--- title: "Four Days of an Open SQL Endpoint. What Real Cricket Queries Needed, and the SSRF Someone Found in the First Couple of Hours." slug: db-mcp-four-days-ssrf-query-guards-aug2026 date_published: 2026-08-12T16:00:00.000Z original_url: https://www.tigzig.com/post/db-mcp-four-days-ssrf-query-guards-aug2026 source: fresh processed_at: 2026-08-12T16:00:00.000Z --- # Four Days of an Open SQL Endpoint. What Real Cricket Queries Needed, and the SSRF Someone Found in the First Couple of Hours. I put the Cricket database API / MCP live about four days ago, ball by ball data, open endpoint to run your SQL queries on my database. No key and no login. 650+ successful API calls since then and the two types of traffic - real cricket queries and exploitation attempts. I have changed a lot of things ... all of it came out of reading what callers were actually being refused. Two guard rules were turning away about 62% of real queries. The join limit was set so low that ordinary two table work broke, schema discovery was blocked, and the errors now tell you what to fix instead of just saying no. Plus many more tweaks to remove bottlenecks and speed up processing. At the same time, within the first couple of hours someone found an SSRF, server side request forgery, which is like getting my server to make network calls on their behalf. It worked. My read-only database connections had external access left switched on, which was a hole at my end. It came up in monitoring about ten minutes later and was closed inside the hour. I have since hardened the engine itself. The docs have been totally refurbished and updated with guidelines on what is allowed and what is blocked so it's easier at your end to setup and debug queries. - For humans: [db-mcp.tigzig.com/redoc](https://db-mcp.tigzig.com/redoc) - For agents: [db-mcp.tigzig.com/v1/openapi.json](https://db-mcp.tigzig.com/v1/openapi.json) ## How cricket analysts are using it A general sense of how cricket data analysts are using the API: scorecards rebuilt from the raw deliveries, death over analysis, bowler dismissal analysis, economy and strike rates, whether the toss changes anything, partnerships, batting first against chasing, phase of innings splits. And then head to head records, and the cuts by opposition, by year and by season. ## Some quick things from the docs - Up to 10 joins per select, subqueries three deep, and window functions are allowed, so partnerships, running totals and rank within an innings all work. - Two traps. `team1_icc_type` and `event` sit in `match_info`, not in the ball table, so a plain top run scorers query pools every level of international cricket and Associate nations come up alongside Full Members. And `match_info` carries all three formats in both engines while each ball table holds only one, so match counts will not reconcile unless you filter on `match_type`. - Scope is men's internationals only for now, no domestic or franchise cricket. - And two small ones. Every query caps at 1000 rows with a `truncated` flag, so set your own limit and a false on `truncated` is your proof nothing was cut. TSV output is way smaller than JSON if you are handing results to an agent. ## A bit more on the SSRF It was not a single request. It ran for around an hour and came from around 159 addresses, almost all used once, across 32 networks, two thirds cloud and the rest home broadband and other providers. Dozens of attempts were refused before anything went through, including every file and URL reader function, an attempt to disguise a function name, and eleven separate attempts to switch a security setting off. What eventually worked was a string evaluation path with the blocked keyword assembled at runtime, so the filter never saw the word it was looking for. That class of bypass is closed now, at more than one level. What it reached was a public file. Nothing was aimed at my data, and nothing internal was touched. ## Related Tools: [DATS-4 Database AI Suite](https://www.tigzig.com/analyzer), [BRIQ](https://www.tigzig.com/briq), [QRep - Security Reports](https://www.tigzig.com/qrep) Explore: [API and MCP catalog](https://www.tigzig.com/apis), [Security checklist](https://www.tigzig.com/security), [Database AI apps](https://www.tigzig.com/database-landing) More posts: [A Database Server With API and MCP You Can Point an AI Agent At, With Ball-by-Ball Cricket Behind It.](https://www.tigzig.com/post/db-mcp-cricket-ball-by-ball-api-aug2026), [Demystifying TIGZIG API Errors: A Practical Guide for MFPRO, TREMOR, and VIGIL Users](https://www.tigzig.com/post/tigzig-api-errors-practical-guide-jul2026), [Zero Callers Rate Limited in 24 Hours. 6,500+ Calls and 9.7 GB Served, After the TigZig API Limits Went Up.](https://www.tigzig.com/post/tigzig-api-zero-rate-limited-aug2026), [VIGIL Data API and Download - 315K+ Records, 7 Tables, Updated Daily](https://www.tigzig.com/post/vigil-data-api-download) --- Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar Source: https://www.tigzig.com/post/db-mcp-four-days-ssrf-query-guards-aug2026 Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar. License: https://www.tigzig.com/terms