queue-aiops 0.2.2__tar.gz → 0.4.0__tar.gz

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v0.4.0 — 2026-07-21
+
+### Changed (BREAKING)
+- **Removed the authorization layer** — read-only mode, the approver gate, and rules.yaml deny are gone. The skill no longer decides read vs write; that is the agent's judgement or the connecting account's permissions. `<PREFIX>_READ_ONLY` now has no effect (a startup warning is logged); `<PREFIX>_AUDIT_APPROVED_BY`/`_RATIONALE` are optional audit annotations.
+- The retained guarantee is **unbypassable audit over MCP and CLI alike** — no unaudited entry point. Harness = audit + runaway safety guard + undo + sanitize; `risk_level` is a descriptive audit label, not a gate.
+
+See RELEASE_NOTES.md for tool-specific changes.
+
+
+## v0.3.0 — 2026-07-20
+
+### Fixed
+- **`redis_config_set` refuses the parameters that lock this tool out of the server**: `requirepass`, `masterauth`, `bind`, `protected-mode`, `maxclients`, `port`, `unixsocket`, `aclfile`, and anything `tls-*`.
+- `list_clients` no longer returns this tool's own connection, and `redis_kill_client` refuses it — by id or by address.
+- Harness: a write whose response is lost is audited `status=unknown`, not `error` — it may have taken effect. Undo tokens gain `effectVerified` (undo.db migrated in place).
+- Harness: a dry-run no longer records an undo token, and no longer requires a named approver. Guards now run on the preview path.
+- Truncated strings end in an ellipsis instead of being cut silently; error messages are capped at 800 chars, not 300.
+
+See RELEASE_NOTES.md for the full detail.
+
 ## v0.1.1 — 2026-07-17
 
 ### Fixed

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: queue-aiops
-Version: 0.2.2
+Version: 0.4.0
 Summary: Governed AI-ops for redis + rabbitmq: memory-pressure/latency/queue-backlog/connection-churn RCAs, slowlog and SCAN-budgeted big-key sampling, queues/policies/nodes, and governed writes (config set, client kill, purge/delete queue, policies) with a built-in governance harness (audit, budget, undo, risk tiers)
-Author-email: wei <zhouwei008@gmail.com>
+Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
@@ -59,40 +59,24 @@ queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
 queue-aiops rabbitmq queues    # deepest backlog first
 ```
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers broker operations — reads and writes — accurately and efficiently,
+and records every one of them. It does **not** decide whether a write is allowed
+to happen. That is the agent's judgement, or the permission of the account you
+connect it with: give the Redis connection an ACL user restricted to read
+commands, or the RabbitMQ management user only the `monitoring` tag, and the
+writes fail at the broker — the place that actually owns the permission.
 
-```bash
-export QUEUE_READ_ONLY=1
-```
-
-With that set, the **8 write tools are never registered**. An MCP client
-lists **20 tools instead of 28** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.queue-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.queue-aiops/audit.db`,
+and reversible writes still capture their before-state and record an inverse.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, kept in agreement with its `[READ]`/`[WRITE]`
+> documentation tag by a test, and carried into the audit row as a descriptive
+> tier — so a reviewer can see at a glance that a row was a high-risk delete. It
+> is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/queue-aiops/references/agent-guardrails.md) — it lists
@@ -125,19 +109,21 @@ verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
 
 ## Governance
 
-Every MCP tool runs through the bundled `@governed_tool` harness
-(`queue_aiops.governance` — no external dependency):
+Every MCP tool — and every CLI write, which routes through the same governed
+functions — runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency). It **records; it does not
+authorize** whether a write may happen (see above):
 
 - **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
-  `QUEUE_AIOPS_HOME`), secret-redacted.
-- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
-  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
-- **Risk tiers & approval** — **secure by default**: with no
-  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
-  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
-  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
-  rules.yaml with that dual-control tier; an operator-authored rules file is
-  honoured as-is.
+  `QUEUE_AIOPS_HOME`), secret-redacted. The CLI writes the same row the MCP path
+  does — there is no unaudited entry point.
+- **Budget / runaway guard** — a safety backstop, not an authorization gate:
+  call/time ceilings (`QUEUE_MAX_TOOL_CALLS`, `QUEUE_MAX_TOOL_SECONDS`) + a
+  runaway-loop breaker stop a stuck agent from burning unbounded calls/time.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing. `QUEUE_AUDIT_APPROVED_BY` / `QUEUE_AUDIT_RATIONALE` are
+  optional annotations recorded on the row (who/why), never required and never
+  blocking.
 - **Undo** — reversible writes capture the real before-state first:
   `redis_config_set` records the prior value from CONFIG GET;
   `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
@@ -146,7 +132,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
   `redis_kill_client`) record priorState only.
 - **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
   `--dry-run` (CLI); CLI writes double-confirm and execute through the same
-  governed twins, so they land in the audit log too.
+  governed twins, so they land in the audit log too. `purge_queue` and
+  `delete_queue` are risk=high with dry-run + double confirmation at the CLI.
 - Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
   scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
   use). Redis passwords are optional — an auth-less lab instance is a
@@ -170,9 +157,9 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 > **env-block caveat**: MCP clients launch the server with a *minimal*
 > environment — your shell profile is not sourced. Anything the server needs
-> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
-> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
-> block above, not just in your terminal.
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`, and any
+> optional `QUEUE_AUDIT_APPROVED_BY`/`QUEUE_AUDIT_RATIONALE` audit annotations)
+> must be set in the `env` block above, not just in your terminal.
 
 Or, with the package installed: `queue-aiops mcp`.
 

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/README.md

@@ -42,40 +42,24 @@ queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
 queue-aiops rabbitmq queues    # deepest backlog first
 ```
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers broker operations — reads and writes — accurately and efficiently,
+and records every one of them. It does **not** decide whether a write is allowed
+to happen. That is the agent's judgement, or the permission of the account you
+connect it with: give the Redis connection an ACL user restricted to read
+commands, or the RabbitMQ management user only the `monitoring` tag, and the
+writes fail at the broker — the place that actually owns the permission.
 
-```bash
-export QUEUE_READ_ONLY=1
-```
-
-With that set, the **8 write tools are never registered**. An MCP client
-lists **20 tools instead of 28** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.queue-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.queue-aiops/audit.db`,
+and reversible writes still capture their before-state and record an inverse.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, kept in agreement with its `[READ]`/`[WRITE]`
+> documentation tag by a test, and carried into the audit row as a descriptive
+> tier — so a reviewer can see at a glance that a row was a high-risk delete. It
+> is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/queue-aiops/references/agent-guardrails.md) — it lists
@@ -108,19 +92,21 @@ verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
 
 ## Governance
 
-Every MCP tool runs through the bundled `@governed_tool` harness
-(`queue_aiops.governance` — no external dependency):
+Every MCP tool — and every CLI write, which routes through the same governed
+functions — runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency). It **records; it does not
+authorize** whether a write may happen (see above):
 
 - **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
-  `QUEUE_AIOPS_HOME`), secret-redacted.
-- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
-  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
-- **Risk tiers & approval** — **secure by default**: with no
-  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
-  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
-  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
-  rules.yaml with that dual-control tier; an operator-authored rules file is
-  honoured as-is.
+  `QUEUE_AIOPS_HOME`), secret-redacted. The CLI writes the same row the MCP path
+  does — there is no unaudited entry point.
+- **Budget / runaway guard** — a safety backstop, not an authorization gate:
+  call/time ceilings (`QUEUE_MAX_TOOL_CALLS`, `QUEUE_MAX_TOOL_SECONDS`) + a
+  runaway-loop breaker stop a stuck agent from burning unbounded calls/time.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing. `QUEUE_AUDIT_APPROVED_BY` / `QUEUE_AUDIT_RATIONALE` are
+  optional annotations recorded on the row (who/why), never required and never
+  blocking.
 - **Undo** — reversible writes capture the real before-state first:
   `redis_config_set` records the prior value from CONFIG GET;
   `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
@@ -129,7 +115,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
   `redis_kill_client`) record priorState only.
 - **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
   `--dry-run` (CLI); CLI writes double-confirm and execute through the same
-  governed twins, so they land in the audit log too.
+  governed twins, so they land in the audit log too. `purge_queue` and
+  `delete_queue` are risk=high with dry-run + double confirmation at the CLI.
 - Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
   scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
   use). Redis passwords are optional — an auth-less lab instance is a
@@ -153,9 +140,9 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 > **env-block caveat**: MCP clients launch the server with a *minimal*
 > environment — your shell profile is not sourced. Anything the server needs
-> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
-> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
-> block above, not just in your terminal.
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`, and any
+> optional `QUEUE_AUDIT_APPROVED_BY`/`QUEUE_AUDIT_RATIONALE` audit annotations)
+> must be set in the `env` block above, not just in your terminal.
 
 Or, with the package installed: `queue-aiops mcp`.
 

queue_aiops-0.4.0/RELEASE_NOTES.md

@@ -0,0 +1,29 @@
+# Release notes — queue-aiops 0.4.0
+
+Previous release: 0.3.0.
+
+## BREAKING — the authorization layer is removed
+
+This tool no longer decides whether a write is permitted. Read-only mode
+(`<PREFIX>_READ_ONLY`), the graduated-approval / approver gate, and the
+`rules.yaml` deny engine are **all gone**. Whether an operation runs is the
+agent's judgement, or the permission of the account you connect it with — point
+it at a read-only credential and the write fails at the server, the place that
+actually owns the permission.
+
+What the tool guarantees instead is that **nothing is silent**: every operation,
+over MCP **and** the CLI alike, lands a row in the audit log — there is no
+unaudited entry point. Destructive writes still capture their before-state and
+record an undo token where a clean inverse exists.
+
+- If you set `<PREFIX>_READ_ONLY=1`, it now has **no effect** and the MCP server
+  logs a warning at startup. Restrict writes via the connecting account instead.
+- `<PREFIX>_AUDIT_APPROVED_BY` / `<PREFIX>_AUDIT_RATIONALE` still work, but are now
+  **optional audit annotations** — recorded on the row when set, never required.
+- The declared `risk_level` is carried into the audit row as a descriptive tier
+  (a label, not a gate).
+
+The governance harness is now: **audit (MCP+CLI, unbypassable) · runaway/budget
+safety guard · undo recording · output sanitize**. `policy.py` is a small
+risk-tier classifier; `governance/readonly.py` is deleted.
+

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/SECURITY.md

@@ -40,8 +40,10 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 - **Token/runaway budget** — hard ceilings (`QUEUE_MAX_TOOL_CALLS` /
   `QUEUE_MAX_TOOL_SECONDS`) plus an on-by-default guard that trips a tight
   poll/retry loop, preventing unbounded API consumption.
-- **Graduated risk tiers** — `~/.queue-aiops/rules.yaml` `risk_tiers` gate
-  writes by environment/tag; the highest tiers require a recorded approver.
+- **Risk tier** — a descriptive label on each audit row derived from
+  `risk_level`; it gates nothing. `QUEUE_AUDIT_APPROVED_BY` /
+  `QUEUE_AUDIT_RATIONALE` are optional annotations recorded on the row, never
+  required and never blocking.
 - **Undo-token recording** — reversible writes capture the BEFORE state (via a
   real read) and record an inverse descriptor (e.g. `redis_config_set` restores
   the prior value from CONFIG GET; `delete_queue` re-declares the captured
@@ -50,9 +52,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 ### State-Changing Operations
 The destructive writes — `purge_queue` and `delete_queue` — are
-`risk_level=high`, accept a `dry_run` preview, and (under `risk_tiers`) require
-a recorded approver (`QUEUE_AUDIT_APPROVED_BY` + `QUEUE_AUDIT_RATIONALE`).
-Purged/deleted **messages cannot be restored** — `purge_queue` records the
+`risk_level=high`, accept a `dry_run` preview, and require double confirmation
+at the CLI. Purged/deleted **messages cannot be restored** — `purge_queue` records the
 prior message count as audit evidence (no undo) and `delete_queue`'s undo
 restores the queue *definition* only. `redis_config_set`, `redis_kill_client`
 (priorState = the client's CLIENT LIST row; no undo), `declare_queue`,

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/docs/VERIFICATION.md

@@ -14,8 +14,8 @@ Exercised end-to-end against a real **Redis 7.4.9** server (Docker) seeded with
   (key count matched `DBSIZE` exactly).
 - All four analyses ran clean: `analyze memory/latency/backlog/churn`.
 - Governance loop end-to-end: `redis_config_set` really changed
-  `maxmemory-policy`, captured `noeviction` as `priorState`, wrote an audit row
-  with approver, and `undo_apply` restored the prior value on the live server.
+  `maxmemory-policy`, captured `noeviction` as `priorState`, wrote an audit row,
+  and `undo_apply` restored the prior value on the live server.
 
 **A real defect was found and fixed by this run**: integer quantities were
 rendered as floats — `202.0` keys, `1.0` connected clients, float byte counts —

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/mcp_server/_shared.py

@@ -17,17 +17,46 @@ from collections.abc import Callable
 from pathlib import Path
 from typing import Any, Optional
 
+import httpx
+import redis
 from mcp.server.fastmcp import FastMCP
 
 from queue_aiops.config import load_config
 from queue_aiops.connection import ConnectionManager, QueueApiError
-from queue_aiops.governance import sanitize
+from queue_aiops.governance import mark_unknown, sanitize
 
 logger = logging.getLogger(__name__)
 
 _DOCTOR_HINT = "Run 'queue-aiops doctor' to verify connectivity and credentials."
 
 
+# Failures that leave the request's fate genuinely undetermined: the bytes
+# went out and either the response or the rest of the connection was lost. A
+# write that hits one of these MAY have taken effect on the server.
+#
+# Deliberately narrow. Connect errors and pool timeouts mean the request never
+# left this process, and an API error carrying a status means the server
+# answered — all are ordinary failures where nothing, or a known something,
+# happened. Marking them 'unknown' would cry wolf on every unreachable host.
+# redis TimeoutError means the command went out and the reply did not come
+# back. redis ConnectionError is excluded: it also covers a connection that
+# was never established.
+_UNDETERMINED_ERRORS = (
+    httpx.ReadTimeout,
+    httpx.WriteTimeout,
+    httpx.ReadError,
+    httpx.WriteError,
+    httpx.RemoteProtocolError,
+    redis.exceptions.TimeoutError,
+)
+
+
+# Long enough to carry the remediation sentence. These messages teach the
+# caller what to do instead, and that clause comes last — a 300-char cap cut
+# it off silently on every refusal long enough to need one.
+_ERROR_MAX = 800
+
+
 def _safe_error(exc: Exception, tool: str) -> str:
     """Return an agent-safe error string; log full detail server-side only."""
     logger.error("Tool %s failed", tool, exc_info=True)
@@ -41,7 +70,7 @@ def _safe_error(exc: Exception, tool: str) -> str:
         QueueApiError,
     )
     if isinstance(exc, _passthrough):
-        return sanitize(str(exc), 300)
+        return sanitize(str(exc), _ERROR_MAX)
     return f"{type(exc).__name__}: operation failed."
 
 
@@ -65,7 +94,13 @@ def tool_errors(shape: str = "dict") -> Callable:
                     return [{"error": msg, "hint": _DOCTOR_HINT}]
                 if shape == "str":
                     return f"Error: {msg} {_DOCTOR_HINT}"
-                return {"error": msg, "hint": _DOCTOR_HINT}
+                payload = {"error": msg, "hint": _DOCTOR_HINT}
+                # Flatten the exception into a dict and its type is gone
+                # for good — so classify here, while it is still known,
+                # whether the operation may nonetheless have taken effect.
+                if isinstance(e, _UNDETERMINED_ERRORS):
+                    return mark_unknown(payload)
+                return payload
 
         return wrapper
 
@@ -85,7 +120,7 @@ mcp = FastMCP(
         "heuristics that show their numbers. Governed writes — config_set and "
         "set_policy/delete_policy (reversible, undo-recorded), declare_queue, "
         "kill_client (priorState only), plus purge_queue / delete_queue at "
-        "risk=high with a dry_run preview and an approver (delete_queue's undo "
+        "risk=high with a dry_run preview (delete_queue's undo "
         "re-declares the captured definition; messages are not restored). Every "
         "tool runs through the queue-aiops governance harness (audit / budget / "
         "risk-tier / undo). A per-target 'platform' field selects the protocol "

queue_aiops-0.4.0/mcp_server/server.py

@@ -0,0 +1,51 @@
+"""MCP server wrapping queue-aiops operations (stdio transport).
+
+Thin adapter layer: each ``@mcp.tool()`` function (in ``mcp_server/tools/``)
+delegates to the ``queue_aiops`` ops package and is wrapped with the
+queue-aiops ``@governed_tool`` harness (audit / budget / undo / risk-tier).
+
+Standalone, self-governed broker operations over redis and rabbitmq:
+redis server/memory/clients/slowlog/config/keyspace/big-key reads, rabbitmq
+overview/queues/connections/channels/policies/node reads, four flagship
+analyses, and governed writes (redis config set + client kill; rabbitmq queue
+purge/delete/declare and policy set/delete).
+
+Source: https://github.com/AIops-tools/Queue-AIops
+License: MIT
+"""
+
+import logging
+import os
+
+from mcp_server._shared import _safe_error, mcp, tool_errors
+
+# Importing the tool modules registers every @mcp.tool() onto the shared
+# `mcp` instance. Order does not matter; each module is self-contained.
+from mcp_server.tools import (  # noqa: F401 — side effects
+    analysis,
+    overview,
+    rabbit_reads,
+    redis_reads,
+    undo,
+    writes,
+)
+
+__all__ = ["mcp", "main", "_safe_error", "tool_errors"]
+
+logger = logging.getLogger(__name__)
+
+
+
+def main() -> None:
+    """Run the MCP server over stdio."""
+    logging.basicConfig(level=logging.INFO)
+    # Read-only mode was removed. Warn a deployment that still exports the old
+    # switch so it gets one audible signal instead of silently gaining writes.
+    if os.environ.get("QUEUE_READ_ONLY"):
+        logger.warning(
+            "QUEUE_READ_ONLY is set but no longer has any effect — "
+            "read-only mode was removed. Writes ARE enabled. Restrict them via "
+            "the connecting account's permissions instead (a read-only socket / "
+            "scope-limited token)."
+        )
+    mcp.run(transport="stdio")

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/mcp_server/tools/undo.py

@@ -3,10 +3,10 @@
 Every governed write records a replayable inverse descriptor (tool + params) to
 ``undo.db``. This module closes the loop: ``undo_apply`` looks up a recorded
 descriptor and dispatches it to the named governed tool, so the inverse runs on
-the SAME governance path as any other call (audited, budget-checked, and — if
-the inverse itself is destructive — re-gated by its own risk tier / approver
-requirement). ``undo_apply`` is itself governed; the real risk is enforced by
-the inner tool it calls.
+the SAME governance path as any other call (audited and budget-checked, and — if
+the inverse itself is destructive — recorded under its own risk tier). Whether
+the inverse *should* run is the caller's decision, exactly as for the original
+write; ``undo_apply`` records it either way.
 
 Note: recorded ``undo_params`` are the redacted safe-params captured at record
 time, so an inverse that would need a secret value cannot be replayed here — by
@@ -41,6 +41,11 @@ def undo_list(limit: int = 50, target: Optional[str] = None) -> dict:
     length coincidence: when it is true there are MORE tokens than shown, so
     re-run with a higher ``limit`` rather than reporting the list as complete.
 
+    Each entry carries ``effectVerified``. False means the original write lost
+    its response, so the change it reverses is PROBABLE, not confirmed — check
+    the live state before applying, and do not report the result as a restore
+    of a state that may never have been reached.
+
     Args:
         limit: Max rows to return (default 50, capped at 500).
         target: Unused (undo state is host-local); accepted for CLI uniformity.
@@ -61,6 +66,7 @@ def undo_list(limit: int = 50, target: Optional[str] = None) -> dict:
                 "originalTool": r["tool"],
                 "inverseTool": r["undo_tool"],
                 "note": r.get("note", ""),
+                "effectVerified": bool(r.get("effect_verified", 1)),
             }
             for r in rows
         ],
@@ -73,9 +79,9 @@ def undo_list(limit: int = 50, target: Optional[str] = None) -> dict:
 def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None) -> dict:
     """[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.
 
-    The inverse runs through its own governed tool, so its real risk tier and
-    any approver requirement are enforced there. Pass dry_run=True to preview
-    the inverse call without executing it. A token can only be applied once.
+    The inverse runs through its own governed tool, so it is audited under its
+    own risk tier. Pass dry_run=True to preview the inverse call without
+    executing it. A token can only be applied once.
 
     Args:
         undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result).
@@ -92,12 +98,27 @@ def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None
         )
 
     inverse_tool = rec["undo_tool"]
+    # Unreadable parameters must stop the replay, not be replaced with {}.
+    # Defaulting dispatched the inverse tool with NO ARGUMENTS: for a tool whose
+    # parameters all have defaults that runs a real, unintended operation, and
+    # dry_run previewed it as a legitimate no-arg inverse. Refusing is the only
+    # honest answer — the recorded intent is gone, so there is nothing to apply.
+    raw = rec["undo_params"]
     try:
-        params = json.loads(rec["undo_params"]) if rec["undo_params"] else {}
-    except (ValueError, TypeError):
-        params = {}
+        params = json.loads(raw) if raw else {}
+    except (ValueError, TypeError) as exc:
+        raise ValueError(
+            f"Undo '{undo_id}' has unreadable recorded parameters, so its inverse "
+            f"cannot be replayed. Inspect the row in undo.db and re-run the "
+            f"inverse tool '{inverse_tool}' by hand if the change still needs "
+            f"reversing."
+        ) from exc
     if not isinstance(params, dict):
-        params = {}
+        raise ValueError(
+            f"Undo '{undo_id}' recorded parameters of type "
+            f"'{type(params).__name__}' rather than an object, so its inverse "
+            f"cannot be replayed. Re-run the inverse tool '{inverse_tool}' by hand."
+        )
 
     fn = _resolve_tool(inverse_tool)
     if fn is None:
@@ -105,10 +126,12 @@ def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None
             f"Inverse tool '{inverse_tool}' is not registered on this server; cannot apply."
         )
 
+    effect_verified = bool(rec.get("effect_verified", 1))
     if dry_run:
         return {
             "dryRun": True,
             "undoId": undo_id,
+            "effectVerified": effect_verified,
             "wouldApply": {"tool": inverse_tool, "params": params},
         }
 
@@ -127,6 +150,15 @@ def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None
     return {
         "undoId": undo_id,
         "applied": applied,
+        "effectVerified": effect_verified,
         "inverseTool": inverse_tool,
         "result": result,
+        "note": (
+            ""
+            if effect_verified
+            else "The original write lost its response, so it was never confirmed "
+            "to have taken effect. This inverse ran regardless; report the "
+            "CURRENT server state, not a restore that may have had nothing "
+            "to restore."
+        ),
     }

{queue_aiops-0.2.2 → queue_aiops-0.4.0}/mcp_server/tools/writes.py

@@ -1,6 +1,6 @@
 """Governed broker-write MCP tools (the only state-changing tools).
 
-Every tool is wrapped with the governance harness (audit + graduated approval
+Every tool is wrapped with the governance harness (audit + descriptive risk
 tier) and takes a ``dry_run`` preview. Reversible writes pass an ``undo=``
 callback that turns the fetched before-state into an inverse descriptor the
 harness records; irreversible ones (kill_client, purge_queue) record only the
@@ -141,6 +141,13 @@ def redis_config_set(
     restores its prior value. Runtime-only — not persisted to the config file.
     Pass dry_run=True to preview.
 
+    Refuses the parameters that would lock this tool out of the instance
+    (requirepass, masterauth, bind, port, protected-mode, maxclients,
+    unixsocket, aclfile, tls-*) — the undo could never be replayed over a
+    connection those settings break. Change those in redis.conf and restart.
+    The refusal applies under dry_run too: a preview whose real call would be
+    refused must report that, not a green 'wouldSet'.
+
     Args:
         parameter: Config parameter name (e.g. maxmemory-policy), from redis_config_get.
         value: New value.
@@ -148,6 +155,9 @@ def redis_config_set(
         target: redis target name from config; omit for the default.
     """
     conn = _get_connection(target)
+    # Ahead of the dry_run return: a preview whose real call would be refused
+    # must say so, or the caller reads the refusal as transient and retries.
+    ops.guard_config_set(parameter)
     if dry_run:
         return {"dryRun": True, "wouldSet": {"parameter": parameter, "value": value}}
     return ops.config_set(conn, parameter, value)
@@ -169,6 +179,10 @@ def redis_kill_client(
     is recorded; most clients transparently reconnect. Pass dry_run=True to
     preview.
 
+    Refuses this tool's own connection, by id or by addr — including under
+    dry_run, which must report a refusal rather than preview a call that will be
+    refused.
+
     Args:
         client_id: Client id from redis_clients (preferred).
         addr: Or the client's 'ip:port' address.
@@ -176,6 +190,9 @@ def redis_kill_client(
         target: redis target name from config; omit for the default.
     """
     conn = _get_connection(target)
+    # Ahead of the dry_run return: a preview whose real call would be refused
+    # must say so, or the caller reads the refusal as transient and retries.
+    ops.guard_kill_client(conn, client_id=client_id, addr=addr)
     if dry_run:
         return {"dryRun": True, "wouldKill": {"clientId": client_id, "addr": addr}}
     return ops.kill_client(conn, client_id=client_id, addr=addr)
@@ -197,9 +214,7 @@ def purge_queue(
 
     Reads the queue first so priorState carries the message count about to be
     destroyed (audit evidence); unacked messages are not purged. No undo —
-    purged messages cannot be restored. Requires an approver
-    (QUEUE_AUDIT_APPROVED_BY) under the graduated-autonomy policy. Pass
-    dry_run=True to preview.
+    purged messages cannot be restored. Pass dry_run=True to preview.
 
     Args:
         vhost: The queue's vhost (the default vhost is '/').
@@ -226,9 +241,8 @@ def delete_queue(
 
     Reads the queue first so priorState carries the definition (durable /
     auto_delete / arguments) and message count; the recorded undo re-declares
-    the queue with those properties — its messages are NOT restored. Requires
-    an approver (QUEUE_AUDIT_APPROVED_BY) under the graduated-autonomy policy.
-    Pass dry_run=True to preview.
+    the queue with those properties — its messages are NOT restored. Pass
+    dry_run=True to preview.
 
     Args:
         vhost: The queue's vhost (the default vhost is '/').