Post-merge review of #244, #245, #246, #248 (do not merge)

.github/workflows/benchmark-issue79.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Build Docker image
         run: |
           docker build \
-            --build-arg MYSQL_VERSION=8.4 \
+            --build-arg MYSQL_VERSION=8.4.8 \
             --build-arg TARGETARCH=amd64 \
             -t ghcr.io/${{ github.repository }}:mysql8.4-fix-issue79 \
             -f Dockerfile.oraclelinux9 \

.github/workflows/docker-publish.yml

@@ -20,22 +20,30 @@ jobs:
     # Publish plugin images only from a dispatch that targets a VERSION tag
     # (refs/tags/v*). The version-tag guard stops a branch / non-version-tag
     # dispatch from overwriting the mutable public plugin tags
-    # (mysql8.0/8.4/9.7/latest).
-    if: github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/v')
+    # (mysql8.0/8.4/9.7/latest). A dry_run dispatch builds and tests without pushing.
+    if: >-
+      (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_dispatch' && inputs.dry_run)
     runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         include:
-          - mysql-tag: 'mysql-8.0.45'
+          # A plugin works only on the exact release it was built against, so each image
+          # is based on mysql:<mysql-release>, the release of mysql-tag, and also tagged
+          # with it (mysql<mysql-release>).
+          - mysql-tag: 'mysql-8.0.46'
+            mysql-release: '8.0.46'
             mysql-version: '8.0'
             dockerfile: Dockerfile.oraclelinux8
             compiler: 10
-          - mysql-tag: 'mysql-8.4.8'
+          - mysql-tag: 'mysql-8.4.13'
+            mysql-release: '8.4.13'
             mysql-version: '8.4'
             dockerfile: Dockerfile.oraclelinux9
             compiler: 10
-          - mysql-tag: 'mysql-9.7.0'
+          - mysql-tag: 'mysql-9.7.4'
+            mysql-release: '9.7.4'
             mysql-version: '9.7'
             dockerfile: Dockerfile.oraclelinux9
             compiler: 11
@@ -162,7 +170,7 @@ jobs:
             docker buildx build \
               --platform "linux/${arch}" \
               --file ${{ matrix.dockerfile }} \
-              --build-arg MYSQL_VERSION=${{ matrix.mysql-version }} \
+              --build-arg MYSQL_VERSION=${{ matrix.mysql-release }} \
               -t "myvector-smoke:${{ matrix.mysql-version }}-${arch}" \
               --load \
               .
@@ -191,10 +199,13 @@ jobs:
           context: .
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ghcr.io/${{ github.repository }}:mysql${{ matrix.mysql-version }}
+          # Never push on a dry_run dispatch — build only, to prove the pipeline.
+          push: ${{ !inputs.dry_run }}
+          tags: |
+            ghcr.io/${{ github.repository }}:mysql${{ matrix.mysql-version }}
+            ghcr.io/${{ github.repository }}:mysql${{ matrix.mysql-release }}
           build-args: |
-            MYSQL_VERSION=${{ matrix.mysql-version }}
+            MYSQL_VERSION=${{ matrix.mysql-release }}
 
       - name: Tag and push latest
         if: matrix.mysql-version == '8.0'
@@ -203,16 +214,19 @@ jobs:
           context: .
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64,linux/arm64
-          push: true
+          push: ${{ !inputs.dry_run }}
           tags: ghcr.io/${{ github.repository }}:latest
           build-args: |
-            MYSQL_VERSION=${{ matrix.mysql-version }}
+            MYSQL_VERSION=${{ matrix.mysql-release }}
 
   # Component-based images (INSTALL COMPONENT), distinct from the legacy plugin
   # images built above. mysql8.4/mysql9.7 already ship as plugin images with
   # existing users depending on them, so component images for those versions get
   # a "-component" tag suffix; mysql26.10 has no plugin equivalent to collide with
   # (component-only), so it gets the plain tag.
+  # The same job also builds component_mcp_guard and publishes the separate mysql-mcp
+  # image family (docker/mysql-mcp/Dockerfile, RFC 0001 in askdba/mysql-mcp-server) as
+  # ghcr.io/<owner>/mysql-mcp:<mysql-version>.
   build-and-publish-component:
     # Publish only from a dispatch that targets a VERSION tag (refs/tags/v*).
     # Without the version-tag guard, a workflow_dispatch off any branch — or any non-version tag — would
@@ -226,18 +240,27 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - mysql-tag: 'mysql-8.4.8'
+          # A component works only on the exact release it was built against (a build for
+          # 8.4.8 crashed 8.4.11 in askdba/myvector#244), so each image is based on
+          # mysql:<mysql-release>, the release of mysql-tag, and also tagged with it.
+          - mysql-tag: 'mysql-8.4.13'
+            mysql-release: '8.4.13'
             mysql-version: '8.4'
             build-script: scripts/build-component-8.4-docker.sh
             image-tag: 'mysql8.4-component'
-          - mysql-tag: 'mysql-9.7.0'
+            release-image-tag: 'mysql8.4.13-component'
+          - mysql-tag: 'mysql-9.7.4'
+            mysql-release: '9.7.4'
             mysql-version: '9.7'
             build-script: scripts/build-component-9.7-docker.sh
             image-tag: 'mysql9.7-component'
+            release-image-tag: 'mysql9.7.4-component'
           - mysql-tag: 'mysql-26.10.0'
+            mysql-release: '26.10.0'
             mysql-version: '26.10'
             build-script: scripts/build-component-26.10-docker.sh
             image-tag: 'mysql26.10'
+            release-image-tag: 'mysql26.10.0'
     steps:
       - name: Checkout MyVector Code
         uses: actions/checkout@v4
@@ -251,6 +274,8 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build MyVector component (amd64/arm64)
+        env:
+          MYVECTOR_BUILD_MCP: "ON"
         run: |
           set -euo pipefail
           chmod +x ${{ matrix.build-script }}
@@ -263,21 +288,23 @@ jobs:
           cp build/component-amd64/libmyvector_component.so myvector-component-amd64.so
           cp build/component-arm64/libmyvector_component.so myvector-component-arm64.so
           cp build/component-amd64/myvector.json myvector.json
+          cp build/component-amd64/component_mcp_guard.so component_mcp_guard-amd64.so
+          cp build/component-arm64/component_mcp_guard.so component_mcp_guard-arm64.so
           cp sql/myvector_install_component.sql myvector_install_component.sql
           cp sql/myvector_uninstall_component.sql myvector_uninstall_component.sql
 
       - name: Smoke test component artifact
         run: |
           chmod +x scripts/smoke-component.sh
-          COMPONENT_DIR=build/component-amd64 ./scripts/smoke-component.sh "${{ matrix.mysql-version }}"
+          COMPONENT_DIR=build/component-amd64 ./scripts/smoke-component.sh "${{ matrix.mysql-release }}"
 
       - name: Smoke test image contents
         run: |
           for arch in amd64 arm64; do
             docker buildx build \
               --platform "linux/${arch}" \
               --file Dockerfile.component \
-              --build-arg MYSQL_VERSION=${{ matrix.mysql-version }} \
+              --build-arg MYSQL_VERSION=${{ matrix.mysql-release }} \
               -t "myvector-component-smoke:${{ matrix.mysql-version }}-${arch}" \
               --load \
               .
@@ -308,6 +335,43 @@ jobs:
           platforms: linux/amd64,linux/arm64
           # Never push on a dry_run dispatch — build only, to prove the pipeline.
           push: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
-          tags: ghcr.io/${{ github.repository }}:${{ matrix.image-tag }}
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ matrix.image-tag }}
+            ghcr.io/${{ github.repository }}:${{ matrix.release-image-tag }}
+          build-args: |
+            MYSQL_VERSION=${{ matrix.mysql-release }}
+
+      # Like the component image, the mysql-mcp image is based on the exact release the
+      # guard was built against (mysql-release).
+      - name: Test mysql-mcp image
+        env:
+          MYSQL_VERSION: ${{ matrix.mysql-release }}
+        run: |
+          for arch in amd64 arm64; do
+            docker buildx build \
+              --platform "linux/${arch}" \
+              --file docker/mysql-mcp/Dockerfile \
+              --build-arg MYSQL_VERSION="$MYSQL_VERSION" \
+              -t "mysql-mcp-smoke:${MYSQL_VERSION}-${arch}" \
+              --load \
+              .
+          done
+          # Full first-start test natively; arm64 under QEMU checks the contents only.
+          chmod +x scripts/test-mysql-mcp-image.sh
+          scripts/test-mysql-mcp-image.sh "mysql-mcp-smoke:${MYSQL_VERSION}-amd64"
+          docker run --rm --platform linux/arm64 --entrypoint /bin/sh "mysql-mcp-smoke:${MYSQL_VERSION}-arm64" -c \
+            "test -f /usr/lib64/mysql/plugin/component_mcp_guard.so && test -f /usr/share/mysql-mcp/mysql_mcp.sql && test -f /docker-entrypoint-initdb.d/50-mysql-mcp.sh"
+
+      - name: Build and push mysql-mcp image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/mysql-mcp/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          # Never push on a dry_run dispatch — build only, to prove the pipeline.
+          push: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/mysql-mcp:${{ matrix.mysql-version }}
+            ghcr.io/${{ github.repository_owner }}/mysql-mcp:${{ matrix.mysql-release }}
           build-args: |
-            MYSQL_VERSION=${{ matrix.mysql-version }}
+            MYSQL_VERSION=${{ matrix.mysql-release }}

.github/workflows/integration-scripts.yml

@@ -46,6 +46,8 @@ on:
       - "scripts/test-*.py"
       - "scripts/test-mcp-guard.sh"
       - "scripts/test-mcp-tool-pack.sh"
+      - "scripts/test-mysql-mcp-image.sh"
+      - "docker/mysql-mcp/**"
       - "scripts/build-component*"
       - "scripts/build-plugin*"
       - "CMakeLists.txt"
@@ -59,6 +61,8 @@ on:
       - "scripts/test-*.py"
       - "scripts/test-mcp-guard.sh"
       - "scripts/test-mcp-tool-pack.sh"
+      - "scripts/test-mysql-mcp-image.sh"
+      - "docker/mysql-mcp/**"
       - "scripts/build-component*"
       - "scripts/build-plugin*"
       - "CMakeLists.txt"
@@ -194,6 +198,18 @@ jobs:
           chmod +x scripts/test-mcp-guard.sh
           scripts/test-mcp-guard.sh "$MYSQL_VERSION" "dist/mcp-guard-${MYSQL_VERSION}"
 
+      - name: mysql-mcp image test
+        # The image docker-publish.yml publishes as ghcr.io/<owner>/mysql-mcp, built on the
+        # official image of the same patch release.
+        env:
+          MYSQL_VERSION: ${{ matrix.mysql-version }}
+        run: |
+          cp "dist/mcp-guard-${MYSQL_VERSION}/component_mcp_guard.so" component_mcp_guard-amd64.so
+          docker build -f docker/mysql-mcp/Dockerfile --build-arg MYSQL_VERSION="$MYSQL_VERSION" \
+            --build-arg TARGETARCH=amd64 -t "mysql-mcp-smoke:$MYSQL_VERSION" .
+          chmod +x scripts/test-mysql-mcp-image.sh
+          scripts/test-mysql-mcp-image.sh "mysql-mcp-smoke:$MYSQL_VERSION"
+
   mcp-tool-pack:
     # The mysql_mcp SQL tool pack (sql/mcp/, RFC 0001 Phase 1 in askdba/mysql-mcp-server):
     # install, re-install, and parity of every procedure with mysql-mcp-server's own query,

CHANGELOG.md

@@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **`component_mcp_guard` tests for views, multi-statement packets and parity** (RFC 0001 §5.2 item 7, Q3). `scripts/test-mcp-guard.sh` now has 102 checks on 8.4.11, 9.7.2 and 26.10.0.
+  - **Views:** a view over another schema or over `mysql` is refused, nested views included (the rules see base tables).
+  - **Multi-statement packets:** a write or disallowed read in a later statement of one packet is refused, and nothing is written.
+  - **Parity table:** `sql/mcp/guard-parity.tsv` (34 statements) has the shared verdicts of mysql-mcp-server's `run_query` validator and the guard, with the reason for each difference. The guard column is checked here; mysql-mcp-server checks the other.
+  - **Known limitation, documented:** reads inside stored functions and triggers aren't seen by the schema rules, because the server raises no table access events for tables the calling statement locked. Writes inside them are still refused. `docs/MCP_COMPONENTS.md` (Limits) gives the mitigation (grants), and a test check shows the behavior ([#247](https://github.com/askdba/myvector/issues/247)).
+- **`mysql-mcp` Docker images** (Phase 3 of RFC 0001). `ghcr.io/askdba/mysql-mcp:<8.4|9.7|26.10>` (also tagged with the exact release) is the official MySQL image of the release the component is built for, with `component_mcp_guard` and the `mysql_mcp` tool pack installed on first start. `MYSQL_MCP_USER`/`MYSQL_MCP_PASSWORD` create an MCP account (`MCP_USER`, tool pack, read access to `MYSQL_MCP_DATABASES`), and `MYSQL_MCP_ALLOWED_SCHEMAS`/`MYSQL_MCP_MAX_EXECUTION_TIME_MS` persist guard settings. The images are a separate family from the MyVector images. They are published by `docker-publish.yml` with releases and tested in CI by `scripts/test-mysql-mcp-image.sh` (22 checks on 8.4.11, 9.7.2 and 26.10.0).
 - **`component_mcp_guard` tool calls and audit messages** (Phase 3 of RFC 0001, server side).
   - **`performance_schema.mcp_tool_calls`:** one row per mysql-mcp-server tool call (account, tool, request id, statements, errors, refusals, latency, first and last seen). The guard groups the MCP session statements that start with the label `/* mcp:tool=... req=... */`, keeping the last `mcp.tool_calls_history_size` calls (new read-only variable, default 1000).
   - **Audit messages:** each refusal is emitted through `mysql_audit_api_message` (component `mcp_guard`, message `refused`, with the option, connection id, redacted statement and the tool call), so audit log consumers record refusals.
@@ -129,6 +135,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     and rebuild the index. See [Declaring a Vector Column](docs/usage.md#declaring-a-vector-column).
 
 ### Fixed
+- **Plugin images pinned to their build release.** The plugin images were built for 8.0.45, 8.4.8 and 9.7.0 but based on the floating `mysql:8.0`/`mysql:8.4`/`mysql:9.7` (now 8.0.46, 8.4.13, 9.7.4), and a library built for one MySQL release can crash another. `docker-publish.yml` now builds them for **8.0.46, 8.4.13 and 9.7.4**, bases each image on `mysql:<that release>` and also tags it with the release (`mysql8.0.46`, `mysql8.4.13`, `mysql9.7.4`). The plugin job also runs on a `dry_run` dispatch, building and testing without pushing. `Dockerfile.oraclelinux8`/`9` now require `MYSQL_VERSION`. `scripts/build-docker-local.sh` builds 8.0, 8.4 or 9.7 on the same releases and rejects other versions (it used to map 9.0 to 9.0.0).
+- **Component images pinned to their build release.** A component works only on the exact MySQL release it was built against: in a dry run, a `component_mcp_guard` built for 8.4.8 crashed `mysql:8.4` (8.4.11). The images were built for 8.4.8 and 9.7.0 but ran on the floating `mysql:8.4`/`mysql:9.7`. `docker-publish.yml` now builds the component images for **8.4.13, 9.7.4 and 26.10.0** (the releases the floating tags now point to) and bases each one on `mysql:<that release>`. It also tags each image with its release (`mysql8.4.13-component`, `mysql9.7.4-component`, `mysql26.10.0`), and the artifact smoke test runs on the same release. `Dockerfile.component` now requires `MYSQL_VERSION` (no default).
 - **Component build scripts reconfigure the server tree after a failed configure.** A `.configure-ok` marker is written only after `cmake` succeeds; before, the scripts trusted `CMakeCache.txt`, which appears before configuration finishes, so a failed configure was skipped on the next run.
 - **Component build scripts no longer re-clone the MySQL source on every run.** Inside the build container, git refused the host-owned tree ("dubious ownership"), so the tag check always failed and the tree was deleted and cloned again, which also defeated the CI cache of the source tree. The scripts now mark the tree as a git safe directory.
 - **Component: `myvector_construct()` with a constant argument is built once, not per row**

Dockerfile.component

@@ -1,4 +1,7 @@
-ARG MYSQL_VERSION=8.4
+# MYSQL_VERSION (required, no default) is the exact release the component was built
+# against, for example 8.4.13: a component built for another patch release can crash
+# the server.
+ARG MYSQL_VERSION
 
 FROM mysql:${MYSQL_VERSION}
 ARG TARGETARCH

Dockerfile.oraclelinux8

@@ -1,4 +1,6 @@
-ARG MYSQL_VERSION=8.0
+# MYSQL_VERSION (required, no default) is the exact release the plugin was built against,
+# for example 8.4.13: a plugin built for another release can crash the server.
+ARG MYSQL_VERSION
 FROM mysql:${MYSQL_VERSION}
 ARG TARGETARCH
 

Dockerfile.oraclelinux9

@@ -1,4 +1,6 @@
-ARG MYSQL_VERSION=8.0
+# MYSQL_VERSION (required, no default) is the exact release the plugin was built against,
+# for example 8.4.13: a plugin built for another release can crash the server.
+ARG MYSQL_VERSION
 
 # Provide libstdc++ compatible with plugin (built with gcc-10). Use Ubuntu (lighter than Oracle Linux + gcc-toolset).
 FROM ubuntu:22.04 AS libstdcxx

docker/mysql-mcp/Dockerfile

@@ -0,0 +1,28 @@
+# mysql-mcp: the official MySQL image with the MCP components of RFC 0001
+# (askdba/mysql-mcp-server): component_mcp_guard and the mysql_mcp SQL tool pack.
+# Published as ghcr.io/askdba/mysql-mcp:<8.4|9.7|26.10> by docker-publish.yml.
+# Build context: the repository root, with component_mcp_guard-<arch>.so staged there.
+# MYSQL_VERSION (required, no default) must be the exact release the component was built
+# against, for example 8.4.13: a component built for another patch release can crash the
+# server.
+ARG MYSQL_VERSION
+
+FROM mysql:${MYSQL_VERSION}
+ARG TARGETARCH
+
+LABEL org.opencontainers.image.title="mysql-mcp" \
+      org.opencontainers.image.description="MySQL with component_mcp_guard and the mysql_mcp tool pack for mysql-mcp-server" \
+      org.opencontainers.image.source="https://github.com/askdba/myvector" \
+      org.opencontainers.image.documentation="https://github.com/askdba/myvector/blob/main/docs/MCP_COMPONENTS.md" \
+      org.opencontainers.image.licenses="GPL-2.0-only AND Apache-2.0"
+
+# Statically linked against libstdc++/libgcc and built in oraclelinux:9, this image's base.
+COPY component_mcp_guard-${TARGETARCH}.so /usr/lib64/mysql/plugin/component_mcp_guard.so
+COPY sql/mcp/mysql_mcp.sql sql/mcp/uninstall.sql sql/mcp/LICENSE /usr/share/mysql-mcp/
+COPY docker/mysql-mcp/mysql-mcp-init.sh /docker-entrypoint-initdb.d/50-mysql-mcp.sh
+COPY docker/mysql-mcp/mysql-mcp-healthcheck.sh /usr/local/bin/mysql-mcp-healthcheck
+
+# checkov:skip=CKV_DOCKER_3:MySQL entrypoint needs root for initialization
+# Healthy only after first-start setup, on the server's port, without touching root's
+# login (see the script).
+HEALTHCHECK --interval=30s --timeout=5s --retries=5 CMD ["/usr/local/bin/mysql-mcp-healthcheck"]

docker/mysql-mcp/mysql-mcp-healthcheck.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Health check of the mysql-mcp image: is mysqld up and done with first-start setup?
+#
+# - TCP: the entrypoint's temporary setup server does not listen on TCP, so the check
+#   passes only once the real server runs.
+# - The port mysqld was started with (--port=N or --port N on its command line; else 3306).
+# - As a user that does not exist, with no password: ping reports a running server even
+#   when access is denied, and a nonexistent account cannot be locked by failed logins
+#   (probing as root could lock out administrators with FAILED_LOGIN_ATTEMPTS).
+port=$(tr '\0' '\n' </proc/1/cmdline 2>/dev/null | awk '
+	prev == "--port" || prev == "-P" { p = $0 }
+	/^--port=/ { p = substr($0, 8) }
+	{ prev = $0 }
+	END { print p }')
+exec mysqladmin ping --protocol=TCP -h127.0.0.1 -P"${port:-3306}" \
+	-umysql-mcp-healthcheck --connect-timeout=3 --silent