DataHub + OKF Governed Query

A security-focused MCP adapter that combines read-only DataHub metadata evidence with a reviewed OKF-derived policy IR before executing a closed, typed query against synthetic PostgreSQL data.

Status

The architecture and implementation slices are specified. Implementation starts with the reproducible TypeScript and Nix foundation.

Related MCP server: readonly-postgres-mcp

Core boundary

MCP caller
  -> Context MCP
      -> pinned DataHub MCP (read-only evidence)
      -> private Unix socket
          -> Query Executor
              -> reviewed Policy IR
              -> live PostgreSQL schema and role verification
              -> fixed typed SQL
  <- validated structured result

• DataHub is evidence, not the authorization authority.

• Runtime authorization is deterministic; an LLM does not decide ALLOW.

• The executor never accepts arbitrary SQL.

• The MVP does not write decisions or query results back to DataHub.

• The demo uses one synthetic dataset and fails closed on ambiguity or drift.

Development checks

Enter the pinned Nix shell, install with pnpm, and use Deno as the least-privilege TCB runtime:

nix develop
pnpm install --frozen-lockfile
deno task check

pnpm-lock.yaml is the only npm dependency lock. Deno uses the existing node_modules in manual mode and receives repository read access only for the TCB check. Environment access is limited to 22 exact non-secret TypeScript watcher, inspector, mode, and terminal keys; Deno receives no write, network, subprocess, FFI, or system permission.

Start with the design specification and the implementation plan index.