postgresql-mcp

The `codemode` module implements robust sandboxing using Node.js `vm` or `worker_threads`, explicitly blocking access to dangerous Node.js globals (like `require`, `process`, `eval`, filesystem, and networking modules). It uses regex patterns to detect and prevent common malicious code injection attempts. The `HttpTransport` also enforces strong network security measures including rate limiting, maximum request body size, HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), and other security headers. OAuth 2.1 is supported for external authentication and authorization. While these layers provide strong protection, inherent theoretical limitations exist for any in-process sandbox compared to full containerization.