Ops MCP Server

A role only sees the tools it may call: a tool that isn't registered can't be prompt-injected into use. The warehouse data comes from the published results of logmine-bench, drive-early-warning and vm-rightsizer (snapshots in the repo).

• Read-only by construction. Each role gets its own in-memory DuckDB copy with enable_external_access=false and locked configuration: no file reads, no writes that persist, no ATTACH.
• SQL guard (analyst only): exactly one statement, type SELECT, a keyword/table-function denylist, row cap 500, 5 s timeout that cancels the query.
• Least privilege. Default role is viewer: curated tools only, example log lines have IPs and hostnames redacted.
• Audit log. Every call, including refusals, is appended to a JSONL file with a SHA-256 hash chain; editing, deleting or reordering a record breaks verification.

These runs execute a reference plan per task through a real MCP client and compare with answers computed from the raw tables with pandas. They validate the tools and the guardrails. They do not measure how well an LLM agent uses the tools: python -m opsmcp.agent_eval does that with Gemini, and has not been run (no API key at build time).

{
  "mcpServers": {
    "ops-warehouse": {
      "command": "python",
      "args": ["-m", "opsmcp"],
      "env": { "OPS_MCP_ROLE": "viewer", "OPS_MCP_AUDIT": "audit/audit.jsonl" }
    }
  }
}