Log Search MCP, Read-Only

src/server.ts

const server = new McpServer({ name: 'postgres-read-safe', version: '1.3.0' }); server.tool('query', { sql: z.string(), limit: z.number().max(500) }, async ({ sql, limit }) => {  if (!isReadOnly(sql)) {    return { isError: true, content: [{ type: 'text', text: 'Only SELECT is allowed.' }] };  }  const rows = await pool.query(`${sql} LIMIT ${limit}`);  return { content: [{ type: 'text', text: JSON.stringify(mask(rows.rows)) }] };});

scorer/score.py

def score_pr(findings, gold, line_slack=3):    """Match each gold bug to at most one finding in the same file within a few lines."""    matched, used = 0, set()    for bug in gold:        for i, f in enumerate(findings):            if i not in used and f.path == bug.path and abs(f.line - bug.line) <= line_slack:                matched += 1                used.add(i)                break     noise = len(findings) - len(used)  # comments that point at no seeded bug    return {"recall": matched / len(gold), "precision": matched / max(len(findings), 1), "noise": noise}

agent.yaml

name: support-triagemodel: claude-opus-5-5tagging_model: gemini-3.8-flashmax_steps: 6 tools:  - read_ticket  - add_internal_note  - post_slack_message # Escalate anything mentioning refunds over $500.policies:

agent.yaml

name: rfp-responsemodel: claude-opus-5-5extraction_model: gemini-3.8-flashmax_steps: 40 tools:  - read_rfp  - search_knowledge_base  - write_matrix  - export_docx  - export_xlsx 

10 files

src/verify.ts

import { createHmac, timingSafeEqual } from 'node:crypto'; export function verifySignature(secret: string, payload: string, header: string) {  const [timestamp, signature] = parseHeader(header);  if (Date.now() / 1000 - timestamp > 300) return false;   const expected = createHmac('sha256', secret)    .update(`${timestamp}.${payload}`)    .digest('hex');   return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));}