MillerMedia

Postgres Read-Only MCP Server

Minimal MCP server for running read-only SQL queries against any Postgres database. Runs locally, connects directly to the database. No third-party services involved.

Setup

1. Install dependencies

pip install mcp asyncpg

MillerMedia

These are settings that I like to use for WordPress sites to mitigate common malicious traffic. These generally get around the Cloudflare WAF so are good supplemental rules to add.  
  
These can be created by going to Security -> WAF, click the 'Custom Rules' tab and then click 'Create Rule'

___

# Title
Challenge all PHP page requests that aren't wp-admin or wp-login

## Conditions

MillerMedia

GraphQL Playgrounds:

http.title:"GraphQL Playground"
http.title:"GraphiQL"

MillerMedia

<?php
/*
	This program is free software; you can redistribute it and/or modify
    	it under the terms of the GNU General Public License as published by
    	the Free Software Foundation; either version 2 of the License, or
    	(at your option) any later version.

	This program is distributed in the hope that it will be useful,
    	but WITHOUT ANY WARRANTY; without even the implied warranty of
    	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

MillerMedia

import socket
import logging
import re
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import hashlib

# Configure logging
logging.basicConfig(level=logging.INFO)

# Server details

MillerMedia

import requests
from bs4 import BeautifulSoup
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Check for command argument
if len(sys.argv) != 2:
    print("Usage: python script.py <command>")
    sys.exit(1)

MillerMedia

(http.request.uri.path contains "php" and not http.request.uri.path contains "wp-login" and not http.request.uri.path contains "wp-cron" and not http.request.uri.path contains "wp-admin/" and not http.request.uri.path contains "wp-admin/a" and not http.request.uri.path contains "wp-admin/c" and not http.request.uri.path contains "wp-admin/e" and not http.request.uri.path contains "wp-admin/f" and not http.request.uri.path contains "wp-admin/i" and not http.request.uri.path contains "wp-admin/l" and not http.request.uri.path contains "wp-admin/m" and not http.request.uri.path contains "wp-admin/n" and not http.request.uri.path contains "wp-admin/o" and not http.request.uri.path contains "wp-admin/p" and not http.request.uri.path contains "wp-admin/r" and not http.request.uri.path contains "wp-admin/s" and not http.request.uri.path contains "wp-admin/t" and not http.request.uri.path contains "wp-admin/u" and not http.request.uri.path contains "wp-admin/w" and not http.request.uri.path contains "/php/")

MillerMedia

/**
MIT License

Copyright (c) 2022 Matt Miller

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

MillerMedia

wget http://wordpress.org/latest.tar.gz;tar xfz latest.tar.gz;mv wordpress/* ./;rmdir ./wordpress/;rm -f latest.tar.gz;

MillerMedia

if(!VOLUSION_HELPERS){
	throw new Error('Volusion Helpers functions not available. Aborting.');
}

var PRODUCT_PAGE_OPTIONS = PRODUCT_PAGE_OPTIONS || {};

PRODUCT_PAGE_OPTIONS.ajax = {
	updateOptions: function( cartItemUrl ){
		jQuery.get( cartItemUrl, function( data ) {
			// Parse the list items