One tool, one transaction
Semicolon-separated mutations stay inside execute_dml_sql, receive one approval, and commit atomically in original order.
Safe DML
Approve the exact mutation evidence, then commit all or nothing.
execute_dml_sql handles one or more supported mutations through preview, approval, commit-time revalidation, and one server-owned atomic transaction. MCP Elicitation is the default approval path, with official Webhook and custom provider options.
Evidence-bound approval
UPDATE and DELETE bind exact row sets; INSERT VALUES binds immutable payloads and compiled commands.
Pluggable approval
Use MCP Elicitation, the official Webhook adapter, or a custom IDmlApprovalProvider without handing over SQL execution authority.
Atomic multi-statement DML without another tool
The built-in MCP surface stays small. execute_dml_sql itself accepts one or more supported UPDATE, DELETE, or INSERT VALUES statements separated by semicolons. A batch is approved once and committed as one server-owned transaction; any stale or failed statement rolls the whole transaction back.
Approval never becomes execution authority
Approval providers receive transport-neutral evidence rather than a database connection, transaction, validated plan, or commit primitive. hs-sql-agent keeps validation, evidence binding, revalidation, and execution inside the server boundary.
Durable external workflows still revalidate
An asynchronous provider can return Pending. A later completion reloads current authorization and database configuration, reparses and previews the DML, compares approved evidence, and only then creates a fresh short-lived execution challenge.