diff --git a/server/age-os/mcp-server/db.js b/server/age-os/mcp-server/db.js
index 4bf72c1b..de4f9dd5 100644
--- a/server/age-os/mcp-server/db.js
+++ b/server/age-os/mcp-server/db.js
@@ -17,7 +17,12 @@ const pool = new Pool({
   host:     process.env.ZY_DB_HOST || '127.0.0.1',
   port:     parseInt(process.env.ZY_DB_PORT || '5432', 10),
   user:     process.env.ZY_DB_USER || 'zy_admin',
-  password: process.env.ZY_DB_PASS || '',
+  password: process.env.ZY_DB_PASS || (() => {
+    if (process.env.NODE_ENV === 'production') {
+      console.error('[DB] 严重: 生产环境未配置ZY_DB_PASS');
+    }
+    return '';
+  })(),
   database: process.env.ZY_DB_NAME || 'age_os',
   max:      10,
   idleTimeoutMillis: 30000,
diff --git a/server/age-os/mcp-server/tools/node-ops.js b/server/age-os/mcp-server/tools/node-ops.js
index d10ebe12..94a0c5c6 100644
--- a/server/age-os/mcp-server/tools/node-ops.js
+++ b/server/age-os/mcp-server/tools/node-ops.js
@@ -201,12 +201,13 @@ async function queryNodes(input) {
   }
 
   const limit = Math.min(input.limit || 50, 200);
+  values.push(limit);
 
   const sql = `SELECT id, title, node_type, parent_id, path, tags, source, source_url, content_url, summary, status, owner, created_at, updated_at
     FROM brain_nodes
     WHERE ${conditions.join(' AND ')}
     ORDER BY updated_at DESC
-    LIMIT ${limit}`;
+    LIMIT $${paramIndex}`;
 
   const result = await db.query(sql, values);
 
diff --git a/server/age-os/mcp-server/tools/relation-ops.js b/server/age-os/mcp-server/tools/relation-ops.js
index f0ba365f..2052fbab 100644
--- a/server/age-os/mcp-server/tools/relation-ops.js
+++ b/server/age-os/mcp-server/tools/relation-ops.js
@@ -50,22 +50,18 @@ async function getRelations(input) {
   const values = [];
   let paramIndex = 1;
 
-  if (dir === 'outgoing' || dir === 'both') {
+  if (dir === 'both') {
+    conditions.push(`(from_node_id = $${paramIndex} OR to_node_id = $${paramIndex})`);
+    values.push(node_id);
+    paramIndex++;
+  } else if (dir === 'outgoing') {
     conditions.push(`from_node_id = $${paramIndex}`);
     values.push(node_id);
     paramIndex++;
-  }
-  if (dir === 'incoming' || dir === 'both') {
-    if (dir === 'both') {
-      // 用 OR 合并
-      conditions[0] = `(from_node_id = $1 OR to_node_id = $${paramIndex})`;
-      values.push(node_id);
-      paramIndex++;
-    } else {
-      conditions.push(`to_node_id = $${paramIndex}`);
-      values.push(node_id);
-      paramIndex++;
-    }
+  } else {
+    conditions.push(`to_node_id = $${paramIndex}`);
+    values.push(node_id);
+    paramIndex++;
   }
 
   if (relation_type) {