fleetanalytics_mcp

kianiadee/fleetanalytics_mcp

Fork 0

Commit graph

Author	SHA1	Message	Date
kiania	f83f67e73f	feat(access): expose tickets + fuel schemas to analytics_ro (read-only) The analytics_ro role only had USAGE/SELECT on reporting + tracksolid, so the tickets schema (INC/CRQ, 8 tables + 1 view + 7 fns) and fuel schema were invisible to the MCP server — queries failed with permission denied. - analytics_ro_role.sql: GRANT USAGE/SELECT/EXECUTE on tickets + fuel. Default privileges for these are keyed to postgres (their owner), not tracksolid_owner, so future objects auto-grant correctly. - analytics_mcp.py: READABLE_SCHEMAS now includes tickets + fuel and is overridable via MCP_READABLE_SCHEMAS, so the introspection helpers (list_tables/describe_table/sample_table) work for them too. - deploy.sh: reuse existing analyst tokens from the running container when MCP_AUTH_TOKENS is unset, so a code-only redeploy needs no secret. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-17 11:37:25 +03:00
david kiania	1eda59fe06	feat: read-only Fleet Analytics MCP server Standalone, hosted MCP server that lets the decision & analytics team query the fleet database (reporting.* / tracksolid.*) from Claude — read-only, for reporting and decisions, never edit/delete. - analytics_mcp.py: FastMCP streamable-HTTP server. Tools: query (guarded single SELECT/WITH, auto-LIMIT, write/DDL blocked), list_schemas, list_tables, describe_table, list_functions, sample_table. Per-analyst Bearer auth; /healthz exempt. No ts_shared_rev import (carries no ingestion secrets). - Read-only enforced at four layers: analytics_ro GRANTs, default_transaction_read_only=on, rolled-back txn, SQL keyword guard. - scripts/: analytics_ro_role.sql + bootstrap_analytics_ro.sh (dedicated least-privilege role, password in host-only ~/.analytics_ro.pw). - Dockerfile + pyproject (uv, package=false) for Coolify build; deploy.sh manual host fallback (standalone Traefik bridge on the tracksolid_db host). - docs/ANALYTICS_MCP.{md,html} + README: architecture, deploy runbook, add-to-Claude, verification, security notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-16 23:43:24 +03:00

Author

SHA1

Message

Date

kiania

f83f67e73f

feat(access): expose tickets + fuel schemas to analytics_ro (read-only)

The analytics_ro role only had USAGE/SELECT on reporting + tracksolid, so
the tickets schema (INC/CRQ, 8 tables + 1 view + 7 fns) and fuel schema
were invisible to the MCP server — queries failed with permission denied.

- analytics_ro_role.sql: GRANT USAGE/SELECT/EXECUTE on tickets + fuel.
  Default privileges for these are keyed to postgres (their owner), not
  tracksolid_owner, so future objects auto-grant correctly.
- analytics_mcp.py: READABLE_SCHEMAS now includes tickets + fuel and is
  overridable via MCP_READABLE_SCHEMAS, so the introspection helpers
  (list_tables/describe_table/sample_table) work for them too.
- deploy.sh: reuse existing analyst tokens from the running container when
  MCP_AUTH_TOKENS is unset, so a code-only redeploy needs no secret.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-17 11:37:25 +03:00

david kiania

1eda59fe06

feat: read-only Fleet Analytics MCP server

Standalone, hosted MCP server that lets the decision & analytics team query
the fleet database (reporting.* / tracksolid.*) from Claude — read-only, for
reporting and decisions, never edit/delete.

- analytics_mcp.py: FastMCP streamable-HTTP server. Tools: query (guarded
  single SELECT/WITH, auto-LIMIT, write/DDL blocked), list_schemas,
  list_tables, describe_table, list_functions, sample_table. Per-analyst
  Bearer auth; /healthz exempt. No ts_shared_rev import (carries no ingestion
  secrets).
- Read-only enforced at four layers: analytics_ro GRANTs,
  default_transaction_read_only=on, rolled-back txn, SQL keyword guard.
- scripts/: analytics_ro_role.sql + bootstrap_analytics_ro.sh (dedicated
  least-privilege role, password in host-only ~/.analytics_ro.pw).
- Dockerfile + pyproject (uv, package=false) for Coolify build; deploy.sh
  manual host fallback (standalone Traefik bridge on the tracksolid_db host).
- docs/ANALYTICS_MCP.{md,html} + README: architecture, deploy runbook,
  add-to-Claude, verification, security notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-16 23:43:24 +03:00

2 commits