[mojianjjun]

Plugin type / 插件类型

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages
• Not applicable / 不适用

Affected plugin name(s) / 涉及的插件名称：db-connector

What / 改动内容

Adds db-connector v0.1.2 — a read-only database access plugin for ZCode.

Problem it solves / 解决的问题：lets the AI query MySQL/MariaDB, PostgreSQL and MongoDB directly in the session, with zero write/DDL surface. Today users hand-write one-off scripts or paste dumps to explore data; this plugin makes it conversational and safe by default.

Capabilities / 能力：

• MCP server with 10 tools: connection management (db_add_connection / db_remove_connection / db_list_connections / db_set_active_environment), connectivity test, table & schema browsing, read-only SQL with mandatory parameter binding (MySQL ? / PG $1), Mongo find / aggregate ($out/$merge rejected)
• A Skill guiding conversational setup
• Multi-environment grouping (dev/test/prod...) with protected banners for production, cross-environment env/name references, workspace/user config merge
• Three-level row-limit/timeout caps with a hard maxRowLimit ceiling
• Credentials stored only as ${ENV_VAR} references resolved from .env files — plaintext passwords are rejected at write time; all tool output masked

Self-contained runtime / 自包含运行时：the server ships as a single esbuild bundle (mcp/dist/db-connect-server.bundle.cjs, ~3 MB, dependencies inlined with their license notices) so an installed plugin runs with zero npm install. TypeScript sources are included under mcp/src.

How to test / 测试方式

1. Install the plugin, define a password in ~/.zcode/db-connector/.env (DB_DEV_PW=...), then ask: "Use db-connector to add a MySQL connection: environment dev, name mysql-main, database shop, password in DB_DEV_PW"
2. Try db_test_connection → db_list_tables → db_describe_table → db_query with params binding
3. Negative checks: any UPDATE/DELETE/DROP — even inside comments or subqueries — is rejected by the statement whitelist
4. Bundled suite: cd mcp && npm install && npm test (26 smoke cases, no real database needed; injection payloads and write statements must all be rejected); mcp/test/real-mysql.mjs ran 19/19 against a real MySQL 8 instance

Self-check / 自查清单

• Plugin name is unique kebab-case; new external plugin directory is external_plugins/<name>/
• Usage category is set independently of publisher ownership（developer-tools）
• Plugin type and affected names are declared above
• version consistent in BOTH plugin.json and marketplace.json（0.1.2，new plugin first release）
• README.md (EN) and README_CN.md (中文) both present and equivalent
• description_i18n has both en and zh-CN
• No secrets, machine-specific paths, or private dependencies
• Model/API/network dependencies documented（README "Disclosure" section: outbound connections only to user-configured database hosts; one node stdio process; writes only ~/.zcode/db-connector/* and workspace db-connections.json/.env）
• python3 scripts/validate.py and python3 scripts/build_dist.py pass locally — note: this contribution comes from a network-restricted environment where cloning the full repo was not feasible. A rule-by-rule equivalent of validate.py is bundled at mcp/test/check-official-rules.py (kebab-case name, ./external_plugins/<name> source, description/description_i18n(en,zh-CN)/semver/category whitelist, dir-name match, symlink sweep, 5000-file / 256 MB caps, manifest↔entry consistency) and passes locally; upstream CI running the original scripts should confirm.

Third-party code bundled / 内联的第三方代码：mysql2（MIT）、node-postgres（MIT）、MongoDB Node driver（Apache-2.0），inlined via esbuild --legal-comments=inline with license notices preserved. Upstream development repo: mojianjjun/zcode-plugins.