
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@sqlike/mcp
Advanced tools
MCP server for sqlike — deterministic SQL static analysis. A thin remote client that tokenizes locally and forwards to the sqlike API.
MCP server for sqlike, a deterministic SQL static analyzer and advisor (validity, anti-patterns, rewrites, index and schema advice) and query-equivalence checker for Postgres, MySQL, MariaDB, SQLite, and SQL Server.
Point your coding agent at it and the SQL it writes gets checked before it runs, by something with no model in the loop and no opinion to guess with.
This package is a thin remote client. It tokenizes your SQL locally, so identifiers and literals are masked before anything leaves your machine, and forwards only the tokenized query to the sqlike API. There is no analysis engine in it.
No install needed. Point your MCP client at it via npx:
{
"mcpServers": {
"sqlike": {
"command": "npx",
"args": ["-y", "@sqlike/mcp"]
}
}
}
It exposes two tools:
analyze: static analysis of one query. Takes sql, plus optional schema DDL for column
and type aware checks and a dialect of postgres (default), mysql, mariadb, sqlite, or
mssql. Returns the JSON analysis envelope.diff: whether two queries are equivalent. Takes sql_a and sql_b, plus the same optional
schema and dialect. Returns a verdict (Equivalent, EquivalentWithNotes, Differs, or
Undecided), a confidence level, and a report per property (columns, rows, cardinality, order).
Undecided never means equivalent.A query that cannot be parsed cannot be tokenized, so the tool refuses rather than send raw SQL.
Overriding that is an explicit allow_raw: true on analyze.
Both are read from the environment:
SQLIKE_URL: API base URL (default https://api.sqlike.com).SQLIKE_API_KEY: optional, sent as a Bearer token for higher rate limits.{
"mcpServers": {
"sqlike": {
"command": "npx",
"args": ["-y", "@sqlike/mcp"],
"env": { "SQLIKE_API_KEY": "sk_..." }
}
}
}
The server is a native binary. Each platform's binary is published as its own optional-dependency
package (@sqlike/mcp-linux-x64, @sqlike/mcp-darwin-arm64, and so on), so npm installs only the
one matching your OS and CPU. No install scripts run, which means this works with --ignore-scripts
and in locked-down environments. Supported: linux x64 and arm64, macOS x64 and arm64, Windows x64.
MIT OR Apache-2.0
FAQs
MCP server for sqlike — deterministic SQL static analysis. A thin remote client that tokenizes locally and forwards to the sqlike API.
The npm package @sqlike/mcp receives a total of 168 weekly downloads. As such, @sqlike/mcp popularity was classified as not popular.
We found that @sqlike/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.