Feature: read_db MCP tool for read-only SQLite queries

[Trecek]

Summary

Add an MCP tool that runs a parameterized read-only SQL query against a specified SQLite database and returns results as JSON. This enables the orchestrating LLM session to check state (counter values, WP statuses, execution records) without spawning a full Claude Code session.

Proposed Interface

@mcp.tool()
async def read_db(db_path: str, query: str, params: list = []) -> str:
    """Run a read-only SQL query against a SQLite database."""
    # Validate read-only (SELECT only, no CTEs with writes, no ATTACH)
    # Execute with parameterized query
    # Return results as JSON array of objects

Guardrails

• SELECT-only validation (reject INSERT/UPDATE/DELETE/DROP/ALTER/ATTACH)
• Parameterized queries only (no string interpolation)
• Query timeout enforcement
• Connection opened read-only (?mode=ro URI)

Motivation

Pipeline scripts orchestrating workflows need to check database state between steps (e.g., retry counter values, work package statuses). Currently this requires either a full Claude Code session (expensive) or a dedicated skill per query (boilerplate). A generic read_db tool eliminates both problems.

Priority

High — prerequisite for helper_agents migration Phase 2.

[Trecek]

Resolved: Added gated read_db MCP tool for read-only SQLite queries. Implements 4-layer defense-in-depth security: regex pre-validation (SELECT-only), SQLite authorizer callback, read-only URI mode (?mode=ro), and parameterized query enforcement. Configurable via ReadDbConfig (timeout, max_rows). 46 new tests added. 313 tests passing.