What happened
Before 1.1.0, write-confirmation logic matched only the query_database tool name, so an agent-invoked custom tool that writes data ran without the intended human confirmation.
Why it matters
Removes a guardrail around agent-driven database writes, allowing an agent (or prompt injection) to modify data silently.
Attack vector
The bundled clients decided whether to request write confirmation by checking only for the query_database tool name, so custom tool calls that perform writes were executed without a confirmation prompt.
Affected systems
pgedge-postgres-mcp < 1.1.0
Mitigation
Upgrade to pgedge-postgres-mcp 1.1.0; set DB roles to least privilege.