greptimedb-mcp-server

The server implements a robust application-level security gate (`security_gate` function) that explicitly blocks DDL/DML operations (e.g., DROP, DELETE, INSERT, UPDATE, ALTER, CREATE), file system access, and common SQL injection bypass techniques (e.g., UNHEX, CHAR functions, hex encoding). It strictly allows only read-only (SELECT, SHOW, DESCRIBE, TQL, EXPLAIN, WITH, UNION) and pipeline management operations. Data masking is enabled by default for sensitive column patterns (configurable). Audit logging is also enabled by default for all tool invocations, enhancing accountability and detectability. The README strongly recommends creating a read-only database user for an additional layer of security. No direct `eval` or obvious hardcoded secrets were found in the provided code snippets.