Diogenes Database Intelligence, SQL Engine & Schema Guard MCP

Deterministic SQL AST Injection & Tautology Vulnerability Auditor

audit_sql_injection_ast

Read-onlyIdempotent

Audit untrusted SQL input by statically parsing queries via AST to detect second-order injection, tautology conditions, and stacked queries before database execution.

Instructions

Statically parses SQL queries via AST lexical analysis to detect second-order injection, tautology conditions, and stacked queries. Use when auditing dynamic query parameters or untrusted user input before database execution; for sanitizing query strings for telemetry logging, use sanitize_sql_telemetry instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'raw_sql' ('audit_sensitivity' defaults to 'strict_zero_dynamic_taint'), supports '?demo=true' or L402 (10 sats), and returns HTTP 400 if invalid.

Input Schema

Name	Required	Description
`raw_sql`	Yes	Raw SQL query string to parse and audit for injection vulnerabilities.
`allow_comments`	No	Whether SQL inline comments are allowed or treated as injection vectors.
`audit_sensitivity`	No	Audit sensitivity mode: strict zero dynamic taint, second order injection check, or standard syntax audit.

Output Schema

Name	Required	Description
`is_safe`	Yes	True if the SQL query passed AST security audit with zero injection indicators.
`risk_score`	Yes	Continuous vulnerability score between 0.0 (safe) and 1.0 (critical exploit).
`ast_fingerprint`	Yes	Normalized structural AST hash of the parsed statement tree.
`vulnerabilities`	Yes	List of flagged injection mechanisms (e.g., tautology_always_true, stacked_statement, comment_truncation).

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Oct 26, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly/idempotent/non-destructive/closed-world, yet the description still adds material facts an agent cannot get elsewhere: stateless edge call, 32 KB input cap, 60 RPM rate limit, HTTP 400 on invalid input, and that either 'demo=true' or an L402 payment of 10 sats is required. That is exactly the beyond-annotation context this dimension rewards.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then routing, then operational constraints in a single dense paragraph with no filler sentences. It is packed tightly enough that the payment/rate-limit clause reads as a run-on, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no prose; annotations carry the safety profile; the description supplies the remaining operational facts (size limit, rate limit, auth/payment gate, failure mode). Nothing an agent needs before calling is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does add one genuinely new fact – that 'audit_sensitivity' defaults to 'strict_zero_dynamic_taint' – but leaves 'allow_comments' entirely unmentioned, so the gain over the schema is marginal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb and mechanism ('statically parses SQL queries via AST lexical analysis') and names the exact vulnerability classes detected: second-order injection, tautology conditions, stacked queries. An agent can distinguish this from summarize_sql or sanitize siblings without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the trigger condition ('auditing dynamic query parameters or untrusted user input before database execution') and names an alternative for the adjacent-but-different job ('for sanitizing query strings for telemetry logging, use sanitize_sql_telemetry instead'). It does not address the closest sibling, validate_sql_query_ast, so the routing guidance is good but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server