Infersec

Kind: Conduit-run (local)

The Local MySQL tool connects a MySQL or MariaDB database to Infersec and exposes it to models as a set of MCP operations. Because it runs inside Conduit on your own machine, the database credentials and the database itself are only ever accessed from your host - the tool-call arguments and query results are relayed through the Infersec API so the model can use them.

It is read-only by default. Write operations (insert, update, delete, truncate, and raw sql) are only registered when you opt in with --allow.

Operations

Operation Category Exposed Description
get-tables read always List tables in a database
get-table-schema read always Return column metadata for a table
select read always Structured, parameterized SELECT (capped at --max-rows)
insert write with --allow Insert one or more rows
update write with --allow Update rows matching a where condition
delete write with --allow Delete rows matching a where condition
truncate write with --allow Truncate a table
sql write with --allow Execute a raw SQL statement with optional parameters

select takes structured arguments (table, columns, where, order, limit) and is always parameterized - the model cannot inject SQL through it. Identifiers (table and column names) are validated and backtick-quoted. update and delete require a non-empty where condition, and bare SELECT statements passed to sql automatically get a LIMIT applied.

Safety defaults

  • Read-only unless --allow is provided.
  • All values are query parameters; identifiers are validated against a strict pattern.
  • Result rows are capped at --max-rows (default 1000).
  • Each query has a client-side timeout and a server-side MAX_EXECUTION_TIME hint for SELECTs (--query-timeout-ms, default 30000).

Connecting via Conduit

The tool's config in the console holds only an optional description. Connection details are supplied when you connect it from Conduit.

MYSQL_URL=mysql://user:pass@host:3306/db \
  npx @infersec/conduit tool connect <tool-id> --key <api-key> [--allow insert,update,sql]

Connection can be supplied as a URL (--url / MYSQL_URL) or as individual fields (--host, --port, --user, --password, --database). Prefer the MYSQL_* environment variables for credentials to avoid shell-history and process-listing exposure.

Flag / env Required Default Notes
--url / MYSQL_URL one of url/host - mysql://user:pass@host:3306/db
--host / MYSQL_HOST one of url/host - Database host
--port / MYSQL_PORT no 3306 Database port
--user / MYSQL_USER with host - Database user
--password / MYSQL_PASSWORD with host - Database password (prefer the env var)
--database / MYSQL_DATABASE no - Default database
--allow / MYSQL_ALLOW no (read-only) Write operations to enable (csv) or all
--pool-max / MYSQL_POOL_MAX no 5 Pool connection limit
--max-rows / MYSQL_MAX_ROWS no 1000 Max rows returned per query
--query-timeout-ms / MYSQL_QUERY_TIMEOUT_MS no 30000 Per-query timeout in ms

See the Conduit reference for installation and Docker usage.