Function executeReadOnlyQuery

src/db/index.ts:200–536

(sql: string)

}

async function executeReadOnlyQuery<T>(sql: string): Promise<T> {
  let connection;
  try {
    // PII redaction works hand-in-hand with explicit column projection: the
    // schema endpoint hides redacted columns, so the LLM should never need
    // SELECT *. Refusing wildcard projections here prevents the LLM from
    // accidentally pulling redacted columns it never saw in the schema.
    if (
      ENABLE_PII_REDACTION &&
      !PII_ALLOW_SELECT_STAR &&
      containsSelectStar(sql)
    ) {
      log(
        "error",
        "Refusing query with SELECT * while PII redaction is enabled; project explicit columns instead.",
      );
      return {
        content: [
          {
            type: "text",
            text:
              "Error: SELECT * (and `table.*`) is not permitted while PII redaction is enabled. " +
              "Project an explicit column list (e.g. SELECT col1, col2 FROM ...) so redacted columns are not accidentally returned. " +
              "Set PII_ALLOW_SELECT_STAR=true to override this policy.",
          },
        ],
        isError: true,
      } as T;
    }

    // Introspection guard. Three sub-policies under ENABLE_PII_REDACTION:
    //   - filterable (SHOW COLUMNS / DESCRIBE / SHOW INDEX): execute, then
    //     drop PII rows from the result.
    //   - passthrough (SHOW TABLES / SHOW DATABASES / charset / collation /
    //     etc.): execute unchanged. These expose only schema topology (table
    //     and database names), no column-level PII.
    //   - rejected (SHOW CREATE TABLE, information_schema.*, mysql.*, plus
    //     any unrecognised SHOW): blocked, because we can't safely filter
    //     them and they can leak column names verbatim.
    // PII_ALLOW_INTROSPECTION=true bypasses the guard entirely.
    // PII_BLOCK_INTROSPECTION=true restores the old hard-block behaviour for
    // every introspection kind, including filterable and passthrough.
    let introspectionFilterKind: FilterableIntrospectionKind | null = null;
    let isIntrospectionPassThrough = false;
    if (ENABLE_PII_REDACTION && !PII_ALLOW_INTROSPECTION) {
      const intro = isIntrospectionQuery(sql);
      if (intro.kind) {
        const filterable: FilterableIntrospectionKind | null =
          intro.kind === "show_columns" ||
          intro.kind === "describe" ||
          intro.kind === "show_index"
            ? intro.kind
            : null;
        const passthrough = intro.kind === "show_passthrough";

        if (PII_BLOCK_INTROSPECTION || (!filterable && !passthrough)) {
          log(
            "error",