Skip to content

fix(mcp): coupon tools return the coupon, not its column list (1.9.3) - #97

Merged
ralyodio merged 2 commits into
masterfrom
fix/mcp-coupon-columns
Oct 26, 2026
Merged

ralyodio merged 2 commits into
masterfrom
fix/mcp-coupon-columns

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

The MCP coupon tools returned no coupons. db.sql binds every ${} as a parameter, so SELECT ${couponFields} selected the column list as a single string literal. Live, top_coupons came back as:

{ "?column?": "c.id, c.code, c.title, ...", "store_name": "Profullstack", "store_slug": "profullstack" }

This affected search_coupons, top_coupons, store_coupons and get_coupon: no id, code or title.

  • The columns are now written into each query.
  • New test/mcp-tools.test.mjs runs the four tools against the real migration in a libSQL file. It fails on master and passes here. Full suite: 84 pass.
  • Version bumped to 1.9.3.

🤖 Generated with Claude Code

db.sql binds every ${} as a parameter, so `SELECT ${couponFields}` selected
the column list as one string literal. search_coupons, top_coupons,
store_coupons and get_coupon returned `?column?: "c.id, c.code, ..."` plus
the store name, and no code, title or id. The columns are now written into
each query, and test/mcp-tools.test.mjs runs the four tools against the
real migration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comment thread test/mcp-tools.test.mjs Fixed
@github-actions

github-actions Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

ThreatCrush Security Scan

38 finding(s)

MEDIUM: 32 | LOW: 6

Severity Rule Location
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:18
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:34
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:43
MEDIUM sql-template-interpolation apps/web/app/api/bounties/route.ts:95
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:68
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:75
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:31
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:33
MEDIUM sql-template-interpolation apps/web/app/api/stores/[slug]/route.ts:9
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:83
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:90
MEDIUM js-open-redirect apps/web/app/bounties/new/page.tsx:61
MEDIUM js-unescaped-html-sink apps/web/app/coupons/[id]/page.tsx:57
MEDIUM js-unescaped-html-sink apps/web/app/layout.tsx:89
MEDIUM sql-template-interpolation apps/web/app/stores/[slug]/page.tsx:16
MEDIUM js-unescaped-html-sink apps/web/components/PitFooter.tsx:24
MEDIUM sql-template-interpolation apps/web/lib/bbs-post.ts:164
MEDIUM sql-template-interpolation apps/web/lib/flipp-sync.ts:445
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:573
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:643
MEDIUM sql-template-interpolation apps/web/lib/mcp-tools.ts:79
MEDIUM sql-template-interpolation apps/web/lib/members.ts:54
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:186
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:206
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:336
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:355
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:361
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:115
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:170
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:37
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:39
MEDIUM sql-template-interpolation apps/web/scripts/migrate.mjs:192
LOW sql-template-interpolation test/bbs-post.test.mjs:129
LOW sql-template-interpolation test/bbs-post.test.mjs:143
LOW sql-template-interpolation test/bbs-post.test.mjs:164
LOW sql-template-interpolation test/inbound-email.test.mjs:139
LOW sql-template-interpolation test/reveal-sweep.test.mjs:69
LOW sql-template-interpolation test/reveal-sweep.test.mjs:112

Snippets are redacted; ThreatCrush never prints matched credential material.

…ons keep their own DB

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit c228458 into master Oct 26, 2026
5 checks passed
@ralyodio
ralyodio deleted the fix/mcp-coupon-columns branch October 26, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants