Skip to main content
Glama

Revisar SQL de solo lectura

sql-readonly-check
Read-onlyIdempotent

Revisa estáticamente si un SQL solo lee: separa sentencias, ignora comentarios y textos entre comillas y marca palabras de escritura o DDL (también en CTE y SELECT … INTO), bloqueos, EXPLAIN ANALYZE y funciones riesgosas. Es heurístico; para imponerlo use roles de solo lectura. Cuándo: hay que revisar si un SQL de un modelo o de un usuario escribe datos antes de que llegue a una base de datos. No para: aplicar una expresión regular de JavaScript a un texto y listar cada coincidencia con posición y grupos (regex-test). Efectos secundarios: ninguno (solo lectura, sin red, sin estado guardado). Determinista: la misma entrada da la misma salida. Límites: entrada JSON de hasta 64 KB, 1 s por llamada, resultado de hasta 1 MB.

EN: Statically checks whether SQL text only reads: splits statements, skips comments and quoted text, and flags write or DDL keywords (also inside CTEs and SELECT … INTO), locking clauses, EXPLAIN ANALYZE and risky functions. A heuristic;… [EN completo / full EN: inputSchema.description]

Input Schema

NameRequiredDescriptionDefault
sqlYesSQL text (any dialect) (string; required).

Output Schema

NameRequiredDescriptionDefault
caveatNo
read_onlyNo
statementsNo
statement_countNo
multiple_statementsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / properties / sql / examples
      Added value: +[
      +  "SELECT id, nombre FROM clientes WHERE ciudad = 'Bogotá; DROP TABLE x' -- nota\nORDER BY id"
      +]
  2. Changed1 schema field changed
    • addedInput schema / description
      Added value: +"EN: Statically checks whether SQL text only reads: splits statements, skips comments and quoted text, and flags write or DDL keywords (also inside CTEs and SELECT … INTO), locking clauses, EXPLAIN ANALYZE and risky functions. A heuristic; enforcement belongs to read-only database roles. When: SQL text from a model or a user has to be screened for writes before it reaches a database. Not for: trying a JavaScript regex on a text and listing each match with its position and groups (regex-test). Side effects: none (read-only, no network access, no stored state). Deterministic: the same input gives the same output. Limits: JSON input up to 64 KB, 1 s per call, result up to 1 MB."
  3. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=false, idempotentHint=true, and destructiveHint=false, but the description adds valuable context beyond them: it is heuristic, not an enforcement mechanism; it has explicit limits (64 KB input, 1 s per call, 1 MB result); and it is deterministic. This gives the agent a clear operational profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The content is front-loaded and well-structured with clear sections for purpose, when, when-not, side effects, determinism, and limits. However, the description duplicates the same information in Spanish and English (with the English version partly deferred to the inputSchema description), which adds length without adding meaning for a single-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, the description is complete: it covers purpose, heuristic caveats, explicit non-goals, limits, determinism, and side effects. An output schema exists, so the description need not explain return values, and the annotations cover safety and idempotency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter and schema description coverage is 100%, so the schema already explains that it expects SQL text (any dialect) with an example and maxLength. The description explains how the SQL is analyzed but does not add parameter-specific syntax or format details beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: statically checks whether SQL only reads, and enumerates exactly what it flags (write/DDL keywords, CTEs, SELECT INTO, locking, EXPLAIN ANALYZE, risky functions). It also explicitly names a sibling tool (regex-test) that it is not, so the agent can distinguish it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it ('Cuándo: hay que revisar si un SQL... escribe datos antes de que llegue a una base de datos') and when not to use it ('No para: ... regex-test'). The alternative is named, and the heuristic limitation is stated with the recommended enforcement mechanism (read-only database roles).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources