# Contributing

Thanks for your interest. This project aims to be an official-quality, safe-by-default MCP
server for TiDB Cloud.

## Development

```bash
pnpm install
pnpm build         # tsc -b across the workspace
pnpm test          # unit tests (vitest)
pnpm lint          # eslint
pnpm format        # prettier --write
pnpm inspector     # explore the tools in the MCP Inspector
```

Requirements: Node >= 22, pnpm.

## Layout

- `packages/core` (`@tidbcloud-mcp/core`): host-agnostic API client, tools, auth, safety,
  observability.
- `packages/stdio` (`@tidbcloud-mcp/server`): local stdio transport (npx entry).
- `packages/remote` (`@tidbcloud-mcp/remote`): the Hono remote endpoint (Node adapter).

## Guidelines

- **Tests first.** Every new tool or module ships with tests; safety-relevant code
  (escaping, guards, preflight) gets thorough coverage.
- **Strict TypeScript.** No `any` escapes; keep Zod schemas precise.
- **Safety.** Mutating/destructive/billable tools use the `withPreflight`/confirm wrapper.
  Never log SQL, result rows, or credentials; route error strings through `redact()`.
- **Conventional Commits** with a DCO sign-off (`git commit -s`). Keep history clean.
- Run `pnpm build && pnpm lint && pnpm test` before opening a PR; CI runs the same.

## Changesets

User-facing changes need a changeset:

```bash
pnpm changeset
```

Describe the change and the semver bump; releases consume these to version and publish.

## Security

Please report vulnerabilities privately (see [SECURITY.md](SECURITY.md)), not in a public
issue.