Migrate SQL Sanitizer plugin from mcp-context-forge

[madhu-mohan-jaishankar]

Summary

Migrate the sql_sanitizer plugin from mcp-context-forge/plugins/sql_sanitizer/ into this repository (cpex-plugins), following the same structure used by existing plugins here.

Source

• Current location: mcp-context-forge/plugins/sql_sanitizer/
• Files to migrate:
  • sql_sanitizer.py
  • plugin-manifest.yaml
  • __init__.py
  • README.md
  • tests/unit/plugins/test_sql_sanitizer.py
  • tests/live_gateway/plugins/test_sql_sanitizer_e2e.py

What the plugin does

Detects risky SQL patterns in tool arguments and prompt args. Supports:

• Blocking dangerous statements (DROP, TRUNCATE, ALTER, GRANT, REVOKE) via configurable regex patterns
• Blocking DELETE without WHERE clause
• Blocking UPDATE without WHERE clause
• Stripping SQL comments
• Requiring parameterized queries
• Audit-only mode (detect but don't block) via block_on_violation flag

Migration tasks

• Move plugin source and manifest into cpex-plugins plugin structure
• Update imports from mcpgateway.plugins.framework / cpex.framework as appropriate for this repo
• Port unit tests
• Port e2e tests
• Update README.md with any repo-specific instructions
• Verify CI passes

Notes

The plugin currently lives in two slightly different forms — one in mcp-context-forge/plugins/sql_sanitizer/ (uses cpex.framework) and one in mcpcontextforge-internal/mcp-context-forge/plugins/sql_sanitizer/ (uses mcpgateway.plugins.framework with a simpler non-recursive _scan_args). The mcp-context-forge version with the recursive _scan_value should be used as the source of truth for migration.