queue-aiops 0.1.0__tar.gz

queue_aiops-0.1.0/.github/workflows/mcp-publish.yml

@@ -0,0 +1,55 @@
+name: mcp-publish
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish-mcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Wait for PyPI
+        # The release event also triggers the PyPI publish workflow; the MCP
+        # registry validates that the package version exists on PyPI, so poll
+        # until it has propagated (every 15s, up to 10 minutes).
+        run: |
+          python3 - <<'EOF'
+          import json
+          import sys
+          import time
+          import urllib.error
+          import urllib.request
+
+          with open("server.json", encoding="utf-8") as f:
+              package = json.load(f)["packages"][0]
+          name, version = package["identifier"], package["version"]
+          url = f"https://pypi.org/pypi/{name}/{version}/json"
+          deadline = time.monotonic() + 600
+          while True:
+              try:
+                  with urllib.request.urlopen(url, timeout=10):
+                      print(f"{name}=={version} is available on PyPI.")
+                      sys.exit(0)
+              except (urllib.error.URLError, OSError) as exc:
+                  print(f"{name}=={version} not on PyPI yet ({exc}); "
+                        "retrying in 15s...")
+              if time.monotonic() >= deadline:
+                  sys.exit(f"Timed out after 10 minutes waiting for "
+                           f"{name}=={version} to appear on PyPI. "
+                           "Check the PyPI publish workflow, then re-run "
+                           "this workflow via workflow_dispatch.")
+              time.sleep(15)
+          EOF
+      - name: Install mcp-publisher
+        run: |
+          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+      - name: Login to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+      - name: Publish server.json
+        run: ./mcp-publisher publish

queue_aiops-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,26 @@
+name: Publish to PyPI
+
+# Trusted Publishing (OIDC) — publishes from GitHub's runners with no API token,
+# sidestepping the local-IP / account new-project rate limit. Configure a matching
+# "trusted publisher" for this package on PyPI (see the repo release notes).
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required for PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1

queue_aiops-0.1.0/.gitignore

@@ -0,0 +1,8 @@
+.venv/
+dist/
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+*.egg-info/
+.coverage

queue_aiops-0.1.0/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## v0.1.0 — 2026-07-17
+
+Initial preview release.
+
+- **Platforms**: redis (RESP via the `redis` Python client; password optional,
+  TLS optional) and rabbitmq (management HTTP API, Basic auth) behind a
+  name-keyed platform registry; one config spans a mixed estate.
+- **26 MCP tools** (19 reads, 7 governed writes), all wrapped by the bundled
+  governance harness (audit / budget / risk tiers / undo).
+- **Flagship RCAs**: `redis_memory_pressure_rca` (maxmemory, eviction policy,
+  fragmentation, SCAN-budgeted big keys), `redis_latency_rca` (slowlog digest
+  by command pattern, blocked clients, fork/AOF stalls),
+  `rabbitmq_queue_backlog_rca` (zero/slow consumers, unacked pileups,
+  memory/disk watermark blocks), `connection_churn_analysis` (both platforms,
+  optional prior-snapshot deltas, clients by source).
+- **Governed writes**: `redis_config_set` (undo = prior value from CONFIG GET),
+  `redis_kill_client` (priorState = client row, no undo), `purge_queue` (high;
+  priorState = message count, no undo), `delete_queue` (high; undo re-declares
+  the captured definition), `declare_queue`, `set_policy` / `delete_policy`
+  (undo = prior policy or delete-if-new). All take `dry_run`; CLI twins add
+  double-confirm.
+- **Safety**: typed redis command allow-list (no generic passthrough; never
+  `KEYS *`), central percent-encoding of rabbitmq path segments (incl. the
+  default vhost `/`), encrypted secret store (Fernet + scrypt), secure-by-default
+  approver gate for high-risk writes.
+- Preview / mock-only: exercised against mocked clients; not yet validated on
+  live production brokers.

queue_aiops-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wei <zhouwei008@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

queue_aiops-0.1.0/PKG-INFO

@@ -0,0 +1,168 @@
+Metadata-Version: 2.4
+Name: queue-aiops
+Version: 0.1.0
+Summary: Governed AI-ops for redis + rabbitmq: memory-pressure/latency/queue-backlog/connection-churn RCAs, slowlog and SCAN-budgeted big-key sampling, queues/policies/nodes, and governed writes (config set, client kill, purge/delete queue, policies) with a built-in governance harness (audit, budget, undo, risk tiers)
+Author-email: wei <zhouwei008@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=42.0
+Requires-Dist: httpx<1.0,>=0.27
+Requires-Dist: mcp[cli]<2.0,>=1.10
+Requires-Dist: pyyaml<7.0,>=6.0
+Requires-Dist: redis<7.0,>=5.0
+Requires-Dist: rich<16.0,>=13.0
+Requires-Dist: typer<1.0,>=0.12
+Description-Content-Type: text/markdown
+
+# Queue AIops (preview)
+
+**Governed AI-ops for redis + rabbitmq.** queue-aiops is for the team running
+their own cache and message broker — a redis that "suddenly eats memory", a
+rabbitmq whose queues quietly grow until publishers block — without an
+enterprise observability suite. It gives an AI agent (or a human at the CLI) a
+governed toolset over both: transparent root-cause analyses for memory
+pressure, latency, queue backlog, and connection churn, plus the handful of
+writes an operator actually needs (config set, client kill, purge/delete
+queue, policies) — every call audited, budgeted, risk-tiered, and undo-recorded
+by the built-in governance harness.
+
+> **Disclaimer**: Community-maintained open-source project, **not affiliated
+> with, endorsed by, or sponsored by the Redis or RabbitMQ projects or their
+> respective owners.** Redis and RabbitMQ are trademarks of their respective owners.
+>
+> **Preview / mock-only**: not yet validated against production brokers. Both
+> redis and rabbitmq are free/self-hostable (one lab container or package install each), so a lab
+> check is easy — `queue-aiops doctor` is the fastest live probe.
+
+## Quick start
+
+```bash
+uv tool install queue-aiops
+
+queue-aiops init      # wizard: pick platform (redis/rabbitmq), host/port, encrypted secret
+queue-aiops doctor    # config + secret + connectivity check (PING / /api/overview)
+queue-aiops overview  # one-shot health summary for the default target
+```
+
+Then the interesting parts:
+
+```bash
+queue-aiops analyze memory     # redis memory-pressure RCA (maxmemory, eviction, frag, big keys)
+queue-aiops analyze latency    # redis latency RCA (slowlog digest, fork/AOF stalls)
+queue-aiops analyze backlog    # rabbitmq queue-backlog RCA (consumers, unacked, watermarks)
+queue-aiops analyze churn      # connection churn, both platforms
+queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
+queue-aiops rabbitmq queues    # deepest backlog first
+```
+
+## Support scope
+
+| Platform | Protocol | Coverage |
+|----------|----------|----------|
+| **redis** (5.x–7.x wire protocol via `redis` Python client) | RESP, password optional, TLS optional | INFO (server/memory/clients/stats/persistence/keyspace), SLOWLOG, CLIENT LIST/KILL, CONFIG GET/SET, MEMORY STATS/USAGE, SCAN-budgeted big-key sampling, DBSIZE, PING |
+| **rabbitmq** (management plugin HTTP API) | HTTP(S), Basic auth | /api/overview, /api/queues (+ per-vhost, detail, purge, declare, delete), /api/connections, /api/channels, /api/consumers, /api/policies (get/set/delete), /api/nodes |
+
+**26 MCP tools** — 19 reads (incl. 4 flagship RCAs) + 7 governed writes.
+
+| Group | Tools | R/W |
+|-------|-------|:---:|
+| Overview | queue_overview | read |
+| redis reads | redis_server_info, redis_memory_stats, redis_clients, redis_slowlog, redis_config_get, redis_keyspace, redis_big_keys | read |
+| rabbitmq reads | rabbitmq_overview, list_queues, queue_detail, list_connections, list_channels, list_policies, node_health | read |
+| Flagship RCAs | redis_memory_pressure_rca, redis_latency_rca, rabbitmq_queue_backlog_rca, connection_churn_analysis | read |
+| Writes (medium) | redis_config_set, redis_kill_client, declare_queue, set_policy, delete_policy | write |
+| Writes (**high**) | purge_queue, delete_queue | write |
+
+The four RCAs are transparent heuristics that report their numbers — thresholds
+are named constants, every finding carries its evidence, never a black-box
+verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
+200 with MEMORY USAGE — **never `KEYS *`** — and reports its coverage.
+
+## Governance
+
+Every MCP tool runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency):
+
+- **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
+  `QUEUE_AIOPS_HOME`), secret-redacted.
+- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
+  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
+- **Risk tiers & approval** — **secure by default**: with no
+  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
+  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
+  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
+  rules.yaml with that dual-control tier; an operator-authored rules file is
+  honoured as-is.
+- **Undo** — reversible writes capture the real before-state first:
+  `redis_config_set` records the prior value from CONFIG GET;
+  `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
+  the queue's definition and its undo re-declares it (the **messages are not
+  restored** — the descriptor says so). Irreversible writes (`purge_queue`,
+  `redis_kill_client`) record priorState only.
+- **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
+  `--dry-run` (CLI); CLI writes double-confirm and execute through the same
+  governed twins, so they land in the audit log too.
+- Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
+  scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
+  use). Redis passwords are optional — an auth-less lab instance is a
+  supported target.
+
+## MCP configuration
+
+```json
+{
+  "mcpServers": {
+    "queue-aiops": {
+      "command": "uvx",
+      "args": ["--from", "queue-aiops", "queue-aiops-mcp"],
+      "env": {
+        "QUEUE_AIOPS_MASTER_PASSWORD": "your-master-password"
+      }
+    }
+  }
+}
+```
+
+> **env-block caveat**: MCP clients launch the server with a *minimal*
+> environment — your shell profile is not sourced. Anything the server needs
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
+> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
+> block above, not just in your terminal.
+
+Or, with the package installed: `queue-aiops mcp`.
+
+## CLI reference (short)
+
+```text
+queue-aiops init | doctor | overview | mcp
+queue-aiops secret set|list|migrate ...
+queue-aiops redis info|memory|clients|slowlog|config-get|keyspace|bigkeys
+queue-aiops redis config-set <param> <value> [--dry-run]
+queue-aiops redis kill-client --id <id> | --addr <ip:port> [--dry-run]
+queue-aiops rabbitmq overview|queues|queue|connections|channels|policies|nodes
+queue-aiops rabbitmq purge|delete-queue|declare-queue <name> [--vhost /] [--dry-run]
+queue-aiops rabbitmq set-policy|delete-policy <name> ... [--dry-run]
+queue-aiops analyze memory|latency|backlog|churn
+```
+
+## Verification status
+
+Preview / mock-only: the full test suite runs against mocked clients (no live
+broker needed), and the REST paths / INFO fields are modelled from the public
+docs of both platforms. Not yet validated against live production brokers —
+both are trivially self-hostable, so `queue-aiops doctor` against a
+local lab redis instance / rabbitmq broker (management plugin enabled) is
+the quickest live check.
+
+## Contributing
+
+缺功能提 issue/PR 欢迎留言 — missing a read you need (streams/consumer groups,
+quorum-queue specifics, shovel/federation status), another broker platform, or
+a threshold that doesn't fit your fleet? Open an issue or PR at
+[github.com/AIops-tools/Queue-AIops](https://github.com/AIops-tools/Queue-AIops)
+— platform registry entries are additive and small.
+
+## License
+
+MIT

queue_aiops-0.1.0/README.md

@@ -0,0 +1,151 @@
+# Queue AIops (preview)
+
+**Governed AI-ops for redis + rabbitmq.** queue-aiops is for the team running
+their own cache and message broker — a redis that "suddenly eats memory", a
+rabbitmq whose queues quietly grow until publishers block — without an
+enterprise observability suite. It gives an AI agent (or a human at the CLI) a
+governed toolset over both: transparent root-cause analyses for memory
+pressure, latency, queue backlog, and connection churn, plus the handful of
+writes an operator actually needs (config set, client kill, purge/delete
+queue, policies) — every call audited, budgeted, risk-tiered, and undo-recorded
+by the built-in governance harness.
+
+> **Disclaimer**: Community-maintained open-source project, **not affiliated
+> with, endorsed by, or sponsored by the Redis or RabbitMQ projects or their
+> respective owners.** Redis and RabbitMQ are trademarks of their respective owners.
+>
+> **Preview / mock-only**: not yet validated against production brokers. Both
+> redis and rabbitmq are free/self-hostable (one lab container or package install each), so a lab
+> check is easy — `queue-aiops doctor` is the fastest live probe.
+
+## Quick start
+
+```bash
+uv tool install queue-aiops
+
+queue-aiops init      # wizard: pick platform (redis/rabbitmq), host/port, encrypted secret
+queue-aiops doctor    # config + secret + connectivity check (PING / /api/overview)
+queue-aiops overview  # one-shot health summary for the default target
+```
+
+Then the interesting parts:
+
+```bash
+queue-aiops analyze memory     # redis memory-pressure RCA (maxmemory, eviction, frag, big keys)
+queue-aiops analyze latency    # redis latency RCA (slowlog digest, fork/AOF stalls)
+queue-aiops analyze backlog    # rabbitmq queue-backlog RCA (consumers, unacked, watermarks)
+queue-aiops analyze churn      # connection churn, both platforms
+queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
+queue-aiops rabbitmq queues    # deepest backlog first
+```
+
+## Support scope
+
+| Platform | Protocol | Coverage |
+|----------|----------|----------|
+| **redis** (5.x–7.x wire protocol via `redis` Python client) | RESP, password optional, TLS optional | INFO (server/memory/clients/stats/persistence/keyspace), SLOWLOG, CLIENT LIST/KILL, CONFIG GET/SET, MEMORY STATS/USAGE, SCAN-budgeted big-key sampling, DBSIZE, PING |
+| **rabbitmq** (management plugin HTTP API) | HTTP(S), Basic auth | /api/overview, /api/queues (+ per-vhost, detail, purge, declare, delete), /api/connections, /api/channels, /api/consumers, /api/policies (get/set/delete), /api/nodes |
+
+**26 MCP tools** — 19 reads (incl. 4 flagship RCAs) + 7 governed writes.
+
+| Group | Tools | R/W |
+|-------|-------|:---:|
+| Overview | queue_overview | read |
+| redis reads | redis_server_info, redis_memory_stats, redis_clients, redis_slowlog, redis_config_get, redis_keyspace, redis_big_keys | read |
+| rabbitmq reads | rabbitmq_overview, list_queues, queue_detail, list_connections, list_channels, list_policies, node_health | read |
+| Flagship RCAs | redis_memory_pressure_rca, redis_latency_rca, rabbitmq_queue_backlog_rca, connection_churn_analysis | read |
+| Writes (medium) | redis_config_set, redis_kill_client, declare_queue, set_policy, delete_policy | write |
+| Writes (**high**) | purge_queue, delete_queue | write |
+
+The four RCAs are transparent heuristics that report their numbers — thresholds
+are named constants, every finding carries its evidence, never a black-box
+verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
+200 with MEMORY USAGE — **never `KEYS *`** — and reports its coverage.
+
+## Governance
+
+Every MCP tool runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency):
+
+- **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
+  `QUEUE_AIOPS_HOME`), secret-redacted.
+- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
+  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
+- **Risk tiers & approval** — **secure by default**: with no
+  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
+  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
+  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
+  rules.yaml with that dual-control tier; an operator-authored rules file is
+  honoured as-is.
+- **Undo** — reversible writes capture the real before-state first:
+  `redis_config_set` records the prior value from CONFIG GET;
+  `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
+  the queue's definition and its undo re-declares it (the **messages are not
+  restored** — the descriptor says so). Irreversible writes (`purge_queue`,
+  `redis_kill_client`) record priorState only.
+- **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
+  `--dry-run` (CLI); CLI writes double-confirm and execute through the same
+  governed twins, so they land in the audit log too.
+- Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
+  scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
+  use). Redis passwords are optional — an auth-less lab instance is a
+  supported target.
+
+## MCP configuration
+
+```json
+{
+  "mcpServers": {
+    "queue-aiops": {
+      "command": "uvx",
+      "args": ["--from", "queue-aiops", "queue-aiops-mcp"],
+      "env": {
+        "QUEUE_AIOPS_MASTER_PASSWORD": "your-master-password"
+      }
+    }
+  }
+}
+```
+
+> **env-block caveat**: MCP clients launch the server with a *minimal*
+> environment — your shell profile is not sourced. Anything the server needs
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
+> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
+> block above, not just in your terminal.
+
+Or, with the package installed: `queue-aiops mcp`.
+
+## CLI reference (short)
+
+```text
+queue-aiops init | doctor | overview | mcp
+queue-aiops secret set|list|migrate ...
+queue-aiops redis info|memory|clients|slowlog|config-get|keyspace|bigkeys
+queue-aiops redis config-set <param> <value> [--dry-run]
+queue-aiops redis kill-client --id <id> | --addr <ip:port> [--dry-run]
+queue-aiops rabbitmq overview|queues|queue|connections|channels|policies|nodes
+queue-aiops rabbitmq purge|delete-queue|declare-queue <name> [--vhost /] [--dry-run]
+queue-aiops rabbitmq set-policy|delete-policy <name> ... [--dry-run]
+queue-aiops analyze memory|latency|backlog|churn
+```
+
+## Verification status
+
+Preview / mock-only: the full test suite runs against mocked clients (no live
+broker needed), and the REST paths / INFO fields are modelled from the public
+docs of both platforms. Not yet validated against live production brokers —
+both are trivially self-hostable, so `queue-aiops doctor` against a
+local lab redis instance / rabbitmq broker (management plugin enabled) is
+the quickest live check.
+
+## Contributing
+
+缺功能提 issue/PR 欢迎留言 — missing a read you need (streams/consumer groups,
+quorum-queue specifics, shovel/federation status), another broker platform, or
+a threshold that doesn't fit your fleet? Open an issue or PR at
+[github.com/AIops-tools/Queue-AIops](https://github.com/AIops-tools/Queue-AIops)
+— platform registry entries are additive and small.
+
+## License
+
+MIT

queue_aiops-0.1.0/RELEASE_NOTES.md

@@ -0,0 +1,33 @@
+# queue-aiops v0.1.0 — 2026-07-17
+
+First preview release: governed AI-ops for **redis + rabbitmq**.
+
+## Highlights
+
+- **Two platforms, one toolset**: a per-target `platform` field selects the
+  protocol shape — redis over the RESP client (password optional, TLS
+  optional), rabbitmq over the management HTTP API (Basic auth). The platform
+  registry makes further brokers additive.
+- **Four flagship RCAs** — transparent heuristics that show their numbers:
+  - `redis_memory_pressure_rca` — used vs maxmemory + eviction policy,
+    evicted-keys pressure, fragmentation/swap signals, big-key sample.
+  - `redis_latency_rca` — SLOWLOG digested by command pattern (O(N) commands
+    flagged), blocked clients, fork/AOF-fsync stalls from INFO persistence.
+  - `rabbitmq_queue_backlog_rca` — per-queue cause (no consumers / unacked
+    pileup / publish outpacing delivery) + global watermark-alarm findings.
+  - `connection_churn_analysis` — both platforms; counts vs an optional prior
+    snapshot, clients grouped by source.
+- **Governed writes with honest undo**: config set (prior value captured),
+  policies (prior policy captured; delete-if-new), delete_queue (undo
+  re-declares the captured definition — messages are not restored, and the
+  descriptor says so), purge/kill record priorState only.
+- **Safety rails**: SCAN-budgeted big-key sampling (never `KEYS *`), typed
+  redis command allow-list, centrally percent-encoded rabbitmq paths (default
+  vhost `/` included), encrypted secret store, secure-by-default approver gate
+  on high-risk writes, dry-run everywhere.
+
+## Known limits (preview)
+
+- Mock-validated only; not yet run against live production brokers.
+- redis cluster-wide topology reads and rabbitmq shovel/federation status are
+  out of scope for v0.1 — issues/PRs welcome.

queue_aiops-0.1.0/SECURITY.md

@@ -0,0 +1,96 @@
+# Security Policy
+
+## Disclaimer
+
+Community-maintained open-source project. **Not affiliated with, endorsed by, or
+sponsored by the Redis or RabbitMQ projects or their respective owners.** Product and
+trademark names (Redis, RabbitMQ) belong to their owners. Source is auditable
+under the MIT license.
+
+## Reporting Vulnerabilities
+
+Report privately via a GitHub Security Advisory on
+[github.com/AIops-tools/Queue-AIops](https://github.com/AIops-tools/Queue-AIops/security/advisories)
+or email zhouwei008@gmail.com. Please do not open public issues for security
+reports.
+
+## Security Design
+
+### Credential Management
+- Per-target secrets — the redis **password** (optional; auth-less lab
+  instances are a supported setup) or the rabbitmq management user's
+  **password** (paired with `username` for HTTP Basic auth) — live
+  **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet/AES-128 +
+  scrypt-derived key; chmod 600), never in `config.yaml` and never in source.
+  The master password is never stored — only a per-store random salt and the
+  ciphertext are on disk.
+- A legacy plaintext env var `QUEUE_<TARGET_NAME_UPPER>_SECRET` is still
+  honoured as a fallback with a deprecation warning (migrate with
+  `queue-aiops secret migrate`).
+- The secret is held only in memory and never logged or echoed. It is presented
+  as `AUTH` at connect time (redis) or HTTP Basic auth (rabbitmq management
+  API); the config file holds only platform, host, port, username, db, and TLS
+  settings.
+
+### Governed Operations
+Every MCP tool runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance`):
+- **Audit** — every call logged to a local SQLite DB under `~/.queue-aiops/`
+  (relocatable via `QUEUE_AIOPS_HOME`), agent-attributed, secret-redacted.
+- **Token/runaway budget** — hard ceilings (`QUEUE_MAX_TOOL_CALLS` /
+  `QUEUE_MAX_TOOL_SECONDS`) plus an on-by-default guard that trips a tight
+  poll/retry loop, preventing unbounded API consumption.
+- **Graduated risk tiers** — `~/.queue-aiops/rules.yaml` `risk_tiers` gate
+  writes by environment/tag; the highest tiers require a recorded approver.
+- **Undo-token recording** — reversible writes capture the BEFORE state (via a
+  real read) and record an inverse descriptor (e.g. `redis_config_set` restores
+  the prior value from CONFIG GET; `delete_queue` re-declares the captured
+  queue definition; `set_policy`/`delete_policy` restore the prior policy) so
+  the change can be rolled back.
+
+### State-Changing Operations
+The destructive writes — `purge_queue` and `delete_queue` — are
+`risk_level=high`, accept a `dry_run` preview, and (under `risk_tiers`) require
+a recorded approver (`QUEUE_AUDIT_APPROVED_BY` + `QUEUE_AUDIT_RATIONALE`).
+Purged/deleted **messages cannot be restored** — `purge_queue` records the
+prior message count as audit evidence (no undo) and `delete_queue`'s undo
+restores the queue *definition* only. `redis_config_set`, `redis_kill_client`
+(priorState = the client's CLIENT LIST row; no undo), `declare_queue`,
+`set_policy`, and `delete_policy` are `risk_level=medium`; reversible ones
+capture before-state and record an undo token.
+
+### Command Surface (redis)
+The connection layer exposes a **typed allow-list of commands only** (INFO,
+SLOWLOG, CLIENT LIST/KILL, CONFIG GET/SET, MEMORY STATS/USAGE, SCAN, DBSIZE,
+PING) — there is no generic "run any command" passthrough, and big-key
+sampling is SCAN-based under a hard budget (never `KEYS *`). `CONFIG SET`
+parameter names are validated against a strict pattern before reaching the
+wire.
+
+### SSL/TLS Verification
+`verify_ssl` defaults to true when TLS is enabled; disable only for self-signed
+lab certificates.
+
+### Prompt-Injection Protection
+All broker-returned text (key names, client addresses, slowlog commands, queue
+and policy names, node names) is passed through a `sanitize()` truncate +
+control-character strip before reaching the agent. RabbitMQ path segments —
+including the default vhost `/` — are percent-encoded centrally so an
+agent-supplied name can never rewrite a request path.
+
+### Network Scope
+No webhooks, no telemetry, no outbound calls beyond the configured redis
+instances and rabbitmq management API endpoints. No post-install scripts or
+background services.
+
+## Static Analysis
+
+```bash
+uvx bandit -r queue_aiops/ mcp_server/
+uv run ruff check .
+```
+
+## Supported Versions
+
+The latest released version receives security fixes. This is a preview (0.x);
+pin a version in production.

queue_aiops-0.1.0/mcp_server/__init__.py

@@ -0,0 +1 @@
+"""MCP server package for queue-aiops."""