v0.3.1

v0.3.1 (2026-07-18)

This release is published under the MIT License.

Bug Fixes

• mcp: Block filesystem, SSRF and dynamic-SQL access from the query tool

The query tool gated SQL only with is_read_only(), an advisory check on the leading keyword. A SELECT could still read local files via read_text() / read_csv() / glob() / ST_Read(), reach internal endpoints (read_csv(‘http://169.254.169.254/…’)), or smuggle any of these past inspection with query(‘…’). An MCP client driven by untrusted data could be made to exfiltrate secrets (e.g. ~/.ssh/id_rsa) through the tool result.

Reject these functions in the query tool. core.unsafe_function() parses the SQL with DuckDB’s own parser (json_serialize_sql) and walks the AST, so a call is found regardless of nesting, with a lexical scan as a fail-closed fallback for statements the parser refuses. The CLI keeps unrestricted SQL: it is run by a trusted local user, not an untrusted agent.

Also correct the tool docstring and server instructions, which described the tool as plain “read-only” and implied it was safe.

Continuous Integration

• release: Docs.queria.io デプロイフックのステップを削除

Documentation

• Describe query tool sandboxing in the README

Note that the MCP query tool runs SELECT-only over the catalogs and blocks file/URL readers and dynamic SQL, and point users at the CLI when they need unrestricted SQL.