1eda59fe06
Standalone, hosted MCP server that lets the decision & analytics team query
the fleet database (reporting.* / tracksolid.*) from Claude — read-only, for
reporting and decisions, never edit/delete.
- analytics_mcp.py: FastMCP streamable-HTTP server. Tools: query (guarded
single SELECT/WITH, auto-LIMIT, write/DDL blocked), list_schemas,
list_tables, describe_table, list_functions, sample_table. Per-analyst
Bearer auth; /healthz exempt. No ts_shared_rev import (carries no ingestion
secrets).
- Read-only enforced at four layers: analytics_ro GRANTs,
default_transaction_read_only=on, rolled-back txn, SQL keyword guard.
- scripts/: analytics_ro_role.sql + bootstrap_analytics_ro.sh (dedicated
least-privilege role, password in host-only ~/.analytics_ro.pw).
- Dockerfile + pyproject (uv, package=false) for Coolify build; deploy.sh
manual host fallback (standalone Traefik bridge on the tracksolid_db host).
- docs/ANALYTICS_MCP.{md,html} + README: architecture, deploy runbook,
add-to-Claude, verification, security notes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
25 lines
1 KiB
Docker
25 lines
1 KiB
Docker
# fleetanalytics-mcp — read-only Fleet Analytics MCP server.
|
|
# Coolify auto-detects this Dockerfile: set the app port to 8892, attach the
|
|
# domain (e.g. fleetmcp.rahamafresh.com) in the Coolify UI, set DATABASE_URL
|
|
# (analytics_ro DSN) + MCP_AUTH_TOKENS as secrets, and connect the app to the
|
|
# network that can reach timescale_db. See README.md / docs/ANALYTICS_MCP.md.
|
|
FROM python:3.12-slim
|
|
|
|
# uv for fast, reproducible dependency installs.
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
|
|
|
|
WORKDIR /app
|
|
|
|
# Install ONLY dependencies (flat module — the project itself is not a package).
|
|
COPY pyproject.toml ./
|
|
RUN uv sync --no-dev --no-install-project
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
COPY analytics_mcp.py ./
|
|
|
|
EXPOSE 8892
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
|
|
CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8892/healthz').status==200 else 1)" || exit 1
|
|
|
|
CMD ["uvicorn", "analytics_mcp:app", "--host", "0.0.0.0", "--port", "8892", "--workers", "2"]
|