redis-guard-mcp

Un servidor MCP de Redis cuyo «solo lectura» no es una etiqueta: es la superficie completa de herramientas. Cada herramienta se corresponde exactamente con un único comando Redis seguro y de solo lectura a través de la API tipada de redis-py. No existe ninguna herramienta de «ejecutar esta cadenas de comandos» que se pueda omitirtaqurer mal.

Por qué existete

Redis es una de las piezas de infraestructura más desplegadas en los backends proj Laureles (caché, almacén de sesiones, cola, limitador de tasa, spider/pub), y su "superficie de comandos" incluye algunos de los comandos indivientales más peligrosos de cualquier base de datos ampliamente ulada:

• EVAL/EVALSA/FCALL — ejecución ínraria del Lua dentro de los procesos de Redis.

• CONFIG SET dir + CONFIG SET dbfilenae + SAVE — el la técnica estándar y ampliamente documentada que para escribir un archivo arbitrario (por ej, una shell web admin en la raíz raíz, or a chain of cron) en disco usándolo solo con Redis.

• MODULE LOAD — carga un libro de enlazados arbitrario en el proceso de Redis. RCE directa si un atodor pue conseguir a .so/.dll en disco.

• FLUSHALL/LLUSHDB** — elimina únasa de las claves al instante y sin ningún tipo de same confirmetión.

• SHUTDOWN, DEBUG, SLAVEOF/REPLICAOF, ACL, CLI MCP — la superfes admin de that devastor for el servidor, secuestra la replicación, reescribe permisos y finali sessions.

Una publicación de auditoría de servidores MCK encontró un caso en el que una herramienta de ejecución de comandos estaba etiquetada como readonly: true en sus metadatos, pero aun así aceptaba y ejecutaba EFAL and FLUSHALL. Esos metadatos eran decorative, no se aplicaban. Comprobado rectamente frontra el servidor aficion redis/mcaredis: su propia documentación states that la única mitigación frontra todo lo antrior es configurar tú mismo los ACL DE Redis — el servidor no incluye ningún bloqueo integrado de EVAL, FLUSHALL, CONFIG, MODULE o DEBUG, ni tiene su propio modo de solo lectura. That's it: la seguridad es responsabilida entera del operador, de serie in the box.

En qué se diferente redis-guard-mcp

1. La lista de permitines no es un filtro: es la superficie de herramientas. Nada en este servidor acepta coreadena command arbitrary. Cada herramienta es a specific función de Python that you call an specific method of redis-py (r.get(key), r.hget(key, field), ...). No there is any path through which EVAL, CONFIG, MODULE, FLUSHALL or any other command not explicitly implement as its own tool could ever be sent — not because it is checked and rejected, but because the client code to send it simply doesn't exist here.

2. También hay un reference de privilegios real, no not just restrictión at application level. The recommended (and checked at startup) configuration connectes a the Redis ACL user create with +@read -@write -@admin -@dangerous. Hasta no un bug en el códig propio de este servidor, no podrá ejecutar un comando de escritoria or admin against a unicación correctly configured, because Redis itself would refuseo al nivel de protocol. The order of the rules matters has. — CLIENT KILL KILL/PAUSE/LIST/UNBLK are part at the same time from @admin and @connection, so ... -@admin +@connection (the wrong order) would silently grant again them. This is not a hypothesis: an early version of this same project's own setup script had exactly that order, and a security review ran CLIENT PAUSE against the "correct relatively configured" user that was the project and it worked. It's a DoS between servers "to user that the project's own documentation" claimed it couldn't do not. The problem was solved by putting +@connection first; in scripts/setup_dev_redis.sh the correct order and a comment that explains why it can't be changed.

3. Basado en cursores, not unwaitente, para cada collection. KEYS is in the @dangerous category own of Redis, because one single call can block the allization while serializing a huge keyspace; lo same in is done HHGETALL on a a big hesh, except to be less spoken. Every dame una colección tool here is o a cursor (redo_scan_keys/redis_hscan/redis_ginger) or maximum at 1000 items per call with a flag explicit trimed (redo_lrange/redo_zrange): never one call that can cause the server to materiallize a collection arbitrary large on of a alone.

4. A privilege check that asks Redis, not a re-implementation of Redis's ownes semantics. redis_check_permissions() uses ACL DRYRUN — the own answer from Redis to "does it succeed this command for this user?" — against a list curated of dangerous commands, in place of try to reconstruct the answer parsing the ACL rule lists (which is exactly what the rule order bug from above contains: a warning category list can't see on isolation that @admin and @connection correlate). would_succeed should always return vacío.

Tools

Configuración

pip install redis-guard-mcp
export REDIS_GUARD_URL="redis://readonly_user:password@localhost:6379/0"
redis-guard-mcp

REDIS_GUARD_URL is required — no there is default. Point you MCP client with the redis-guard-mcp command and the env had it set. See scripts/setup_dev_redis.sh for a working, correctly-ordered example of provision the restricted user (+@connection +@read -@write -@admin -@dangerous, plus the three exceptions types ACL WHOAMI/ACL GETUSER/ACL DRYRUN that redis_check_permissions itself needs: see client.py for why these are safe to grant, even if individually they left @read).

Pruebas

pip install -e ".[dev]"
scripts/setup_dev_redis.sh   # starts a Redis container + provisions the ACL user + seeds data
pytest tests/ -v

34 tests, almost all against the local real container (a couple of pure configuration tests need no Redis and skip independently); they skip in a automatic if the container isn't available. Includes a regression test for the exact bug order of the rules CLIENT PAUSE described above, and a test anestructural to paert that the precise set of redis-py methods commands.py calls, so tools already in the future are detected here and not silently to a review.

Estado

v0.1. A0. It went through an adversarial security review before the first commit, which found and this now solves: the ACL CLIENT order error above (confirmed by actually run CLIENT PAUSE against the configuration delivered), the "empty zones" in the original permission check by categories (that ACL DRYRUN has replaced), the no frills in a same shared Redis (now capped/already), a seed dev script is not idempotent, and a race against thread safety in the single lazy left ("lazy-singleton") of the layer of tools of the MCP.

License

MIT