Skip to content

v0.7.0 · The read-only agent layer — measured, not asserted

Latest
Latest

Choose a tag to compare

View all tags
@gulmezeren2-byte gulmezeren2-byte released this 18 Jul 06:16
· 18 commits to main since this release
v0.7.0
1292030

A verifiably-safe, read-only access layer for the SQL database behind an ERP — for AI agents as much as for weekly reports.

This release is a repositioning the tool had already grown into, plus the work to make its core claim checkable rather than merely asserted.

The headline: "read-only" is now a number, not an adjective

The trust benchmark runs 28 well-formed-SQL attacks (including the two most-cited MCP database failures by name — the Postgres COMMIT; DROP SCHEMA public CASCADE; transaction escape and the Supabase lethal-trifecta write leg) plus the legitimate reads that must still pass. New this release: it runs that same corpus through the shortcuts real tools ship, so you can see the gap instead of taking anyone's word:

Guard Attacks refused Legit reads allowed
starts-with-SELECT check 6 / 28 8 / 8
write-keyword blocklist 9 / 28 7 / 8 (blocks a read whose string contains "delete")
this guard 28 / 28 8 / 8

Every number is computed from a live guard run — reproduce it with erp-report-engine trust-benchmark, or paste your own SQL into the in-browser playground (the real guard.py via Pyodide, nothing sent anywhere).

Also in 0.7.0

  • The guard is fuzzed — hypothesis dresses every denylisted function up thousands of ways (case, whitespace, arguments, four dialects) and asserts it is still refused; a plain read with arbitrary identifiers still passes.
  • CodeQL scans the code itself on every push (it caught a real ReDoS in the benchmark's own code during this cycle — now fixed).
  • describe_model is a real semantic layer — every entity's grain, every column's type and meaning, and runnable example queries.
  • The guard moved to its own dependency-light module (guard.py) so the browser playground loads the genuine code.
  • On-time % is a p-chart (a proportion with limits that widen when a week is thin), not an XmR chart.
  • Automatic listing on the official MCP registry on release via GitHub OIDC — no stored token.
  • Security case-study, a fair five-way comparison of read-only DB access for agents, and a landing hub.

Links

Install

pipx install erp-report-engine        # or: pip install "erp-report-engine[mcp]"
erp-report-engine trust-benchmark     # reproduce the number above
Assets 2
Loading