{"record":{"id":"8b27f7e692d9b426","repo":"different-ai/openwork","slug":"statement-contains-a-forbidden-keyword-read-only","errorCode":null,"errorMessage":"Statement contains a forbidden keyword (read-only access)","messagePattern":"Statement contains a forbidden keyword \\(read-only access\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ee/packages/den-admin-mcp/index.mjs","lineNumber":193,"sourceCode":"    signedUpAt: row.created_at,\n    lastActiveAt: lastActive.get(row.id) ?? null,\n    organizations: memberships.get(row.id) ?? [],\n  }));\n}\n\n// --- read-only guard for den_query ---\n\nconst FORBIDDEN_SQL =\n  /\\b(insert|update|delete|drop|alter|create|truncate|rename|replace|grant|revoke|call|load|handler|lock|unlock|set|use|outfile|dumpfile|for\\s+update)\\b/i;\n\nfunction assertReadOnly(input) {\n  const sqlText = input.trim().replace(/;+\\s*$/, \"\");\n  if (sqlText.includes(\";\")) throw new Error(\"Only a single SQL statement is allowed\");\n  if (!/^(select|with|show|describe|explain)\\b/i.test(sqlText)) {\n    throw new Error(\"Only SELECT/WITH/SHOW/DESCRIBE/EXPLAIN statements are allowed\");\n  }\n  if (FORBIDDEN_SQL.test(sqlText)) {\n    throw new Error(\"Statement contains a forbidden keyword (read-only access)\");\n  }\n  return sqlText;\n}\n\n// --- MCP server ---\n\n// Keep in sync with package.json. The hosted admin MCP may expose additional\n// admin-only write tools while this break-glass stdio variant remains read-only.\nconst DEN_ADMIN_MCP_VERSION = \"0.4.0\";\n\nconst server = new McpServer({ name: \"den-admin\", version: DEN_ADMIN_MCP_VERSION });\n\nserver.tool(\n  \"den_admin_version\",\n  \"Report the den-admin MCP version and runtime so you can verify which build is running.\",\n  {},\n  async () =>\n    run(async () => ({","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/packages/den-admin-mcp/index.mjs#L175-L211","documentation":"Error \"Statement contains a forbidden keyword (read-only access)\" thrown in different-ai/openwork.","triggerScenarios":"Thrown at ee/packages/den-admin-mcp/index.mjs:193 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}