MSSQL: mssql_list_tables tool #327

New issue

Closed

opened 2026-11-10 08:21:21 +00:00 by david · 2 comments

david commented

2026-11-10 08:21:21 +00:00

Owner

Summary

Register mssql_list_tables: a fixed INFORMATION_SCHEMA query listing user tables and views across all schemas, with a schema column.

Background

Schema tools use fixed, parameterised queries and do not pass through the guard. INFORMATION_SCHEMA shows only objects the login can access, so some tables may be hidden; document this in the tool description. System schemas (INFORMATION_SCHEMA, sys, and similar) are excluded. Blocked until the Stage 1 gate (#318) passes. TDD with the injected fake pool.

Depends on: #326

Documentation Required

docs/reference/mssql/ — https://raw.githubusercontent.com/tediousjs/node-mssql/master/README.md : node-mssql README (executing a query on a pool). Vendored on main; fetch the URL if absent.

Implementation Details

In extensions/mssql/tools.ts (or schema-tools.ts) register mssql_list_tables with no parameters. Constant SQL, for example: SELECT TABLE_SCHEMA AS [schema], TABLE_NAME AS [name], TABLE_TYPE AS [type] FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA NOT IN ('INFORMATION_SCHEMA','sys') ORDER BY TABLE_SCHEMA, TABLE_NAME. No string concatenation of any input. Run it through the pool directly (not the guard). Apply the row cap and timeout through the same runner so a huge catalogue is still bounded, and audit the call as an executed query. Return JSON rows plus the truncation note when applicable.

Acceptance Criteria

The tool takes no user input and uses a constant SQL string.
The SQL excludes system schemas and returns schema, name and type.
The result lists both tables and views.
The row cap and timeout apply, and the call is audited.
The tool description notes that results depend on the login's access.

Test Plan

node --test extensions/mssql/tools.test.ts: fake pool returns sample catalogue rows; assert the exact SQL executed, the JSON output, the truncation note at the cap, and the audit entry.

## Summary Register `mssql_list_tables`: a fixed `INFORMATION_SCHEMA` query listing user tables and views across all schemas, with a schema column. ## Background Schema tools use fixed, parameterised queries and do not pass through the guard. `INFORMATION_SCHEMA` shows only objects the login can access, so some tables may be hidden; document this in the tool description. System schemas (`INFORMATION_SCHEMA`, `sys`, and similar) are excluded. **Blocked until the Stage 1 gate (#318) passes.** TDD with the injected fake pool. **Depends on:** #326 ## Documentation Required - `docs/reference/mssql/` — https://raw.githubusercontent.com/tediousjs/node-mssql/master/README.md : node-mssql README (executing a query on a pool). Vendored on `main`; fetch the URL if absent. ## Implementation Details In `extensions/mssql/tools.ts` (or `schema-tools.ts`) register `mssql_list_tables` with no parameters. Constant SQL, for example: `SELECT TABLE_SCHEMA AS [schema], TABLE_NAME AS [name], TABLE_TYPE AS [type] FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA NOT IN ('INFORMATION_SCHEMA','sys') ORDER BY TABLE_SCHEMA, TABLE_NAME`. No string concatenation of any input. Run it through the pool directly (not the guard). Apply the row cap and timeout through the same runner so a huge catalogue is still bounded, and audit the call as an executed query. Return JSON rows plus the truncation note when applicable. ## Acceptance Criteria - [ ] The tool takes no user input and uses a constant SQL string. - [ ] The SQL excludes system schemas and returns schema, name and type. - [ ] The result lists both tables and views. - [ ] The row cap and timeout apply, and the call is audited. - [ ] The tool description notes that results depend on the login's access. ## Test Plan `node --test extensions/mssql/tools.test.ts`: fake pool returns sample catalogue rows; assert the exact SQL executed, the JSON output, the truncation note at the cap, and the audit entry.

david added this to the MSSQL: M7 - Tools milestone

2026-11-10 08:21:21 +00:00

david added the

feature

label

2026-11-10 08:21:21 +00:00

david referenced this issue

2026-11-10 08:21:34 +00:00

MSSQL: mssql_table_schema tool (parameterised) #328

david commented

2026-11-10 23:44:17 +00:00

Author

Owner

Update: the "Blocked until the Stage 1 gate (#318) passes" note is superseded. The gate resolved as STOP, and docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md replaced the parser design with read-only credentials, a minimal guard and a write-access warning. Stage 2 is unblocked. The scope of this issue is unchanged.

Update: the "Blocked until the Stage 1 gate (#318) passes" note is superseded. The gate resolved as STOP, and `docs/adr/0002-mssql-read-only-credentials-with-minimal-guard.md` replaced the parser design with read-only credentials, a minimal guard and a write-access warning. Stage 2 is unblocked. The scope of this issue is unchanged.

david referenced this issue

2026-11-10 23:46:59 +00:00

MSSQL spike: write RESULT.md, apply the gate, open the Stage 1 PR #318

david referenced this issue

2026-11-11 00:21:12 +00:00

327: MSSQL: mssql_list_tables tool #351

david closed this issue

2026-11-11 00:21:13 +00:00

david commented

2026-11-11 00:21:13 +00:00

Author

Owner