haltsql-mcp 0.0.1__py3-none-any.whl

haltsql_mcp/__init__.py

@@ -0,0 +1,24 @@
+"""haltsql-mcp: an MCP server that runs SQL only after HaltSQL allows it."""
+
+from .config import ConfigError, Settings, TokenEntry, hash_token, load_tokens_file
+from .core import HaltSQLTools, ToolFailure, jsonable, summarize_policy
+from .server import StaticTokenVerifier, build_server, build_tools, main
+
+__version__ = "0.0.1"
+
+__all__ = [
+    "__version__",
+    "Settings",
+    "ConfigError",
+    "TokenEntry",
+    "hash_token",
+    "load_tokens_file",
+    "HaltSQLTools",
+    "ToolFailure",
+    "jsonable",
+    "summarize_policy",
+    "StaticTokenVerifier",
+    "build_server",
+    "build_tools",
+    "main",
+]

haltsql_mcp/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .server import main
+
+sys.exit(main())

haltsql_mcp/config.py

@@ -0,0 +1,397 @@
+"""Configuration for haltsql-mcp: environment variables, overridable by flags.
+
+Tenant context is configuration, never a tool argument:
+
+* stdio: one static context for the whole process (``HALTSQL_MCP_CONTEXT`` or
+  ``--context-file``), set by whoever launches the server for one user.
+* streamable HTTP: each bearer token in the tokens file maps to its own
+  context; the authenticated MCP session decides the tenant.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import ipaddress
+import json
+import os
+import re
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Mapping, Optional
+
+from haltsql import validate_context
+
+__all__ = ["ConfigError", "TokenEntry", "Settings", "load_config_file", "load_tokens_file", "hash_token"]
+
+_HEX64 = re.compile(r"^[0-9a-f]{64}$")
+_SETTING_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_.]*$")
+MAX_ROW_CAP = 10_000
+
+
+class ConfigError(ValueError):
+    """Invalid configuration; the server refuses to start."""
+
+
+def hash_token(token: str) -> str:
+    """Lower-case hex SHA-256 of a bearer token (what the tokens file stores)."""
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+@dataclass(frozen=True)
+class TokenEntry:
+    """One accepted bearer token, stored only as its SHA-256."""
+
+    name: str
+    token_sha256: str
+    context: Mapping[str, Any]
+
+    def matches(self, token_hash: str) -> bool:
+        return hmac.compare_digest(self.token_sha256.encode(), token_hash.encode())
+
+
+def load_tokens_file(path: str) -> List[TokenEntry]:
+    """Load ``{"tokens": [{"name", "token_sha256", "context"}]}`` (JSON)."""
+    try:
+        with open(path, encoding="utf-8") as f:
+            data = json.load(f)
+    except OSError as e:
+        raise ConfigError(f"cannot read tokens file {path}: {e.strerror}") from None
+    except ValueError as e:
+        raise ConfigError(f"tokens file {path} is not valid JSON: {e}") from None
+    if not isinstance(data, dict) or set(data) != {"tokens"} or not isinstance(data["tokens"], list):
+        raise ConfigError('tokens file must be {"tokens": [...]} with no other keys')
+    entries: List[TokenEntry] = []
+    names = set()
+    hashes = set()
+    for i, t in enumerate(data["tokens"]):
+        where = f"tokens[{i}]"
+        if not isinstance(t, dict) or set(t) - {"name", "token_sha256", "context"}:
+            raise ConfigError(f"{where}: expected keys name, token_sha256, context")
+        name = t.get("name")
+        h = t.get("token_sha256")
+        if not isinstance(name, str) or not name:
+            raise ConfigError(f"{where}.name must be a non-empty string")
+        if not isinstance(h, str) or not _HEX64.match(h):
+            raise ConfigError(f"{where}.token_sha256 must be 64 lower-case hex characters")
+        if name in names or h in hashes:
+            raise ConfigError(f"{where}: duplicate name or token")
+        try:
+            ctx = validate_context(t.get("context") or {})
+        except ValueError as e:
+            raise ConfigError(f"{where}.context: {e}") from None
+        names.add(name)
+        hashes.add(h)
+        entries.append(TokenEntry(name=name, token_sha256=h, context=ctx))
+    if not entries:
+        raise ConfigError("tokens file has no tokens")
+    return entries
+
+
+def _env_int(env: Mapping[str, str], name: str, default: int) -> int:
+    raw = env.get(name)
+    if raw is None or raw == "":
+        return default
+    try:
+        return int(raw)
+    except ValueError:
+        raise ConfigError(f"{name} must be an integer") from None
+
+
+def _json_obj(raw: str, what: str) -> Dict[str, Any]:
+    try:
+        data = json.loads(raw)
+    except ValueError as e:
+        raise ConfigError(f"{what} is not valid JSON: {e}") from None
+    if not isinstance(data, dict):
+        raise ConfigError(f"{what} must be a JSON object")
+    return data
+
+
+# Config file keys -> (Settings attribute, kind). Paths are resolved relative
+# to the config file's directory, so one file works natively and in Docker.
+_FILE_KEYS: Dict[str, Any] = {
+    "database_url": ("database_url", "str"),
+    "policy": ("local_policy_file", "path"),
+    "policy_file": ("policy_file", "path"),
+    "context": ("context", "obj"),
+    "tokens_file": ("tokens_file", "path"),
+    "row_cap": ("row_cap", "int"),
+    "statement_timeout_ms": ("statement_timeout_ms", "int"),
+    "set_config": ("set_config", "obj"),
+    "transport": ("transport", "str"),
+    "host": ("host", "str"),
+    "port": ("port", "int"),
+    "public_url": ("public_url", "str"),
+    "haltsql_bin": ("haltsql_bin", "path"),
+}
+_SERVER_KEYS: Dict[str, Any] = {
+    "url": ("haltsql_url", "str"),
+    "token_file": ("haltsql_token", "secret_file"),
+    "policy": ("haltsql_policy", "str"),
+    "timeout": ("haltsql_timeout", "num"),
+    "ca_file": ("haltsql_ca_file", "path"),
+    "client_cert": ("haltsql_client_cert", "path"),
+    "client_key": ("haltsql_client_key", "path"),
+}
+
+
+def _parse_config_text(path: str, raw: str) -> Any:
+    if path.endswith(".json"):
+        try:
+            return json.loads(raw)
+        except ValueError as e:
+            raise ConfigError(f"config file {path} is not valid JSON: {e}") from None
+    try:
+        import yaml  # type: ignore[import-untyped]
+    except ImportError:
+        try:
+            return json.loads(raw)  # JSON is valid YAML
+        except ValueError:
+            raise ConfigError(
+                f"config file {path} is YAML; install PyYAML (pip install 'haltsql-mcp[yaml]') "
+                "or write it as JSON"
+            ) from None
+    try:
+        return yaml.safe_load(raw)
+    except yaml.YAMLError as e:
+        raise ConfigError(f"config file {path} is not valid YAML: {e}") from None
+
+
+def _convert(value: Any, kind: str, where: str, base: str) -> Any:
+    if kind in ("str", "path", "secret_file"):
+        if not isinstance(value, str) or not value:
+            raise ConfigError(f"{where} must be a non-empty string")
+        if kind == "str":
+            return value
+        p = os.path.join(base, os.path.expanduser(value))
+        if kind == "path":
+            return p
+        try:
+            with open(p, encoding="utf-8") as f:
+                secret = f.read().strip()
+        except OSError as e:
+            raise ConfigError(f"cannot read {where} {p}: {e.strerror}") from None
+        if not secret:
+            raise ConfigError(f"{where} {p} is empty")
+        return secret
+    if kind == "int":
+        if isinstance(value, bool) or not isinstance(value, int):
+            raise ConfigError(f"{where} must be an integer")
+        return value
+    if kind == "num":
+        if isinstance(value, bool) or not isinstance(value, (int, float)):
+            raise ConfigError(f"{where} must be a number")
+        return float(value)
+    if not isinstance(value, dict):  # obj
+        raise ConfigError(f"{where} must be a mapping")
+    return dict(value)
+
+
+def load_config_file(path: str) -> Dict[str, Any]:
+    """Read a haltsql-mcp config file and return ``{Settings attribute: value}``.
+
+    Unknown keys are errors (a typo must not silently drop a guardrail).
+    ``policy`` (local verification with the haltsql CLI) and ``server``
+    (a central haltsql-server) are mutually exclusive. The sidecar token is
+    read from ``server.token_file`` or ``HALTSQL_TOKEN``, never inline.
+    """
+    try:
+        with open(path, encoding="utf-8") as f:
+            raw = f.read()
+    except OSError as e:
+        raise ConfigError(f"cannot read config file {path}: {e.strerror}") from None
+    data = _parse_config_text(path, raw)
+    if data is None:
+        data = {}
+    if not isinstance(data, dict):
+        raise ConfigError(f"config file {path} must be a mapping")
+    base = os.path.dirname(os.path.abspath(path))
+    out: Dict[str, Any] = {}
+    for key, value in data.items():
+        if key == "server":
+            if not isinstance(value, dict):
+                raise ConfigError("server must be a mapping")
+            for skey, svalue in value.items():
+                if skey == "token":
+                    raise ConfigError(
+                        "server.token is not allowed in the config file; use server.token_file "
+                        "or the HALTSQL_TOKEN environment variable"
+                    )
+                if skey not in _SERVER_KEYS:
+                    raise ConfigError(
+                        f"unknown key server.{skey} in {path} (expected one of {', '.join(sorted(_SERVER_KEYS))})"
+                    )
+                attr, kind = _SERVER_KEYS[skey]
+                out[attr] = _convert(svalue, kind, f"server.{skey}", base)
+            continue
+        if key not in _FILE_KEYS:
+            raise ConfigError(
+                f"unknown key {key!r} in {path} (expected one of {', '.join(sorted([*_FILE_KEYS, 'server']))})"
+            )
+        attr, kind = _FILE_KEYS[key]
+        out[attr] = _convert(value, kind, key, base)
+    if "local_policy_file" in out and "server" in data:
+        raise ConfigError("set either policy (verify locally) or server (central haltsql-server), not both")
+    if "set_config" in out:
+        out["set_config"] = {str(k): v for k, v in out["set_config"].items()}
+    return out
+
+
+@dataclass
+class Settings:
+    """Everything haltsql-mcp needs. See ``docs/mcp.md`` for each variable."""
+
+    # Verification: sidecar (default) or local CLI.
+    haltsql_url: str = "http://127.0.0.1:8080"
+    haltsql_token: Optional[str] = field(default=None, repr=False)
+    haltsql_policy: Optional[str] = None
+    haltsql_timeout: float = 2.0
+    haltsql_ca_file: Optional[str] = None
+    """CA bundle for an https sidecar with a private CA (default: system CAs)."""
+    haltsql_client_cert: Optional[str] = None
+    """Client certificate (PEM) for mutual TLS to the sidecar."""
+    haltsql_client_key: Optional[str] = field(default=None, repr=False)
+    """Private key for ``haltsql_client_cert`` when it is a separate file."""
+    local_policy_file: Optional[str] = None
+    haltsql_bin: Optional[str] = None
+    # Execution.
+    database_url: Optional[str] = field(default=None, repr=False)
+    row_cap: int = 200
+    statement_timeout_ms: int = 5000
+    set_config: Dict[str, str] = field(default_factory=dict)
+    """Postgres setting -> context key, applied with set_config(..., true) (for RLS)."""
+    # Policy description.
+    policy_file: Optional[str] = None
+    # Tenant context.
+    context: Dict[str, Any] = field(default_factory=dict)
+    tokens_file: Optional[str] = None
+    insecure_static_context: bool = False
+    # Transport.
+    transport: str = "stdio"
+    host: str = "127.0.0.1"
+    port: int = 8765
+    public_url: Optional[str] = None
+
+    @classmethod
+    def from_env(cls, env: Optional[Mapping[str, str]] = None) -> "Settings":
+        """Defaults overridden by environment variables."""
+        s = cls()
+        s.apply_env(os.environ if env is None else env)
+        return s
+
+    @classmethod
+    def from_sources(
+        cls, env: Optional[Mapping[str, str]] = None, config_file: Optional[str] = None
+    ) -> "Settings":
+        """Defaults, then the config file (if any), then environment variables."""
+        e = os.environ if env is None else env
+        s = cls()
+        path = config_file or e.get("HALTSQL_MCP_CONFIG") or None
+        if path:
+            s.apply_file(path)
+        s.apply_env(e)
+        return s
+
+    def apply_env(self, e: Mapping[str, str]) -> None:
+        """Override settings with every environment variable that is set (non-empty)."""
+        def get(name: str) -> Optional[str]:
+            v = e.get(name)
+            return v if v else None
+
+        self.haltsql_url = get("HALTSQL_URL") or self.haltsql_url
+        self.haltsql_token = get("HALTSQL_TOKEN") or self.haltsql_token
+        self.haltsql_policy = get("HALTSQL_POLICY") or self.haltsql_policy
+        if get("HALTSQL_TIMEOUT"):
+            try:
+                self.haltsql_timeout = float(e["HALTSQL_TIMEOUT"])
+            except ValueError:
+                raise ConfigError("HALTSQL_TIMEOUT must be a number") from None
+        self.haltsql_ca_file = get("HALTSQL_CA_FILE") or self.haltsql_ca_file
+        self.haltsql_client_cert = get("HALTSQL_CLIENT_CERT") or self.haltsql_client_cert
+        self.haltsql_client_key = get("HALTSQL_CLIENT_KEY") or self.haltsql_client_key
+        self.local_policy_file = get("HALTSQL_MCP_LOCAL_POLICY") or self.local_policy_file
+        self.haltsql_bin = get("HALTSQL_BIN") or self.haltsql_bin
+        self.database_url = get("HALTSQL_MCP_DATABASE_URL") or get("DATABASE_URL") or self.database_url
+        self.row_cap = _env_int(e, "HALTSQL_MCP_ROW_CAP", self.row_cap)
+        self.statement_timeout_ms = _env_int(e, "HALTSQL_MCP_STATEMENT_TIMEOUT_MS", self.statement_timeout_ms)
+        if get("HALTSQL_MCP_SET_CONFIG"):
+            self.set_config = {
+                str(k): v for k, v in _json_obj(e["HALTSQL_MCP_SET_CONFIG"], "HALTSQL_MCP_SET_CONFIG").items()
+            }
+        self.policy_file = get("HALTSQL_MCP_POLICY_FILE") or self.policy_file
+        if get("HALTSQL_MCP_CONTEXT"):
+            self.context = _json_obj(e["HALTSQL_MCP_CONTEXT"], "HALTSQL_MCP_CONTEXT")
+        self.tokens_file = get("HALTSQL_MCP_TOKENS_FILE") or self.tokens_file
+        self.transport = get("HALTSQL_MCP_TRANSPORT") or self.transport
+        self.host = get("HALTSQL_MCP_HOST") or self.host
+        self.port = _env_int(e, "HALTSQL_MCP_PORT", self.port)
+        self.public_url = get("HALTSQL_MCP_PUBLIC_URL") or self.public_url
+
+    def apply_file(self, path: str) -> None:
+        """Load a config file (YAML or JSON). See ``load_config_file``."""
+        for attr, value in load_config_file(path).items():
+            setattr(self, attr, value)
+
+    def load_context_file(self, path: str) -> None:
+        try:
+            with open(path, encoding="utf-8") as f:
+                self.context = _json_obj(f.read(), f"context file {path}")
+        except OSError as e:
+            raise ConfigError(f"cannot read context file {path}: {e.strerror}") from None
+
+    def validate(self) -> None:
+        """Check every setting; raise :class:`ConfigError` on the first problem."""
+        if self.transport not in ("stdio", "http"):
+            raise ConfigError("transport must be 'stdio' or 'http'")
+        if not (1 <= self.row_cap <= MAX_ROW_CAP):
+            raise ConfigError(f"row cap must be between 1 and {MAX_ROW_CAP}")
+        if not (1 <= self.statement_timeout_ms <= 600_000):
+            raise ConfigError("statement timeout must be between 1 and 600000 ms")
+        if self.haltsql_timeout <= 0:
+            raise ConfigError("HALTSQL_TIMEOUT must be > 0")
+        for setting, key in self.set_config.items():
+            if not _SETTING_RE.match(setting):
+                raise ConfigError(
+                    f"set_config setting {setting!r} must be a custom setting like app.tenant_id"
+                )
+            if not isinstance(key, str) or not key:
+                raise ConfigError(f"set_config[{setting!r}] must name a context key")
+        try:
+            self.context = validate_context(self.context)
+        except ValueError as e:
+            raise ConfigError(f"context: {e}") from None
+        if self.haltsql_client_key and not self.haltsql_client_cert:
+            raise ConfigError("HALTSQL_CLIENT_KEY needs HALTSQL_CLIENT_CERT")
+        for f in (
+            self.local_policy_file,
+            self.policy_file,
+            self.tokens_file,
+            self.haltsql_ca_file,
+            self.haltsql_client_cert,
+            self.haltsql_client_key,
+        ):
+            if f is not None and not os.path.isfile(f):
+                raise ConfigError(f"file not found: {f}")
+        if self.transport == "http":
+            if self.tokens_file is None and not self.insecure_static_context:
+                raise ConfigError(
+                    "HTTP transport needs a tokens file (HALTSQL_MCP_TOKENS_FILE / --tokens-file) so "
+                    "each client is authenticated and mapped to its tenant context; "
+                    "--insecure-static-context exists for local development only"
+                )
+            if self.insecure_static_context and self.tokens_file is None:
+                try:
+                    loopback = ipaddress.ip_address(self.host).is_loopback
+                except ValueError:
+                    loopback = self.host == "localhost"
+                if not loopback:
+                    raise ConfigError("--insecure-static-context is only allowed on a loopback host")
+            if not (1 <= self.port <= 65535):
+                raise ConfigError("port must be between 1 and 65535")
+        if self.tokens_file is not None and self.transport == "stdio":
+            raise ConfigError("a tokens file only applies to the HTTP transport")
+
+    @property
+    def describe_file(self) -> Optional[str]:
+        """The policy document used for describe_policy / list_tables."""
+        return self.policy_file or self.local_policy_file

haltsql_mcp/core.py

@@ -0,0 +1,354 @@
+"""Tool logic for haltsql-mcp, independent of the MCP SDK (easy to test).
+
+Invariants:
+
+* The tenant context comes from :attr:`HaltSQLTools.context_provider`
+  (server configuration or the authenticated session). No tool takes it as an
+  argument, so a prompt-injected model cannot choose a tenant.
+* ``query`` executes only through :func:`haltsql.guard.execute_async`: verify,
+  then run exactly the verified string with the bound parameters, in a
+  ``READ ONLY`` transaction with ``statement_timeout`` and a row cap.
+* Any verification failure means nothing runs.
+"""
+
+from __future__ import annotations
+
+import base64
+import datetime as _dt
+import decimal
+import ipaddress
+import json
+import os
+import subprocess
+import uuid
+from typing import Any, Awaitable, Callable, Dict, List, Mapping, Optional
+
+from haltsql import (
+    GuardError,
+    HaltSQLRequestError,
+    HaltSQLUnavailable,
+    QueryDenied,
+    Verdict,
+    guard,
+)
+
+__all__ = ["ToolFailure", "HaltSQLTools", "jsonable", "load_policy_document", "summarize_policy"]
+
+MAX_SQL_CHARS = 100_000
+MAX_CELL_CHARS = 10_000
+
+
+class ToolFailure(Exception):
+    """A tool error whose message is safe to show to the model."""
+
+
+ContextProvider = Callable[[], Mapping[str, Any]]
+Connect = Callable[[], Awaitable[Any]]
+
+
+def jsonable(value: Any) -> Any:
+    """Convert a database value into JSON-safe data."""
+    if value is None or isinstance(value, (bool, int, str)):
+        if isinstance(value, str) and len(value) > MAX_CELL_CHARS:
+            return value[:MAX_CELL_CHARS] + "...[truncated]"
+        return value
+    if isinstance(value, float):
+        return value if value == value and value not in (float("inf"), float("-inf")) else str(value)
+    if isinstance(value, decimal.Decimal):
+        return str(value)
+    if isinstance(value, (_dt.datetime, _dt.date, _dt.time)):
+        return value.isoformat()
+    if isinstance(value, _dt.timedelta):
+        return value.total_seconds()
+    if isinstance(value, (uuid.UUID, ipaddress.IPv4Address, ipaddress.IPv6Address,
+                          ipaddress.IPv4Network, ipaddress.IPv6Network,
+                          ipaddress.IPv4Interface, ipaddress.IPv6Interface)):
+        return str(value)
+    if isinstance(value, (bytes, bytearray, memoryview)):
+        return {"base64": base64.b64encode(bytes(value)[:MAX_CELL_CHARS]).decode()}
+    if isinstance(value, Mapping):
+        return {str(k): jsonable(v) for k, v in value.items()}
+    if isinstance(value, (list, tuple, set, frozenset)):
+        return [jsonable(v) for v in value]
+    return str(value)
+
+
+def _reasons(verdict: Verdict) -> List[Dict[str, Any]]:
+    return [r.to_dict() for r in verdict.reasons]
+
+
+def load_policy_document(path: str, haltsql_bin: Optional[str] = None) -> Dict[str, Any]:
+    """Read a policy (JSON, or YAML via PyYAML or ``haltsql convert``)."""
+    with open(path, "rb") as f:
+        raw = f.read()
+    if path.endswith(".json"):
+        data = json.loads(raw)
+    else:
+        try:
+            import yaml  # type: ignore[import-untyped]
+
+            data = yaml.safe_load(raw)
+        except ImportError:
+            binary = haltsql_bin or os.environ.get("HALTSQL_BIN") or "haltsql"
+            proc = subprocess.run(
+                [binary, "convert", path, "--to", "json"],
+                capture_output=True, timeout=10, check=False,
+            )
+            if proc.returncode != 0:
+                raise ToolFailure("policy file is YAML; install PyYAML or the haltsql CLI to read it")
+            data = json.loads(proc.stdout)
+    if not isinstance(data, dict):
+        raise ToolFailure("policy file is not a mapping")
+    return data
+
+
+def summarize_policy(doc: Mapping[str, Any]) -> Dict[str, Any]:
+    """The parts of a policy an agent needs to write accepted SQL.
+
+    Tenancy key *names* are included, never context values.
+    """
+    meta = doc.get("metadata") or {}
+    tenancy = doc.get("tenancy") or {}
+    keys = tenancy.get("keys") or {}
+    tables_out: List[Dict[str, Any]] = []
+    for name, spec in sorted((doc.get("tables") or {}).items()):
+        spec = spec or {}
+        entry: Dict[str, Any] = {"table": name, "columns": spec.get("columns", [])}
+        if "tenant_column" in spec:
+            entry["tenant_columns"] = {spec["tenant_column"]: next(iter(keys), "tenant")}
+        elif "tenant_columns" in spec:
+            entry["tenant_columns"] = dict(spec["tenant_columns"])
+        entry["tenant_scoped"] = "tenant_columns" in entry
+        if spec.get("writes"):
+            entry["writes"] = spec["writes"]
+        tables_out.append(entry)
+    out: Dict[str, Any] = {
+        "name": meta.get("name"),
+        "description": meta.get("description"),
+        "search_path": doc.get("search_path", []),
+        "statements": (doc.get("statements") or {}).get("allow", ["select"]),
+        "require_limit": doc.get("require_limit"),
+        "mode": doc.get("mode", "enforce"),
+        "tenancy": {"mode": tenancy.get("mode"), "keys": sorted(keys)} if tenancy else None,
+        "tables": tables_out,
+        "functions": doc.get("functions"),
+    }
+    return out
+
+
+def _tenancy_guidance(summary: Optional[Mapping[str, Any]]) -> str:
+    base = (
+        "Only tables and columns listed here are readable. Every tenant-scoped table, in every "
+        "subquery, CTE and UNION branch, needs its own predicate on its tenant column."
+    )
+    ten = (summary or {}).get("tenancy") or {}
+    if ten.get("mode") == "bound":
+        return base + (" Write the predicate as alias.tenant_column = $1 (one $n per tenancy key, "
+                       "or = ANY($n) for tenant sets); the server binds the values. Never write "
+                       "tenant IDs into the SQL.")
+    if ten.get("mode") == "literal":
+        return base + " Write the predicate with the caller's tenant value as a literal."
+    return base
+
+
+class HaltSQLTools:
+    """Implements the four tools. ``verifier`` may be sync or async.
+
+    Args:
+        verifier: :class:`haltsql.AsyncHaltSQLClient`, :class:`haltsql.AsyncLocalVerifier`, ...
+        context_provider: Returns the caller's context; raises
+            :class:`PermissionError` when the session is not authenticated.
+        connect: ``async () -> connection`` (psycopg ``AsyncConnection`` or
+            asyncpg); ``None`` disables ``query``.
+        row_cap / statement_timeout_ms / set_config: execution limits.
+        policy_file: Policy document for ``describe_policy`` / ``list_tables``.
+        policies_lister: ``async () -> list[PolicyInfo]`` (``/v1/policies``).
+    """
+
+    def __init__(
+        self,
+        verifier: Any,
+        context_provider: ContextProvider,
+        *,
+        connect: Optional[Connect] = None,
+        row_cap: int = 200,
+        statement_timeout_ms: int = 5000,
+        set_config: Optional[Mapping[str, str]] = None,
+        policy_file: Optional[str] = None,
+        policies_lister: Optional[Callable[[], Awaitable[Any]]] = None,
+        haltsql_bin: Optional[str] = None,
+    ) -> None:
+        self.verifier = verifier
+        self.context_provider = context_provider
+        self.connect = connect
+        self.row_cap = row_cap
+        self.statement_timeout_ms = statement_timeout_ms
+        self.set_config = dict(set_config or {})
+        self.policy_file = policy_file
+        self.policies_lister = policies_lister
+        self.haltsql_bin = haltsql_bin
+        self._summary: Optional[Dict[str, Any]] = None
+
+    # -- helpers -----------------------------------------------------------
+    def _context(self) -> Dict[str, Any]:
+        try:
+            ctx = self.context_provider()
+        except PermissionError as e:
+            raise ToolFailure(str(e) or "not authenticated") from None
+        return dict(ctx)
+
+    @staticmethod
+    def _check_sql(sql: Any) -> str:
+        if not isinstance(sql, str) or not sql.strip():
+            raise ToolFailure("sql must be a non-empty string")
+        if len(sql) > MAX_SQL_CHARS:
+            raise ToolFailure(f"sql is longer than {MAX_SQL_CHARS} characters")
+        return sql
+
+    async def _verify(self, sql: str, ctx: Mapping[str, Any]) -> Verdict:
+        try:
+            result = self.verifier.verify(sql, ctx)
+            if hasattr(result, "__await__"):
+                result = await result
+        except HaltSQLRequestError as e:
+            raise ToolFailure(f"verification refused ({e.code}); the query was not executed") from None
+        except HaltSQLUnavailable:
+            raise ToolFailure("verification is unavailable; the query was not executed") from None
+        except Exception:  # noqa: BLE001 - any other failure also means deny
+            raise ToolFailure("verification failed; the query was not executed") from None
+        if not isinstance(result, Verdict) or not result.matches_sql(sql):
+            raise ToolFailure("verification returned an invalid verdict; the query was not executed")
+        return result
+
+    def _settings(self, ctx: Mapping[str, Any]) -> Dict[str, str]:
+        out: Dict[str, str] = {}
+        for setting, key in self.set_config.items():
+            if key not in ctx:
+                raise ToolFailure(f"server misconfigured: context has no {key!r} for {setting}")
+            v = ctx[key]
+            out[setting] = ",".join(str(x) for x in v) if isinstance(v, list) else str(v)
+        return out
+
+    def _policy_summary(self) -> Optional[Dict[str, Any]]:
+        if self.policy_file is None:
+            return None
+        if self._summary is None:
+            try:
+                self._summary = summarize_policy(load_policy_document(self.policy_file, self.haltsql_bin))
+            except ToolFailure:
+                raise
+            except Exception as e:  # noqa: BLE001
+                raise ToolFailure(f"could not read the policy file: {type(e).__name__}") from None
+        return self._summary
+
+    # -- tools -------------------------------------------------------------
+    async def query(self, sql: str) -> Dict[str, Any]:
+        """Verify, then run the SQL read-only and return rows (or the denial)."""
+        sql = self._check_sql(sql)
+        if self.connect is None:
+            raise ToolFailure("no database is configured for this server")
+        ctx = self._context()
+        settings = self._settings(ctx)
+        verdict = await self._verify(sql, ctx)
+        if not verdict.allowed:
+            return {
+                "allowed": False,
+                "executed": False,
+                "reasons": _reasons(verdict),
+                "message": "HaltSQL denied the query. Fix it using the reasons and hints, then retry.",
+            }
+        try:
+            conn = await self.connect()
+        except Exception as e:  # noqa: BLE001
+            raise ToolFailure(f"database connection failed: {type(e).__name__}") from None
+        try:
+            # The guard re-checks the verdict against this exact string.
+            result = await guard.execute_async(
+                conn, sql, ctx,
+                verdict=verdict,
+                read_only=True,
+                statement_timeout_ms=self.statement_timeout_ms,
+                settings=settings,
+                max_rows=self.row_cap,
+            )
+        except QueryDenied as e:  # pragma: no cover - verdict already checked
+            return {"allowed": False, "executed": False, "reasons": _reasons(e.verdict)}
+        except (GuardError, HaltSQLUnavailable) as e:
+            raise ToolFailure(f"query not executed: {e}") from None
+        except Exception as e:  # noqa: BLE001 - database error
+            raise ToolFailure(f"database error: {_db_error(e)}") from None
+        finally:
+            close = getattr(conn, "close", None)
+            if close is not None:
+                r = close()
+                if hasattr(r, "__await__"):
+                    await r
+        return {
+            "allowed": True,
+            "executed": True,
+            "columns": result.columns,
+            "rows": [jsonable(list(r) if isinstance(r, tuple) else r) for r in result.rows],
+            "row_count": len(result.rows),
+            "truncated": result.truncated,
+            "row_cap": self.row_cap,
+            "shadow_reasons": [r.to_dict() for r in verdict.shadow_reasons],
+        }
+
+    async def explain_denial(self, sql: str) -> Dict[str, Any]:
+        """Verify only; explain why the SQL would be denied (never executes)."""
+        sql = self._check_sql(sql)
+        ctx = self._context()
+        verdict = await self._verify(sql, ctx)
+        out: Dict[str, Any] = {
+            "allowed": verdict.allowed,
+            "reasons": _reasons(verdict),
+            "shadow_reasons": [r.to_dict() for r in verdict.shadow_reasons],
+            "statement_kind": verdict.statement_kind,
+            "tables": list(verdict.tables),
+            "columns": list(verdict.columns),
+            "policy": {"name": verdict.policy.name, "version": verdict.policy.version},
+        }
+        if verdict.allowed:
+            out["message"] = "This query is allowed; run it with the query tool."
+        return out
+
+    async def list_tables(self) -> Dict[str, Any]:
+        """Tables and columns the policy allows."""
+        self._context()  # require an authenticated session for schema info too
+        summary = self._policy_summary()
+        if summary is None:
+            raise ToolFailure("no policy file is configured, so the table list is unavailable")
+        return {
+            "tables": [
+                {k: t[k] for k in ("table", "columns", "tenant_scoped", "tenant_columns") if k in t}
+                for t in summary["tables"]
+            ],
+            "guidance": _tenancy_guidance(summary),
+        }
+
+    async def describe_policy(self) -> Dict[str, Any]:
+        """Policy name/version/mode (from /v1/policies) and its rules (from the policy file)."""
+        self._context()
+        out: Dict[str, Any] = {}
+        if self.policies_lister is not None:
+            try:
+                infos = await self.policies_lister()
+                out["policies"] = [{"name": p.name, "version": p.version, "mode": p.mode} for p in infos]
+            except (HaltSQLUnavailable, HaltSQLRequestError):
+                out["policies_error"] = "could not list policies from the HaltSQL sidecar"
+        summary = self._policy_summary()
+        if summary is not None:
+            out["policy"] = summary
+            out["guidance"] = _tenancy_guidance(summary)
+        if not out:
+            raise ToolFailure("no policy information is configured")
+        return out
+
+
+def _db_error(e: BaseException) -> str:
+    sqlstate = getattr(e, "sqlstate", None)
+    diag = getattr(e, "diag", None)
+    primary = getattr(diag, "message_primary", None) if diag is not None else None
+    text = str(e).strip()
+    msg = primary or (text.splitlines()[0] if text else type(e).__name__)
+    return f"{sqlstate} {msg}" if sqlstate else msg

haltsql_mcp/server.py

@@ -0,0 +1,318 @@
+"""The haltsql-mcp server: MCP tools over stdio or streamable HTTP.
+
+Works with the official ``mcp`` SDK 2.x (``MCPServer``) and 1.x (``FastMCP``).
+"""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import sys
+from typing import Any, Callable, Dict, List, Mapping, Optional, Tuple
+
+from haltsql import AsyncHaltSQLClient, AsyncLocalVerifier, RetryPolicy
+
+from .config import ConfigError, Settings, TokenEntry, hash_token, load_tokens_file
+from .core import HaltSQLTools, ToolFailure
+
+__all__ = ["StaticTokenVerifier", "build_tools", "build_server", "main", "INSTRUCTIONS"]
+
+log = logging.getLogger("haltsql_mcp")
+
+INSTRUCTIONS = (
+    "SQL access to a PostgreSQL database guarded by HaltSQL. Call describe_policy or "
+    "list_tables first, write one SELECT with a LIMIT, and run it with query. If the query "
+    "is denied, read the reason codes and hints (or call explain_denial), fix the SQL, and "
+    "retry. The tenant is fixed by the server; never try to choose or change it."
+)
+
+
+def _sdk() -> Tuple[Any, Any, int]:
+    """(ServerClass, ToolError, major_version) for the installed mcp SDK."""
+    try:
+        from mcp.server.mcpserver import MCPServer
+        from mcp.server.mcpserver.exceptions import ToolError
+
+        return MCPServer, ToolError, 2
+    except ImportError:  # pragma: no cover - mcp 1.x
+        from mcp.server.fastmcp import FastMCP  # type: ignore[attr-defined, import-not-found, no-redef]
+        from mcp.server.fastmcp.exceptions import ToolError  # type: ignore[import-not-found, no-redef]
+
+        return FastMCP, ToolError, 1
+
+
+def _get_access_token() -> Any:
+    from mcp.server.auth.middleware.auth_context import get_access_token
+
+    return get_access_token()
+
+
+class StaticTokenVerifier:
+    """MCP ``TokenVerifier`` for pre-shared bearer tokens stored as SHA-256.
+
+    Every entry is compared in constant time; the raw token is never stored
+    or logged. The returned ``AccessToken`` carries the entry name as
+    ``client_id``, which the context provider maps to that client's context.
+    """
+
+    def __init__(self, entries: List[TokenEntry]) -> None:
+        self._entries = list(entries)
+        self.by_name: Dict[str, TokenEntry] = {e.name: e for e in entries}
+
+    async def verify_token(self, token: str) -> Any:
+        from mcp.server.auth.provider import AccessToken
+
+        if not isinstance(token, str) or not token:
+            return None
+        h = hash_token(token)
+        match: Optional[TokenEntry] = None
+        for e in self._entries:  # no early exit: constant work per entry
+            if e.matches(h):
+                match = e
+        if match is None:
+            return None
+        # Store the hash, not the token, in the request context.
+        return AccessToken(token=f"sha256:{h}", client_id=match.name, scopes=[])
+
+
+def session_context_provider(verifier: StaticTokenVerifier) -> Callable[[], Mapping[str, Any]]:
+    """Context from the authenticated MCP session (HTTP transport)."""
+
+    def provider() -> Mapping[str, Any]:
+        tok = _get_access_token()
+        if tok is None:
+            raise PermissionError("not authenticated")
+        entry = verifier.by_name.get(getattr(tok, "client_id", None) or "")
+        if entry is None:
+            raise PermissionError("unknown client")
+        return dict(entry.context)
+
+    return provider
+
+
+def static_context_provider(context: Mapping[str, Any]) -> Callable[[], Mapping[str, Any]]:
+    """One fixed context from server configuration (stdio transport)."""
+    frozen = dict(context)
+    return lambda: dict(frozen)
+
+
+def build_tools(
+    settings: Settings,
+    context_provider: Callable[[], Mapping[str, Any]],
+    *,
+    connect: Optional[Callable[[], Any]] = None,
+) -> HaltSQLTools:
+    """Wire verifier, database, and limits from ``settings``."""
+    lister = None
+    if settings.local_policy_file:
+        verifier: Any = AsyncLocalVerifier(settings.local_policy_file, binary=settings.haltsql_bin)
+    else:
+        client = AsyncHaltSQLClient(
+            settings.haltsql_url,
+            settings.haltsql_token,
+            timeout=settings.haltsql_timeout,
+            policy=settings.haltsql_policy,
+            retry=RetryPolicy(),
+            verify=settings.haltsql_ca_file or True,
+            cert=(
+                (settings.haltsql_client_cert, settings.haltsql_client_key)
+                if settings.haltsql_client_cert and settings.haltsql_client_key
+                else settings.haltsql_client_cert
+            ),
+        )
+        verifier = client
+        lister = client.policies
+    if connect is None and settings.database_url:
+        dsn = settings.database_url
+
+        async def connect() -> Any:  # type: ignore[no-redef]
+            import psycopg
+
+            return await psycopg.AsyncConnection.connect(dsn, autocommit=True)
+
+    return HaltSQLTools(
+        verifier,
+        context_provider,
+        connect=connect,
+        row_cap=settings.row_cap,
+        statement_timeout_ms=settings.statement_timeout_ms,
+        set_config=settings.set_config,
+        policy_file=settings.describe_file,
+        policies_lister=lister,
+        haltsql_bin=settings.haltsql_bin,
+    )
+
+
+def build_server(
+    tools: HaltSQLTools,
+    *,
+    token_verifier: Optional[StaticTokenVerifier] = None,
+    public_url: str = "http://127.0.0.1:8765",
+    name: str = "haltsql-mcp",
+) -> Any:
+    """Create the MCP server object and register the four tools."""
+    Server, ToolError, major = _sdk()
+    kwargs: Dict[str, Any] = {"instructions": INSTRUCTIONS}
+    if token_verifier is not None:
+        from mcp.server.auth.settings import AuthSettings
+
+        kwargs["token_verifier"] = token_verifier
+        kwargs["auth"] = AuthSettings.model_validate({
+            "issuer_url": public_url,
+            "resource_server_url": public_url.rstrip("/") + "/mcp",
+            "validate_token_resource": False,
+        })
+    server = Server(name, **kwargs)
+
+    try:
+        from mcp.types import ToolAnnotations
+
+        ro = ToolAnnotations.model_validate({"readOnlyHint": True, "openWorldHint": False})
+    except Exception:  # noqa: BLE001  # pragma: no cover
+        ro = None
+
+    def tool(fn_name: str, description: str) -> Callable[[Any], Any]:
+        if ro is not None:
+            return server.tool(name=fn_name, description=description, annotations=ro)
+        return server.tool(name=fn_name, description=description)  # pragma: no cover
+
+    async def _call(coro: Any) -> Dict[str, Any]:
+        try:
+            return await coro
+        except ToolFailure as e:
+            raise ToolError(str(e)) from None
+
+    @tool(
+        "query",
+        "Run one read-only SQL query on PostgreSQL. HaltSQL verifies it against the policy for "
+        "your tenant first; if allowed, the exact SQL runs with server-bound $n parameters and "
+        "rows are returned (capped). If denied, the result has allowed=false and reasons with "
+        "hints; fix the SQL and retry.",
+    )
+    async def query(sql: str) -> Dict[str, Any]:
+        return await _call(tools.query(sql))
+
+    @tool(
+        "explain_denial",
+        "Check SQL against the HaltSQL policy without running it and return every reason code, "
+        "message, and hint, plus the tables and columns it touches.",
+    )
+    async def explain_denial(sql: str) -> Dict[str, Any]:
+        return await _call(tools.explain_denial(sql))
+
+    @tool("list_tables", "List the tables and columns the policy lets you read, and which are tenant-scoped.")
+    async def list_tables() -> Dict[str, Any]:
+        return await _call(tools.list_tables())
+
+    @tool(
+        "describe_policy",
+        "Describe the active HaltSQL policy: name, version, mode, allowed statements, LIMIT "
+        "rule, tenancy mode, tables, and functions.",
+    )
+    async def describe_policy() -> Dict[str, Any]:
+        return await _call(tools.describe_policy())
+
+    server._haltsql_sdk_major = major  # noqa: SLF001 - informational
+    return server
+
+
+def _parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="haltsql-mcp",
+        description="MCP server that runs SQL on PostgreSQL only after HaltSQL allows it.",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""\
+EXAMPLES
+  # stdio (one user per process); tenant fixed by the launcher:
+  HALTSQL_URL=http://127.0.0.1:8080 HALTSQL_TOKEN=... \\
+  HALTSQL_MCP_DATABASE_URL=postgresql://agent_ro@db/app \\
+  HALTSQL_MCP_CONTEXT='{"tenant_id":"acme"}' haltsql-mcp
+
+  # streamable HTTP; each bearer token maps to a tenant context:
+  haltsql-mcp --transport http --port 8765 --tokens-file tokens.json \\
+    --database-url postgresql://agent_ro@db/app --policy-file policy.yaml
+
+  # without a sidecar, verifying with the local haltsql CLI:
+  haltsql-mcp --local-policy policy.yaml --context-file ctx.json --database-url ...
+
+  # everything in one file (YAML or JSON); env and flags override it:
+  haltsql-mcp --config haltsql-mcp.yaml
+
+  # drop-in for @modelcontextprotocol/server-postgres (DSN as the last argument):
+  haltsql-mcp --local-policy policy.yaml postgresql://agent_ro@localhost/app
+
+Exit status: 0 on shutdown, 2 on a configuration error.
+See docs/mcp.md for every environment variable.""",
+    )
+    p.add_argument("--config", help="Config file (YAML or JSON); environment variables and flags override it. "
+                                    "Also HALTSQL_MCP_CONFIG.")
+    p.add_argument("--transport", choices=["stdio", "http"])
+    p.add_argument("--host")
+    p.add_argument("--port", type=int)
+    p.add_argument("--public-url", help="External URL of this server (OAuth resource metadata).")
+    p.add_argument("--haltsql-url")
+    p.add_argument("--policy", dest="haltsql_policy", help="Policy name to request from the sidecar.")
+    p.add_argument("--local-policy", help="Verify with the local haltsql CLI and this policy file.")
+    p.add_argument("--policy-file", help="Policy document for describe_policy/list_tables.")
+    p.add_argument("--database-url")
+    p.add_argument("dsn", nargs="?", metavar="DATABASE_URL",
+                   help="libpq DSN, as a positional argument like @modelcontextprotocol/server-postgres "
+                        "takes it (same as --database-url).")
+    p.add_argument("--row-cap", type=int)
+    p.add_argument("--statement-timeout-ms", type=int)
+    p.add_argument("--context-file", help="JSON context for stdio (overrides HALTSQL_MCP_CONTEXT).")
+    p.add_argument("--tokens-file", help="JSON tokens file for the HTTP transport.")
+    p.add_argument("--insecure-static-context", action="store_true",
+                   help="HTTP without authentication, using the static context (loopback only; dev).")
+    return p
+
+
+def settings_from_args(argv: Optional[List[str]] = None, env: Optional[Mapping[str, str]] = None) -> Settings:
+    args = _parser().parse_args(argv)
+    s = Settings.from_sources(env, config_file=args.config)
+    for attr in ("transport", "host", "port", "public_url", "haltsql_url", "haltsql_policy",
+                 "local_policy", "policy_file", "database_url", "row_cap",
+                 "statement_timeout_ms", "tokens_file"):
+        val = getattr(args, attr)
+        if val is not None:
+            setattr(s, "local_policy_file" if attr == "local_policy" else attr, val)
+    if args.dsn is not None:
+        if args.database_url is not None and args.database_url != args.dsn:
+            raise ConfigError("give the database URL once: positionally or with --database-url, not both")
+        s.database_url = args.dsn
+    if args.context_file:
+        s.load_context_file(args.context_file)
+    s.insecure_static_context = bool(args.insecure_static_context)
+    s.validate()
+    return s
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    logging.basicConfig(level=logging.WARNING, stream=sys.stderr)
+    try:
+        settings = settings_from_args(argv)
+        token_verifier: Optional[StaticTokenVerifier] = None
+        if settings.transport == "http" and settings.tokens_file:
+            token_verifier = StaticTokenVerifier(load_tokens_file(settings.tokens_file))
+            provider = session_context_provider(token_verifier)
+        else:
+            provider = static_context_provider(settings.context)
+        tools = build_tools(settings, provider)
+    except ConfigError as e:
+        print(f"haltsql-mcp: {e}", file=sys.stderr)
+        return 2
+    public_url = settings.public_url or f"http://{settings.host}:{settings.port}"
+    server = build_server(tools, token_verifier=token_verifier, public_url=public_url)
+    if settings.transport == "stdio":
+        server.run("stdio")
+    elif getattr(server, "_haltsql_sdk_major", 2) >= 2:
+        server.run("streamable-http", host=settings.host, port=settings.port)
+    else:  # pragma: no cover - mcp 1.x
+        server.settings.host = settings.host
+        server.settings.port = settings.port
+        server.run("streamable-http")
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

haltsql_mcp-0.0.1.dist-info/METADATA

@@ -0,0 +1,62 @@
+Metadata-Version: 2.4
+Name: haltsql-mcp
+Version: 0.0.1
+Summary: MCP server that runs LLM-written SQL on PostgreSQL only after HaltSQL allows it
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: haltsql>=0.0.1
+Requires-Dist: mcp>=1.10
+Requires-Dist: psycopg[binary]>=3.2
+Provides-Extra: yaml
+Requires-Dist: PyYAML>=6; extra == "yaml"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: pytest-asyncio>=0.21; extra == "test"
+Requires-Dist: uvicorn>=0.30; extra == "test"
+
+# haltsql-mcp
+
+The safe drop-in replacement for `@modelcontextprotocol/server-postgres`.
+Same `query(sql)` tool, same positional connection string, plus column, tenant
+and function guardrails, a row cap and a statement timeout.
+
+```sh
+haltsql-mcp --local-policy policy.yaml postgresql://agent_ro@localhost/mydb
+```
+
+Or with Docker (includes the `haltsql` CLI; no central server needed):
+
+```sh
+docker run -i --rm --read-only -v "$PWD:/config:ro" ghcr.io/haltsql/haltsql-mcp \
+  postgresql://agent_ro@host.docker.internal/mydb      # /config/policy.yaml is picked up
+```
+
+Build it with `docker build -f clients/mcp/Dockerfile .` from the repository
+root, and see `scripts/mcp-docker-smoke.sh` for the end-to-end test.
+
+An MCP server that lets an agent query PostgreSQL only through
+[HaltSQL](https://github.com/HaltSQL/HaltSQL): every SQL string is verified
+against your policy, then exactly that string runs with server-bound
+parameters in a read-only transaction (row cap, `statement_timeout`).
+
+Tools: `query(sql)`, `explain_denial(sql)`, `list_tables()`, `describe_policy()`.
+The tenant comes from server configuration (stdio) or the authenticated
+bearer token (streamable HTTP), never from tool arguments.
+
+```sh
+pip install ../python .   # Python 3.10+
+HALTSQL_URL=http://127.0.0.1:8080 HALTSQL_TOKEN=... \
+HALTSQL_MCP_DATABASE_URL=postgresql://agent_ro@db/app \
+HALTSQL_MCP_CONTEXT='{"tenant_id":"acme"}' haltsql-mcp
+```
+
+See [docs/mcp.md](../../docs/mcp.md) for configuration, the tokens file, and
+examples. `haltsql-mcp --help` lists every flag.
+
+## Tests
+
+```sh
+python3 -m venv .venv && .venv/bin/pip install -e ../python -e '.[test,yaml]'
+.venv/bin/pytest -q
+```

haltsql_mcp-0.0.1.dist-info/RECORD

@@ -0,0 +1,11 @@
+haltsql_mcp/__init__.py,sha256=9HTku6HjsdL5XNY3NjLszASk9PZMehRiLP0VlefsbuM,616
+haltsql_mcp/__main__.py,sha256=WAhr-TR-SUgzU8lRacTT70n91sBZgxPy6yff-Zyeu3E,55
+haltsql_mcp/config.py,sha256=3tPK-Sl1PC_QOGlnrrexs8qgMWe-lzNRT5tme4EjlXw,16985
+haltsql_mcp/core.py,sha256=PUYPf3u65Ty4-xuXEsxLVxJqj4IsHdDJHfifMjtu7XE,14881
+haltsql_mcp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+haltsql_mcp/server.py,sha256=gyNO2FG6oQXvrFcx58Soer9Mxo2c_i0Qe_24CuyaEV4,13024
+haltsql_mcp-0.0.1.dist-info/METADATA,sha256=1nLXAOPjW6T3cQly4p5TvMeJ5nElGabaLYSjzXPVWSU,2222
+haltsql_mcp-0.0.1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+haltsql_mcp-0.0.1.dist-info/entry_points.txt,sha256=IphR83W-nz7V3LmiUKcxZJ2xfc1UO-dQlubXPu0irpU,56
+haltsql_mcp-0.0.1.dist-info/top_level.txt,sha256=nhRefq_5ENZo6lagDAo78GT8VztboguBgevtPktIFys,12
+haltsql_mcp-0.0.1.dist-info/RECORD,,

haltsql_mcp-0.0.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

haltsql_mcp-0.0.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+haltsql-mcp = haltsql_mcp.server:main

haltsql_mcp-0.0.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+haltsql_mcp