queue-aiops 0.3.0__tar.gz → 0.5.0__tar.gz

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v0.5.0 — 2026-08-02
+
+### Changed (BREAKING)
+- **Requires MCP SDK 2.0** (`mcp[cli]>=2.0,<3.0`). `mcp.server.fastmcp` no longer exists in 2.0; the server is now built with `MCPServer` and reports its package version in the stdio handshake.
+
+### Fixed
+- **`undo apply` works from the CLI.** Every write tool is imported lazily inside its own CLI command, so a CLI-driven undo ran in a process where the inverse tool was never registered and failed with "inverse tool is not registered" — for every write tool. Only the MCP entry point, which imports the whole server, worked. Found while live-verifying against a real cluster.
+- **An undetermined outcome is audited `unknown`, not `ok`.** The harness only classified a result as undetermined when the payload *also* carried an `error` key, so a write that looked successful but had not been confirmed was recorded as a success.
+- **`as_int` no longer round-trips integers through float64**, which cannot represent values above 2**53 exactly. A line-wide sweep found only one of six vendored copies had actually been fixed after the original precision bug. The bool guard precedes the int short-circuit because `bool` subclasses `int` — otherwise `True` would be returned unchanged and serialised as `true` rather than a number.
+
+
+## v0.4.0 — 2026-07-21
+
+### Changed (BREAKING)
+- **Removed the authorization layer** — read-only mode, the approver gate, and rules.yaml deny are gone. The skill no longer decides read vs write; that is the agent's judgement or the connecting account's permissions. `<PREFIX>_READ_ONLY` now has no effect (a startup warning is logged); `<PREFIX>_AUDIT_APPROVED_BY`/`_RATIONALE` are optional audit annotations.
+- The retained guarantee is **unbypassable audit over MCP and CLI alike** — no unaudited entry point. Harness = audit + runaway safety guard + undo + sanitize; `risk_level` is a descriptive audit label, not a gate.
+
+See RELEASE_NOTES.md for tool-specific changes.
+
+
 ## v0.3.0 — 2026-07-20
 
 ### Fixed

queue_aiops-0.5.0/Dockerfile

@@ -0,0 +1,9 @@
+# syntax=docker/dockerfile:1
+# Minimal image for Glama introspection: starts the MCP server over stdio.
+# The tools/list introspection handshake needs no live Redis/RabbitMQ credentials.
+FROM python:3.12-slim
+
+RUN pip install --no-cache-dir queue-aiops
+
+# MCP server speaks JSON-RPC over stdio.
+ENTRYPOINT ["queue-aiops-mcp"]

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: queue-aiops
-Version: 0.3.0
+Version: 0.5.0
 Summary: Governed AI-ops for redis + rabbitmq: memory-pressure/latency/queue-backlog/connection-churn RCAs, slowlog and SCAN-budgeted big-key sampling, queues/policies/nodes, and governed writes (config set, client kill, purge/delete queue, policies) with a built-in governance harness (audit, budget, undo, risk tiers)
 Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT
@@ -8,7 +8,7 @@ License-File: LICENSE
 Requires-Python: >=3.11
 Requires-Dist: cryptography>=42.0
 Requires-Dist: httpx<1.0,>=0.27
-Requires-Dist: mcp[cli]<2.0,>=1.10
+Requires-Dist: mcp[cli]<3.0,>=2.0
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: redis<7.0,>=5.0
 Requires-Dist: rich<16.0,>=13.0
@@ -59,40 +59,24 @@ queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
 queue-aiops rabbitmq queues    # deepest backlog first
 ```
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers broker operations — reads and writes — accurately and efficiently,
+and records every one of them. It does **not** decide whether a write is allowed
+to happen. That is the agent's judgement, or the permission of the account you
+connect it with: give the Redis connection an ACL user restricted to read
+commands, or the RabbitMQ management user only the `monitoring` tag, and the
+writes fail at the broker — the place that actually owns the permission.
 
-```bash
-export QUEUE_READ_ONLY=1
-```
-
-With that set, the **8 write tools are never registered**. An MCP client
-lists **20 tools instead of 28** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.queue-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.queue-aiops/audit.db`,
+and reversible writes still capture their before-state and record an inverse.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, kept in agreement with its `[READ]`/`[WRITE]`
+> documentation tag by a test, and carried into the audit row as a descriptive
+> tier — so a reviewer can see at a glance that a row was a high-risk delete. It
+> is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/queue-aiops/references/agent-guardrails.md) — it lists
@@ -125,19 +109,21 @@ verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
 
 ## Governance
 
-Every MCP tool runs through the bundled `@governed_tool` harness
-(`queue_aiops.governance` — no external dependency):
+Every MCP tool — and every CLI write, which routes through the same governed
+functions — runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency). It **records; it does not
+authorize** whether a write may happen (see above):
 
 - **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
-  `QUEUE_AIOPS_HOME`), secret-redacted.
-- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
-  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
-- **Risk tiers & approval** — **secure by default**: with no
-  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
-  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
-  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
-  rules.yaml with that dual-control tier; an operator-authored rules file is
-  honoured as-is.
+  `QUEUE_AIOPS_HOME`), secret-redacted. The CLI writes the same row the MCP path
+  does — there is no unaudited entry point.
+- **Budget / runaway guard** — a safety backstop, not an authorization gate:
+  call/time ceilings (`QUEUE_MAX_TOOL_CALLS`, `QUEUE_MAX_TOOL_SECONDS`) + a
+  runaway-loop breaker stop a stuck agent from burning unbounded calls/time.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing. `QUEUE_AUDIT_APPROVED_BY` / `QUEUE_AUDIT_RATIONALE` are
+  optional annotations recorded on the row (who/why), never required and never
+  blocking.
 - **Undo** — reversible writes capture the real before-state first:
   `redis_config_set` records the prior value from CONFIG GET;
   `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
@@ -146,7 +132,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
   `redis_kill_client`) record priorState only.
 - **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
   `--dry-run` (CLI); CLI writes double-confirm and execute through the same
-  governed twins, so they land in the audit log too.
+  governed twins, so they land in the audit log too. `purge_queue` and
+  `delete_queue` are risk=high with dry-run + double confirmation at the CLI.
 - Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
   scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
   use). Redis passwords are optional — an auth-less lab instance is a
@@ -170,9 +157,9 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 > **env-block caveat**: MCP clients launch the server with a *minimal*
 > environment — your shell profile is not sourced. Anything the server needs
-> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
-> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
-> block above, not just in your terminal.
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`, and any
+> optional `QUEUE_AUDIT_APPROVED_BY`/`QUEUE_AUDIT_RATIONALE` audit annotations)
+> must be set in the `env` block above, not just in your terminal.
 
 Or, with the package installed: `queue-aiops mcp`.
 

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/README.md

@@ -42,40 +42,24 @@ queue-aiops redis bigkeys      # SCAN-budgeted big-key sample (never KEYS *)
 queue-aiops rabbitmq queues    # deepest backlog first
 ```
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers broker operations — reads and writes — accurately and efficiently,
+and records every one of them. It does **not** decide whether a write is allowed
+to happen. That is the agent's judgement, or the permission of the account you
+connect it with: give the Redis connection an ACL user restricted to read
+commands, or the RabbitMQ management user only the `monitoring` tag, and the
+writes fail at the broker — the place that actually owns the permission.
 
-```bash
-export QUEUE_READ_ONLY=1
-```
-
-With that set, the **8 write tools are never registered**. An MCP client
-lists **20 tools instead of 28** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.queue-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.queue-aiops/audit.db`,
+and reversible writes still capture their before-state and record an inverse.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, kept in agreement with its `[READ]`/`[WRITE]`
+> documentation tag by a test, and carried into the audit row as a descriptive
+> tier — so a reviewer can see at a glance that a row was a high-risk delete. It
+> is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/queue-aiops/references/agent-guardrails.md) — it lists
@@ -108,19 +92,21 @@ verdict. Big-key sampling walks at most 10,000 keys with SCAN and sizes at most
 
 ## Governance
 
-Every MCP tool runs through the bundled `@governed_tool` harness
-(`queue_aiops.governance` — no external dependency):
+Every MCP tool — and every CLI write, which routes through the same governed
+functions — runs through the bundled `@governed_tool` harness
+(`queue_aiops.governance` — no external dependency). It **records; it does not
+authorize** whether a write may happen (see above):
 
 - **Audit** — every call lands in `~/.queue-aiops/audit.db` (relocatable via
-  `QUEUE_AIOPS_HOME`), secret-redacted.
-- **Budget** — call/time ceilings (`QUEUE_MAX_TOOL_CALLS`,
-  `QUEUE_MAX_TOOL_SECONDS`) + a runaway-loop breaker.
-- **Risk tiers & approval** — **secure by default**: with no
-  `~/.queue-aiops/rules.yaml`, high-risk writes (`purge_queue`,
-  `delete_queue`) are denied unless `QUEUE_AUDIT_APPROVED_BY` names an approver
-  (set `QUEUE_AUDIT_RATIONALE` too). `queue-aiops init` seeds a starter
-  rules.yaml with that dual-control tier; an operator-authored rules file is
-  honoured as-is.
+  `QUEUE_AIOPS_HOME`), secret-redacted. The CLI writes the same row the MCP path
+  does — there is no unaudited entry point.
+- **Budget / runaway guard** — a safety backstop, not an authorization gate:
+  call/time ceilings (`QUEUE_MAX_TOOL_CALLS`, `QUEUE_MAX_TOOL_SECONDS`) + a
+  runaway-loop breaker stop a stuck agent from burning unbounded calls/time.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing. `QUEUE_AUDIT_APPROVED_BY` / `QUEUE_AUDIT_RATIONALE` are
+  optional annotations recorded on the row (who/why), never required and never
+  blocking.
 - **Undo** — reversible writes capture the real before-state first:
   `redis_config_set` records the prior value from CONFIG GET;
   `set_policy`/`delete_policy` record the prior policy; `delete_queue` records
@@ -129,7 +115,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
   `redis_kill_client`) record priorState only.
 - **Dry-run + double-confirm** — every write takes `dry_run=True` (MCP) /
   `--dry-run` (CLI); CLI writes double-confirm and execute through the same
-  governed twins, so they land in the audit log too.
+  governed twins, so they land in the audit log too. `purge_queue` and
+  `delete_queue` are risk=high with dry-run + double confirmation at the CLI.
 - Credentials live **encrypted** in `~/.queue-aiops/secrets.enc` (Fernet +
   scrypt master password; `QUEUE_AIOPS_MASTER_PASSWORD` for non-interactive
   use). Redis passwords are optional — an auth-less lab instance is a
@@ -153,9 +140,9 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 > **env-block caveat**: MCP clients launch the server with a *minimal*
 > environment — your shell profile is not sourced. Anything the server needs
-> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`,
-> `QUEUE_AUDIT_APPROVED_BY` for high-risk writes) must be set in the `env`
-> block above, not just in your terminal.
+> (`QUEUE_AIOPS_MASTER_PASSWORD`, a relocated `QUEUE_AIOPS_HOME`, and any
+> optional `QUEUE_AUDIT_APPROVED_BY`/`QUEUE_AUDIT_RATIONALE` audit annotations)
+> must be set in the `env` block above, not just in your terminal.
 
 Or, with the package installed: `queue-aiops mcp`.
 

queue_aiops-0.5.0/RELEASE_NOTES.md

@@ -0,0 +1,29 @@
+# Release notes — queue-aiops 0.4.0
+
+Previous release: 0.3.0.
+
+## BREAKING — the authorization layer is removed
+
+This tool no longer decides whether a write is permitted. Read-only mode
+(`<PREFIX>_READ_ONLY`), the graduated-approval / approver gate, and the
+`rules.yaml` deny engine are **all gone**. Whether an operation runs is the
+agent's judgement, or the permission of the account you connect it with — point
+it at a read-only credential and the write fails at the server, the place that
+actually owns the permission.
+
+What the tool guarantees instead is that **nothing is silent**: every operation,
+over MCP **and** the CLI alike, lands a row in the audit log — there is no
+unaudited entry point. Destructive writes still capture their before-state and
+record an undo token where a clean inverse exists.
+
+- If you set `<PREFIX>_READ_ONLY=1`, it now has **no effect** and the MCP server
+  logs a warning at startup. Restrict writes via the connecting account instead.
+- `<PREFIX>_AUDIT_APPROVED_BY` / `<PREFIX>_AUDIT_RATIONALE` still work, but are now
+  **optional audit annotations** — recorded on the row when set, never required.
+- The declared `risk_level` is carried into the audit row as a descriptive tier
+  (a label, not a gate).
+
+The governance harness is now: **audit (MCP+CLI, unbypassable) · runaway/budget
+safety guard · undo recording · output sanitize**. `policy.py` is a small
+risk-tier classifier; `governance/readonly.py` is deleted.
+

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/SECURITY.md

@@ -40,8 +40,10 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 - **Token/runaway budget** — hard ceilings (`QUEUE_MAX_TOOL_CALLS` /
   `QUEUE_MAX_TOOL_SECONDS`) plus an on-by-default guard that trips a tight
   poll/retry loop, preventing unbounded API consumption.
-- **Graduated risk tiers** — `~/.queue-aiops/rules.yaml` `risk_tiers` gate
-  writes by environment/tag; the highest tiers require a recorded approver.
+- **Risk tier** — a descriptive label on each audit row derived from
+  `risk_level`; it gates nothing. `QUEUE_AUDIT_APPROVED_BY` /
+  `QUEUE_AUDIT_RATIONALE` are optional annotations recorded on the row, never
+  required and never blocking.
 - **Undo-token recording** — reversible writes capture the BEFORE state (via a
   real read) and record an inverse descriptor (e.g. `redis_config_set` restores
   the prior value from CONFIG GET; `delete_queue` re-declares the captured
@@ -50,9 +52,8 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 
 ### State-Changing Operations
 The destructive writes — `purge_queue` and `delete_queue` — are
-`risk_level=high`, accept a `dry_run` preview, and (under `risk_tiers`) require
-a recorded approver (`QUEUE_AUDIT_APPROVED_BY` + `QUEUE_AUDIT_RATIONALE`).
-Purged/deleted **messages cannot be restored** — `purge_queue` records the
+`risk_level=high`, accept a `dry_run` preview, and require double confirmation
+at the CLI. Purged/deleted **messages cannot be restored** — `purge_queue` records the
 prior message count as audit evidence (no undo) and `delete_queue`'s undo
 restores the queue *definition* only. `redis_config_set`, `redis_kill_client`
 (priorState = the client's CLIENT LIST row; no undo), `declare_queue`,

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/docs/VERIFICATION.md

@@ -14,8 +14,8 @@ Exercised end-to-end against a real **Redis 7.4.9** server (Docker) seeded with
   (key count matched `DBSIZE` exactly).
 - All four analyses ran clean: `analyze memory/latency/backlog/churn`.
 - Governance loop end-to-end: `redis_config_set` really changed
-  `maxmemory-policy`, captured `noeviction` as `priorState`, wrote an audit row
-  with approver, and `undo_apply` restored the prior value on the live server.
+  `maxmemory-policy`, captured `noeviction` as `priorState`, wrote an audit row,
+  and `undo_apply` restored the prior value on the live server.
 
 **A real defect was found and fixed by this run**: integer quantities were
 rendered as floats — `202.0` keys, `1.0` connected clients, float byte counts —

queue_aiops-0.5.0/glama.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://glama.ai/mcp/schemas/server.json",
+  "maintainers": [
+    "zw008"
+  ]
+}

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/mcp_server/_shared.py

@@ -1,13 +1,15 @@
-"""Shared MCP server primitives: the FastMCP instance, connection helper,
+"""Shared MCP server primitives: the MCPServer instance, connection helper,
 error sanitisation, and the ``@tool_errors`` decorator.
 
 Tool modules under ``mcp_server/tools/`` import ``mcp`` from here and register
 their ``@mcp.tool()`` functions onto it. ``mcp_server/server.py`` then imports
 those modules and runs the server.
 
-Keep ``Optional[X]`` (never PEP 604 ``X | None``) in any FastMCP-reflected
-tool signature — on older mcp/pydantic the union eval'd to ``types.UnionType``
-crashes FastMCP's ``issubclass`` check.
+Keep ``Optional[X]`` (never PEP 604 ``X | None``) in any reflected tool
+signature. mcp>=2.0 accepts the union, but the legacy form is retained for
+consistency and to stay safe under any pydantic reflection path (踩坑 #33 —
+older mcp/pydantic eval'd the union to ``types.UnionType`` and crashed the
+``issubclass`` check).
 """
 
 import functools
@@ -19,8 +21,9 @@ from typing import Any, Optional
 
 import httpx
 import redis
-from mcp.server.fastmcp import FastMCP
+from mcp.server import MCPServer
 
+from queue_aiops import __version__
 from queue_aiops.config import load_config
 from queue_aiops.connection import ConnectionManager, QueueApiError
 from queue_aiops.governance import mark_unknown, sanitize
@@ -78,7 +81,7 @@ def tool_errors(shape: str = "dict") -> Callable:
     """Wrap a tool body in the canonical try/except → ``_safe_error`` pattern.
 
     Place this *between* ``@governed_tool`` and the function so the audit
-    decorator and FastMCP still see the original signature.
+    decorator and MCPServer still see the original signature.
     """
 
     def decorator(func: Callable) -> Callable:
@@ -107,8 +110,9 @@ def tool_errors(shape: str = "dict") -> Callable:
     return decorator
 
 
-mcp = FastMCP(
+mcp = MCPServer(
     "queue-aiops",
+    version=__version__,
     instructions=(
         "Queue/cache broker operations over redis and rabbitmq: for a "
         "redis target — server/memory/keyspace reads, clients, slowlog, config, "
@@ -120,7 +124,7 @@ mcp = FastMCP(
         "heuristics that show their numbers. Governed writes — config_set and "
         "set_policy/delete_policy (reversible, undo-recorded), declare_queue, "
         "kill_client (priorState only), plus purge_queue / delete_queue at "
-        "risk=high with a dry_run preview and an approver (delete_queue's undo "
+        "risk=high with a dry_run preview (delete_queue's undo "
         "re-declares the captured definition; messages are not restored). Every "
         "tool runs through the queue-aiops governance harness (audit / budget / "
         "risk-tier / undo). A per-target 'platform' field selects the protocol "

queue_aiops-0.5.0/mcp_server/server.py

@@ -0,0 +1,51 @@
+"""MCP server wrapping queue-aiops operations (stdio transport).
+
+Thin adapter layer: each ``@mcp.tool()`` function (in ``mcp_server/tools/``)
+delegates to the ``queue_aiops`` ops package and is wrapped with the
+queue-aiops ``@governed_tool`` harness (audit / budget / undo / risk-tier).
+
+Standalone, self-governed broker operations over redis and rabbitmq:
+redis server/memory/clients/slowlog/config/keyspace/big-key reads, rabbitmq
+overview/queues/connections/channels/policies/node reads, four flagship
+analyses, and governed writes (redis config set + client kill; rabbitmq queue
+purge/delete/declare and policy set/delete).
+
+Source: https://github.com/AIops-tools/Queue-AIops
+License: MIT
+"""
+
+import logging
+import os
+
+from mcp_server._shared import _safe_error, mcp, tool_errors
+
+# Importing the tool modules registers every @mcp.tool() onto the shared
+# `mcp` instance. Order does not matter; each module is self-contained.
+from mcp_server.tools import (  # noqa: F401 — side effects
+    analysis,
+    overview,
+    rabbit_reads,
+    redis_reads,
+    undo,
+    writes,
+)
+
+__all__ = ["mcp", "main", "_safe_error", "tool_errors"]
+
+logger = logging.getLogger(__name__)
+
+
+
+def main() -> None:
+    """Run the MCP server over stdio."""
+    logging.basicConfig(level=logging.INFO)
+    # Read-only mode was removed. Warn a deployment that still exports the old
+    # switch so it gets one audible signal instead of silently gaining writes.
+    if os.environ.get("QUEUE_READ_ONLY"):
+        logger.warning(
+            "QUEUE_READ_ONLY is set but no longer has any effect — "
+            "read-only mode was removed. Writes ARE enabled. Restrict them via "
+            "the connecting account's permissions instead (a read-only socket / "
+            "scope-limited token)."
+        )
+    mcp.run(transport="stdio")

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/mcp_server/tools/undo.py

@@ -3,10 +3,10 @@
 Every governed write records a replayable inverse descriptor (tool + params) to
 ``undo.db``. This module closes the loop: ``undo_apply`` looks up a recorded
 descriptor and dispatches it to the named governed tool, so the inverse runs on
-the SAME governance path as any other call (audited, budget-checked, and — if
-the inverse itself is destructive — re-gated by its own risk tier / approver
-requirement). ``undo_apply`` is itself governed; the real risk is enforced by
-the inner tool it calls.
+the SAME governance path as any other call (audited and budget-checked, and — if
+the inverse itself is destructive — recorded under its own risk tier). Whether
+the inverse *should* run is the caller's decision, exactly as for the original
+write; ``undo_apply`` records it either way.
 
 Note: recorded ``undo_params`` are the redacted safe-params captured at record
 time, so an inverse that would need a secret value cannot be replayed here — by
@@ -22,8 +22,22 @@ from queue_aiops.governance.undo import get_undo_store
 
 
 def _resolve_tool(name: str) -> Any:
-    """Return the governed callable registered under ``name`` (or None)."""
+    """Return the governed callable registered under ``name`` (or None).
+
+    The CLI reaches this through ``undo apply``, whose process only imports
+    ``mcp_server.tools.undo`` — every other tool module is imported lazily inside
+    its own CLI command and so is absent here. Without forcing a full load,
+    ``undo_apply`` would fail with "inverse tool not registered" for every write
+    tool when driven from the CLI (the MCP entry point loads all modules, so it
+    never hit this). If the first lookup misses, import ``mcp_server.server`` —
+    which registers every ``@mcp.tool()`` as an import side effect — and retry.
+    Imported lazily to avoid the undo↔server cycle.
+    """
     tool = mcp._tool_manager._tools.get(name)
+    if tool is None:
+        import mcp_server.server  # noqa: F401 — registers all tools as a side effect
+
+        tool = mcp._tool_manager._tools.get(name)
     return getattr(tool, "fn", None) if tool else None
 
 
@@ -79,9 +93,9 @@ def undo_list(limit: int = 50, target: Optional[str] = None) -> dict:
 def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None) -> dict:
     """[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.
 
-    The inverse runs through its own governed tool, so its real risk tier and
-    any approver requirement are enforced there. Pass dry_run=True to preview
-    the inverse call without executing it. A token can only be applied once.
+    The inverse runs through its own governed tool, so it is audited under its
+    own risk tier. Pass dry_run=True to preview the inverse call without
+    executing it. A token can only be applied once.
 
     Args:
         undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result).
@@ -98,12 +112,27 @@ def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None
         )
 
     inverse_tool = rec["undo_tool"]
+    # Unreadable parameters must stop the replay, not be replaced with {}.
+    # Defaulting dispatched the inverse tool with NO ARGUMENTS: for a tool whose
+    # parameters all have defaults that runs a real, unintended operation, and
+    # dry_run previewed it as a legitimate no-arg inverse. Refusing is the only
+    # honest answer — the recorded intent is gone, so there is nothing to apply.
+    raw = rec["undo_params"]
     try:
-        params = json.loads(rec["undo_params"]) if rec["undo_params"] else {}
-    except (ValueError, TypeError):
-        params = {}
+        params = json.loads(raw) if raw else {}
+    except (ValueError, TypeError) as exc:
+        raise ValueError(
+            f"Undo '{undo_id}' has unreadable recorded parameters, so its inverse "
+            f"cannot be replayed. Inspect the row in undo.db and re-run the "
+            f"inverse tool '{inverse_tool}' by hand if the change still needs "
+            f"reversing."
+        ) from exc
     if not isinstance(params, dict):
-        params = {}
+        raise ValueError(
+            f"Undo '{undo_id}' recorded parameters of type "
+            f"'{type(params).__name__}' rather than an object, so its inverse "
+            f"cannot be replayed. Re-run the inverse tool '{inverse_tool}' by hand."
+        )
 
     fn = _resolve_tool(inverse_tool)
     if fn is None:

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/mcp_server/tools/writes.py

@@ -1,6 +1,6 @@
 """Governed broker-write MCP tools (the only state-changing tools).
 
-Every tool is wrapped with the governance harness (audit + graduated approval
+Every tool is wrapped with the governance harness (audit + descriptive risk
 tier) and takes a ``dry_run`` preview. Reversible writes pass an ``undo=``
 callback that turns the fetched before-state into an inverse descriptor the
 harness records; irreversible ones (kill_client, purge_queue) record only the
@@ -214,9 +214,7 @@ def purge_queue(
 
     Reads the queue first so priorState carries the message count about to be
     destroyed (audit evidence); unacked messages are not purged. No undo —
-    purged messages cannot be restored. Requires an approver
-    (QUEUE_AUDIT_APPROVED_BY) under the graduated-autonomy policy. Pass
-    dry_run=True to preview.
+    purged messages cannot be restored. Pass dry_run=True to preview.
 
     Args:
         vhost: The queue's vhost (the default vhost is '/').
@@ -243,9 +241,8 @@ def delete_queue(
 
     Reads the queue first so priorState carries the definition (durable /
     auto_delete / arguments) and message count; the recorded undo re-declares
-    the queue with those properties — its messages are NOT restored. Requires
-    an approver (QUEUE_AUDIT_APPROVED_BY) under the graduated-autonomy policy.
-    Pass dry_run=True to preview.
+    the queue with those properties — its messages are NOT restored. Pass
+    dry_run=True to preview.
 
     Args:
         vhost: The queue's vhost (the default vhost is '/').

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "queue-aiops"
-version = "0.3.0"
+version = "0.5.0"
 description = "Governed AI-ops for redis + rabbitmq: memory-pressure/latency/queue-backlog/connection-churn RCAs, slowlog and SCAN-budgeted big-key sampling, queues/policies/nodes, and governed writes (config set, client kill, purge/delete queue, policies) with a built-in governance harness (audit, budget, undo, risk tiers)"
 readme = "README.md"
 license = "MIT"
@@ -17,7 +17,7 @@ dependencies = [
     "rich>=13.0,<16.0",
     "pyyaml>=6.0,<7.0",
     "cryptography>=42.0",
-    "mcp[cli]>=1.10,<2.0",
+    "mcp[cli]>=2.0,<3.0",
 ]
 
 [dependency-groups]

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/queue_aiops/__init__.py

@@ -1,7 +1,7 @@
 """queue-aiops — governed redis + rabbitmq broker operations for AI agents.
 
 Standalone and self-contained: the governance harness (audit, token budget,
-undo-token recording, graduated risk tiers, output sanitize) is
+undo-token recording, descriptive risk tiers, output sanitize) is
 bundled under ``queue_aiops.governance`` — this package has no external
 skill-family dependency. Preview: not yet full-coverage.
 """

{queue_aiops-0.3.0 → queue_aiops-0.5.0}/queue_aiops/cli/_common.py

@@ -23,10 +23,18 @@ DryRunOption = Annotated[
 
 
 def _cli_error_types() -> tuple[type[BaseException], ...]:
-    """Exceptions translated to a one-line teaching error instead of a traceback."""
+    """Exceptions translated to a one-line teaching error instead of a traceback.
+
+    ``BudgetExceeded`` (and the retained ``PolicyDenied`` type) are raised by
+    ``@governed_tool`` OUTSIDE the tool body, so ``tool_errors`` never sees them
+    and they never arrive as an ``{"error": ...}`` dict. Their message is the
+    teaching text (e.g. which budget was hit) — without them here such a refusal
+    reaches the CLI as a traceback instead.
+    """
     from queue_aiops.connection import QueueApiError
+    from queue_aiops.governance import BudgetExceeded, PolicyDenied
 
-    return (QueueApiError, KeyError, OSError, ValueError)
+    return (QueueApiError, PolicyDenied, BudgetExceeded, KeyError, OSError, ValueError)
 
 
 def cli_errors(fn: Callable) -> Callable: