# SQL Preview > Run governed SQL queries and inspect database schemas from MCP agents. - name: io.github.fadnavismehul/sql-preview - version: 0.6.28 - connection class: L0 (run_local_package) - trust: 91/100 - quality: –/100 (not scored) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/io.github.fadnavismehul%2Fsql-preview - tools: https://api.protogrid.dev/v1/servers/io.github.fadnavismehul%2Fsql-preview/tools **Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it. ## Connection (mcpServers) ```json { "mcpServers": { "sql-preview": { "command": "npx", "args": [ "-y", "sql-preview@0.6.28", "--stdio" ], "env": { "SQL_PREVIEW_CONNECTIONS": "${SQL_PREVIEW_CONNECTIONS}" } } } } ``` Placeholders to fill: `${SQL_PREVIEW_CONNECTIONS}`. ## Trust - hygiene: 100 - liveness: n/a - freshness: 85 - provenance: 90 - drivers: +repository +namespace-matches-repo +website ~liveness-unmeasured ~updated-62d-ago - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality –/100 (not scored) Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package. ### protocol: n/a (weight 25) - n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only) ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: n/a (weight 30) - n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty) ### stability: n/a (weight 15) - n/a `stability.changes`, `stability.rug_pull`: tool list unknown ### dependencies: 33 (weight 15) - fail `deps.known_vulns`: 8 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-45rx-2jwx-cxfr in @opentelemetry/propagator-jaeger@2.7.1 (indirect, fixed in 2.9.0), GHSA-66ff-xgx4-vchm in protobufjs@8.0.1 (indirect, fixed in 8.0.2), GHSA-685m-2w69-288q in protobufjs@8.0.1 (indirect, fixed in 8.0.2), ...; 14 more of lower severity or without a fix - fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later - pass `deps.resolvable`: sql-preview@0.6.28 resolved: 498 packages - tools: unknown - badge: [![protogrid quality](https://protogrid.dev/badge/io.github.fadnavismehul/sql-preview.svg)](https://protogrid.dev/servers/io.github.fadnavismehul/sql-preview) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes _No tool definition changes recorded._ ## Dependencies - npm sql-preview@0.6.28: resolved, 497 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1 - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h - GHSA-45rx-2jwx-cxfr (high) in `` @opentelemetry/propagator-jaeger@2.7.1 ``, indirect, fixed in `` 2.9.0 ``, advisory summary: "OpenTelemetry JavaScript: Denial of service in \`JaegerPropagator\` via unhandled exception on a malformed header" https://osv.dev/vulnerability/GHSA-45rx-2jwx-cxfr - GHSA-66ff-xgx4-vchm (high) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Code injection through bytes field defaults in generated toObject code" https://osv.dev/vulnerability/GHSA-66ff-xgx4-vchm - GHSA-685m-2w69-288q (high) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Denial of service through unbounded protobuf recursion" https://osv.dev/vulnerability/GHSA-685m-2w69-288q - GHSA-75px-5xx7-5xc7 (high) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Code generation gadget after prototype pollution" https://osv.dev/vulnerability/GHSA-75px-5xx7-5xc7 - GHSA-jvwf-75h9-cwgg (high) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Process-wide denial of service through unsafe option paths" https://osv.dev/vulnerability/GHSA-jvwf-75h9-cwgg - GHSA-wcpc-wj8m-hjx6 (high) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.4.1 ``, advisory summary: "protobufjs: Denial of service through unbounded Any expansion during JSON conversion" https://osv.dev/vulnerability/GHSA-wcpc-wj8m-hjx6 - GHSA-82x6-q7mm-w9cf (high) in `` toml@3.0.0 ``, indirect, fixed in `` 4.2.0 ``, advisory summary: "toml-node: Uncontrolled Recursion" https://osv.dev/vulnerability/GHSA-82x6-q7mm-w9cf - GHSA-v5mp-jgw5-2x6j (high) in `` toml@3.0.0 ``, indirect, fixed in `` 4.1.2 ``, advisory summary: "toml-node: Prototype Pollution Leads to \`Object.prototype\` Corruption via \`\_\_proto\_\_\` Key-Path Desynchronization" https://osv.dev/vulnerability/GHSA-v5mp-jgw5-2x6j - GHSA-8988-4f7v-96qf (moderate) in `` @opentelemetry/core@2.7.1 ``, indirect, fixed in `` 2.8.0 ``, advisory summary: "OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation" https://osv.dev/vulnerability/GHSA-8988-4f7v-96qf - GHSA-gh4j-gqv2-49f6 (moderate) in `` fast-xml-parser@4.5.7 ``, indirect, fixed in `` 5.7.0 ``, advisory summary: "fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters" https://osv.dev/vulnerability/GHSA-gh4j-gqv2-49f6 - GHSA-2pr8-phx7-x9h3 (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Denial of service from crafted field names in generated code" https://osv.dev/vulnerability/GHSA-2pr8-phx7-x9h3 - GHSA-f38q-mgvj-vph7 (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.6.0 ``, advisory summary: "protobufjs : Schema-derived names can shadow runtime-significant properties" https://osv.dev/vulnerability/GHSA-f38q-mgvj-vph7 - GHSA-fx83-v9x8-x52w (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobuf.js: Prototype injection in generated message constructors" https://osv.dev/vulnerability/GHSA-fx83-v9x8-x52w - GHSA-j3f2-48v5-ccww (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.6.6 ``, advisory summary: "protobufjs: Denial of Service via infinite loop in .proto option parsing" https://osv.dev/vulnerability/GHSA-j3f2-48v5-ccww - GHSA-jggg-4jg4-v7c6 (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.2.0 ``, advisory summary: "protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion" https://osv.dev/vulnerability/GHSA-jggg-4jg4-v7c6 - GHSA-q6x5-8v7m-xcrf (moderate) in `` protobufjs@8.0.1 ``, indirect, fixed in `` 8.0.2 ``, advisory summary: "protobufjs has overlong UTF-8 decoding" https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf - GHSA-qqj6-54q6-cxv6 (moderate) in `` snowflake-sdk@1.15.0 ``, direct, fixed in `` 3.3.0 ``, advisory summary: "Snowflake drivers writes sensitive information to logs" https://osv.dev/vulnerability/GHSA-qqj6-54q6-cxv6 - GHSA-xfhv-wqj6-rx99 (moderate) in `` snowflake-sdk@1.15.0 ``, direct, fixed in `` 2.0.2 ``, advisory summary: "snowflake-sdk may incorrectly validate temporary credential cache file permissions" https://osv.dev/vulnerability/GHSA-xfhv-wqj6-rx99 - GHSA-w5hq-g745-h8pq (moderate) in `` uuid@8.3.2 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq - GHSA-w5hq-g745-h8pq (moderate) in `` uuid@9.0.1 ``, indirect, fixed in `` 11.1.1 ``, advisory summary: "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided" https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq - GHSA-hp3w-g68c-fv3c (moderate) in `` sprintf-js@1.1.3 ``, indirect, no fix yet, advisory summary: "sprintf-js vulnerable to denial of service through unbounded precision specifiers" https://osv.dev/vulnerability/GHSA-hp3w-g68c-fv3c - GHSA-wmjq-jrm2-9wfr (low) in `` snowflake-sdk@1.15.0 ``, direct, fixed in `` 2.0.4 ``, advisory summary: "NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file" https://osv.dev/vulnerability/GHSA-wmjq-jrm2-9wfr Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. ## Remotes _none_ ## Packages - npm sql-preview@0.6.28 secrets: SQL_PREVIEW_CONNECTIONS ## Tools (0) _none observed_