What happened
Before 1.1.0, the CLI and web clients decided whether to request write confirmation based only on the first keyword of the statement, so a SELECT-like statement that performs a write was not flagged for confirmation.
Why it matters
For AI agents driving SQL via MCP, this removes an intended human-confirmation guardrail, so an agent can execute a write the operator expected to be prompted about.
Attack vector
The bundled clients classify query_database statements only by their first keyword before deciding whether to show a write confirmation, so a statement that starts with a reading keyword but later performs a write bypasses the confirmation prompt.
Affected systems
pgedge-postgres-mcp < 1.1.0 (CLI/web client query classification)
Mitigation
Upgrade to pgedge-postgres-mcp 1.1.0; prefer explicit write-allowlisting / least-privilege DB roles.