ca38dcd0c9
agent 可对数据库执行只读查询。三重防护:
- 静态校验:仅单条 SELECT/WITH,词边界拒 insert/update/delete/drop/alter/create/
truncate/grant 等写/DDL 关键字(不误伤 created_at 之类列名)。
- 只读事务(sql.TxOptions{ReadOnly:true}):Postgres 引擎级强制只读,硬兜底。
- 行数(100)+超时(10s)+单元格(200 rune)上限。
连接:SQL_QUERY_DSN 优先(生产应指向专用只读库/账号),未设回退服务已解析的平台 PG DSN
(经 NewGateway 传入 g.pgDSN,不再裸读 env)。独立小连接池(8)。
测试:单测 validateReadOnlySQL(放行 SELECT/WITH/列名含 created;拒写/DDL/多语句)。
live 自主 agent 实测:查 sundynix_task=157 行、sundynix_model=2 行。
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
107 lines
4.1 KiB
Go
107 lines
4.1 KiB
Go
// Command server 启动 sundynix-mcp-go —— 第 5 层 Go I/O 型 MCP 工具微服务。
|
||
package main
|
||
|
||
import (
|
||
"context"
|
||
"log"
|
||
"os"
|
||
"os/signal"
|
||
"syscall"
|
||
|
||
sharedbus "github.com/sundynix/sundynix-shared/bus"
|
||
"github.com/sundynix/sundynix-shared/contract"
|
||
|
||
"github.com/sundynix/sundynix-mcp-go/internal/history"
|
||
"github.com/sundynix/sundynix-mcp-go/internal/mcp"
|
||
"github.com/sundynix/sundynix-mcp-go/internal/memory"
|
||
"github.com/sundynix/sundynix-mcp-go/internal/rag"
|
||
"github.com/sundynix/sundynix-mcp-go/internal/search"
|
||
|
||
"github.com/sundynix/sundynix-shared/otelx"
|
||
"github.com/sundynix/sundynix-shared/secrets"
|
||
)
|
||
|
||
func main() {
|
||
secrets.MustHaveKeyInProd() // 生产须配 SUNDYNIX_SECRET_KEY 以解密下发的 api_key 密文
|
||
otelx.SetupSlog("sundynix-mcp-go") // 结构化日志 + 链路感知(工具日志带 trace_id)
|
||
|
||
// 链路追踪:工具服务端 span 续上 dispatcher 的 trace(tool.call → tool.serve)。
|
||
shutdownTrace, _ := otelx.Init(context.Background(), "sundynix-mcp-go")
|
||
defer func() { _ = shutdownTrace(context.Background()) }()
|
||
|
||
natsURL := envOr("NATS_URL", "nats://localhost:4222")
|
||
pgDSN := envOr("POSTGRES_DSN", "postgres://sundynix:sundynix@localhost:5432/sundynix?sslmode=disable")
|
||
redisAddr := envOr("REDIS_ADDR", "localhost:6379")
|
||
milvusAddr := envOr("MILVUS_ADDR", "localhost:19530")
|
||
embBase := envOr("EMBED_BASE_URL", "") // OpenAI 兼容 embeddings 端点(空=向量检索降级)
|
||
embKey := envOr("EMBED_API_KEY", "")
|
||
embModel := envOr("EMBED_MODEL", "")
|
||
rerankBase := envOr("RERANK_BASE_URL", "") // DashScope 文本重排端点(空=不启用 rerank)
|
||
rerankKey := envOr("RERANK_API_KEY", "")
|
||
rerankModel := envOr("RERANK_MODEL", "")
|
||
neo4jURI := envOr("NEO4J_URI", "neo4j://localhost:7687") // GraphRAG 图谱(连不上则降级)
|
||
neo4jUser := envOr("NEO4J_USER", "neo4j")
|
||
neo4jPass := envOr("NEO4J_PASS", "sundynix")
|
||
|
||
b, err := sharedbus.Connect(natsURL)
|
||
if err != nil {
|
||
log.Fatalf("[mcp_go] nats connect: %v", err)
|
||
}
|
||
defer b.Close()
|
||
log.Printf("[mcp_go] connected %s", natsURL)
|
||
|
||
engine := search.NewHybrid() // LLM Wiki 混合检索:Bleve + Milvus + Neo4j
|
||
mem := memory.Open(pgDSN) // 偏好记忆:sundynix_user_profile(连不上则降级)
|
||
defer mem.Close()
|
||
hist := history.Open(redisAddr) // 会话短期历史:Redis(连不上则降级)
|
||
defer hist.Close()
|
||
|
||
ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
|
||
defer stop()
|
||
|
||
// RAG 核心链:embedding + Milvus(向量) + Bleve(全文) + Neo4j(图谱) + 可选 rerank
|
||
ragEngine := rag.Open(ctx, rag.Config{
|
||
MilvusAddr: milvusAddr,
|
||
EmbedBase: embBase, EmbedKey: embKey, EmbedModel: embModel,
|
||
RerankBase: rerankBase, RerankKey: rerankKey, RerankModel: rerankModel,
|
||
Neo4jURI: neo4jURI, Neo4jUser: neo4jUser, Neo4jPass: neo4jPass,
|
||
})
|
||
defer ragEngine.Close()
|
||
|
||
// 配置控制面:取激活 embedding(向量) + chat(图谱抽取) 配置并订阅热更新。
|
||
applyEmbed := func(cfg *contract.ModelConfig) {
|
||
if cfg != nil {
|
||
ragEngine.SetEmbedding(cfg.BaseURL, cfg.APIKey, cfg.Model)
|
||
}
|
||
}
|
||
applyChat := func(cfg *contract.ModelConfig) {
|
||
if cfg != nil {
|
||
ragEngine.SetChat(cfg.BaseURL, cfg.APIKey, cfg.Model)
|
||
}
|
||
}
|
||
// 先订阅热更新(控制台改配置即生效)。
|
||
if _, err := b.SubscribeConfigUpdated(contract.ConfigKindChat, applyChat); err != nil {
|
||
log.Printf("[mcp_go] subscribe chat config: %v", err)
|
||
}
|
||
if _, err := b.SubscribeConfigUpdated(contract.ConfigKindEmbedding, applyEmbed); err != nil {
|
||
log.Printf("[mcp_go] subscribe embedding config: %v", err)
|
||
}
|
||
// 后台重试拉初始配置:容忍 gateway 晚于本服务启动(避免一次性扑空致 RAG 长期降级)。
|
||
go b.RequestConfigWithRetry(ctx, contract.ConfigKindEmbedding, applyEmbed)
|
||
go b.RequestConfigWithRetry(ctx, contract.ConfigKindChat, applyChat)
|
||
|
||
gw := mcp.NewGateway(b, engine, mem, hist, ragEngine, pgDSN)
|
||
|
||
log.Println("[mcp_go] serving MCP over sundynix.tools.go.* (Ctrl-C to quit)")
|
||
if err := gw.Serve(ctx); err != nil && err != context.Canceled {
|
||
log.Fatalf("[mcp_go] exit: %v", err)
|
||
}
|
||
}
|
||
|
||
func envOr(key, def string) string {
|
||
if v := os.Getenv(key); v != "" {
|
||
return v
|
||
}
|
||
return def
|
||
}
|