execute_sql · Qtz Iris MCP: Risk & Policy

WHAT IT DOES

What execute_sql does on Qtz Iris

AI agents invoke execute_sql to trigger actions in Qtz Iris. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

PARAMETERS

Parameter	Type	Required	Description
`query`	string	Yes	SQL 查询语句
`parameters`	array	—	查询参数数组（可选）

Parameters from the server's own tool schema.

WHY IT NEEDS A POLICY

Why execute_sql needs a policy

Although the description only mentions 'return results', the tool name and function indicate it executes SQL queries without restriction. SQL execution is inherently an Execute category risk because it triggers database operations whose effects depend entirely on the query argument.

From the tool's definition Tool name 'execute_sql' combined with description '执行 SQL 查询并返回结果' (Execute SQL query and return results) indicates execution of arbitrary SQL statements.

Risk signalsAccepts freeform code/query input (query)

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

execute_sql Rate-limited

execute_sql stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "execute_sql": {
      "limits": [
        {
          "counter": "execute_sql_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Qtz Iris, so you can run agents against it safely.

FAQ

Questions about execute_sql

What does the execute_sql tool do? +

执行 SQL 查询并返回结果. It is categorised as a Execute tool in the Qtz Iris MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

What parameters does execute_sql accept? +

execute_sql accepts 2 parameters: query, parameters. Required: query. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on execute_sql? +

Register the Qtz Iris MCP server in PolicyLayer and add a rule for execute_sql: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Qtz Iris. Nothing to install.

What risk level is execute_sql? +

execute_sql is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit execute_sql? +

Yes. Add a rate_limit block to the execute_sql rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block execute_sql completely? +

Set action: deny in the PolicyLayer policy for execute_sql. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides execute_sql? +

execute_sql is provided by the Qtz Iris MCP server (qtz-iris-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.