surreal-mcp

The server includes a 'query' tool that allows direct execution of arbitrary SurrealQL queries provided by the AI. While this is an intended feature to provide full database control, it represents a critical security risk if the AI model is untrusted, unconstrained, or compromised. An attacker could leverage this to perform arbitrary database operations including data deletion, modification, or exfiltration, especially if the SurrealDB user configured for the server has broad permissions (e.g., 'root' as in the examples). The `patch` tool also allows path-based updates, which, if not carefully controlled by the AI, could target sensitive fields. It is NOT safe to run this server in production or with untrusted AI input unless the SurrealDB user permissions are severely restricted to only necessary operations and/or AI input to the 'query' tool is rigorously validated and sanitized by an external layer.