graylog-mcp 0.3.0__tar.gz

graylog_mcp-0.3.0/.dockerignore

@@ -0,0 +1,8 @@
+.git
+.venv
+**/__pycache__
+.pytest_cache
+.ruff_cache
+dist
+tests
+examples

graylog_mcp-0.3.0/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,toml,json,md}]
+indent_size = 2

graylog_mcp-0.3.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @ntbang0901

graylog_mcp-0.3.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,34 @@
+name: Bug report
+description: Something does not work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: "Do not paste log lines, tokens or URLs of private Graylog instances. For security problems (for example a value that should be masked but is not), see SECURITY.md instead."
+  - type: input
+    id: version
+    attributes:
+      label: graylog-mcp version
+      placeholder: "graylog-mcp --version"
+    validations:
+      required: true
+  - type: input
+    id: graylog
+    attributes:
+      label: Graylog version and search backend
+      placeholder: "6.1.16 with OpenSearch 2.15 (shown by list_instances)"
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened and what you expected
+      description: The tool called, its arguments and the (redacted) result or error.
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Relevant configuration
+      description: Remove secrets and hostnames.
+      render: toml

graylog_mcp-0.3.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security problem
+    url: https://github.com/ntbang0901/graylog-mcp/security/advisories/new
+    about: Report a vulnerability or a masking gap privately.

graylog_mcp-0.3.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: A tool, option or behaviour you would like
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to investigate or automate, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: How it could work. Note that the server must stay read-only towards Graylog.

graylog_mcp-0.3.0/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      python:
+        patterns: ["*"]
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly

graylog_mcp-0.3.0/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## What and why
+
+<!-- What does this change and which problem does it solve? Link the issue if there is one. -->
+
+## How it was tested
+
+- [ ] `uv run pytest` (unit + contract)
+- [ ] `uv run ruff check && uv run ruff format --check && uv run mypy`
+- [ ] Integration against real Graylog (`tests/integration/run.sh <v43|v50|v52|v61|v70>`) — needed for changes to `backends/`, `client.py` or query building
+
+## Checklist
+
+- [ ] The server still never writes to Graylog (only GET, and POST to the read-only search endpoints)
+- [ ] New output goes through redaction and the size budget
+- [ ] CHANGELOG.md updated under "Unreleased"

graylog_mcp-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,156 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+    tags-ignore: ["**"]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: "1"
+  UV_LOCKED: "1"   # every uv command must match uv.lock
+
+# Branch pushes run CI directly; pull requests run only when they come from a fork (a same-repo
+# PR is already covered by the push of its branch). Each job repeats this condition.
+
+jobs:
+  lint:
+    name: Lint and type check
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.13"
+          enable-cache: true
+      - run: uv sync
+      - name: Lockfile up to date
+        run: uv lock --check
+      - name: Ruff lint
+        run: uv run ruff check --output-format=github
+      - name: Ruff format
+        run: uv run ruff format --check
+      - name: Mypy
+        run: uv run mypy
+
+  test:
+    name: Test (${{ matrix.os }}, py${{ matrix.python }})
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ["3.11", "3.12", "3.13"]
+        include:
+          - { os: windows-latest, python: "3.13" }
+          - { os: macos-latest, python: "3.13" }
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python }}
+          enable-cache: true
+      - run: uv sync
+      - name: Unit and contract tests
+        run: uv run pytest -q --cov --cov-report=term --cov-report=xml
+      - uses: actions/upload-artifact@v7
+        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.13'
+        with:
+          name: coverage
+          path: coverage.xml
+
+  build:
+    name: Build and check distribution
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.13"
+      - run: uv build
+      - name: Check metadata
+        run: uvx twine check --strict dist/*
+      - name: Smoke test the wheel in a clean environment
+        run: |
+          uv venv /tmp/smoke
+          uv pip install --python /tmp/smoke dist/*.whl
+          /tmp/smoke/bin/graylog-mcp --version
+          # --check exits 1 when an instance is unreachable, 2 on a configuration error
+          set +e
+          GRAYLOG_URL=http://127.0.0.1:9 GRAYLOG_TOKEN=x /tmp/smoke/bin/graylog-mcp --check > /dev/null
+          test $? -eq 1
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  docker:
+    name: Docker image
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          load: true
+          tags: graylog-mcp:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Smoke test the image
+        run: |
+          docker run --rm --entrypoint graylog-mcp graylog-mcp:ci --version
+          docker run -d --name mcp -p 8000:8000 -e GRAYLOG_URL=http://127.0.0.1:9 -e GRAYLOG_TOKEN=x \
+            -e GRAYLOG_MCP_HTTP_TOKEN=ci graylog-mcp:ci
+          for i in $(seq 1 30); do curl -fs localhost:8000/healthz && break; sleep 1; done
+          test "$(curl -s -o /dev/null -w '%{http_code}' -X POST localhost:8000/mcp)" = 401
+          docker rm -f mcp
+
+  start:
+    name: Start at login (${{ matrix.os }})
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.13"
+      - run: uv sync
+      - name: start, crash, restart, stop with the real service manager
+        env:
+          XDG_CURRENT_DESKTOP: CI   # Linux without a systemd user session: XDG autostart
+        run: uv run python tests/smoke_start.py
+      - name: per-repository setup, port change and update on this machine
+        run: uv run python tests/smoke_repo.py
+
+  # Single required check for branch protection.
+  ci-ok:
+    name: CI passed
+    if: always()
+    needs: [lint, test, build, docker, start]
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: echo "$NEEDS" | jq -e 'all(.[]; .result == "success" or .result == "skipped")'

graylog_mcp-0.3.0/.github/workflows/claude.yml

@@ -0,0 +1,48 @@
+name: Claude
+
+# Claude implements an issue when a maintainer adds the "claude" label, and answers "@claude" in issues and pull
+# requests. It works on a claude/ branch and opens a pull request for review; it never pushes to main.
+# Only people with write access trigger it: labels need triage access, and the action ignores comments from others.
+# Auth: the repository secret ANTHROPIC_API_KEY.
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+jobs:
+  claude:
+    if: >-
+      (github.event_name == 'issues' && github.event.label.name == 'claude') ||
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: claude-${{ github.event.issue.number || github.event.pull_request.number }}
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+      - uses: astral-sh/setup-uv@v7
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          label_trigger: claude
+          claude_args: >-
+            --max-turns 60
+            --allowedTools "Bash(uv sync:*),Bash(uv run pytest:*),Bash(uv run ruff:*),Bash(uv run mypy:*),Bash(git:*)"

graylog_mcp-0.3.0/.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, "claude/**"]
+  pull_request:
+  schedule:
+    - cron: "23 4 * * 2"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (python, actions)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}

graylog_mcp-0.3.0/.github/workflows/integration.yml

@@ -0,0 +1,53 @@
+name: Integration (Graylog matrix)
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 1"   # weekly
+  pull_request:
+    paths:
+      - "src/graylog_mcp/backends/**"
+      - "src/graylog_mcp/client.py"
+      - "src/graylog_mcp/rca.py"
+      - "src/graylog_mcp/scan.py"
+      - "src/graylog_mcp/scanrules.py"
+      - "tests/fake_graylog.py"
+      - "tests/integration/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: integration-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  graylog:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { profile: v43, port: 9043 }
+          - { profile: v50, port: 9050 }
+          - { profile: v52, port: 9052 }
+          - { profile: v61, port: 9061 }
+          - { profile: v70, port: 9070 }
+    env:
+      GRAYLOG_IT_URL: http://127.0.0.1:${{ matrix.port }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.13"
+          enable-cache: true
+      - run: uv sync --locked
+      - run: sudo sysctl -w vm.max_map_count=262144
+      - run: docker compose -f tests/integration/docker-compose.yml --profile ${{ matrix.profile }} up -d
+      - name: Seed Graylog
+        run: uv run python tests/integration/seed.py
+      - name: Run every tool against Graylog
+        run: uv run pytest -m integration -v -s tests/integration
+      - if: failure()
+        run: docker compose -f tests/integration/docker-compose.yml --profile ${{ matrix.profile }} logs --tail 200

graylog_mcp-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,96 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - run: uv sync --locked && uv run pytest -q && uv run mypy
+      - name: Check tag matches version and changelog
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          test "$(uv run python -c 'import graylog_mcp; print(graylog_mcp.__version__)')" = "$version"
+          grep -q "^version = \"$version\"" pyproject.toml
+          grep -q "^## \[$version\]" CHANGELOG.md
+      - run: uv build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # PyPI trusted publishing + PEP 740 attestations (signed with Sigstore)
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  github-release:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - name: Sign with Sigstore
+        uses: sigstore/gh-action-sigstore-python@v3.5.0
+        with:
+          inputs: ./dist/*.tar.gz ./dist/*.whl
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          notes=$(awk "/^## \\[${GITHUB_REF_NAME#v}\\]/{f=1;next} /^## \\[/{f=0} f" CHANGELOG.md)
+          gh release create "$GITHUB_REF_NAME" dist/* --title "$GITHUB_REF_NAME" --notes "$notes"
+
+  docker:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v6
+        id: meta
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - uses: docker/build-push-action@v7
+        id: push
+        with:
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: true
+          sbom: true

graylog_mcp-0.3.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+dist/
+build/
+*.egg-info/
+.coverage

graylog_mcp-0.3.0/.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+# pip install pre-commit && pre-commit install
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-toml
+      - id: check-yaml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-merge-conflict
+      - id: detect-private-key
+        exclude: ^tests/
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.10
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        pass_filenames: false
+        types: [python]