ICUICU
critical

@benborla29/mcp-server-mysql

v2.0.8

MCP server for interacting with MySQL databases with write operations support

npmbenborla29First seen Feb 22, 2026Source

84

Total

56

Critical

22

High

6

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    350: 
    351:    ```bash
>>> 352:    # create .env file
    353:    touch .env
    354:    ```
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    351:    ```bash
    352:    # create .env file
>>> 353:    touch .env
    354:    ```
    355: 
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    354:    ```
    355: 
>>> 356: 2. Copy-paste [example file](https://github.com/benborla/mcp-server-mysql/blob/main/.env) from this repository
    357: 3. Set the MySQL credentials to match your environment
    358: 4. Set `IS_REMOTE_MCP=true`
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    362: 
    363:    ```bash
>>> 364:    source .env
    365:    ```
    366: 
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    640: 
    641: 3. **Configure Test Environment**
>>> 642:    Create a `.env.test` file in the project root (if not existing):
    643: 
    644:    ```env
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    737:    - If you see "Server disconnected" logs in Claude Desktop, check the logs at `~/Library/Logs/Claude/mcp-server-mcp_server_mysql.log`
    738:    - Ensure you're using the absolute path to both the Node binary and the server script
>>> 739:    - Check if your `.env` file is being properly loaded; use explicit environment variables in the configuration
    740:    - Try running the server directly from the command line to see if there are connection issues
    741:    - If you need write operations (INSERT, UPDATE, DELETE), set the appropriate flags to "true" in your configuration:
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    12: import { realpathSync } from 'fs';
    13: log("info", `Starting MySQL MCP server v${version}...`);
>>> 14: const toolVersion = `MySQL MCP Server [v${process.env.npm_package_version}]`;
    15: let toolDescription = `[${toolVersion}] Run SQL queries against MySQL database`;
    16: if (isMultiDbMode) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    50:     ALLOW_DDL_OPERATION);
    51: log("info", "MySQL Configuration:", JSON.stringify({
>>> 52:     ...(process.env.MYSQL_SOCKET_PATH
    53:         ? {
    54:             socketPath: process.env.MYSQL_SOCKET_PATH,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    52:     ...(process.env.MYSQL_SOCKET_PATH
    53:         ? {
>>> 54:             socketPath: process.env.MYSQL_SOCKET_PATH,
    55:             connectionType: "Unix Socket",
    56:         }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    56:         }
    57:         : {
>>> 58:             host: process.env.MYSQL_HOST || "127.0.0.1",
    59:             port: process.env.MYSQL_PORT || "3306",
    60:             connectionType: "TCP/IP",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    57:         : {
    58:             host: process.env.MYSQL_HOST || "127.0.0.1",
>>> 59:             port: process.env.MYSQL_PORT || "3306",
    60:             connectionType: "TCP/IP",
    61:         }),
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    63:     password: config.mysql.password ? "******" : "not set",
    64:     database: config.mysql.database || "MULTI_DB_MODE",
>>> 65:     ssl: process.env.MYSQL_SSL === "true" ? "enabled" : "disabled",
    66:     multiDbMode: isMultiDbMode ? "enabled" : "disabled",
    67: }, null, 2));
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    72:     const server = new Server({
    73:         name: "MySQL MCP Server",
>>> 74:         version: process.env.npm_package_version || "1.0.0",
    75:     }, {
    76:         capabilities: {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    103:         try {
    104:             log("info", "Handling ListResourcesRequest");
>>> 105:             const connectionInfo = process.env.MYSQL_SOCKET_PATH
    106:                 ? `socket: ${process.env.MYSQL_SOCKET_PATH}`
    107:                 : `host: ${process.env.MYSQL_HOST || "localhost"}, port: ${process.env.MYSQL_PORT || 3306}`;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    104:             log("info", "Handling ListResourcesRequest");
    105:             const connectionInfo = process.env.MYSQL_SOCKET_PATH
>>> 106:                 ? `socket: ${process.env.MYSQL_SOCKET_PATH}`
    107:                 : `host: ${process.env.MYSQL_HOST || "localhost"}, port: ${process.env.MYSQL_PORT || 3306}`;
    108:             log("info", `Connection info: ${connectionInfo}`);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    105:             const connectionInfo = process.env.MYSQL_SOCKET_PATH
    106:                 ? `socket: ${process.env.MYSQL_SOCKET_PATH}`
>>> 107:                 : `host: ${process.env.MYSQL_HOST || "localhost"}, port: ${process.env.MYSQL_PORT || 3306}`;
    108:             log("info", `Connection info: ${connectionInfo}`);
    109:             const tablesQuery = `
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3: export const MCP_VERSION = "2.0.2";
    4: dotenv.config();
>>> 5: const connectionStringConfig = process.env.MYSQL_CONNECTION_STRING
    6:     ? parseMySQLConnectionString(process.env.MYSQL_CONNECTION_STRING)
    7:     : {};
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    4: dotenv.config();
    5: const connectionStringConfig = process.env.MYSQL_CONNECTION_STRING
>>> 6:     ? parseMySQLConnectionString(process.env.MYSQL_CONNECTION_STRING)
    7:     : {};
    8: if (process.env.NODE_ENV === "test" && !process.env.MYSQL_DB) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    6:     ? parseMySQLConnectionString(process.env.MYSQL_CONNECTION_STRING)
    7:     : {};
>>> 8: if (process.env.NODE_ENV === "test" && !process.env.MYSQL_DB) {
    9:     process.env.MYSQL_DB = "mcp_test_db";
    10: }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    7:     : {};
    8: if (process.env.NODE_ENV === "test" && !process.env.MYSQL_DB) {
>>> 9:     process.env.MYSQL_DB = "mcp_test_db";
    10: }
    11: export const ALLOW_INSERT_OPERATION = process.env.ALLOW_INSERT_OPERATION === "true";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    9:     process.env.MYSQL_DB = "mcp_test_db";
    10: }
>>> 11: export const ALLOW_INSERT_OPERATION = process.env.ALLOW_INSERT_OPERATION === "true";
    12: export const ALLOW_UPDATE_OPERATION = process.env.ALLOW_UPDATE_OPERATION === "true";
    13: export const ALLOW_DELETE_OPERATION = process.env.ALLOW_DELETE_OPERATION === "true";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    10: }
    11: export const ALLOW_INSERT_OPERATION = process.env.ALLOW_INSERT_OPERATION === "true";
>>> 12: export const ALLOW_UPDATE_OPERATION = process.env.ALLOW_UPDATE_OPERATION === "true";
    13: export const ALLOW_DELETE_OPERATION = process.env.ALLOW_DELETE_OPERATION === "true";
    14: export const ALLOW_DDL_OPERATION = process.env.ALLOW_DDL_OPERATION === "true";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    11: export const ALLOW_INSERT_OPERATION = process.env.ALLOW_INSERT_OPERATION === "true";
    12: export const ALLOW_UPDATE_OPERATION = process.env.ALLOW_UPDATE_OPERATION === "true";
>>> 13: export const ALLOW_DELETE_OPERATION = process.env.ALLOW_DELETE_OPERATION === "true";
    14: export const ALLOW_DDL_OPERATION = process.env.ALLOW_DDL_OPERATION === "true";
    15: export const MYSQL_DISABLE_READ_ONLY_TRANSACTIONS = process.env.MYSQL_DISABLE_READ_ONLY_TRANSACTIONS === "true";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    12: export const ALLOW_UPDATE_OPERATION = process.env.ALLOW_UPDATE_OPERATION === "true";
    13: export const ALLOW_DELETE_OPERATION = process.env.ALLOW_DELETE_OPERATION === "true";
>>> 14: export const ALLOW_DDL_OPERATION = process.env.ALLOW_DDL_OPERATION === "true";
    15: export const MYSQL_DISABLE_READ_ONLY_TRANSACTIONS = process.env.MYSQL_DISABLE_READ_ONLY_TRANSACTIONS === "true";
    16: export const SCHEMA_INSERT_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_INSERT_PERMISSIONS);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:             }
    36:             : {
>>> 37:                 host: connectionStringConfig.host || process.env.MYSQL_HOST || "127.0.0.1",
    38:                 port: connectionStringConfig.port || Number(process.env.MYSQL_PORT || "3306"),
    39:             }),
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    13: export const ALLOW_DELETE_OPERATION = process.env.ALLOW_DELETE_OPERATION === "true";
    14: export const ALLOW_DDL_OPERATION = process.env.ALLOW_DDL_OPERATION === "true";
>>> 15: export const MYSQL_DISABLE_READ_ONLY_TRANSACTIONS = process.env.MYSQL_DISABLE_READ_ONLY_TRANSACTIONS === "true";
    16: export const SCHEMA_INSERT_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_INSERT_PERMISSIONS);
    17: export const SCHEMA_UPDATE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_UPDATE_PERMISSIONS);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    14: export const ALLOW_DDL_OPERATION = process.env.ALLOW_DDL_OPERATION === "true";
    15: export const MYSQL_DISABLE_READ_ONLY_TRANSACTIONS = process.env.MYSQL_DISABLE_READ_ONLY_TRANSACTIONS === "true";
>>> 16: export const SCHEMA_INSERT_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_INSERT_PERMISSIONS);
    17: export const SCHEMA_UPDATE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_UPDATE_PERMISSIONS);
    18: export const SCHEMA_DELETE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DELETE_PERMISSIONS);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    15: export const MYSQL_DISABLE_READ_ONLY_TRANSACTIONS = process.env.MYSQL_DISABLE_READ_ONLY_TRANSACTIONS === "true";
    16: export const SCHEMA_INSERT_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_INSERT_PERMISSIONS);
>>> 17: export const SCHEMA_UPDATE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_UPDATE_PERMISSIONS);
    18: export const SCHEMA_DELETE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DELETE_PERMISSIONS);
    19: export const SCHEMA_DDL_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DDL_PERMISSIONS);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    16: export const SCHEMA_INSERT_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_INSERT_PERMISSIONS);
    17: export const SCHEMA_UPDATE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_UPDATE_PERMISSIONS);
>>> 18: export const SCHEMA_DELETE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DELETE_PERMISSIONS);
    19: export const SCHEMA_DDL_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DDL_PERMISSIONS);
    20: export const IS_REMOTE_MCP = process.env.IS_REMOTE_MCP === "true";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    17: export const SCHEMA_UPDATE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_UPDATE_PERMISSIONS);
    18: export const SCHEMA_DELETE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DELETE_PERMISSIONS);
>>> 19: export const SCHEMA_DDL_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DDL_PERMISSIONS);
    20: export const IS_REMOTE_MCP = process.env.IS_REMOTE_MCP === "true";
    21: export const REMOTE_SECRET_KEY = process.env.REMOTE_SECRET_KEY || "";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    18: export const SCHEMA_DELETE_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DELETE_PERMISSIONS);
    19: export const SCHEMA_DDL_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DDL_PERMISSIONS);
>>> 20: export const IS_REMOTE_MCP = process.env.IS_REMOTE_MCP === "true";
    21: export const REMOTE_SECRET_KEY = process.env.REMOTE_SECRET_KEY || "";
    22: export const PORT = process.env.PORT || 3000;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    19: export const SCHEMA_DDL_PERMISSIONS = parseSchemaPermissions(process.env.SCHEMA_DDL_PERMISSIONS);
    20: export const IS_REMOTE_MCP = process.env.IS_REMOTE_MCP === "true";
>>> 21: export const REMOTE_SECRET_KEY = process.env.REMOTE_SECRET_KEY || "";
    22: export const PORT = process.env.PORT || 3000;
    23: const dbFromEnvOrConnString = connectionStringConfig.database || process.env.MYSQL_DB;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    20: export const IS_REMOTE_MCP = process.env.IS_REMOTE_MCP === "true";
    21: export const REMOTE_SECRET_KEY = process.env.REMOTE_SECRET_KEY || "";
>>> 22: export const PORT = process.env.PORT || 3000;
    23: const dbFromEnvOrConnString = connectionStringConfig.database || process.env.MYSQL_DB;
    24: export const isMultiDbMode = !dbFromEnvOrConnString || dbFromEnvOrConnString.trim() === "";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    21: export const REMOTE_SECRET_KEY = process.env.REMOTE_SECRET_KEY || "";
    22: export const PORT = process.env.PORT || 3000;
>>> 23: const dbFromEnvOrConnString = connectionStringConfig.database || process.env.MYSQL_DB;
    24: export const isMultiDbMode = !dbFromEnvOrConnString || dbFromEnvOrConnString.trim() === "";
    25: export const mcpConfig = {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    30:     },
    31:     mysql: {
>>> 32:         ...(connectionStringConfig.socketPath || process.env.MYSQL_SOCKET_PATH
    33:             ? {
    34:                 socketPath: connectionStringConfig.socketPath || process.env.MYSQL_SOCKET_PATH,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    32:         ...(connectionStringConfig.socketPath || process.env.MYSQL_SOCKET_PATH
    33:             ? {
>>> 34:                 socketPath: connectionStringConfig.socketPath || process.env.MYSQL_SOCKET_PATH,
    35:             }
    36:             : {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    36:             : {
    37:                 host: connectionStringConfig.host || process.env.MYSQL_HOST || "127.0.0.1",
>>> 38:                 port: connectionStringConfig.port || Number(process.env.MYSQL_PORT || "3306"),
    39:             }),
    40:         user: connectionStringConfig.user || process.env.MYSQL_USER || "root",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    38:                 port: connectionStringConfig.port || Number(process.env.MYSQL_PORT || "3306"),
    39:             }),
>>> 40:         user: connectionStringConfig.user || process.env.MYSQL_USER || "root",
    41:         password: connectionStringConfig.password !== undefined
    42:             ? connectionStringConfig.password
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    41:         password: connectionStringConfig.password !== undefined
    42:             ? connectionStringConfig.password
>>> 43:             : process.env.MYSQL_PASS === undefined
    44:                 ? ""
    45:                 : process.env.MYSQL_PASS,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    43:             : process.env.MYSQL_PASS === undefined
    44:                 ? ""
>>> 45:                 : process.env.MYSQL_PASS,
    46:         database: connectionStringConfig.database || process.env.MYSQL_DB || undefined,
    47:         connectionLimit: 10,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    44:                 ? ""
    45:                 : process.env.MYSQL_PASS,
>>> 46:         database: connectionStringConfig.database || process.env.MYSQL_DB || undefined,
    47:         connectionLimit: 10,
    48:         waitForConnections: true,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    47:         connectionLimit: 10,
    48:         waitForConnections: true,
>>> 49:         queueLimit: process.env.MYSQL_QUEUE_LIMIT ? parseInt(process.env.MYSQL_QUEUE_LIMIT, 10) : 100,
    50:         enableKeepAlive: true,
    51:         keepAliveInitialDelay: 0,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    50:         enableKeepAlive: true,
    51:         keepAliveInitialDelay: 0,
>>> 52:         connectTimeout: process.env.MYSQL_CONNECT_TIMEOUT ? parseInt(process.env.MYSQL_CONNECT_TIMEOUT, 10) : 10000,
    53:         authPlugins: {
    54:             mysql_clear_password: () => () => Buffer.from(connectionStringConfig.password !== undefined
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    54:             mysql_clear_password: () => () => Buffer.from(connectionStringConfig.password !== undefined
    55:                 ? connectionStringConfig.password
>>> 56:                 : process.env.MYSQL_PASS !== undefined
    57:                     ? process.env.MYSQL_PASS
    58:                     : ""),
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    55:                 ? connectionStringConfig.password
    56:                 : process.env.MYSQL_PASS !== undefined
>>> 57:                     ? process.env.MYSQL_PASS
    58:                     : ""),
    59:         },
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    58:                     : ""),
    59:         },
>>> 60:         ...(process.env.MYSQL_SSL === "true"
    61:             ? {
    62:                 ssl: {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    61:             ? {
    62:                 ssl: {
>>> 63:                     rejectUnauthorized: process.env.MYSQL_SSL_REJECT_UNAUTHORIZED === "true",
    64:                 },
    65:             }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    65:             }
    66:             : {}),
>>> 67:         ...(process.env.MYSQL_TIMEZONE
    68:             ? {
    69:                 timezone: process.env.MYSQL_TIMEZONE,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    67:         ...(process.env.MYSQL_TIMEZONE
    68:             ? {
>>> 69:                 timezone: process.env.MYSQL_TIMEZONE,
    70:             }
    71:             : {}),
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    70:             }
    71:             : {}),
>>> 72:         ...(process.env.MYSQL_DATE_STRINGS === "true"
    73:             ? {
    74:                 dateStrings: true,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    6: import { log } from "./../utils/index.js";
    7: import { mcpConfig as config, MYSQL_DISABLE_READ_ONLY_TRANSACTIONS } from "./../config/index.js";
>>> 8: if (isMultiDbMode && process.env.MULTI_DB_WRITE_MODE !== "true") {
    9:     log("error", "Multi-DB mode detected - enabling read-only mode for safety");
    10: }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    9:     log("error", "Multi-DB mode detected - enabling read-only mode for safety");
    10: }
>>> 11: const isTestEnvironment = process.env.NODE_ENV === "test" || process.env.VITEST;
    12: function safeExit(code) {
    13:     if (!isTestEnvironment) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    5: const parser = new Parser();
    6: function extractSchemaFromQuery(sql) {
>>> 7:     const defaultSchema = process.env.MYSQL_DB || null;
    8:     if (defaultSchema && !isMultiDbMode) {
    9:         return defaultSchema;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

>>> 1: const ENABLE_LOGGING = process.env.ENABLE_LOGGING === "true" || process.env.ENABLE_LOGGING === "1";
    2: export function log(type = "info", ...args) {
    3:     if (!ENABLE_LOGGING)
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

>>> 1: const ENABLE_LOGGING = ["true", "1"].includes(process.env.ENABLE_LOGGING || 'false');
    2: export function log(type = 'info', ...args) {
    3:     if (!ENABLE_LOGGING)
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    33:     "test:e2e": "vitest run --config vitest.e2e.config.ts",
    34:     "stdio": "node dist/index.js --stdio",
>>> 35:     "exec": " pnpm build && npx node --env-file=.env dist/index.js",
    36:     "lint": "npm run lint:eslint && npm run lint:markdown",
    37:     "lint:eslint": "eslint .",
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��'���Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��^��'��m��-��%��d

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��'���Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��)u�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޕ�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {��בy�N�\����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��'���Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��)u�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޕ�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {��בy�N�\����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: .+-E�(������-

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {��בy�N�\����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: .+-E�(������-

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {��בy�N�\����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��)u�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޕ�^Yh��E�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: {��בy�N�\����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��^��'��m��-��%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��-�����+jب��(rG�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �������� ��j�^�g)

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.2 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical84
Feb 23, 2026critical84
Feb 22, 2026critical84