MCP Server Local WP

Instructions

Implementation Reference

• src/index.ts:115-125 (handler)

  MCP server handler for the 'mysql_query' tool call. Parses arguments and delegates to MySQLClient.executeReadOnlyQuery.

  case 'mysql_query': {
    const sql = String(args.sql);
    const params = Array.isArray(args.params) ? args.params : undefined;
    debugLog('Executing mysql_query');
    const result = await mysql.executeReadOnlyQuery(sql, params);
    return {
      content: [
        { type: 'text', text: JSON.stringify(result, null, 2) },
      ],
    };
  }

• src/mysql-client.ts:46-74 (helper)

  Core helper function implementing the read-only SQL query execution with safety checks for single statement and read-only operations.

  async executeReadOnlyQuery(sql: string, params?: any[]): Promise<any[]> {
    const trimmed = sql.trim();
    if (!trimmed) {
      throw new Error('SQL is empty');
    }
  
    // Disallow multiple statements entirely for safety
    if (trimmed.includes(';')) {
      // Allow a trailing semicolon only
      const statements = trimmed.split(';').filter(s => s.trim().length > 0);
      if (statements.length > 1) {
        throw new Error('Multiple statements are not allowed. Submit a single read-only query.');
      }
    }
  
    const firstToken = trimmed
      .replace(/^\/\*[\s\S]*?\*\//g, '') // strip block comments
      .replace(/^--.*$/gm, '') // strip line comments
      .trim()
      .toLowerCase()
      .split(/\s+/)[0];
  
    const allowed = new Set(['select', 'show', 'describe', 'desc', 'explain']);
    if (!allowed.has(firstToken)) {
      throw new Error('Only read-only queries are permitted (SELECT/SHOW/DESCRIBE/EXPLAIN).');
    }
  
    return await this.query(sql, params);
  }

• src/index.ts:62-80 (schema)

  Input schema definition for the mysql_query tool, specifying sql and optional params.

  {
    name: 'mysql_query',
    description: 'Execute a read-only SQL query against the Local WordPress database',
    inputSchema: {
      type: 'object',
      properties: {
        sql: {
          type: 'string',
          description: 'Single read-only SQL statement (SELECT/SHOW/DESCRIBE/EXPLAIN).',
        },
        params: {
          type: 'array',
          description: 'Optional parameter values for placeholders (?).',
          items: { type: 'string' },
        },
      },
      required: ['sql'],
    },
  },

• src/index.ts:97-101 (registration)

  Registration of the listTools handler, which returns the tools array including mysql_query.

  server.setRequestHandler(ListToolsRequestSchema, async () => {
    return {
      tools,
    };
  });

• src/mysql-client.ts:33-44 (helper)

  Underlying query execution method used by executeReadOnlyQuery.

  async query<T = any>(sql: string, params?: any[]): Promise<T[]> {
    if (!this.connection) {
      throw new Error('Not connected to database');
    }
  
    try {
      const [rows] = await this.connection.execute(sql, params);
      return rows as T[];
    } catch (error: any) {
      throw new Error(`Query failed: ${error.message}`);
    }
  }