Skip to main content
Glama
Shrike-Security

Shrike Security MCP Server

by Shrike-Security
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

scan_sql_query

Read-onlyIdempotent

Scan SQL queries for injection, destructive operations, and PII extraction before execution. Blocks unsafe queries; allows safe ones. Use for LLM-generated or user-input SQL.

Instructions

Protective check on SQL queries — catches injection or destructive operations before execution, so a malformed or injected query doesn't damage data on your watch.

Call this BEFORE executing any SQL query generated by an LLM or constructed from user input.

DECISION LOGIC:

  • If blocked=true: do NOT execute the query. Return the user_message and log audit.scan_id for security review.

  • If blocked=false: the query is safe to execute.

Checks for:

  • SQL injection patterns (UNION, stacked queries, tautologies, blind injection)

  • Destructive operations (DROP, TRUNCATE, DELETE without WHERE)

  • Privilege escalation (GRANT, CREATE USER)

  • PII extraction (queries targeting password/SSN/credit card columns)

Read-only queries (SELECT) are scanned for injection and PII extraction. Write queries (INSERT, UPDATE, DELETE, DROP) receive additional destructive operation analysis. All queries should be scanned regardless of type — injection attacks frequently use SELECT as a vector.

Set allowDestructive=true to permit DROP/TRUNCATE for migrations. Pass database name for context-aware analysis.

Enterprise context: Critical for any agent with database access. Prevents both malicious and accidental data destruction or unauthorized data extraction.

ERROR HANDLING: If this tool returns an error or is unavailable, default to BLOCKING the query. Do NOT execute unscanned SQL.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queryYesThe SQL query to scan
databaseNoOptional target database name for context
allowDestructiveNoAllow destructive operations like DROP/TRUNCATE (default: false)
session_idNoSession identifier for multi-turn correlation.
agent_idNoYour agent identifier for activity tracking.
parent_agent_idNoParent agent ID if you are a sub-agent (delegation chain tracking).
task_chainNoDelegation path from root agent (e.g., "main→research→fetch").

Tool Definition Quality

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, idempotent, open-world. Description adds detailed behavioral info: specific checks (injection, destructive, privilege escalation, PII), differential analysis for read vs write queries, and error handling policy. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with logical sections: purpose, call timing, decision logic, checks, read/write notes, error handling. Every sentence adds value; no fluff. Front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Thoroughly covers all aspects: what it checks, how to interpret results, when to allow destructive operations, error handling, and enterprise context. Despite no output schema, the description explains the blocked flag and decision logic comprehensively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but description adds meaningful context for key parameters: allowDestructive (controls permission for DROP/TRUNCATE), database (for context-aware analysis), and the query parameter's purpose is reinforced. Tracking parameters are less elaborated but schema covers them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is a protective check for SQL queries, catching injection and destructive operations before execution. It distinguishes itself from sibling tools like scan_command and scan_prompt by focusing specifically on SQL queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs to call before executing any SQL query generated by an LLM or user input. Provides clear decision logic (blocked=true vs false), alternatives for destructive operations (allowDestructive parameter), and error handling (default to blocking).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Shrike-Security/shrike-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server