1eda59fe06
Standalone, hosted MCP server that lets the decision & analytics team query
the fleet database (reporting.* / tracksolid.*) from Claude — read-only, for
reporting and decisions, never edit/delete.
- analytics_mcp.py: FastMCP streamable-HTTP server. Tools: query (guarded
single SELECT/WITH, auto-LIMIT, write/DDL blocked), list_schemas,
list_tables, describe_table, list_functions, sample_table. Per-analyst
Bearer auth; /healthz exempt. No ts_shared_rev import (carries no ingestion
secrets).
- Read-only enforced at four layers: analytics_ro GRANTs,
default_transaction_read_only=on, rolled-back txn, SQL keyword guard.
- scripts/: analytics_ro_role.sql + bootstrap_analytics_ro.sh (dedicated
least-privilege role, password in host-only ~/.analytics_ro.pw).
- Dockerfile + pyproject (uv, package=false) for Coolify build; deploy.sh
manual host fallback (standalone Traefik bridge on the tracksolid_db host).
- docs/ANALYTICS_MCP.{md,html} + README: architecture, deploy runbook,
add-to-Claude, verification, security notes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
4.6 KiB
Bash
Executable file
77 lines
4.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# deploy.sh — manual host deploy for the read-only Fleet Analytics MCP server.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Use this if you are NOT letting Coolify build the Dockerfile (see README §Deploy
|
|
# for the Coolify-managed path, which is the recommended default). This script
|
|
# builds the image from this repo ON THE HOST and runs it as a standalone
|
|
# Traefik-labelled bridge — the same proven pattern as the dashboard_api bridges:
|
|
# it joins the network that can reach timescale_db, derives a READ-ONLY DATABASE_URL
|
|
# for the analytics_ro role, and exposes the MCP over HTTPS with Bearer auth.
|
|
#
|
|
# Prereqs ON THE HOST:
|
|
# * the analytics_ro role exists -> scripts/bootstrap_analytics_ro.sh (writes ~/.analytics_ro.pw)
|
|
# * this repo is checked out (e.g. ~/fleetanalytics_mcp) — run this script from inside it
|
|
#
|
|
# Run:
|
|
# cd ~/fleetanalytics_mcp && git pull
|
|
# MCP_AUTH_TOKENS="alice:$(openssl rand -hex 16)" bash deploy.sh
|
|
#
|
|
# A token/env change needs a container RECREATE — this script does that. Record
|
|
# each analyst's token securely; it is only shown once (when you generate it).
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
|
|
NAME=analytics_mcp
|
|
PORT=8892
|
|
HOST_DOMAIN="${HOST_DOMAIN:-fleetmcp.fivetitude.com}" # prod: fleetmcp.rahamafresh.com
|
|
IMAGE="fleetanalytics-mcp:latest"
|
|
ENV_FILE="$(pwd)/.deploy.env"
|
|
: "${MCP_AUTH_TOKENS:?set MCP_AUTH_TOKENS=name:token[,name:token...] before running (per-analyst Bearer tokens)}"
|
|
|
|
# Resolve the network + DB DSN from the running webhook_receiver (it sits on the
|
|
# same internal network as timescale_db and holds a DATABASE_URL we can reuse the
|
|
# host:port/dbname from). This avoids hardcoding the internal DB hostname.
|
|
WH=$(docker ps --filter name=webhook_receiver --format "{{.Names}}" | head -1)
|
|
[ -n "$WH" ] || { echo "ERROR: webhook_receiver container not found (need the tracksolid stack running)"; exit 1; }
|
|
APPNET=$(docker inspect "$WH" --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}')
|
|
SRC_DB_URL=$(docker inspect "$WH" --format '{{range .Config.Env}}{{println .}}{{end}}' | sed -n 's/^DATABASE_URL=//p' | head -1)
|
|
[ -n "$SRC_DB_URL" ] || { echo "ERROR: DATABASE_URL not found in $WH env"; exit 1; }
|
|
echo "Reusing network $APPNET (from $WH)"
|
|
|
|
# Build a READ-ONLY DATABASE_URL: app DB host:port/dbname + analytics_ro creds.
|
|
RO_PW=$(cat "${ANALYTICS_RO_PW_FILE:-$HOME/.analytics_ro.pw}" 2>/dev/null || true)
|
|
[ -n "$RO_PW" ] || { echo "ERROR: ~/.analytics_ro.pw missing — run scripts/bootstrap_analytics_ro.sh first"; exit 1; }
|
|
HOSTPART="${SRC_DB_URL#*@}" # host:port/dbname[?params]
|
|
RO_DB_URL="postgresql://analytics_ro:${RO_PW}@${HOSTPART}"
|
|
|
|
# Build the image from this repo.
|
|
echo "Building $IMAGE ..."
|
|
docker build -t "$IMAGE" .
|
|
|
|
# Minimal env (read-only DSN + auth only — no Tracksolid ingestion secrets).
|
|
{ echo "DATABASE_URL=${RO_DB_URL}"; echo "MCP_AUTH_TOKENS=${MCP_AUTH_TOKENS}"; } > "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
|
|
docker rm -f "$NAME" 2>/dev/null || true
|
|
docker run -d --name "$NAME" --restart unless-stopped \
|
|
--network "$APPNET" \
|
|
--env-file "$ENV_FILE" \
|
|
--label 'traefik.enable=true' \
|
|
--label 'traefik.docker.network=coolify' \
|
|
--label 'traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https' \
|
|
--label "traefik.http.routers.http-0-fleetmcp.entryPoints=http" \
|
|
--label "traefik.http.routers.http-0-fleetmcp.middlewares=redirect-to-https" \
|
|
--label "traefik.http.routers.http-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.entryPoints=https" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.tls=true" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.tls.certresolver=letsencrypt" \
|
|
--label "traefik.http.services.fleetmcp.loadbalancer.server.port=${PORT}" \
|
|
"$IMAGE"
|
|
|
|
docker network connect coolify "$NAME" 2>/dev/null || true
|
|
rm -f "$ENV_FILE"
|
|
sleep 5
|
|
echo "== container =="; docker ps --filter name="$NAME" --format "{{.Names}} | {{.Status}}"
|
|
echo "== DB role (expect analytics_ro) =="; docker exec "$NAME" sh -lc 'printenv DATABASE_URL | sed -E "s#://([^:]+):[^@]+@#://\1:<pw>@#"'
|
|
echo "== health =="; docker exec "$NAME" sh -lc "curl -s http://localhost:${PORT}/healthz" 2>&1 | head
|