MCP: a tool that refuses more than it accepts

A protocol server for a database, and the constraints that make it safe rather than the capabilities that make it useful.

const REFUSED = [
  /^s*(INSERT|UPDATE|DELETE|REPLACE|TRUNCATE)b/i,
  /^s*(CREATE|ALTER|DROP|RENAME)b/i,
  /^s*(GRANT|REVOKE|SET|FLUSH)b/i,
  /bintos+outfileb/i,
  /;s*S/,                    // more than one statement
]

// plus: a read-only credential, a 5,000 row limit, a
// 10-second timeout, and a schema allow-list.

A read-only credential is the floor rather than the protection — it prevents writes and permits a query that reads every row of every table until the connection dies. Five constraints, each of which is individually bypassable and which together make the server exactly as safe as its narrowest one.