LogCarverGuard.Local 0.1.0

.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher. 
{
  "inputs": [
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_CONNECTION_STRING",
      "description": "SQL Server connection string the statements run as. Example: Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true",
      "password": true
    },
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_READ_ONLY",
      "description": "Set to true to allow queries only (SELECT without INTO; remote sources such as OPENQUERY are blocked). Leave unset for the default guard rules."
    },
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_AUDIT_DB_PATH",
      "description": "Path of the audit log SQLite file. Defaults to LogCarverGuard/audit.db under the local application data folder."
    },
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_TRUNCATE_ALLOWLIST",
      "description": "Comma-separated schema.table entries where TRUNCATE TABLE is allowed. Empty means all TRUNCATE is blocked."
    },
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_EXEC_WHITELIST",
      "description": "Comma-separated schema.procedure entries that may be run with EXEC. Empty means all EXEC is blocked."
    },
    {
      "type": "promptString",
      "id": "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST",
      "description": "Comma-separated schema.table entries where ALTER TABLE ... DROP COLUMN is allowed. Empty means it is blocked."
    }
  ],
  "servers": {
    "LogCarverGuard.Local": {
      "type": "stdio",
      "command": "dnx",
      "args": ["LogCarverGuard.Local@0.1.0", "--yes"],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "${input:LOGCARVERGUARD_CONNECTION_STRING}",
        "LOGCARVERGUARD_READ_ONLY": "${input:LOGCARVERGUARD_READ_ONLY}",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "${input:LOGCARVERGUARD_AUDIT_DB_PATH}",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "${input:LOGCARVERGUARD_TRUNCATE_ALLOWLIST}",
        "LOGCARVERGUARD_EXEC_WHITELIST": "${input:LOGCARVERGUARD_EXEC_WHITELIST}",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "${input:LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST}"
      }
    }
  }
}
This package contains an MCP Server. The server can be used in VS Code by copying the generated JSON to your VS Code workspace's .vscode/mcp.json settings file. 
dotnet tool install --global LogCarverGuard.Local --version 0.1.0
This package contains a .NET tool you can call from the shell/command line. 
dotnet new tool-manifest
                    


                            if you are setting up this repo
                        

                    

                
dotnet tool install --local LogCarverGuard.Local --version 0.1.0
This package contains a .NET tool you can call from the shell/command line. 
#tool dotnet:?package=LogCarverGuard.Local&version=0.1.0
                    


                    

                
nuke :add-package LogCarverGuard.Local --version 0.1.0

LogCarverGuard.Local

A local MCP server that puts a statement guard, an optional read-only mode and an audit log between an AI agent and your SQL Server. It runs on your own machine, started by your AI tool over stdio: no server, no Docker, no API keys.

A guardrail, not a security boundary. It protects against an agent doing something destructive by accident. See "What it is, and is not" below.

Install

dotnet tool install -g LogCarverGuard.Local
claude mcp add logcarverguard --env LOGCARVERGUARD_CONNECTION_STRING="Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true" -- logcarverguard

To run it without installing, end the command with -- dotnet dnx LogCarverGuard.Local --yes.

What it does

One tool, execute_sql.

  • A SELECT returns its rows (the first 100 shown, with the true count).
  • A real T-SQL parser blocks DROP TABLE, DROP DATABASE, RESTORE, ALTER DATABASE ... SET, dynamic EXEC, sp_executesql, xp_cmdshell, identity switching (REVERT, EXECUTE AS), permission changes and caller-managed transactions. TRUNCATE, DROP COLUMN and named EXEC are blocked unless you allow-list them.
  • Data changes run in a transaction the proxy controls, so a batch of INSERT / UPDATE / DELETE is rolled back as a whole if one fails.
  • Every blocked or executed statement is written to a local SQLite audit log.
  • If SQL Server rejects a statement, the agent gets the reason instead of a generic error.

Settings

Environment variables only. An appsettings.json in the working directory is ignored.

Variable Purpose Default
LOGCARVERGUARD_CONNECTION_STRING (or _FILE) The login the statements run as required
LOGCARVERGUARD_READ_ONLY true allows queries only false
LOGCARVERGUARD_AUDIT_DB_PATH Audit log SQLite file LogCarverGuard/audit.db under your local application data folder
LOGCARVERGUARD_TRUNCATE_ALLOWLIST schema.table entries where TRUNCATE is allowed empty
LOGCARVERGUARD_EXEC_WHITELIST schema.procedure entries that may be EXEC'd empty
LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST schema.table entries where DROP COLUMN is allowed empty

A blank LOGCARVERGUARD_READ_ONLY or an unwritable audit path stops the server with a message instead of starting in a weaker state.

Read-only mode

Lets SELECT (without INTO) through, plus SET, DECLARE and PRINT. Everything else is blocked with a reason, including EXEC even when it is allow-listed, NEXT VALUE FOR, and the remote or file sources OPENQUERY, OPENROWSET and OPENDATASOURCE, which can run a write on another server.

Not covered: a SELECT that calls a CLR or extended-procedure function with side effects, long-running or expensive queries, and locks. Give the login only the permissions it needs; the guard is a second line of defence, not the first.

What it is, and is not

  • The connection string, and so the credentials, live on your machine and in your AI tool's configuration. An agent that can run shell commands or read that configuration can connect to SQL Server directly and skip this server.
  • Every statement runs as the one login in the connection string. There is no per-person identity; the audit log records the operating-system user name and is a local file.
  • It governs only the SQL sent through this MCP connection.
  • For a real boundary, use the central service in the repository: SQL Server accepts connections only from the proxy, and each person has their own login.

Tested on Windows with integrated authentication.

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

Version Downloads Last Updated
0.1.0 92 10/12/2026