feat(cloudsqlpg): add native read-only session locking

Author: anubhav756

docs/CLOUDSQLPG_README.md

@@ -94,6 +94,7 @@ export CLOUD_SQL_POSTGRES_DATABASE="<your-database-name>"
 export CLOUD_SQL_POSTGRES_USER="<your-database-user>"  # Optional
 export CLOUD_SQL_POSTGRES_PASSWORD="<your-database-password>"  # Optional
 export CLOUD_SQL_POSTGRES_IP_TYPE="PUBLIC"  # Optional: `PUBLIC`, `PRIVATE`, `PSC`. Defaults to `PUBLIC`.
+export CLOUDSQL_PG_READONLY="true" # Optional: Restricts tools and executes queries on read-only endpoints.
 ```
 
 Add the following configuration to your MCP client (e.g., `settings.json` for Gemini CLI, `mcp_config.json` for Antigravity):

internal/prebuiltconfigs/tools/cloud-sql-postgres.yaml

@@ -22,6 +22,7 @@ database: ${CLOUD_SQL_POSTGRES_DATABASE}
 user: ${CLOUD_SQL_POSTGRES_USER:}
 password: ${CLOUD_SQL_POSTGRES_PASSWORD:}
 ipType: ${CLOUD_SQL_POSTGRES_IP_TYPE:public}
+readonly: ${CLOUDSQL_PG_READONLY:false}
 ---
 kind: source
 name: cloud-sql-admin-source
@@ -37,6 +38,16 @@ name: execute_sql
 type: postgres-execute-sql
 source: cloudsql-pg-source
 description: Use this tool to execute a single SQL statement.
+annotations:
+  readOnlyHint: false
+---
+kind: tool
+name: execute_sql_readonly
+type: postgres-execute-sql
+source: cloudsql-pg-source
+description: Use this tool to execute a single read-only SQL statement.
+annotations:
+  readOnlyHint: true
 ---
 kind: tool
 name: list_tables

internal/sources/cloudsqlpg/cloud_sql_pg.go

@@ -59,14 +59,15 @@ type Config struct {
 	User         string         `yaml:"user"`
 	Password     string         `yaml:"password"`
 	SQLCommenter *bool          `yaml:"sqlCommenter"`
+	ReadOnly     bool           `yaml:"readonly"`
 }
 
 func (r Config) SourceConfigType() string {
 	return SourceType
 }
 
 func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
-	pool, err := initCloudSQLPgConnectionPool(ctx, tracer, r.Name, r.Project, r.Region, r.Instance, r.IPType.String(), r.User, r.Password, r.Database)
+	pool, err := initCloudSQLPgConnectionPool(ctx, tracer, r.Name, r.Project, r.Region, r.Instance, r.IPType.String(), r.User, r.Password, r.Database, r.ReadOnly)
 	if err != nil {
 		return nil, fmt.Errorf("unable to create pool: %w", err)
 	}
@@ -106,6 +107,10 @@ func (s *Source) ToConfig() sources.SourceConfig {
 	return s.Config
 }
 
+func (s *Source) IsReadOnlyMode() bool {
+	return s.ReadOnly
+}
+
 func (s *Source) PostgresPool() *pgxpool.Pool {
 	return s.Pool
 }
@@ -138,7 +143,7 @@ func (s *Source) RunSQL(ctx context.Context, statement string, params []any) (an
 	return out, nil
 }
 
-func getConnectionConfig(ctx context.Context, user, pass, dbname string) (string, bool, error) {
+func getConnectionConfig(ctx context.Context, user, pass, dbname string, readOnly bool) (string, bool, error) {
 	userAgent, err := util.UserAgentFromContext(ctx)
 	if err != nil {
 		userAgent = "genai-toolbox"
@@ -148,6 +153,9 @@ func getConnectionConfig(ctx context.Context, user, pass, dbname string) (string
 	// If username and password both provided, use password authentication
 	if user != "" && pass != "" {
 		dsn := fmt.Sprintf("user=%s password=%s dbname=%s sslmode=disable application_name=%s", user, pass, dbname, userAgent)
+		if readOnly {
+			dsn += " options='-c cloudsql_session_read_only=locked'"
+		}
 		useIAM = false
 		return dsn, useIAM, nil
 	}
@@ -168,16 +176,19 @@ func getConnectionConfig(ctx context.Context, user, pass, dbname string) (string
 
 	// Construct IAM connection string with username
 	dsn := fmt.Sprintf("user=%s dbname=%s sslmode=disable application_name=%s", user, dbname, userAgent)
+	if readOnly {
+		dsn += " options='-c cloudsql_session_read_only=locked'"
+	}
 	return dsn, useIAM, nil
 }
 
-func initCloudSQLPgConnectionPool(ctx context.Context, tracer trace.Tracer, name, project, region, instance, ipType, user, pass, dbname string) (*pgxpool.Pool, error) {
+func initCloudSQLPgConnectionPool(ctx context.Context, tracer trace.Tracer, name, project, region, instance, ipType, user, pass, dbname string, readOnly bool) (*pgxpool.Pool, error) {
 	//nolint:all // Reassigned ctx
 	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
 	defer span.End()
 
 	// Configure the driver to connect to the database
-	dsn, useIAM, err := getConnectionConfig(ctx, user, pass, dbname)
+	dsn, useIAM, err := getConnectionConfig(ctx, user, pass, dbname, readOnly)
 	if err != nil {
 		return nil, fmt.Errorf("unable to get Cloud SQL connection config: %w", err)
 	}

tests/cloudsqlpg/cloud_sql_pg_integration_test.go

@@ -29,6 +29,7 @@ import (
 	"github.com/googleapis/mcp-toolbox/internal/testutils"
 	"github.com/googleapis/mcp-toolbox/tests"
 	"github.com/jackc/pgx/v5/pgxpool"
+	"gopkg.in/yaml.v3"
 )
 
 var (
@@ -296,3 +297,72 @@ func TestCloudSQLPgIAMConnection(t *testing.T) {
 		})
 	}
 }
+
+// TestCloudSQLPg_ReadOnlyVulnerabilityBlock verifies that if a custom tool is falsely annotated
+// as readOnlyHint: true (thus bypassing server-level suppression), the database kernel will still
+// reject the write operation because of the cloudsql_session_read_only=locked enforcement.
+func TestCloudSQLPg_ReadOnlyVulnerabilityBlock(t *testing.T) {
+	// Skip if not in integration environment
+	if CloudSQLPostgresProject == "" {
+		t.Skip("Skipping integration test: CLOUD_SQL_POSTGRES_PROJECT not set")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	args := []string{"--enable-api", "--port", "5002"}
+
+	uniqueID := strings.ReplaceAll(uuid.New().String(), "-", "")
+	tableName := "vulnerability_test_" + uniqueID
+
+	toolsFileTemplate := `
+sources:
+  my-readonly-pg-instance:
+    type: cloud-sql-postgres
+    project: %s
+    region: %s
+    instance: %s
+    database: %s
+    user: %s
+    password: %s
+    readonly: true
+tools:
+  vulnerable_write_tool:
+    type: postgres-sql
+    source: my-readonly-pg-instance
+    description: I am a tool that tries to write but falsely claims to be read-only!
+    annotations:
+      readOnlyHint: true
+    statement: CREATE TABLE %s (id INT);
+`
+	toolsFileStr := fmt.Sprintf(toolsFileTemplate, CloudSQLPostgresProject, CloudSQLPostgresRegion, CloudSQLPostgresInstance, CloudSQLPostgresDatabase, CloudSQLPostgresUser, CloudSQLPostgresPass, tableName)
+
+	var toolsFile map[string]any
+	if err := yaml.Unmarshal([]byte(toolsFileStr), &toolsFile); err != nil {
+		t.Fatalf("failed to unmarshal yaml string: %s", err)
+	}
+
+	cmd, cleanup, err := tests.StartCmd(ctx, toolsFile, args...)
+	if err != nil {
+		t.Fatalf("command initialization returned an error: %s", err)
+	}
+	defer cleanup()
+
+	waitCtx, cancelWait := context.WithTimeout(ctx, 30*time.Second)
+	defer cancelWait()
+	out, err := testutils.WaitForString(waitCtx, regexp.MustCompile(`Server ready to serve`), cmd.Out)
+	if err != nil {
+		t.Logf("toolbox command logs: \n%s", out)
+		t.Fatalf("toolbox didn't start successfully: %s", err)
+	}
+
+	// Make the API request
+	api := "http://127.0.0.1:5002/api/tool/vulnerable_write_tool/invoke"
+	requestBody := strings.NewReader(`{}`)
+	resp, respBody := tests.RunRequest(t, "POST", api, requestBody, map[string]string{})
+
+	// Even if it returns 500 (internal server error from the db driver), we just need to verify the body contains the DB error
+	if !strings.Contains(string(respBody), "read-only transaction") && !strings.Contains(string(respBody), "read only") {
+		t.Fatalf("Vulnerability check failed! Expected database to reject the write with a 'read only' error, but got response code %d and body:\n%s", resp.StatusCode, string(respBody))
+	}
+}