Unreleased: not public yet. Maintainers have not reviewed this result.
Results / @bytebase/dbhub
@bytebase/dbhub
A
Protocol4/4 points
F
Database3/7 pointscritical: mutating-sql
Coverage: covered (1 of 2 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 2 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 2 tool definition(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 8 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 8 captured response(s) |
Database checks
| Check | Verdict | What happened |
|---|---|---|
| read-only Read-only by default | fail | writes executed through execute_sql |
| write-gate (advisory) Write approval gate | fail | writes executed with no confirmation step through execute_sql (advisory: MCP clients may add their own approval) |
| rlscritical Row-level security respected | pass | DB-enforced: the server passed the policy through and added no filtering of its own (support role saw only its own tenant on every tool) |
| mutating-sqlcritical Mutating SQL blocked | fail | EXECUTED: stacked statements (DROP), stacked statements (INSERT), COMMIT then write (read-only transaction escape), case and comment obfuscation (INSERT), data-modifying CTE (DELETE), data-modifying CTE (INSERT), function with side effects (defeats any prefix filter by construction), anonymous DO block, TRUNCATE, DDL (CREATE TABLE), DDL via SELECT INTO, PREPARE then EXECUTE, session state (disable read-only, then write), PREPARE and EXECUTE in one call, function with side effects in FROM, EXPLAIN ANALYZE runs the statement; 0 of 16 blocked |
| piicritical Personal data masking respected | pass | DB-enforced: the server passed the grants through and added no filtering of its own (analyst role never received raw emails on any tool) |
| pii-masked Masked data reachable | pass | the masked view was readable and returned only masked emails |
| db-rowcap Row cap | fail | no row cap: 200,000 rows could be read through every tool |
| db-timeout Statement timeout | fail | no statement timeout within 18s (expected 10s): SELECT pg_sleep(30) on execute_sql |
| audit (advisory) Every call logged | n/a | not measured: servers do not write audit rows by themselves |
| db-privilege (advisory) Connects as the database role it was given | pass | every instance connected as exactly the role it was given (sm_admin, sm_support, sm_analyst); none is a superuser, has BYPASSRLS or owns an RLS table |
What was not covered
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- SQLite: Not applicable. No {sqlite_path} placeholder in the server config, so the harness cannot give the server a database to grade (add {sqlite_path} to the server args)
- Effects: Not applicable. No tool takes a harness-owned target (file path, repository or URL) with medium confidence or higher
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "search_objects" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- The sandbox is a convention the harness follows, not a security boundary. A malicious server runs with your user's privileges, sees the real file system and network, and can ignore cwd, HOME and PATH. Run untrusted servers in a throwaway VM or container.
- Prompt injection carried in tool output (only tool metadata is scanned)
- Authentication and transport security
- Audit logging (not measured by these packs; only the db pack has an advisory audit check)
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
npx -y @bytebase/dbhub@1.5.0
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.