
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@sqlike/mcp
Advanced tools
MCP server for sqlike — deterministic SQL static analysis. A thin remote client that tokenizes locally and forwards to the sqlike API.
MCP server for sqlike, a deterministic SQL static analyzer and advisor (validity, anti-patterns, rewrites, index and schema advice) and query-equivalence checker for Postgres, MySQL, MariaDB, SQLite, SQL Server, and DuckDB.
Point your coding agent at it and the SQL it writes gets checked before it runs, by something with no model in the loop and no opinion to guess with.
This package is a thin remote client. It tokenizes your SQL locally, so identifiers and literals are masked before anything leaves your machine, and forwards only the tokenized query to the sqlike API. There is no analysis engine in it.
No install needed. Point your MCP client at it via npx:
{
"mcpServers": {
"sqlike": {
"command": "npx",
"args": ["-y", "@sqlike/mcp"]
}
}
}
It exposes two tools:
analyze: static analysis of one query. Takes sql, plus optional schema DDL for column
and type aware checks and a dialect of postgres (default), mysql, mariadb, sqlite,
mssql, or duckdb. Returns the JSON analysis envelope.diff: whether two queries are equivalent. Takes sql_a and sql_b, plus the same optional
schema and dialect. Returns a verdict (Equivalent, EquivalentWithNotes, Differs, or
Undecided), a confidence level, and a report per property (columns, rows, cardinality, order).
Undecided never means equivalent.A query that cannot be parsed cannot be tokenized, so the tool refuses rather than send raw SQL.
Overriding that is an explicit allow_raw: true on analyze.
Both are read from the environment:
SQLIKE_URL: API base URL (default https://api.sqlike.com).SQLIKE_API_KEY: optional, sent as a Bearer token for higher rate limits.{
"mcpServers": {
"sqlike": {
"command": "npx",
"args": ["-y", "@sqlike/mcp"],
"env": { "SQLIKE_API_KEY": "sk_..." }
}
}
}
The server is a native binary. Each platform's binary is published as its own optional-dependency
package (@sqlike/mcp-linux-x64, @sqlike/mcp-darwin-arm64, and so on), so npm installs only the
one matching your OS and CPU. No install scripts run, which means this works with --ignore-scripts
and in locked-down environments. Supported: linux x64 and arm64, macOS x64 and arm64, Windows x64.
MIT OR Apache-2.0
FAQs
MCP server for sqlike — deterministic SQL static analysis. A thin remote client that tokenizes locally and forwards to the sqlike API.
The npm package @sqlike/mcp receives a total of 184 weekly downloads. As such, @sqlike/mcp popularity was classified as not popular.
We found that @sqlike/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.