Skip to content

Commit 4e8d0b3

Browse files
benborlabenborla
authored
Merge pull request #17 from saarthak-gupta-architect/main
Multi-DB Support and Schema-Specific Permissions
2 parents 857b256 + e3db799 commit 4e8d0b3

File tree

6 files changed

+958
-66
lines changed

6 files changed

+958
-66
lines changed

‎.env.dist

+39-6
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,45 @@
1+
# Basic MySQL connection settings
12
MYSQL_HOST=127.0.0.1
23
MYSQL_PORT=3306
34
MYSQL_USER=root
4-
MYSQL_PASS=password
5-
MYSQL_DB=your_database_name
6-
MYSQL_SSL=false
7-
MYSQL_SSL_REJECT_UNAUTHORIZED=false
5+
MYSQL_PASS=your_password
6+
MYSQL_DB=
7+
8+
# Leave MYSQL_DB empty for multi-DB mode
9+
# Set MYSQL_DB to a specific database name for single-DB mode
810

9-
# Write operation settings (default to false for security)
11+
# Global write operation permissions (default to false for safety)
1012
ALLOW_INSERT_OPERATION=false
1113
ALLOW_UPDATE_OPERATION=false
12-
ALLOW_DELETE_OPERATION=false
14+
ALLOW_DELETE_OPERATION=false
15+
ALLOW_DDL_OPERATION=false
16+
17+
# Schema-specific permissions
18+
# Format: "schema1:true,schema2:false"
19+
SCHEMA_INSERT_PERMISSIONS=test_db:true,staging_db:false
20+
SCHEMA_UPDATE_PERMISSIONS=test_db:true,staging_db:false
21+
SCHEMA_DELETE_PERMISSIONS=test_db:false,staging_db:false
22+
SCHEMA_DDL_PERMISSIONS=test_db:true,staging_db:false
23+
24+
# Multi-DB mode settings
25+
# Set to true ONLY if you want to allow write operations in multi-DB mode without
26+
# schema-specific permissions (not recommended)
27+
MULTI_DB_WRITE_MODE=false
28+
29+
# SSL configuration
30+
MYSQL_SSL=false
31+
MYSQL_SSL_REJECT_UNAUTHORIZED=true
32+
33+
# Performance settings
34+
MYSQL_POOL_SIZE=10
35+
MYSQL_QUERY_TIMEOUT=30000
36+
MYSQL_CACHE_TTL=60000
37+
38+
# Security settings
39+
MYSQL_RATE_LIMIT=100
40+
MYSQL_MAX_QUERY_COMPLEXITY=1000
41+
42+
# Monitoring settings
43+
MYSQL_ENABLE_LOGGING=false
44+
MYSQL_LOG_LEVEL=info
45+
MYSQL_METRICS_ENABLED=false

‎README-MULTI-DB.md

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Multi-DB Mode and Schema-Specific Permissions
2+
3+
This document describes the new multi-database mode and schema-specific permissions features added to the MCP-Server-MySQL.
4+
5+
## Multi-DB Mode
6+
7+
MCP-Server-MySQL now supports working with multiple databases simultaneously when no specific database is set in the configuration.
8+
9+
### How to Enable Multi-DB Mode
10+
11+
To enable multi-DB mode, simply leave the `MYSQL_DB` environment variable empty:
12+
13+
```json
14+
{
15+
"mcpServers": {
16+
"mcp_server_mysql": {
17+
"env": {
18+
"MYSQL_HOST": "127.0.0.1",
19+
"MYSQL_PORT": "3306",
20+
"MYSQL_USER": "root",
21+
"MYSQL_PASS": "your_password",
22+
"MYSQL_DB": "", // Empty to enable multi-DB mode
23+
...
24+
}
25+
}
26+
}
27+
}
28+
```
29+
30+
### Features in Multi-DB Mode
31+
32+
1. **List All Databases**: In multi-DB mode, the server will list resources from all available databases when the LLM requests database schemas.
33+
34+
2. **Query Any Database**: You can execute queries against any database to which the MySQL user has access.
35+
36+
3. **Schema Qualification Required**: When working in multi-DB mode, you should use fully qualified table names with schema/database prefixes:
37+
```sql
38+
-- Use fully qualified table names
39+
SELECT * FROM database_name.table_name;
40+
41+
-- Or use USE statements to switch between databases
42+
USE database_name;
43+
SELECT * FROM table_name;
44+
```
45+
46+
4. **Automatic Read-Only Mode**: For safety, multi-DB mode enforces read-only operations by default. This can be customized using schema-specific permissions (see below).
47+
48+
5. **Database Exploration**: You can explore databases using commands like:
49+
```sql
50+
-- List all databases
51+
SHOW DATABASES;
52+
53+
-- List tables in a specific database
54+
SHOW TABLES FROM database_name;
55+
56+
-- Describe a table's structure
57+
DESCRIBE database_name.table_name;
58+
```
59+
60+
## Schema-Specific Permissions
61+
62+
This new feature allows fine-grained control over which operations are allowed on specific database schemas.
63+
64+
### Available Permission Types
65+
66+
1. **INSERT Permissions**: Control which schemas can have new records inserted.
67+
2. **UPDATE Permissions**: Control which schemas can have records updated.
68+
3. **DELETE Permissions**: Control which schemas can have records deleted.
69+
4. **DDL Permissions**: Control which schemas can have their structure modified (CREATE, ALTER, DROP, TRUNCATE).
70+
71+
### How to Configure Schema-Specific Permissions
72+
73+
Set the following environment variables with a comma-separated list of schema:permission pairs:
74+
75+
```
76+
SCHEMA_INSERT_PERMISSIONS=production:false,development:true,test:true
77+
SCHEMA_UPDATE_PERMISSIONS=production:false,development:true,test:true
78+
SCHEMA_DELETE_PERMISSIONS=production:false,development:false,test:true
79+
SCHEMA_DDL_PERMISSIONS=production:false,development:false,test:true
80+
```
81+
82+
This configuration:
83+
- Allows INSERT and UPDATE on development and test databases, but not production
84+
- Allows DELETE and DDL operations only on the test database
85+
- Blocks all write operations on the production database
86+
87+
### Example Configuration
88+
89+
Here's a complete example configuration with schema-specific permissions:
90+
91+
```json
92+
{
93+
"mcpServers": {
94+
"mcp_server_mysql": {
95+
"command": "npx",
96+
"args": ["-y", "@benborla29/mcp-server-mysql"],
97+
"env": {
98+
"MYSQL_HOST": "127.0.0.1",
99+
"MYSQL_PORT": "3306",
100+
"MYSQL_USER": "root",
101+
"MYSQL_PASS": "your_password",
102+
"MYSQL_DB": "", // Empty for multi-DB mode
103+
104+
// Global defaults (apply when no schema-specific permission is set)
105+
"ALLOW_INSERT_OPERATION": "false",
106+
"ALLOW_UPDATE_OPERATION": "false",
107+
"ALLOW_DELETE_OPERATION": "false",
108+
"ALLOW_DDL_OPERATION": "false",
109+
110+
// Schema-specific permissions
111+
"SCHEMA_INSERT_PERMISSIONS": "dev_db:true,test_db:true,prod_db:false",
112+
"SCHEMA_UPDATE_PERMISSIONS": "dev_db:true,test_db:true,prod_db:false",
113+
"SCHEMA_DELETE_PERMISSIONS": "dev_db:false,test_db:true,prod_db:false",
114+
"SCHEMA_DDL_PERMISSIONS": "dev_db:false,test_db:true,prod_db:false"
115+
}
116+
}
117+
}
118+
}
119+
```
120+
121+
### Permission Resolution Logic
122+
123+
1. If a schema-specific permission is set, it takes precedence over the global setting.
124+
2. If no schema-specific permission is found, the global setting (`ALLOW_X_OPERATION`) is used.
125+
3. In multi-DB mode, if a query doesn't specify a schema and one can't be determined from context, only read operations are allowed for safety.
126+
127+
## Environment Variables Summary
128+
129+
### Multi-DB Mode
130+
- `MYSQL_DB`: Leave empty to enable multi-DB mode
131+
- `MULTI_DB_WRITE_MODE`: Set to "true" to allow write operations in multi-DB mode without schema-specific permissions (not recommended for security)
132+
133+
### Schema-Specific Permissions
134+
- `SCHEMA_INSERT_PERMISSIONS`: Control INSERT permissions per schema
135+
- `SCHEMA_UPDATE_PERMISSIONS`: Control UPDATE permissions per schema
136+
- `SCHEMA_DELETE_PERMISSIONS`: Control DELETE permissions per schema
137+
- `SCHEMA_DDL_PERMISSIONS`: Control DDL permissions per schema (CREATE, ALTER, DROP, TRUNCATE)
138+
139+
### Global Permission Defaults
140+
- `ALLOW_INSERT_OPERATION`: Global default for INSERT permissions
141+
- `ALLOW_UPDATE_OPERATION`: Global default for UPDATE permissions
142+
- `ALLOW_DELETE_OPERATION`: Global default for DELETE permissions
143+
- `ALLOW_DDL_OPERATION`: Global default for DDL permissions
144+
145+
## Security Considerations
146+
147+
1. **Default to Principle of Least Privilege**: By default, all write operations are disabled globally and must be explicitly enabled.
148+
149+
2. **Isolation in Multi-DB Mode**: Consider using a dedicated MySQL user with limited database grants when using multi-DB mode.
150+
151+
3. **Careful with DDL Permissions**: DDL operations can modify database structure, so grant these permissions cautiously.
152+
153+
4. **Production Databases**: Always set `schema:false` for production database schemas in all write permission settings.
154+
155+
5. **User Least Privilege**: Ensure the MySQL user only has the required permissions on the specific databases needed.

‎README.md

+41-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ A Model Context Protocol server that provides access to MySQL databases. This se
1717
- [Components](#components)
1818
- [Configuration](#configuration)
1919
- [Environment Variables](#environment-variables)
20+
- [Multi-DB Mode](#multi-db-mode)
21+
- [Schema-Specific Permissions](#schema-specific-permissions)
2022
- [Testing](#testing)
2123
- [Troubleshooting](#troubleshooting)
2224
- [Contributing](#contributing)
@@ -348,7 +350,7 @@ For more control over the MCP server's behavior, you can use these advanced conf
348350
- `MYSQL_PORT`: MySQL server port (default: "3306")
349351
- `MYSQL_USER`: MySQL username (default: "root")
350352
- `MYSQL_PASS`: MySQL password
351-
- `MYSQL_DB`: Target database name
353+
- `MYSQL_DB`: Target database name (leave empty for multi-DB mode)
352354

353355
### Performance Configuration
354356
- `MYSQL_POOL_SIZE`: Connection pool size (default: "10")
@@ -362,12 +364,50 @@ For more control over the MCP server's behavior, you can use these advanced conf
362364
- `ALLOW_INSERT_OPERATION`: Enable INSERT operations (default: "false")
363365
- `ALLOW_UPDATE_OPERATION`: Enable UPDATE operations (default: "false")
364366
- `ALLOW_DELETE_OPERATION`: Enable DELETE operations (default: "false")
367+
- `ALLOW_DDL_OPERATION`: Enable DDL operations (default: "false")
368+
- `SCHEMA_INSERT_PERMISSIONS`: Schema-specific INSERT permissions
369+
- `SCHEMA_UPDATE_PERMISSIONS`: Schema-specific UPDATE permissions
370+
- `SCHEMA_DELETE_PERMISSIONS`: Schema-specific DELETE permissions
371+
- `SCHEMA_DDL_PERMISSIONS`: Schema-specific DDL permissions
372+
- `MULTI_DB_WRITE_MODE`: Enable write operations in multi-DB mode (default: "false")
365373

366374
### Monitoring Configuration
367375
- `MYSQL_ENABLE_LOGGING`: Enable query logging (default: "false")
368376
- `MYSQL_LOG_LEVEL`: Logging level (default: "info")
369377
- `MYSQL_METRICS_ENABLED`: Enable performance metrics (default: "false")
370378

379+
## Multi-DB Mode
380+
381+
MCP-Server-MySQL supports connecting to multiple databases when no specific database is set. This allows the LLM to query any database the MySQL user has access to. For full details, see [README-MULTI-DB.md](./README-MULTI-DB.md).
382+
383+
### Enabling Multi-DB Mode
384+
385+
To enable multi-DB mode, simply leave the `MYSQL_DB` environment variable empty. In multi-DB mode, queries require schema qualification:
386+
387+
```sql
388+
-- Use fully qualified table names
389+
SELECT * FROM database_name.table_name;
390+
391+
-- Or use USE statements to switch between databases
392+
USE database_name;
393+
SELECT * FROM table_name;
394+
```
395+
396+
## Schema-Specific Permissions
397+
398+
For fine-grained control over database operations, MCP-Server-MySQL now supports schema-specific permissions. This allows different databases to have different levels of access (read-only, read-write, etc.).
399+
400+
### Configuration Example
401+
402+
```
403+
SCHEMA_INSERT_PERMISSIONS=development:true,test:true,production:false
404+
SCHEMA_UPDATE_PERMISSIONS=development:true,test:true,production:false
405+
SCHEMA_DELETE_PERMISSIONS=development:false,test:true,production:false
406+
SCHEMA_DDL_PERMISSIONS=development:false,test:true,production:false
407+
```
408+
409+
For complete details and security recommendations, see [README-MULTI-DB.md](./README-MULTI-DB.md).
410+
371411
## Testing
372412

373413
### Database Setup

0 commit comments

Comments
 (0)