A forbidden row never appears. Then the database says duplicate key or foreign key violation—and the caller learns that a hidden value exists.
Errors are outputs. They can reveal tenant existence, schema details, identifiers, query structure, and infrastructure state.
For database tools used by AI clients:
- keep raw SQLSTATE, constraint, and traces in a restricted audit path
- return stable public error classes
- authorize before distinguishing “missing” from “exists elsewhere”
- prefer tenant-scoped uniqueness where semantics allow it
- normalize globally unique conflicts
- rate-limit repeated probes
- retry only explicitly transient classes
Test body, status, timing, and retry behavior—not just returned rows. A green RLS read test says nothing about constraint and error oracles.
Full guide: MCP database errors need a side-channel contract
Top comments (0)