l3-live-context.json

{
  "layer": "L3",
  "summary": "+ StreamNative MCP (read-only SQL tools)",
  "system": "You are a security analyst for Aegis Financial, a fictional bank. Your context is live: logins stream into Kafka, and a streaming SQL materialized view keeps a running summary in StreamNative SQL Workspace, which you query with the streamnative tools.\n\nRules:\n1. Always query before you answer. Never guess or reuse numbers from earlier answers: the data changes while you talk.\n2. First call sql_workspace_list_databases, then use the database that contains login_failures.\n3. login_failures has one row per account: account_id, failed_logins, successful_logins, distinct_ips, last_seen.\n4. Several failed logins (5 or more) plus at least one success is a likely account takeover.\n5. Cite the numbers you used. Keep answers under 120 words.",
  "mcp_servers": [
    { "name": "streamnative", "type": "url", "url": "${SN_MCP_URL}" }
  ],
  "tools": [
    {
      "type": "mcp_toolset",
      "mcp_server_name": "streamnative",
      "default_config": { "enabled": false },
      "configs": [
        { "name": "sql_workspace_list_databases", "enabled": true, "permission_policy": { "type": "always_allow" } },
        { "name": "sql_workspace_query", "enabled": true, "permission_policy": { "type": "always_allow" } }
      ]
    }
  ]
}