component_mcp Phase 5: production hardening of the endpoint (RFC 0001) #256

Follow-up to the Phase 4 spike (#253, component_mcp), as listed in docs/MCP_COMPONENTS.md and RFC 0001 §9/§10. The spike deferred these items to Phase 5:

Bounds and memory

• Bounded row consumer. The command service's default consumer collects every row while a statement runs, so a run_query with a large explicit LIMIT is buffered in full in mysqld before the reply is cut (sql_select_limit only bounds statements without their own LIMIT). Implement a custom consumer (mysql_command_consumer services) that stops retaining rows past max_rows + 1 and a byte budget. Acceptance: retained rows and bytes during execution stay within the bounds for SELECT … LIMIT 1000000 and for wide rows. (CodeRabbit review on feat(mcp): component_mcp spike, an MCP endpoint inside mysqld (RFC 0001 Phase 4) #253.)

Accounts and sessions

• account_locked check. Impersonation skips ACCOUNT LOCK (verified in fix(mcp-guard): guard sessions opened by components (RFC 0001 Phase 4, Q4) #252). Use mysql_account_database_security_context_lookup (26.10).
• Per-account session cap. max_user_connections isn't enforced for command-service sessions (verified in fix(mcp-guard): guard sessions opened by components (RFC 0001 Phase 4, Q4) #252).
• Token → account mapping beyond one token. Design decision: OAuth 2.1 or a token table (RFC §10 security review).

Transport

• TLS, mandatory off loopback (RFC §5.3).
• Origin validation (MCP spec, against DNS rebinding).
• More than one I/O worker. The spike serves one call at a time on one thread.
• Streamable HTTP details: session id, SSE where needed, protocol version negotiation.

Tools

• The five core tools for the MVP (RFC §9).
• Column masking, or disable run_query when mcp.mask_columns is set (RFC §5.3).

Go/no-go (RFC §10)

• 72 h of fuzzing plus a soak test under ASAN with zero crashes. An amd64 host is planned for this.
• Guard overhead under 1% p99 on non-MCP traffic.
• MCP conformance against at least two clients.