fix: scope view search to the default schema (#364)

searchViews called connector.getSchemas() directly instead of
resolveDefaultSchemas(), unlike the tables/columns/procedures/indexes
paths. For MySQL/MariaDB, getSchemas() enumerates every user database on
the server, so `search_objects` with object_type "view" and no schema
filter listed views across all databases on the host even when the DSN
named a specific one — contradicting the anti-leak intent documented on
resolveDefaultSchemas.

Connectors that report no default schema (e.g. a MySQL DSN with no
database name) still fall back to the full list, so db-less connections
are unaffected.

Also corrects CLAUDE.md, which documented a `source_id` tool parameter
that does not exist. Multi-database routing is by tool name
(execute_sql_{source_id}); source_id appears in tool output metadata only.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tianzhou

CLAUDE.md

@@ -53,7 +53,7 @@ Key architectural patterns:
   - Runs in stateless mode (no SSE support) - GET requests to `/mcp` return 405 Method Not Allowed
   - Tests in `src/__tests__/json-rpc-integration.test.ts`
 - **Tool Handlers**: Clean separation of MCP protocol concerns
-  - Tools accept optional `source_id` parameter for multi-database routing
+  - Multi-database routing is by tool name, not by parameter: one tool instance is registered per source, named `execute_sql_{source_id}` / `search_objects_{source_id}` (single-source configs keep the bare `execute_sql` / `search_objects` names). See `src/tools/index.ts` and `src/utils/tool-metadata.ts`. `source_id` appears in tool *output* metadata only.
 - **Token-Efficient Schema Exploration**: Unified search/list tool with progressive disclosure
   - `search_objects`: Single tool for both pattern-based search and listing all objects
   - Pattern parameter defaults to `%` (match all) - optional for listing use cases
@@ -107,7 +107,7 @@ DBHub supports three configuration methods (in priority order):
   - Path expansion for `~/` in file paths
   - Automatic password redaction in logs
   - First source is the default database
-- Usage in MCP tools: Add optional `source_id` parameter (e.g., `execute_sql(sql, source_id="prod_pg")`)
+- Usage in MCP tools: each source gets its own tool, suffixed with the normalized source id (e.g. `execute_sql_prod_pg(sql)`, `search_objects_staging_mysql(...)`)
 - See `dbhub.toml.example` for complete configuration reference
 - Documentation: https://dbhub.ai/config/toml
 

src/tools/__tests__/search-objects.test.ts

@@ -1351,6 +1351,11 @@ describe('search_database_objects tool', () => {
         if (schema === 'other_db') return ['secrets'];
         return ['misc'];
       });
+      vi.mocked(mockConnector.getViews).mockImplementation(async (schema?: string) => {
+        if (schema === 'configured_db') return ['order_summary'];
+        if (schema === 'other_db') return ['secret_view'];
+        return ['misc_view'];
+      });
     });
 
     it('scopes table search to the default schema and never fans out to other databases', async () => {
@@ -1370,6 +1375,40 @@ describe('search_database_objects tool', () => {
       expect(mockConnector.getTables).toHaveBeenCalledWith('configured_db');
     });
 
+    it('scopes view search to the default schema and never fans out to other databases', async () => {
+      vi.mocked((mockConnector as any).getDefaultSchema).mockResolvedValue('configured_db');
+
+      const handler = createSearchDatabaseObjectsToolHandler();
+      const result = await handler(
+        { object_type: 'view', pattern: '%', detail_level: 'names' },
+        null
+      );
+
+      const parsed = parseToolResponse(result);
+      expect(parsed.data.results.map((r: any) => r.schema)).toEqual(['configured_db']);
+      expect(parsed.data.results.map((r: any) => r.name)).toEqual(['order_summary']);
+      // Only the configured database should have been inspected.
+      expect(mockConnector.getViews).toHaveBeenCalledTimes(1);
+      expect(mockConnector.getViews).toHaveBeenCalledWith('configured_db');
+    });
+
+    it('falls back to the full schema list for views when no default is configured (null)', async () => {
+      vi.mocked((mockConnector as any).getDefaultSchema).mockResolvedValue(null);
+
+      const handler = createSearchDatabaseObjectsToolHandler();
+      const result = await handler(
+        { object_type: 'view', pattern: '%', detail_level: 'names' },
+        null
+      );
+
+      const parsed = parseToolResponse(result);
+      expect(parsed.data.results.map((r: any) => r.schema)).toEqual([
+        'configured_db',
+        'other_db',
+        'third_db',
+      ]);
+    });
+
     it('scopes schema listing to the default schema', async () => {
       vi.mocked((mockConnector as any).getDefaultSchema).mockResolvedValue('configured_db');
 

src/tools/search-objects.ts

@@ -296,7 +296,7 @@ async function searchViews(
   if (schemaFilter) {
     schemasToSearch = [schemaFilter];
   } else {
-    schemasToSearch = await connector.getSchemas();
+    schemasToSearch = await resolveDefaultSchemas(connector);
   }
 
   // Search views in each schema