SQL Security Flaw: Gate the Statement, Not the Tool Name

A security review of the Dolt-over-MCP plugin revealed that blocking 'dangerous tools' by name provides no real protection, since a single query tool can execute any SQL verb including destructive ones. The core insight is that tool-name allowlisting is meaningless when a tool exposes a full sub-language like SQL, where harmful operations live inside the statement, not the tool itself. The fix shifts from tool-name grants to statement-level classification, sorting every SQL command into read, safe-write, or history-affecting categories before execution. A 259-line Python classifier now acts as a chokepoint, defaulting to deny for any unrecognized or ambiguous statement rather than relying on a denylist that could miss future commands. This approach applies least-privilege principles at the grammar level, ensuring agents can only execute statement classes they are explicitly permitted to run.