security: add monitoring and alerting for suspicious query patterns #27

New issue

Open

opened 2026-02-21 01:03:12 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-21 01:03:12 +00:00

Member

Summary

The package currently logs all queries but has no active monitoring for suspicious patterns. Anomalous query behaviour should trigger alerts.

Problem

No detection of unusual query volumes (potential scraping)
No alert on rapid sequential exploration of table structure
Blocked query attempts are logged but not alerted
No baseline for 'normal' query patterns per workspace

Proposed Features

Rate of blocked queries threshold — alert if >N blocked in M minutes
Unusual table access patterns — alert on scanning many tables quickly
Query volume spike detection — alert if workspace exceeds 10x normal rate
Off-hours access detection — alert on queries outside workspace's typical hours
Integration with Laravel notification channels (Slack, email, webhook)

Files

src/Mcp/Services/QueryAnomalyDetector.php (new)
src/Mcp/Console/Commands/McpMonitorAnomalies.php (new)
src/Mcp/Listeners/DetectQueryAnomalies.php (new)

Notes

Also noted in TODO.md under Infrastructure. Estimated effort: 4-5 hours.

## Summary The package currently logs all queries but has no active monitoring for suspicious patterns. Anomalous query behaviour should trigger alerts. ## Problem - No detection of unusual query volumes (potential scraping) - No alert on rapid sequential exploration of table structure - Blocked query attempts are logged but not alerted - No baseline for 'normal' query patterns per workspace ## Proposed Features - Rate of blocked queries threshold — alert if >N blocked in M minutes - Unusual table access patterns — alert on scanning many tables quickly - Query volume spike detection — alert if workspace exceeds 10x normal rate - Off-hours access detection — alert on queries outside workspace's typical hours - Integration with Laravel notification channels (Slack, email, webhook) ## Files - `src/Mcp/Services/QueryAnomalyDetector.php` (new) - `src/Mcp/Console/Commands/McpMonitorAnomalies.php` (new) - `src/Mcp/Listeners/DetectQueryAnomalies.php` (new) ## Notes Also noted in TODO.md under Infrastructure. Estimated effort: 4-5 hours.