x=hub

your toolset

    build deployment
    sign in

    LogCarverGuard

    mcpother
    io.github.caiderek/logcarverguard · v0.1.0
    deploy just this

    Guardrail for AI agents on SQL Server: statement blocking, optional read-only mode and an audit log.

    run it

    on your own machines, one way per deploy method
    generated from the record, not tested yet
    #!/usr/bin/env bash
# logcarverguard (io.github.caiderek/logcarverguard), recipe baremetal (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-logcarverguard.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec uvx mcp-proxy --host 127.0.0.1 --port 8101 --pass-environment -- dnx [email protected] --yes

[Unit]
Description=MCP server logcarverguard (toolset my-agent), generated by Hub
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=mcp
Group=mcp
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/logcarverguard
WorkingDirectory=/var/lib/mcp/logcarverguard
ExecStart=/opt/mcp/my-agent/bin/logcarverguard.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/logcarverguard

[Install]
WantedBy=multi-user.target

    connect to it

    copy what your client needs
    dnx [email protected] --yes
# env: LOGCARVERGUARD_CONNECTION_STRING, LOGCARVERGUARD_READ_ONLY, LOGCARVERGUARD_AUDIT_DB_PATH, LOGCARVERGUARD_TRUNCATE_ALLOWLIST, LOGCARVERGUARD_EXEC_WHITELIST, LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST
    {
  "mcpServers": {
    "logcarverguard": {
      "command": "dnx",
      "args": [
        "[email protected]",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "${LOGCARVERGUARD_CONNECTION_STRING}",
        "LOGCARVERGUARD_READ_ONLY": "${LOGCARVERGUARD_READ_ONLY}",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "${LOGCARVERGUARD_AUDIT_DB_PATH}",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "${LOGCARVERGUARD_TRUNCATE_ALLOWLIST}",
        "LOGCARVERGUARD_EXEC_WHITELIST": "${LOGCARVERGUARD_EXEC_WHITELIST}",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "${LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST}"
      }
    }
  }
}
    #!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add logcarverguard -e "LOGCARVERGUARD_CONNECTION_STRING=${LOGCARVERGUARD_CONNECTION_STRING}" -e "LOGCARVERGUARD_READ_ONLY=${LOGCARVERGUARD_READ_ONLY}" -e "LOGCARVERGUARD_AUDIT_DB_PATH=${LOGCARVERGUARD_AUDIT_DB_PATH}" -e "LOGCARVERGUARD_TRUNCATE_ALLOWLIST=${LOGCARVERGUARD_TRUNCATE_ALLOWLIST}" -e "LOGCARVERGUARD_EXEC_WHITELIST=${LOGCARVERGUARD_EXEC_WHITELIST}" -e "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST=${LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST}" -- dnx [email protected] --yes

    {
  "mcpServers": {
    "logcarverguard": {
      "command": "dnx",
      "args": [
        "[email protected]",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "${LOGCARVERGUARD_CONNECTION_STRING}",
        "LOGCARVERGUARD_READ_ONLY": "${LOGCARVERGUARD_READ_ONLY}",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "${LOGCARVERGUARD_AUDIT_DB_PATH}",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "${LOGCARVERGUARD_TRUNCATE_ALLOWLIST}",
        "LOGCARVERGUARD_EXEC_WHITELIST": "${LOGCARVERGUARD_EXEC_WHITELIST}",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "${LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST}"
      }
    }
  }
}
    {
  "servers": {
    "logcarverguard": {
      "type": "stdio",
      "command": "dnx",
      "args": [
        "[email protected]",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "${LOGCARVERGUARD_CONNECTION_STRING}",
        "LOGCARVERGUARD_READ_ONLY": "${LOGCARVERGUARD_READ_ONLY}",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "${LOGCARVERGUARD_AUDIT_DB_PATH}",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "${LOGCARVERGUARD_TRUNCATE_ALLOWLIST}",
        "LOGCARVERGUARD_EXEC_WHITELIST": "${LOGCARVERGUARD_EXEC_WHITELIST}",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "${LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST}"
      }
    }
  }
}
    name: my-agent
target: local
servers:
- hub: io.github.caiderek/logcarverguard
    • not probed yet: tools unpinned, ingest lists them

    tools

    Not probed yetThe tools appear once the hub or its worker has listed this entry. Running it still works: your client lists them on first start.