cc-mysql-mcp

The server directly executes arbitrary SQL queries provided via the `execute_query` tool without any internal sanitization or validation. This poses a significant SQL injection vulnerability if the input is not strictly controlled by a trusted source. The `mysql2` library's `connection.query` is called with a raw query string, allowing for any SQL statement (including destructive ones like `DROP TABLE` or `DELETE FROM`) to be executed. The README explicitly warns about 'No safety rails' and recommends using a restricted database user, which is crucial but does not mitigate the code's inherent vulnerability to malicious or erroneous AI-generated SQL. No hardcoded secrets were found; configuration uses environment variables.