ModelsAtlas
Explore
Atlas / MCP servers / nethinwei / nethinwei-sql-gateway

nethinwei-sql-gatewayBLOCK

mcp/nethinwei/sql-mcp-server
MCP server by nethinwei · ai agent · data governance · mcp · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Governed SQL gateway for untrusted AI agents. No arbitrary SQL. Policy-enforced, cost-bounded access to relational data.

Verdict
BLOCK
Grade
F
Trust score
57 /100
Exposed tools
—
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The governed SQL gateway for untrusted AI agents.

面向不可信 AI Agent 的受控 SQL 数据访问网关。通过显式 Entity、关系代数 IR 和 参数化 codegen 访问 PostgreSQL、MySQL 与 OceanBase,不接受任意 SQL,不提供 DDL。

核心差异

  • 确定性执行:Agent 只能组合受控工具和白名单 IR;
  • 字段与行治理:RBAC、字段 ACL、row policy 和 mask 统一强制;
  • 成本可控:EXPLAIN 预筛、结果上限、超时和 session/tenant 预算;
  • 默认拒绝:安全能力无法证明时 fail closed;
  • 可审计:配置热重载、异步审计和 OpenTelemetry hook。

运行时安全行为以安全模型为准;Provider 验证边界与证据层级 以兼容矩阵为准;威胁、控制与剩余风险见 威胁模型。所有对外声明的证据汇总见 架构、安全边界与证据索引。不以本页摘要为准。

五分钟体验

只需 Docker 与 Docker Compose:

docker compose -f examples/quickstart/compose.yaml up -d --wait
curl -fsS http://127.0.0.1:8080/healthz

完整的 MCP Inspector 调用、tenant 隔离、mask 和拒绝场景见 五分钟快速体验。

安装与接入

源码构建要求 Go 1.26.9+ 和一个已验证数据库版本:

git clone https://github.com/nethinwei/sql-mcp-server.git
cd sql-mcp-server
make build
  • Cursor、Claude Desktop 和 VS Code 的 stdio 模板:

examples/clients/(核对结论见 客户端接入核对);

  • 完整配置模板:examples/config.example.yaml;
  • CLI、启动、热重载、容器部署和升级:运行与运维;
  • Web 管理控制台与 Docker Compose 部署:管理控制台;
  • 魔搭分发展示:ModelScope 上架与使用。

按角色阅读

首次体验与集成

  • 五分钟快速体验:唯一完整 Demo 与 Inspector 示例;
  • 配置参考:公开 YAML 配置的唯一事实源;
  • Provider 兼容性与

支持版本:当前能力和验证边界。

部署与安全

  • 运行与运维:CLI、容器部署、生命周期、监控和升级;
  • 管理控制台:配置编辑、发布回滚、管理员权限与 Docker 部署;
  • 安全模型:运行时安全行为的唯一事实源;
  • 威胁模型:威胁、控制、测试证据与剩余风险;
  • SECURITY.md:漏洞披露流程。

开发与维护

  • 架构、不变量与术语表;
  • 测试与 CI:测试命令、CI、fuzz 和发布前门禁;
  • [贡献指南](CONTRIBU
Read from source at commit 53bec1adf14fOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (oci)
claude mcp add sql-mcp-server:0.1.13 --env DATABASE_DSN=${DATABASE_DSN} -- docker run -i --rm ghcr.io/nethinwei/sql-mcp-server:0.1.13:None serve /config/config.yaml stdio
03

Trust audit

BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (3 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
web/admin/src/lib/revisionDetail.ts:17
watch(id, (rev) => (rev ? void yaml.load(rev) : yaml.reset()), { immediate: true })
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/relalg/interp/aggregate.go:18
in, err := eval(db, n.Input)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/relalg/interp/interp.go:47
func Eval(db DB, e relalg.Expr) (Result, error) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/relalg/interp/interp.go:48
r, err := eval(db, e)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/relalg/interp/interp.go:69
func eval(db DB, e relalg.Expr) (relation, error) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/relalg/interp/interp.go:97
in, err := eval(db, n.Input)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
mcp_config.json:15
"DATABASE_DSN": "postgres://reader:[email protected]:5432/app?sslmode=require"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
web/admin/src/lib/selection.ts:111
const url = URL.createObjectURL(new Blob(['' + text], { type: `${type};charset=utf-8` }))
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
docs/modelscope.md:56
"DATABASE_DSN": "postgres://reader:[email protected]:5432/app?sslmode=require"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
examples/modelscope/docker-mcp-config.json:23
"DATABASE_DSN": "postgres://reader:[email protected]:5432/app?sslmode=require"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
x/bootstrap/bootstrap_store_test.go:40
{"postgres", "postgres://app:hunter2@db/app"},
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
examples/quickstart/config.yaml:8
token: "quickstart-only-token"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
internal/protocolsmoke/config.yaml:7
token: "protocol-smoke-token"
LOWInventory / provenance · inv.hidden_file · CWE-1104
.golangci.yml
.golangci.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.goreleaser.yaml
.goreleaser.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
eval/runner/diagnostic_test.go:12
dir := "../../fixtures/v4/tasks-v5"
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
eval/runner/workload_test.go:16
file, err := loadWorkloadTasks("../../fixtures/v4/tasks/tasks.yaml",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/evalcoverage/matrix_test.go:50
"../../fixtures/v4/tasks-v5/guided-metadata.yaml",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/evalcoverage/matrix_test.go:51
"../../fixtures/v4/tasks-v5/additions.yaml",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/evalcoverage/matrix_test.go:52
"../../fixtures/v4/coverage/dimensions.yaml",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:134
sql-mcp-server serve --store sqlite:/path/config.db --admin --watch   # 控制台 http://127.0.0.1:18090/admin/(默认地址以配置为准)
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:137
`web/admin` 下 `pnpm dev` 会把 API 代理到 `SMCP_ADMIN_API`(默认 `http://127.0.0.1:18090`)。
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:28
curl -fsS http://127.0.0.1:8080/healthz
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/console.md:35
打开 `http://127.0.0.1:8080/admin/`,用刚创建的账号登录。
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/console.md:236
- 控制台:<http://127.0.0.1:8080/admin/>,用 `admin` 登录;

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 53bec1adf14ffull audit observations/trust-audit/mcp-server/nethinwei__sql-mcp-server.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1153bec1adf14fBLOCKF57first audit
05

Questions

What is the nethinwei-sql-gateway MCP server?

Governed SQL gateway for untrusted AI agents. No arbitrary SQL. Policy-enforced, cost-bounded access to relational data.

Is nethinwei-sql-gateway safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (57/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does nethinwei-sql-gateway need?

It reads DATABASE_DSN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does nethinwei-sql-gateway run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sql-mcp-server-admin at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (53bec1adf14f), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement