MCP server returned: mcp-clickhouse · version 0.7.0.
MCP tools returned: list_databases, list_tables, run_query. Tool listing does not establish authenticated tool-call success.
Safety: Review signals: 1 connection review, 5 known vulnerability. 1 static matches retained as context.
Review signals: 1 connection review, 5 known vulnerability. 1 static matches retained as context.
Reviewed as expected for a test run: attempted writes that failed, so nothing was written.
Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 9 distinct locations. 10 attributed processes.
OSV reports a known vulnerability in this dependency version. 3 distinct locations. 5 findings.
1 hardcoded secret matches retained as context; full list in the evidence.
OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.
A short run cannot establish that code is safe.
Connections show IP addresses; proxies can hide the final hostname.
Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.
Full safety evidence →
What the agent did
Run SQL through the mcp-clickhouse stdio MCP server (run_query tool) against a ClickHouse server, including named parameter binding.
cd <guest-path> && ls -la && git status 2>&1 | head -3; python3 --version; id -u; cat README.md | head -200
cd <guest-path> && cat .python-version pyproject.toml; grep -n -i "install\|uv \|quick\|getting started\|docker\|run" README.md | head -80; which uv; cat /etc/os-release | head -2; ls <guest-path> /inputs 2>&1
cd <guest-path> && sed -n 200,300p README.md
cd <guest-path> && sed -n 300,360p README.md; sed -n 462,530p README.md; (which docker clickhouse; ss -ltn 2>/dev/null | grep -E '8123|9000'; echo done)
cd <guest-path> && uv --version && timeout 600 uv sync --python 3.12 2>&1 | tail -15; ls .venv/bin | grep -i clickhouse
timeout 15 curl -sS -m 10 "https://sql-clickhouse.clickhouse.com:8443/?query=SELECT%201" ; echo " rc=$?"; echo "CDP:"; timeout 10 curl -sS -m 8 $CDP_URL/json/version; echo " rc=$?"
cd <guest-path> && sed -n 360,380p README.md; grep -n "CLICKHOUSE_HOST\|CLICKHOUSE_PORT\|CLICKHOUSE_SECURE\|MCP_TRANSPORT\|MCP_SERVER_TRANSPORT" README.md | head; wc -l <guest-path>; grep -n "def \|argv" <guest-path> | head -80
timeout 20 curl -sS -m 15 "https://sql-clickhouse.clickhouse.com:8443/?user=demo&query=SELECT%20version(),%20'hello'" ; echo " rc=$?"; sed -n 43,50p <guest-path>
grep -n "'env'" <guest-path> | head; sed -n 420,480p <guest-path>
cd <guest-path> && ls -la .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"run_query","arguments":{"query":"SELECT 'coldpass-ok' AS marker"},"expected_text":"coldpass-ok","env":{"CLICKHOUSE_HOST":"sql-clickhouse.clickhouse.com","CLICKHOUSE_PORT":"8443","CLICKHOUSE_USER":"demo","CLICKHOUSE_PASSWORD":"","CLICKHOUSE_SECURE":"true","CLICKHOUSE_VERIFY":"true","CLICKHOUSE_CONNECT_TIMEOUT":"30"}}
EOF
python3 -I -c 'import json;print(json.load(open("<guest-path>"))["tool"])'
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"run_query executes SQL queries on the ClickHouse cluster","source":"Execute SQL queries on your ClickHouse cluster.","input":"SELECT 'coldpass-ok' AS marker","expected":"query result containing coldpass-ok","probe_kind":"mcp","argv":["<guest-path>"],"tool":"run_query","arguments":{"query":"SELECT 'coldpass-ok' AS marker"},"expected_text":"coldpass-ok","cwd":"<guest-path>","env":{"CLICKHOUSE_HOST":"sql-clickhouse.clickhouse.com","CLICKHOUSE_PORT":"8443","CLICKHOUSE_USER":"demo","CLICKHOUSE_PASSWORD":"","CLICKHOUSE_SECURE":"true","CLICKHOUSE_VERIFY":"true","CLICKHOUSE_CONNECT_TIMEOUT":"30"}},
{"kind":"claim","claim":"run_query binds named {name:Type} parameters from the params object","source":"SELECT {id:UInt32} AS id, {name:String} AS name","input":"SELECT {id:UInt32} AS id, {name:String} AS name with id=13 and name=O'Reilly","expected":"result row containing O'Reilly","probe_kind":"mcp","argv":["<guest-path>"],"tool":"run_query","arguments":{"query":"SELECT {id:UInt32} AS id, {name:String} AS name","params":{"id":13,"name":"O'Reilly"}},"expected_text":"O'Reilly","cwd":"<guest-path>","env":{"CLICKHOUSE_HOST":"sql-clickhouse.clickhouse.com","CLICKHOUSE_PORT":"8443","CLICKHOUSE_USER":"demo","CLICKHOUSE_PASSWORD":"","CLICKHOUSE_SECURE":"true","CLICKHOUSE_VERIFY":"true","CLICKHOUSE_CONNECT_TIMEOUT":"30"}}]
EOF
python3 -I -c 'import json;print(len(json.load(open("<guest-path>"))))'; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && grep -rn -i "schedule\|cron\|while True\|--once\|webhook" mcp_clickhouse/ | head; ls tests test-services; sed -n 1,30p mcp_clickhouse/main.py | head -40
cd <guest-path> && sed -n 208,222p mcp_clickhouse/auth.py; grep -n "CLICKHOUSE_HOST\|localhost\|8123" tests/conftest.py | head -5; timeout 900 uv run --python 3.12 --extra dev pytest -q tests 2>&1 | tail -25
cd <guest-path> && timeout 300 uv run --python 3.12 --extra dev pytest -q tests/test_tool.py::TestClickhouseTools::test_list_databases 2>&1 | grep -E "KeyError|Error|environ|CLICKHOUSE" | head -8; grep -n "environ\[" tests/conftest.py | head -5
cd <guest-path> && uv run ruff check . 2>&1 | tail -5; echo rc=$?
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Lint check from the README Running tests section","source":"README.md: uv run ruff check . # run linting","input":"ruff check . in the checkout","expected":"All checks passed!","argv":["uv","run","ruff","check","."],"cwd":"<guest-path>","env":{},"expected_text":"All checks passed!"},
{"kind":"example","claim":"Documented pytest suite against a live ClickHouse (README Running tests)","source":"README.md: uv run pytest -v tests","reason":"Not replayed as a pass. The suite needs a live ClickHouse from docker compose (test-services), and Docker is absent in this guest. Run without CLICKHOUSE_HOST/USER/PASSWORD: <secret> passed, 7 skipped, 1 xfailed, 101 failed, 46 errors; failures are 'Missing required environment variables: CLICKHOUSE_HOST, CLICKHOUSE_USER, CLICKHOUSE_PASSWORD'."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: mcp_clickhouse/main.py runs a stdio or HTTP MCP server via mcp.run(), with no cron, scheduler, --once, --now, or webhook trigger. The only while-loop (mcp_clickhouse/auth.py:216) walks up directories to find a .env file. Request-driven tool calls are the product's operation and are covered by the MCP probe and claims.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open("<guest-path>"+f)) for f in ["examples.json","cycles.json"]];print("ok")'
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run SQL through the mcp-clickhouse stdio MCP server (run_query tool) against a ClickHouse server, including named parameter binding.","operation_scope":"Local Linux guest, Python 3.12 via uv, public ClickHouse SQL playground sql-clickhouse.clickhouse.com:8443 as user demo (README's documented playground config). Read-only default. Docker and a local ClickHouse were not available, so the docker compose test suite was not run against a live server. CDP browser endpoint not needed: this is an MCP stdio server.","steps":["uv sync --python 3.12 (README Development: uv sync --all-extras --dev; run without --all-extras)","Start server: .venv/bin/mcp-clickhouse (README Configuration/Claude Desktop entry)","MCP tools/call run_query with query SELECT 'coldpass-ok' AS marker -> returned coldpass-ok","MCP tools/call run_query with SELECT {id:UInt32} AS id, {name:String} AS name and params id=13, name=O'Reilly -> returned [13, O'Reilly]","uv run ruff check . -> All checks passed!"],"deviations":["Checker path /inputs/coldpass-preflight.py does not exist in this guest; used <guest-path> with the same flags as instructed.","README 'uv run pytest -v tests' needs a live ClickHouse (docker compose test-services). Docker not present; the run gave 700 passed, 7 skipped, 1 xfailed, 101 failed, 46 errors, all from missing CLICKHOUSE_HOST/USER/PASSWORD. Recorded as a prerequisite, not a product fault.","Used the README's 'uv sync' dev install instead of the PyPI install path; the README's pip route was not exercised.","Playground connection: the demo user works over HTTP; the README's password is an empty string."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import sys,json; t=sys.stdin.read(); d=json.loads(t[t.index("{"):]); print("valid:",d["valid"]); print("problems:",d["problems"]); r=d.get("replay",{}); print("replay:",r.get("status")); print({k:(v if not isinstance(v,(dict,list)) else "...") for k,v in r.get("details",{}).items()})' ; echo rc=$?