection. A client without Elicitation support cannot commit DML.

Per-key request quotas

Every MCP key has one rate-limit mode:

Mode	Behavior
Inherit	Uses KeyPermitLimit and KeyWindowSeconds from the runtime security policy
Custom	Uses that key's request and window overrides
Unlimited	Disables only the authenticated per-key request quota

Unlimited does not disable the IP rate limit, SQL concurrency limit, query limit, timeout, DML safeguards, table whitelist, or tool permissions. A rejected request returns HTTP 429 with Retry-After.

Audit events

Policy decisions and SQL outcomes are written as structured audit events. See Operations and Audit for investigation workflows and Access Management for key lifecycle and role permissions.