chore: strengthen deployment hardening

Author: iscarson

.env.example

@@ -32,8 +32,10 @@ OB_ALLOW_SELECT_STAR=false
 # OB_CONNECT_TIMEOUT_MS=10000
 # OB_QUERY_TIMEOUT_MS=30000
 # OB_MAX_ROWS=100
+# OB_MAX_RESULT_BYTES=1048576
 # OB_MAX_SQL_LENGTH=20000
 # OB_MAX_PARAM_COUNT=500
+# OB_MAX_CONCURRENT_QUERIES=5
 # OB_ENFORCE_READ_ONLY_TX=true
 # OB_PASSWORD_FILE=/run/secrets/ob_password
 # OB_ALLOWED_TABLES=biz_test.ob_sample,biz_test.*
@@ -56,9 +58,13 @@ OB_ALLOW_SELECT_STAR=false
 # OB_MCP_PATH=/mcp
 # OB_MCP_AUTH_TOKEN=
 # OB_MCP_AUTH_TOKEN_FILE=/run/secrets/ob_mcp_auth_token
+# OB_MCP_AUTH_TOKENS_FILE=/run/secrets/ob_mcp_auth_tokens.json
 # OB_MCP_ALLOWED_HOSTS=localhost,127.0.0.1
 # OB_MCP_ALLOWED_IPS=127.0.0.1,10.0.0.0/8,203.0.113.10
 # OB_MCP_TRUST_PROXY=false
+# OB_MCP_METRICS_AUTH_REQUIRED=false
+# OB_MCP_HEALTH_AUTH_REQUIRED=false
+# OB_MCP_CLIENT_ID_HEADER=x-ob-mcp-client-id
 # OB_MCP_BODY_LIMIT=256kb
 # OB_MCP_RATE_LIMIT_WINDOW_MS=60000
 # OB_MCP_RATE_LIMIT_MAX=60

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
       - name: 依赖审计
         run: npm audit --omit=dev --audit-level=moderate
 
+      - name: 生成 SBOM
+        run: npm sbom --sbom-format cyclonedx --omit=dev > sbom.cdx.json
+
+      - name: 上传 SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-cyclonedx
+          path: sbom.cdx.json
+          if-no-files-found: error
+
       - name: npm 打包检查
         run: npm pack --dry-run
 

.github/workflows/release.yml

@@ -96,14 +96,19 @@ jobs:
       - name: 测试
         run: npm test
 
+      - name: 生成 SBOM
+        run: npm sbom --sbom-format cyclonedx --omit=dev > sbom.cdx.json
+
       - name: 打包
         run: npm pack
 
       - name: 上传 npm 包产物
         uses: actions/upload-artifact@v4
         with:
           name: npm-package
-          path: "*.tgz"
+          path: |
+            "*.tgz"
+            sbom.cdx.json
           if-no-files-found: error
 
   image:
@@ -255,4 +260,5 @@ jobs:
           prerelease: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease == true }}
           files: |
             dist-release/*.tgz
+            dist-release/*.json
             dist-release/*.tar.gz

Dockerfile

@@ -1,14 +1,14 @@
-FROM node:22-alpine AS build
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build
 
 WORKDIR /app
 COPY package.json package-lock.json tsconfig.json ./
-RUN npm ci
+RUN npm ci --ignore-scripts
 
 COPY src ./src
 RUN npm run build
 RUN npm prune --omit=dev
 
-FROM node:22-alpine AS runtime
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS runtime
 
 ENV NODE_ENV=production
 WORKDIR /app

README.md

@@ -28,10 +28,11 @@ OceanBase MCP is read-only by design. It has no write tool, rejects write/contro
 - Local stdio MCP server for OpenCode desktop/local workflows.
 - Streamable HTTP MCP server for shared or remote deployments.
 - Multiple profiles for dev, staging, production, tenants, or clusters.
-- Schema/table allowlist, denied system schemas, denied sensitive columns, and masked sample rows.
+- Schema/table allowlist, denied system schemas, denied sensitive columns, hard row/response caps, and masked sample rows.
 - Source IP allowlist with exact IP and CIDR entries through `OB_MCP_ALLOWED_IPS`.
-- HTTP bearer token, Host allowlist, body limit, and rate limiting.
+- HTTP bearer token policies, Host allowlist, body limit, endpoint auth, and rate limiting.
 - Health endpoint, Prometheus metrics, JSON audit logs, and config diagnostics.
+- Database grant verification through a read-only permission check tool.
 - Docker, Docker Compose, Kubernetes, Nginx, systemd, and local macOS/Linux/Windows client examples.
 - GitHub Actions for CI, tagged releases, GHCR multi-architecture images, and offline image archives.
 
@@ -63,6 +64,8 @@ OB_MCP_READ_ONLY=true
 OB_ALLOWED_SCHEMAS=app_schema
 OB_ALLOW_SELECT_STAR=false
 OB_ENFORCE_READ_ONLY_TX=true
+OB_MAX_ROWS=100
+OB_MAX_RESULT_BYTES=1048576
 OB_MCP_HOST=127.0.0.1
 OB_MCP_AUTH_TOKEN_FILE=/run/secrets/ob_mcp_auth_token
 OB_MCP_ALLOWED_IPS=127.0.0.1,10.0.0.0/8
@@ -76,6 +79,7 @@ Use `OB_MCP_HOST=0.0.0.0` only behind TLS/reverse proxy or a trusted network bou
 | --- | --- |
 | `ob_list_profiles` | List configured profiles with secrets redacted. |
 | `ob_config_diagnostics` | Report deployment and policy checks. |
+| `ob_verify_permissions` | Check current database grants for write/admin privileges. |
 | `ob_ping` | Verify the OceanBase connection. |
 | `ob_policy_explain` | Explain whether SQL would be allowed. |
 | `ob_query` | Run strict read-only SQL. |

deploy/kubernetes/ob-mcp-optional.yaml

@@ -0,0 +1,95 @@
+# 可选生产增强模板。应用前请按集群命名空间、Ingress、监控和 OceanBase 网络修改。
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ob-mcp
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: ob-mcp
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: ob-mcp
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: ob-mcp
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ob-mcp
+spec:
+  podSelector:
+    matchLabels:
+      app: ob-mcp
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # 修改为实际 Ingress Controller 或内网客户端所在 namespace。
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+    # 如 Prometheus 不经过 Ingress 抓取 /metrics，请改成实际监控 namespace。
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # 允许 DNS 解析。若集群 DNS namespace 不同，请调整。
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # 修改为 OBProxy 或 OceanBase 的真实网段和端口。
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+      ports:
+        - protocol: TCP
+          port: 2883
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ob-mcp
+  labels:
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: ob-mcp
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s
+      bearerTokenSecret:
+        name: ob-mcp-secrets
+        key: ob_mcp_auth_token

deploy/kubernetes/ob-mcp.yaml

@@ -4,9 +4,9 @@ metadata:
   name: ob-mcp-secrets
 type: Opaque
 stringData:
-  # 应用到真实集群前必须替换这两个值。
+  # 应用到真实集群前必须替换这两个值；token 建议不少于 32 字节。
   ob_password: replace-me
-  ob_mcp_auth_token: replace-me-long-random-token
+  ob_mcp_auth_token: replace-me-long-random-token-32b
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -25,14 +25,20 @@ data:
   OB_ALLOWED_SCHEMAS: app_schema
   OB_ALLOW_SELECT_STAR: "false"
   OB_ENFORCE_READ_ONLY_TX: "true"
+  OB_MAX_ROWS: "100"
+  OB_MAX_RESULT_BYTES: "1048576"
+  OB_MAX_CONCURRENT_QUERIES: "5"
   OB_MCP_HOST: 0.0.0.0
   OB_MCP_PORT: "3000"
   OB_MCP_PATH: /mcp
   OB_MCP_ALLOWED_HOSTS: your-mcp.example.com
   # 允许的客户端、VPN、NAT 或反向代理来源 IP/CIDR。
   OB_MCP_ALLOWED_IPS: 10.0.0.0/8,203.0.113.10
-  # 仅在 Ingress 可信且客户端无法绕过时启用。
-  OB_MCP_TRUST_PROXY: "true"
+  # Ingress 前置时通常只信任 1 跳；不要让客户端绕过 Ingress 直连 Pod/Service。
+  OB_MCP_TRUST_PROXY: "1"
+  # metrics 建议鉴权；health 默认不鉴权，便于 Kubernetes probe。
+  OB_MCP_METRICS_AUTH_REQUIRED: "true"
+  OB_MCP_HEALTH_AUTH_REQUIRED: "false"
   OB_MCP_BODY_LIMIT: 256kb
   OB_MCP_RATE_LIMIT_WINDOW_MS: "60000"
   OB_MCP_RATE_LIMIT_MAX: "60"
@@ -108,6 +114,8 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ob-mcp
+  labels:
+    app: ob-mcp
 spec:
   selector:
     app: ob-mcp

docker-compose.yml

@@ -21,15 +21,20 @@ services:
       OB_ALLOWED_SCHEMAS: app_schema
       OB_ALLOW_SELECT_STAR: "false"
       OB_ENFORCE_READ_ONLY_TX: "true"
+      OB_MAX_ROWS: "100"
+      OB_MAX_RESULT_BYTES: "1048576"
+      OB_MAX_CONCURRENT_QUERIES: "5"
       OB_MCP_HOST: 0.0.0.0
       OB_MCP_PORT: "3000"
       OB_MCP_PATH: /mcp
       OB_MCP_AUTH_TOKEN_FILE: /run/secrets/ob_mcp_auth_token
       OB_MCP_ALLOWED_HOSTS: localhost,127.0.0.1,your-mcp.example.com
       # 允许访问 /mcp、/healthz、/metrics 的来源 IP 或 CIDR。
       OB_MCP_ALLOWED_IPS: 127.0.0.1,10.0.0.0/8,203.0.113.10
-      # 仅在可信反向代理后启用，且代理必须控制转发头。
-      OB_MCP_TRUST_PROXY: "true"
+      # 有一层可信反向代理时使用 1；本机直连可设为 false。
+      OB_MCP_TRUST_PROXY: "1"
+      OB_MCP_METRICS_AUTH_REQUIRED: "true"
+      OB_MCP_HEALTH_AUTH_REQUIRED: "false"
       OB_MCP_BODY_LIMIT: 256kb
       OB_MCP_RATE_LIMIT_WINDOW_MS: "60000"
       OB_MCP_RATE_LIMIT_MAX: "60"

docs/en/README.md

@@ -9,9 +9,10 @@ OceanBase MCP is a read-only MCP gateway for OceanBase. It is designed for OpenC
 - Connects to OceanBase through OBProxy or a MySQL protocol endpoint.
 - Supports OceanBase MySQL and Oracle compatibility modes.
 - Exposes only read-only MCP tools.
-- Enforces schema/table allowlists, denied system schemas, denied sensitive columns, row limits, SQL length limits, and read-only transactions.
+- Enforces schema/table allowlists, denied system schemas, denied sensitive columns, hard row/response caps, SQL length limits, and read-only transactions.
 - Provides stdio mode for local development and HTTP mode for shared deployments.
-- Protects HTTP mode with bearer auth, Host allowlist, source IP allowlist, body limits, and rate limiting.
+- Protects HTTP mode with bearer token policies, Host allowlist, source IP allowlist, endpoint auth, body limits, and rate limiting.
+- Provides a read-only database account permission verification tool.
 - Ships Docker, Kubernetes, Nginx, systemd, and local OpenCode examples.
 
 ## Read-Only Contract
@@ -102,6 +103,7 @@ When binding to a non-local interface such as `0.0.0.0`, the server requires:
 | --- | --- |
 | `ob_list_profiles` | List configured profiles with secrets redacted. |
 | `ob_config_diagnostics` | Report deployment and policy checks. |
+| `ob_verify_permissions` | Check current database grants for write or administrative privileges. |
 | `ob_ping` | Verify the OceanBase connection. |
 | `ob_policy_explain` | Explain whether SQL would be allowed. |
 | `ob_query` | Run strict read-only SQL. |