Nothing in the server distinguishes a SELECT from a DROP, which means the safety decision happens when you create the account you put in `MYSQL_PASSWORD`. Give it read-only grants on one schema and this is a fine way to let a model answer questions about your data; give it your application user and it inherits everything that user can do.
A minimal TypeScript server with a single tool: hand it a SQL string, get the results back. The database is fixed by environment variables at launch, so the connection is not something a call can change. It is small enough to read in a sitting, which makes it a reasonable starting point for a server you want to extend.
- `query` executes a SQL query and returns the results
- The SQL string is the only required parameter
- Connection details fixed at launch, so every call runs against the same database
Four environment variables in your client config: `MYSQL_HOST`, `MYSQL_USER`, `MYSQL_PASSWORD` and `MYSQL_DATABASE`. Run `npm install` and `npm run build`, then point your client at the built `index.js`. Package `mysql-server`, version 0.1.0. There is no statement filtering, so whatever the connecting MySQL user is allowed to do, a query can do — the account's grants are the only limit.