Repository navigation
Conversation
Ports mysql-mcp-server's MYSQL_MCP_MASK_COLUMNS rules: a result column whose name contains one of the comma-separated patterns (ASCII case-insensitive, empty patterns ignored) has every non-NULL value replaced by "********". RFC 0001 listed masking as a parity gap and required the endpoint to disable run_query while it is set; with the port, the same setting gives the same output on both servers. test-mcp-endpoint.sh: masked, unmasked, NULL and binary values, with spaced and mixed-case patterns. 33 checks. Part of #256 (RFC 0001 Phase 5). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 45 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a166976f8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| constexpr char kMasked[] = "********"; | ||
|
|
||
| std::string ascii_lower(std::string s) { | ||
| for (char &c : s) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c))); |
There was a problem hiding this comment.
When a result column name and mask pattern differ only by non-ASCII case (for example, ПАРОЛЬ and пароль), this byte-wise std::tolower does not case-fold the UTF-8 characters, so the value is returned unmasked. The Go implementation uses strings.ToLower on both sides and masks this case, so this breaks the stated parity and can expose a sensitive column; use Unicode-aware folding or narrow the parity claim. Go maskResults
Useful? React with 👍 / 👎.
Phase 5 item from #256: column masking.
RFC 0001 listed masking as a parity gap with mysql-mcp-server's
MYSQL_MCP_MASK_COLUMNS. Until it was ported, the RFC required the endpoint to disablerun_querywhenever masking was configured. Porting it is small, so this PR ports it rather than disablingrun_query.Change
mcp_http.mask_columnssetting: read-only, comma-separated patterns, none by default.maskResults(cmd/mysql-mcp-server/tools.go):"********", and NULL staysnull.{"base64": ...}are masked too.run_as()builds, including the tool pack'sCALL.Tests
scripts/test-mcp-endpoint.shonmysql:26.10.0: 33 passed, 0 failed. Withmask_columns = ' secret, PASS ,,':user_passwordandSecretKeyare masked;secret_nullstaysnull;okis unchanged;pass_hashis masked.Docs: settings table, CHANGELOG. The RFC's parity note gets updated in mysql-mcp-server when Phase 5 lands.
Independent of #257–#260.
Part of #256.
🤖 Generated with Claude Code