mcp-sql-guard

Validate this SQL against the safety rules: it must be a single read-only SELECT, may only access the sales_orders and customers tables, and must enforce LIMIT 100 automatically; if it includes email or phone columns, mask them for the analyst role and return an audit log summary. SQL: SELECT customer_id, email, total_amount FROM sales_orders JOIN customers USING(customer_id) ORDER BY total_amount DESC;

Returns the validation result, any SQL rewrite or rejection reason, masked field handling details, and an audit log summary.

Check whether this SQL should be rejected and explain why: DELETE FROM users WHERE last_login < '2023-01-01'; The rule is to allow only a single read-only SELECT, with no write operations or multi-statement execution.

Clearly rejects the query, stating that it violates the read-only and operation-type rules, optionally with audit log details.

Validate and process this SQL: SELECT id, full_name, ssn, phone FROM employees LIMIT 50; Access to the employees table is allowed. For the viewer role, mask ssn and phone, and generate a tamper-evident audit log summary.

Returns a successful validation result, masking policy details, confirmation of enforced limits, and the corresponding audit summary.