diff --git a/confluence-mdx/README.md b/confluence-mdx/README.md index be3f18573..3db5ef58c 100644 --- a/confluence-mdx/README.md +++ b/confluence-mdx/README.md @@ -197,6 +197,7 @@ bin/convert_all.py --verify-translations - `target/public/` 디렉토리에 첨부파일이 저장됩니다. - 한국어 제목의 번역이 누락된 경우, 오류와 함께 누락 목록을 출력합니다. - `etc/korean-titles-translations.txt`에 번역을 추가한 후 재실행합니다. +- 표시용 영어 제목과 다른 기존 public route segment를 유지해야 하는 경우 `etc/content-slug-overrides.yaml`에 Confluence content ID와 canonical slug를 추가합니다. ## Confluence xhtml 을 Markdown 으로 변환하기 diff --git a/confluence-mdx/bin/convert_all.py b/confluence-mdx/bin/convert_all.py index 99fd88661..e536e3cd0 100755 --- a/confluence-mdx/bin/convert_all.py +++ b/confluence-mdx/bin/convert_all.py @@ -158,6 +158,16 @@ def _supported_children( or (catalog_node or {}).get("type") or "page" ) + status = str(child.get("status") or "current") + if status != "current": + print( + "WARNING: skipping non-current Confluence child " + f"parent_id={parent_id} id={child_id} " + f"type={child_type} status={status} " + f"title={child.get('title', '')!r}", + file=sys.stderr, + ) + continue if child_type not in _SUPPORTED_CONTENT_TYPES: print( "WARNING: skipping unsupported Confluence child " diff --git a/confluence-mdx/bin/fetch/config.py b/confluence-mdx/bin/fetch/config.py index d55beeca1..c8730d3e5 100644 --- a/confluence-mdx/bin/fetch/config.py +++ b/confluence-mdx/bin/fetch/config.py @@ -29,6 +29,7 @@ class Config: default_output_dir: str = "var" cache_dir: str = "cache" translations_file: str = "etc/korean-titles-translations.txt" + slug_overrides_file: str = "etc/content-slug-overrides.yaml" email: Optional[str] = None api_token: Optional[str] = None download_attachments: bool = False @@ -46,7 +47,12 @@ def __post_init__(self): self.api_token = os.environ.get('ATLASSIAN_TOKEN', 'your-api-token') # Resolve relative paths against project root (confluence-mdx/) - for field in ('default_output_dir', 'cache_dir', 'translations_file'): + for field in ( + 'default_output_dir', + 'cache_dir', + 'translations_file', + 'slug_overrides_file', + ): value = getattr(self, field) if not os.path.isabs(value): setattr(self, field, str(_PROJECT_DIR / value)) diff --git a/confluence-mdx/bin/fetch/processor.py b/confluence-mdx/bin/fetch/processor.py index 685cfd312..a79f57db1 100644 --- a/confluence-mdx/bin/fetch/processor.py +++ b/confluence-mdx/bin/fetch/processor.py @@ -13,7 +13,6 @@ from fetch.translation import TranslationService from fetch.stages import Stage1Processor, Stage2Processor, Stage3Processor, Stage4Processor from fetch.models import ContentNode, ContentRef -from text_utils import slugify class ConfluencePageProcessor: @@ -26,7 +25,11 @@ def __init__(self, config: Config, logger: logging.Logger): # Initialize services with dependency injection self.api_client = ApiClient(config, logger) self.file_manager = FileManager(logger) - self.translation_service = TranslationService(config.translations_file, logger) + self.translation_service = TranslationService( + config.translations_file, + config.slug_overrides_file, + logger, + ) # Initialize stage processors self.stage1 = Stage1Processor(config, self.api_client, self.file_manager, logger) @@ -36,6 +39,7 @@ def __init__(self, config: Config, logger: logging.Logger): # Load translations self.translation_service.load_translations() + self.translation_service.load_slug_overrides() def process_page_complete( self, @@ -100,6 +104,14 @@ def get_child_content_refs(self, page_id: str) -> List[ContentRef]: child_type = str(child.get("type") or "page") child_id = str(child["id"]) title = str(child.get("title") or "") + status = str(child.get("status") or "current") + if status != "current": + self.logger.warning( + "Skipping non-current Confluence child " + f"parent_id={page_id} id={child_id} " + f"type={child_type} status={status} title={title!r}" + ) + continue if child_type not in ("page", "folder"): self.logger.warning( "Skipping unsupported Confluence child " @@ -143,6 +155,7 @@ def fetch_page_tree_recursive( use_local: bool = False, content_type: Optional[str] = None, parent_breadcrumbs: Optional[List[str]] = None, + parent_path: Optional[List[str]] = None, visited: Optional[Set[str]] = None, ) -> Generator[ContentNode, None, None]: """Recursively fetch a typed content tree.""" @@ -186,19 +199,16 @@ def fetch_page_tree_recursive( ) if page: - # Update translations if available - if self.translation_service.translations: - self.translation_service.translate_page(page) - else: - # If no translations available, use original breadcrumbs for English and path - page.breadcrumbs_en = page.breadcrumbs - page.path = [slugify(crumb) for crumb in page.breadcrumbs] + self.translation_service.translate_page(page, parent_path) yield page child_parent_breadcrumbs = ( [] if page_id == start_page_id else list(page.breadcrumbs) ) + child_parent_path = ( + [] if page_id == start_page_id else list(page.path) + ) for child in self.get_child_content_refs(page_id): yield from self.fetch_page_tree_recursive( child.id, @@ -206,6 +216,7 @@ def fetch_page_tree_recursive( use_local, content_type=child.type, parent_breadcrumbs=child_parent_breadcrumbs, + parent_path=child_parent_path, visited=visited, ) except Exception as e: @@ -345,12 +356,7 @@ def run(self) -> None: include_children=False, ) if page: - # Update translations if available - if self.translation_service.translations: - self.translation_service.translate_page(page) - else: - page.breadcrumbs_en = page.breadcrumbs - page.path = [slugify(crumb) for crumb in page.breadcrumbs] + self.translation_service.translate_page(page) # Output to stdout during download breadcrumbs_str = " />> ".join(page.breadcrumbs) if page.breadcrumbs else "" diff --git a/confluence-mdx/bin/fetch/translation.py b/confluence-mdx/bin/fetch/translation.py index a9a763e0f..c11a8dd94 100644 --- a/confluence-mdx/bin/fetch/translation.py +++ b/confluence-mdx/bin/fetch/translation.py @@ -2,7 +2,9 @@ import logging import os -from typing import Protocol +from typing import List, Optional, Protocol + +import yaml from fetch.exceptions import TranslationError from fetch.models import Page @@ -15,20 +17,34 @@ class TranslationServiceProtocol(Protocol): def load_translations(self) -> None: ... + def load_slug_overrides(self) -> None: + ... + def translate(self, content: str) -> str: ... - def translate_page(self, page: 'Page') -> None: + def translate_page( + self, + page: 'Page', + parent_path: Optional[List[str]] = None, + ) -> None: ... class TranslationService: """Handles Korean to English title translations""" - def __init__(self, translations_file: str, logger: logging.Logger): + def __init__( + self, + translations_file: str, + slug_overrides_file: str, + logger: logging.Logger, + ): self.translations_file = translations_file + self.slug_overrides_file = slug_overrides_file self.logger = logger self.translations = {} + self.slug_overrides = {} def load_translations(self) -> None: """Load translations from the translations file""" @@ -55,6 +71,52 @@ def load_translations(self) -> None: self.logger.error(f"Error loading translations from {self.translations_file}: {str(e)}") raise TranslationError(f"Failed to load translations: {str(e)}") + def load_slug_overrides(self) -> None: + """Load content ID to canonical slug overrides.""" + if not os.path.exists(self.slug_overrides_file): + self.logger.warning( + f"Slug overrides file not found: {self.slug_overrides_file}" + ) + return + + try: + with open(self.slug_overrides_file, 'r', encoding='utf-8') as f: + data = yaml.safe_load(f) + if data is None: + return + if not isinstance(data, dict): + raise TranslationError( + "Slug overrides must be a content ID to slug mapping" + ) + + for content_id_value, slug_value in data.items(): + content_id = str(content_id_value).strip() + if not content_id or not isinstance(slug_value, str): + raise TranslationError( + f"Invalid slug override: {content_id_value!r}: {slug_value!r}" + ) + slug = slug_value.strip() + if not slug or slugify(slug) != slug: + raise TranslationError( + f"Slug override must be a canonical slug: {slug_value!r}" + ) + self.slug_overrides[content_id] = slug + + self.logger.info( + f"Loaded {len(self.slug_overrides)} slug overrides " + f"from {self.slug_overrides_file}" + ) + except TranslationError: + raise + except Exception as e: + self.logger.error( + f"Error loading slug overrides from " + f"{self.slug_overrides_file}: {str(e)}" + ) + raise TranslationError( + f"Failed to load slug overrides: {str(e)}" + ) from e + def translate(self, content: str) -> str: """Translate Korean titles in content to English""" if not self.translations: @@ -72,8 +134,12 @@ def translate(self, content: str) -> str: return translated_content - def translate_page(self, page: Page) -> None: - """Update English translations and path using the translator""" + def translate_page( + self, + page: Page, + parent_path: Optional[List[str]] = None, + ) -> None: + """Update display translations and build the canonical path.""" # Translate breadcrumbs to English page.breadcrumbs_en = [] for crumb in page.breadcrumbs: @@ -84,5 +150,21 @@ def translate_page(self, page: Page) -> None: break page.breadcrumbs_en.append(translated) - # Create path by slugifying English breadcrumbs - page.path = [slugify(crumb) for crumb in page.breadcrumbs_en] + if parent_path is None: + page.path = [slugify(crumb) for crumb in page.breadcrumbs_en] + elif page.breadcrumbs_en: + page.path = [ + *parent_path, + slugify(page.breadcrumbs_en[-1]), + ] + else: + page.path = list(parent_path) + + slug_override = self.slug_overrides.get(str(page.page_id)) + if slug_override: + if not page.path: + raise TranslationError( + f"Cannot apply slug override to content without a path: " + f"{page.page_id}" + ) + page.path[-1] = slug_override diff --git a/confluence-mdx/bin/skeleton/ignore_rules.yaml b/confluence-mdx/bin/skeleton/ignore_rules.yaml index e623753b5..5294e66d8 100644 --- a/confluence-mdx/bin/skeleton/ignore_rules.yaml +++ b/confluence-mdx/bin/skeleton/ignore_rules.yaml @@ -77,3 +77,12 @@ ignores: # Below are the rules that are not reviewed yet. ############################################################################# + # 사용자가 복사하는 checklist template을 target locale로 번역한 경우 + # Lines 326-345: 한국어 template을 영어로 번역 + - file: target/en/support/querypie-acp-operational-log-collection-guide.mdx + line_numbers: [326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345] + + # 사용자가 복사하는 checklist template을 target locale로 번역한 경우 + # Lines 326-345: 한국어 template을 일본어로 번역 + - file: target/ja/support/querypie-acp-operational-log-collection-guide.mdx + line_numbers: [326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345] diff --git a/confluence-mdx/etc/content-slug-overrides.yaml b/confluence-mdx/etc/content-slug-overrides.yaml new file mode 100644 index 000000000..f9c73ac3a --- /dev/null +++ b/confluence-mdx/etc/content-slug-overrides.yaml @@ -0,0 +1,2 @@ +# Confluence content ID to stable public route segment. +'2262630428': web-client diff --git a/confluence-mdx/etc/korean-titles-translations.txt b/confluence-mdx/etc/korean-titles-translations.txt index 46b039d87..c21713ff4 100644 --- a/confluence-mdx/etc/korean-titles-translations.txt +++ b/confluence-mdx/etc/korean-titles-translations.txt @@ -56,6 +56,9 @@ Multi Agent OS별 3rd Party Tool 지원 목록 | Multi Agent 3rd Party Tool Supp Multi Agent - qpctl CLI 사용 가이드 | Multi Agent - qpctl CLI Usage Guide Multi Agent 제약사항 | Multi Agent Limitations +# MCP Access Control +MAC을 통해 Remote MCP Servers 사용하기 | Using Remote MCP Servers through MAC + # User Management Email을 통한 사용자 비밀번호 초기화 | User Password Reset via Email 사용자 프로필 | User Profile @@ -87,6 +90,9 @@ LLM Provider 설정 | LLM Provider Configuration # Databases > DAC General Configurations Masking Pattern (메뉴 위치 이동) | Masking Pattern (Menu Relocated) +# Databases > DB Access Control +MongoDB / Document DB 의 Privilege Type Mapping | MongoDB / Document DB Privilege Type Mapping + # Databases > Connection Management > Cloud Providers AWS에서 DB 리소스 동기화 | Synchronizing DB Resources from AWS MS Azure에서 DB 리소스 동기화 | Synchronizing DB Resources from MS Azure @@ -180,3 +186,4 @@ MCP 설정 가이드 | MCP Configuration Guide 기술지원 | Technical Support 프리미엄 지원 | Premium Support Standard Edition 라이선스 정책 | Standard Edition License Policy +QueryPie ACP 운영 로그 수집 가이드 | QueryPie ACP Operational Log Collection Guide diff --git a/confluence-mdx/tests/test_convert_all_folders.py b/confluence-mdx/tests/test_convert_all_folders.py index c9e0812f0..2bdebab30 100644 --- a/confluence-mdx/tests/test_convert_all_folders.py +++ b/confluence-mdx/tests/test_convert_all_folders.py @@ -177,6 +177,13 @@ def test_navigation_is_generated_after_page_and_folder_mdx_exist(tmp_path): "results": [ {"id": "page", "type": "page", "childPosition": 2}, {"id": "folder", "type": "folder", "childPosition": 1}, + { + "id": "draft-page", + "type": "page", + "status": "draft", + "title": "Draft Page", + "childPosition": 3, + }, ], }) _write_yaml(var_dir / "folder" / "children.v2.yaml", {"results": []}) @@ -191,6 +198,7 @@ def test_navigation_is_generated_after_page_and_folder_mdx_exist(tmp_path): meta_path = output_dir / "parent" / "_meta.ts" content = meta_path.read_text() assert content.index("'folder': 'Folder'") < content.index("'page': 'Page'") + assert "Draft Page" not in content assert entries == [{ "page_id": "parent", "type": "page", diff --git a/confluence-mdx/tests/test_fetch_folders.py b/confluence-mdx/tests/test_fetch_folders.py index 0ba3edaa2..1c9d5fee6 100644 --- a/confluence-mdx/tests/test_fetch_folders.py +++ b/confluence-mdx/tests/test_fetch_folders.py @@ -8,8 +8,10 @@ from fetch.config import Config from fetch.exceptions import ApiError from fetch.file_manager import FileManager +from fetch.models import ContentNode from fetch.processor import ConfluencePageProcessor from fetch.stages import Stage1Processor +from fetch.translation import TranslationService def _config(tmp_path: Path, *, mode: str = "local", root_type: str = "page") -> Config: @@ -18,6 +20,7 @@ def _config(tmp_path: Path, *, mode: str = "local", root_type: str = "page") -> default_output_dir=str(tmp_path / "var"), cache_dir=str(tmp_path / "cache"), translations_file=str(tmp_path / "translations.txt"), + slug_overrides_file=str(tmp_path / "content-slug-overrides.yaml"), default_start_page_id="root", root_content_type=root_type, mode=mode, @@ -278,6 +281,13 @@ def test_local_mixed_tree_preserves_types_paths_order_and_warns( "title": "Embed", "childPosition": 5, }, + { + "id": "draft-page", + "type": "page", + "status": "draft", + "title": "Draft Page", + "childPosition": 6, + }, ], }) @@ -335,6 +345,112 @@ def test_local_mixed_tree_preserves_types_paths_order_and_warns( assert "type=whiteboard" in caplog.text assert "type=database" in caplog.text assert "type=embed" in caplog.text + assert ( + "parent_id=folder id=draft-page type=page " + "status=draft title='Draft Page'" + ) in caplog.text + + +def test_local_tree_separates_display_translation_from_canonical_slug( + tmp_path, +): + config = _config(tmp_path, mode="local") + var_dir = Path(config.default_output_dir) + Path(config.translations_file).write_text( + "부모 문서 | Descriptive Parent Title\n" + "자식 문서 | Child Document\n", + encoding="utf-8", + ) + _write_yaml( + Path(config.slug_overrides_file), + {"parent": "stable-parent"}, + ) + + _write_yaml(var_dir / "root" / "page.v1.yaml", _page_data("root", "Root")) + _write_yaml(var_dir / "root" / "page.v2.yaml", {"id": "root", "title": "Root"}) + _write_yaml(var_dir / "root" / "children.v2.yaml", { + "results": [{ + "id": "parent", + "type": "page", + "title": "부모 문서", + "childPosition": 1, + }], + }) + _write_yaml( + var_dir / "parent" / "page.v1.yaml", + _page_data("parent", "부모 문서"), + ) + _write_yaml( + var_dir / "parent" / "page.v2.yaml", + {"id": "parent", "type": "page", "title": "부모 문서"}, + ) + _write_yaml(var_dir / "parent" / "children.v2.yaml", { + "results": [{ + "id": "child", + "type": "page", + "title": "자식 문서", + "childPosition": 1, + }], + }) + _write_yaml( + var_dir / "child" / "page.v1.yaml", + _page_data("child", "자식 문서"), + ) + _write_yaml( + var_dir / "child" / "page.v2.yaml", + {"id": "child", "type": "page", "title": "자식 문서"}, + ) + _write_yaml(var_dir / "child" / "children.v2.yaml", {"results": []}) + + processor = ConfluencePageProcessor(config, logging.getLogger(__name__)) + nodes = list(processor.fetch_page_tree_recursive( + "root", + "root", + use_local=True, + content_type="page", + )) + + assert nodes[1].breadcrumbs_en == ["Descriptive Parent Title"] + assert nodes[1].path == ["stable-parent"] + assert nodes[2].breadcrumbs_en == [ + "Descriptive Parent Title", + "Child Document", + ] + assert nodes[2].path == ["stable-parent", "child-document"] + + +def test_web_client_uses_full_translation_and_stable_repository_slug(): + project_dir = Path(__file__).resolve().parents[1] + service = TranslationService( + str(project_dir / "etc" / "korean-titles-translations.txt"), + str(project_dir / "etc" / "content-slug-overrides.yaml"), + logging.getLogger(__name__), + ) + service.load_translations() + service.load_slug_overrides() + page = ContentNode( + page_id="2262630428", + title="Web Client로 쿠버네티스 클러스터 접속하기", + title_orig="Web Client로 쿠버네티스 클러스터 접속하기", + breadcrumbs=[ + "사용자 매뉴얼", + "Kubernetes Access Control", + "Web Client로 쿠버네티스 클러스터 접속하기", + ], + ) + + service.translate_page(page) + + assert page.breadcrumbs_en == [ + "User Manual", + "Kubernetes Access Control", + "Connecting to Kubernetes Clusters with Web Client", + ] + assert page.path == [ + "user-manual", + "kubernetes-access-control", + "web-client", + ] class _RemoteTreeApi: diff --git a/confluence-mdx/var/convert-manifests/convert-manifest.qm.yaml b/confluence-mdx/var/convert-manifests/convert-manifest.qm.yaml index 666ff3ad8..8ec349591 100644 --- a/confluence-mdx/var/convert-manifests/convert-manifest.qm.yaml +++ b/confluence-mdx/var/convert-manifests/convert-manifest.qm.yaml @@ -1,3 +1,1603 @@ version: 1 sync_code: qm -outputs: [] +outputs: +- page_id: '544178405' + type: page + kind: mdx + path: administrator-manual.mdx +- page_id: '544178405' + type: page + kind: navigation + path: administrator-manual/_meta.ts +- page_id: '544379062' + type: page + kind: mdx + path: administrator-manual/audit.mdx +- page_id: '544379062' + type: page + kind: navigation + path: administrator-manual/audit/_meta.ts +- page_id: '544080248' + type: page + kind: mdx + path: administrator-manual/audit/database-logs.mdx +- page_id: '544080248' + type: page + kind: navigation + path: administrator-manual/audit/database-logs/_meta.ts +- page_id: '544080264' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/access-control-logs.mdx +- page_id: '544014894' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/account-lock-history.mdx +- page_id: '544113141' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/db-access-history.mdx +- page_id: '544244163' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/dml-snapshots.mdx +- page_id: '1070694532' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/policy-audit-logs.mdx +- page_id: '1164705793' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/policy-exception-logs.mdx +- page_id: '544244149' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/query-audit.mdx +- page_id: '544145819' + type: page + kind: mdx + path: administrator-manual/audit/database-logs/running-queries.mdx +- page_id: '544211450' + type: page + kind: mdx + path: administrator-manual/audit/general-logs.mdx +- page_id: '544211450' + type: page + kind: navigation + path: administrator-manual/audit/general-logs/_meta.ts +- page_id: '544113108' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/activity-logs.mdx +- page_id: '544047557' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/admin-role-history.mdx +- page_id: '2167111691' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/ai-chat-audit.mdx +- page_id: '775455036' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/reverse-tunnels.mdx +- page_id: '775455036' + type: page + kind: navigation + path: administrator-manual/audit/general-logs/reverse-tunnels/_meta.ts +- page_id: '811466988' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/reverse-tunnels/communicating-with-clusters-through-reverse-tunnel.mdx +- page_id: '955318273' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/reverse-tunnels/communicating-with-db-through-reverse-tunnel.mdx +- page_id: '811434216' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/reverse-tunnels/communicating-with-servers-through-reverse-tunnel.mdx +- page_id: '544080230' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/user-access-history.mdx +- page_id: '705724442' + type: page + kind: mdx + path: administrator-manual/audit/general-logs/workflow-logs.mdx +- page_id: '544383513' + type: page + kind: mdx + path: administrator-manual/audit/kubernetes-logs.mdx +- page_id: '544383513' + type: page + kind: navigation + path: administrator-manual/audit/kubernetes-logs/_meta.ts +- page_id: '544383799' + type: page + kind: mdx + path: administrator-manual/audit/kubernetes-logs/kubernetes-role-history.mdx +- page_id: '544383693' + type: page + kind: mdx + path: administrator-manual/audit/kubernetes-logs/pod-session-recordings.mdx +- page_id: '544383587' + type: page + kind: mdx + path: administrator-manual/audit/kubernetes-logs/request-audit.mdx +- page_id: '2167472160' + type: folder + kind: mdx + path: administrator-manual/audit/mcp.mdx +- page_id: '2167472160' + type: folder + kind: navigation + path: administrator-manual/audit/mcp/_meta.ts +- page_id: '2167078929' + type: page + kind: mdx + path: administrator-manual/audit/mcp/mcp-server-role-history.mdx +- page_id: '2167308318' + type: page + kind: mdx + path: administrator-manual/audit/mcp/request-audit.mdx +- page_id: '693043522' + type: page + kind: mdx + path: administrator-manual/audit/reports.mdx +- page_id: '693043522' + type: page + kind: navigation + path: administrator-manual/audit/reports/_meta.ts +- page_id: '544379140' + type: page + kind: mdx + path: administrator-manual/audit/reports/audit-log-export.mdx +- page_id: '544384417' + type: page + kind: mdx + path: administrator-manual/audit/reports/reports.mdx +- page_id: '544014907' + type: page + kind: mdx + path: administrator-manual/audit/server-logs.mdx +- page_id: '544014907' + type: page + kind: navigation + path: administrator-manual/audit/server-logs/_meta.ts +- page_id: '544244234' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/access-control-logs.mdx +- page_id: '543949311' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/account-lock-history.mdx +- page_id: '544244208' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/command-audit.mdx +- page_id: '544244182' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/server-access-history.mdx +- page_id: '544244244' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/server-role-history.mdx +- page_id: '544014927' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/session-logs.mdx +- page_id: '544014940' + type: page + kind: mdx + path: administrator-manual/audit/server-logs/session-monitoring-moved.mdx +- page_id: '1064829366' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs.mdx +- page_id: '1064829366' + type: page + kind: navigation + path: administrator-manual/audit/web-app-logs/_meta.ts +- page_id: '1070694552' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs/jit-access-control-logs.mdx +- page_id: '1070694561' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs/user-activity-recordings.mdx +- page_id: '1064829380' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs/web-access-history.mdx +- page_id: '1070563469' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs/web-app-role-history.mdx +- page_id: '1070563457' + type: page + kind: mdx + path: administrator-manual/audit/web-app-logs/web-event-audit.mdx +- page_id: '544379638' + type: page + kind: mdx + path: administrator-manual/databases.mdx +- page_id: '544379638' + type: page + kind: navigation + path: administrator-manual/databases/_meta.ts +- page_id: '544379705' + type: page + kind: mdx + path: administrator-manual/databases/connection-management.mdx +- page_id: '544379705' + type: page + kind: navigation + path: administrator-manual/databases/connection-management/_meta.ts +- page_id: '544145672' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/cloud-providers.mdx +- page_id: '544145672' + type: page + kind: navigation + path: administrator-manual/databases/connection-management/cloud-providers/_meta.ts +- page_id: '544379719' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/cloud-providers/synchronizing-db-resources-from-aws.mdx +- page_id: '562167809' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/cloud-providers/synchronizing-db-resources-from-google-cloud.mdx +- page_id: '562167871' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/cloud-providers/synchronizing-db-resources-from-ms-azure.mdx +- page_id: '712507393' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/cloud-providers/verifying-cloud-synchronization-settings-with-dry-run-feature.mdx +- page_id: '2010153049' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/custom-jdbc-configs.mdx +- page_id: '2010153049' + type: page + kind: navigation + path: administrator-manual/databases/connection-management/custom-jdbc-configs/_meta.ts +- page_id: '2010153057' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/custom-jdbc-configs/custom-jdbc-configs-databricks-example.mdx +- page_id: '2010120237' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/custom-jdbc-configs/qsi-parser-selection.mdx +- page_id: '544014712' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections.mdx +- page_id: '544014712' + type: page + kind: navigation + path: administrator-manual/databases/connection-management/db-connections/_meta.ts +- page_id: '820806182' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections/aws-athena-specific-guide.mdx +- page_id: '880082945' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections/custom-data-source-configuration-and-log-verification.mdx +- page_id: '568852692' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections/documentdb-specific-guide.mdx +- page_id: '811434142' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections/google-bigquery-oauth-authentication-configuration.mdx +- page_id: '544380381' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/db-connections/mongodb-specific-guide.mdx +- page_id: '544112932' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/kerberos-configurations.mdx +- page_id: '544047436' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/ssh-configurations.mdx +- page_id: '544145691' + type: page + kind: mdx + path: administrator-manual/databases/connection-management/ssl-configurations.mdx +- page_id: '956071939' + type: page + kind: mdx + path: administrator-manual/databases/dac-general-configurations.mdx +- page_id: '956071939' + type: page + kind: navigation + path: administrator-manual/databases/dac-general-configurations/_meta.ts +- page_id: '1275396097' + type: page + kind: mdx + path: administrator-manual/databases/dac-general-configurations/masking-pattern-menu-relocated.mdx +- page_id: '921436219' + type: page + kind: mdx + path: administrator-manual/databases/dac-general-configurations/unmasking-zones.mdx +- page_id: '544380126' + type: page + kind: mdx + path: administrator-manual/databases/db-access-control.mdx +- page_id: '544380126' + type: page + kind: navigation + path: administrator-manual/databases/db-access-control/_meta.ts +- page_id: '544380173' + type: page + kind: mdx + path: administrator-manual/databases/db-access-control/access-control.mdx +- page_id: '544380140' + type: page + kind: mdx + path: administrator-manual/databases/db-access-control/privilege-type.mdx +- page_id: '544380140' + type: page + kind: navigation + path: administrator-manual/databases/db-access-control/privilege-type/_meta.ts +- page_id: '2288549894' + type: page + kind: mdx + path: administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx +- page_id: '571277577' + type: page + kind: mdx + path: administrator-manual/databases/ledger-management.mdx +- page_id: '571277577' + type: page + kind: navigation + path: administrator-manual/databases/ledger-management/_meta.ts +- page_id: '571277650' + type: page + kind: mdx + path: administrator-manual/databases/ledger-management/ledger-approval-rules.mdx +- page_id: '544380061' + type: page + kind: mdx + path: administrator-manual/databases/ledger-management/ledger-table-policy.mdx +- page_id: '954139156' + type: page + kind: mdx + path: administrator-manual/databases/monitoring.mdx +- page_id: '954139156' + type: page + kind: navigation + path: administrator-manual/databases/monitoring/_meta.ts +- page_id: '954204974' + type: page + kind: mdx + path: administrator-manual/databases/monitoring/proxy-management.mdx +- page_id: '954172219' + type: page + kind: mdx + path: administrator-manual/databases/monitoring/running-queries.mdx +- page_id: '873136365' + type: page + kind: mdx + path: administrator-manual/databases/new-policy-management.mdx +- page_id: '873136365' + type: page + kind: navigation + path: administrator-manual/databases/new-policy-management/_meta.ts +- page_id: '878805502' + type: page + kind: mdx + path: administrator-manual/databases/new-policy-management/data-paths.mdx +- page_id: '879198569' + type: page + kind: mdx + path: administrator-manual/databases/new-policy-management/data-policies.mdx +- page_id: '1064796485' + type: page + kind: mdx + path: administrator-manual/databases/new-policy-management/exception-management.mdx +- page_id: '544379868' + type: page + kind: mdx + path: administrator-manual/databases/policies.mdx +- page_id: '544379868' + type: page + kind: navigation + path: administrator-manual/databases/policies/_meta.ts +- page_id: '544379937' + type: page + kind: mdx + path: administrator-manual/databases/policies/data-access.mdx +- page_id: '544379882' + type: page + kind: mdx + path: administrator-manual/databases/policies/data-masking.mdx +- page_id: '569376769' + type: page + kind: mdx + path: administrator-manual/databases/policies/masking-pattern.mdx +- page_id: '713129986' + type: page + kind: mdx + path: administrator-manual/databases/policies/policy-exception.mdx +- page_id: '2010153040' + type: page + kind: mdx + path: administrator-manual/databases/policies/query-rules.mdx +- page_id: '544379993' + type: page + kind: mdx + path: administrator-manual/databases/policies/sensitive-data.mdx +- page_id: '544080057' + type: page + kind: mdx + path: administrator-manual/general.mdx +- page_id: '544080057' + type: page + kind: navigation + path: administrator-manual/general/_meta.ts +- page_id: '543948978' + type: page + kind: mdx + path: administrator-manual/general/company-management.mdx +- page_id: '543948978' + type: page + kind: navigation + path: administrator-manual/general/company-management/_meta.ts +- page_id: '543981760' + type: page + kind: mdx + path: administrator-manual/general/company-management/alerts.mdx +- page_id: '543981760' + type: page + kind: navigation + path: administrator-manual/general/company-management/alerts/_meta.ts +- page_id: '793608206' + type: page + kind: mdx + path: administrator-manual/general/company-management/alerts/new-request-template-variables-by-request-type.mdx +- page_id: '544112846' + type: page + kind: mdx + path: administrator-manual/general/company-management/allowed-zones.mdx +- page_id: '544243925' + type: page + kind: mdx + path: administrator-manual/general/company-management/channels.mdx +- page_id: '544145591' + type: page + kind: mdx + path: administrator-manual/general/company-management/general.mdx +- page_id: '544178443' + type: page + kind: mdx + path: administrator-manual/general/company-management/licenses.mdx +- page_id: '544178422' + type: page + kind: mdx + path: administrator-manual/general/company-management/security.mdx +- page_id: '544112865' + type: page + kind: mdx + path: administrator-manual/general/system.mdx +- page_id: '544112865' + type: page + kind: navigation + path: administrator-manual/general/system/_meta.ts +- page_id: '544377652' + type: page + kind: mdx + path: administrator-manual/general/system/api-token.mdx +- page_id: '544080097' + type: page + kind: mdx + path: administrator-manual/general/system/integrations.mdx +- page_id: '544080097' + type: page + kind: navigation + path: administrator-manual/general/system/integrations/_meta.ts +- page_id: '1454342158' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/identity-providers.mdx +- page_id: '1454342158' + type: page + kind: navigation + path: administrator-manual/general/system/integrations/identity-providers/_meta.ts +- page_id: '1495433217' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/identity-providers/integrating-with-aws-sso-saml-20.mdx +- page_id: '811401365' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-google-cloud-api-for-oauth-20.mdx +- page_id: '798064641' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-email.mdx +- page_id: '1267007528' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-event-callback.mdx +- page_id: '544379587' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-secret-store.mdx +- page_id: '883654669' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-slack-dm.mdx +- page_id: '883654669' + type: page + kind: navigation + path: administrator-manual/general/system/integrations/integrating-with-slack-dm/_meta.ts +- page_id: '544378759' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-slack-dm/slack-dm-workflow-notification-types.mdx +- page_id: '557940795' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-splunk.mdx +- page_id: '544379393' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/integrating-with-syslog.mdx +- page_id: '2166784044' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/llm-provider-configuration.mdx +- page_id: '1453588486' + type: page + kind: mdx + path: administrator-manual/general/system/integrations/oauth-client-application.mdx +- page_id: '544211220' + type: page + kind: mdx + path: administrator-manual/general/system/jobs.mdx +- page_id: '1456144391' + type: page + kind: mdx + path: administrator-manual/general/system/maintenance.mdx +- page_id: '544375969' + type: page + kind: mdx + path: administrator-manual/general/user-management.mdx +- page_id: '544375969' + type: page + kind: navigation + path: administrator-manual/general/user-management/_meta.ts +- page_id: '544375984' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication.mdx +- page_id: '544375984' + type: page + kind: navigation + path: administrator-manual/general/user-management/authentication/_meta.ts +- page_id: '544376183' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication/integrating-with-aws-sso.mdx +- page_id: '619381289' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication/integrating-with-google-saml.mdx +- page_id: '544376004' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication/integrating-with-ldap.mdx +- page_id: '544376100' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication/integrating-with-okta.mdx +- page_id: '793575425' + type: page + kind: mdx + path: administrator-manual/general/user-management/authentication/setting-up-multi-factor-authentication.mdx +- page_id: '544047341' + type: page + kind: mdx + path: administrator-manual/general/user-management/groups.mdx +- page_id: '544376982' + type: page + kind: mdx + path: administrator-manual/general/user-management/profile-editor.mdx +- page_id: '544376982' + type: page + kind: navigation + path: administrator-manual/general/user-management/profile-editor/_meta.ts +- page_id: '953221256' + type: page + kind: mdx + path: administrator-manual/general/user-management/profile-editor/custom-attribute.mdx +- page_id: '544376236' + type: page + kind: mdx + path: administrator-manual/general/user-management/provisioning.mdx +- page_id: '544376236' + type: page + kind: navigation + path: administrator-manual/general/user-management/provisioning/_meta.ts +- page_id: '544376265' + type: page + kind: mdx + path: administrator-manual/general/user-management/provisioning/activating-provisioning.mdx +- page_id: '544376394' + type: page + kind: mdx + path: administrator-manual/general/user-management/provisioning/okta-provisioning-integration-guide.mdx +- page_id: '543948996' + type: page + kind: mdx + path: administrator-manual/general/user-management/roles.mdx +- page_id: '544047331' + type: page + kind: mdx + path: administrator-manual/general/user-management/users.mdx +- page_id: '544047331' + type: page + kind: navigation + path: administrator-manual/general/user-management/users/_meta.ts +- page_id: '920944732' + type: page + kind: mdx + path: administrator-manual/general/user-management/users/password-change-enforcement-and-account-deletion-feature-for-qp-admin-default-account.mdx +- page_id: '544376787' + type: page + kind: mdx + path: administrator-manual/general/user-management/users/user-profile.mdx +- page_id: '544178462' + type: page + kind: mdx + path: administrator-manual/general/workflow-management.mdx +- page_id: '544178462' + type: page + kind: navigation + path: administrator-manual/general/workflow-management/_meta.ts +- page_id: '544047359' + type: page + kind: mdx + path: administrator-manual/general/workflow-management/all-requests.mdx +- page_id: '544378513' + type: page + kind: mdx + path: administrator-manual/general/workflow-management/approval-rules.mdx +- page_id: '561414376' + type: page + kind: mdx + path: administrator-manual/general/workflow-management/workflow-configurations.mdx +- page_id: '544381596' + type: page + kind: mdx + path: administrator-manual/kubernetes.mdx +- page_id: '544381596' + type: page + kind: navigation + path: administrator-manual/kubernetes/_meta.ts +- page_id: '544381637' + type: page + kind: mdx + path: administrator-manual/kubernetes/connection-management.mdx +- page_id: '544381637' + type: page + kind: navigation + path: administrator-manual/kubernetes/connection-management/_meta.ts +- page_id: '544381651' + type: page + kind: mdx + path: administrator-manual/kubernetes/connection-management/cloud-providers.mdx +- page_id: '544381651' + type: page + kind: navigation + path: administrator-manual/kubernetes/connection-management/cloud-providers/_meta.ts +- page_id: '544381739' + type: page + kind: mdx + path: administrator-manual/kubernetes/connection-management/cloud-providers/synchronizing-kubernetes-resources-from-aws.mdx +- page_id: '544381839' + type: page + kind: mdx + path: administrator-manual/kubernetes/connection-management/clusters.mdx +- page_id: '544381839' + type: page + kind: navigation + path: administrator-manual/kubernetes/connection-management/clusters/_meta.ts +- page_id: '544381877' + type: page + kind: mdx + path: administrator-manual/kubernetes/connection-management/clusters/manually-registering-kubernetes-clusters.mdx +- page_id: '544383110' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control.mdx +- page_id: '544383110' + type: page + kind: navigation + path: administrator-manual/kubernetes/k8s-access-control/_meta.ts +- page_id: '544383124' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/access-control.mdx +- page_id: '544383124' + type: page + kind: navigation + path: administrator-manual/kubernetes/k8s-access-control/access-control/_meta.ts +- page_id: '544383381' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/access-control/granting-and-revoking-kubernetes-roles.mdx +- page_id: '544382060' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies.mdx +- page_id: '544382060' + type: page + kind: navigation + path: administrator-manual/kubernetes/k8s-access-control/policies/_meta.ts +- page_id: '544382659' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies/kubernetes-policy-action-configuration-reference-guide.mdx +- page_id: '544382445' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies/kubernetes-policy-tips-guide.mdx +- page_id: '544382522' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies/kubernetes-policy-ui-code-helper-guide.mdx +- page_id: '544382364' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies/kubernetes-policy-yaml-code-syntax-guide.mdx +- page_id: '544382274' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/policies/setting-kubernetes-policies.mdx +- page_id: '544382741' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/roles.mdx +- page_id: '544382741' + type: page + kind: navigation + path: administrator-manual/kubernetes/k8s-access-control/roles/_meta.ts +- page_id: '544382963' + type: page + kind: mdx + path: administrator-manual/kubernetes/k8s-access-control/roles/setting-kubernetes-roles.mdx +- page_id: '954172232' + type: page + kind: mdx + path: administrator-manual/kubernetes/kac-general-configurations.mdx +- page_id: '2167636017' + type: folder + kind: mdx + path: administrator-manual/mcp-server.mdx +- page_id: '2167636017' + type: folder + kind: navigation + path: administrator-manual/mcp-server/_meta.ts +- page_id: '2167144528' + type: page + kind: mdx + path: administrator-manual/mcp-server/mac-general-configurations.mdx +- page_id: '2167799919' + type: page + kind: mdx + path: administrator-manual/mcp-server/mcp-access-control.mdx +- page_id: '2167242794' + type: page + kind: mdx + path: administrator-manual/mcp-server/mcp-server-connection-management.mdx +- page_id: '851280543' + type: page + kind: mdx + path: administrator-manual/multi-agent-limitations.mdx +- page_id: '544380588' + type: page + kind: mdx + path: administrator-manual/servers.mdx +- page_id: '544380588' + type: page + kind: navigation + path: administrator-manual/servers/_meta.ts +- page_id: '544380635' + type: page + kind: mdx + path: administrator-manual/servers/connection-management.mdx +- page_id: '544380635' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/_meta.ts +- page_id: '544178567' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/cloud-providers.mdx +- page_id: '544178567' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/cloud-providers/_meta.ts +- page_id: '544380650' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/cloud-providers/synchronizing-server-resources-from-aws.mdx +- page_id: '544380741' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/cloud-providers/synchronizing-server-resources-from-azure.mdx +- page_id: '544380708' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/cloud-providers/synchronizing-server-resources-from-gcp.mdx +- page_id: '615710737' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/proxyjump-configurations.mdx +- page_id: '615710737' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/proxyjump-configurations/_meta.ts +- page_id: '615743551' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/proxyjump-configurations/creating-proxyjump.mdx +- page_id: '544211376' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/server-agents-for-rdp.mdx +- page_id: '544211376' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/server-agents-for-rdp/_meta.ts +- page_id: '565575990' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/server-agents-for-rdp/installing-and-removing-server-agent.mdx +- page_id: '544080186' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/server-groups.mdx +- page_id: '544080186' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/server-groups/_meta.ts +- page_id: '544380846' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/server-groups/managing-servers-as-groups.mdx +- page_id: '544211361' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/servers.mdx +- page_id: '544211361' + type: page + kind: navigation + path: administrator-manual/servers/connection-management/servers/_meta.ts +- page_id: '544380774' + type: page + kind: mdx + path: administrator-manual/servers/connection-management/servers/manually-registering-individual-servers.mdx +- page_id: '954336174' + type: page + kind: mdx + path: administrator-manual/servers/sac-general-configurations.mdx +- page_id: '543949216' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control.mdx +- page_id: '543949216' + type: page + kind: navigation + path: administrator-manual/servers/server-access-control/_meta.ts +- page_id: '544381186' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/access-control.mdx +- page_id: '544381186' + type: page + kind: navigation + path: administrator-manual/servers/server-access-control/access-control/_meta.ts +- page_id: '544381282' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/access-control/granting-and-revoking-permissions.mdx +- page_id: '544381200' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/access-control/granting-and-revoking-roles.mdx +- page_id: '878838349' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/access-control/granting-server-privilege.mdx +- page_id: '544244109' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/blocked-accounts.mdx +- page_id: '544381118' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/command-templates.mdx +- page_id: '544381025' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/policies.mdx +- page_id: '544381025' + type: page + kind: navigation + path: administrator-manual/servers/server-access-control/policies/_meta.ts +- page_id: '544377895' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/policies/enabling-server-proxy.mdx +- page_id: '544381039' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/policies/setting-server-access-policy.mdx +- page_id: '544381150' + type: page + kind: mdx + path: administrator-manual/servers/server-access-control/roles.mdx +- page_id: '613777446' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management.mdx +- page_id: '613777446' + type: page + kind: navigation + path: administrator-manual/servers/server-account-management/_meta.ts +- page_id: '615743501' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management/account-management.mdx +- page_id: '615677962' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management/password-provisioning.mdx +- page_id: '615677962' + type: page + kind: navigation + path: administrator-manual/servers/server-account-management/password-provisioning/_meta.ts +- page_id: '619380898' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management/password-provisioning/creating-password-change-job.mdx +- page_id: '544380991' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management/server-account-templates.mdx +- page_id: '544380960' + type: page + kind: mdx + path: administrator-manual/servers/server-account-management/ssh-key-configurations.mdx +- page_id: '1760657435' + type: page + kind: mdx + path: administrator-manual/servers/session-monitoring.mdx +- page_id: '783515900' + type: page + kind: mdx + path: administrator-manual/web-apps.mdx +- page_id: '783515900' + type: page + kind: navigation + path: administrator-manual/web-apps/_meta.ts +- page_id: '1064829276' + type: page + kind: mdx + path: administrator-manual/web-apps/connection-management.mdx +- page_id: '1064829276' + type: page + kind: navigation + path: administrator-manual/web-apps/connection-management/_meta.ts +- page_id: '1064829246' + type: page + kind: mdx + path: administrator-manual/web-apps/connection-management/web-app-configurations.mdx +- page_id: '1070694423' + type: page + kind: mdx + path: administrator-manual/web-apps/connection-management/web-apps.mdx +- page_id: '783417593' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart.mdx +- page_id: '783745324' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/1027-wac-role-policy-guide.mdx +- page_id: '924287097' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/1028-wac-rbac-guide.mdx +- page_id: '956235931' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/1030-wac-jit-permission-acquisition-guide.mdx +- page_id: '783417593' + type: page + kind: navigation + path: administrator-manual/web-apps/wac-quickstart/_meta.ts +- page_id: '883654785' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/initial-wac-setup-in-web-app-configurations.mdx +- page_id: '805962425' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/root-ca-certificate-installation-guide.mdx +- page_id: '927629410' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/wac-faq.mdx +- page_id: '924319936' + type: page + kind: mdx + path: administrator-manual/web-apps/wac-quickstart/wac-troubleshooting-guide.mdx +- page_id: '1070596135' + type: page + kind: mdx + path: administrator-manual/web-apps/web-app-access-control.mdx +- page_id: '1070596135' + type: page + kind: navigation + path: administrator-manual/web-apps/web-app-access-control/_meta.ts +- page_id: '1070628904' + type: page + kind: mdx + path: administrator-manual/web-apps/web-app-access-control/access-control.mdx +- page_id: '1070628904' + type: page + kind: navigation + path: administrator-manual/web-apps/web-app-access-control/access-control/_meta.ts +- page_id: '1064599910' + type: page + kind: mdx + path: administrator-manual/web-apps/web-app-access-control/access-control/granting-and-revoking-roles.mdx +- page_id: '1064829343' + type: page + kind: mdx + path: administrator-manual/web-apps/web-app-access-control/policies.mdx +- page_id: '1070628923' + type: page + kind: mdx + path: administrator-manual/web-apps/web-app-access-control/roles.mdx +- page_id: '544375808' + type: page + kind: mdx + path: installation.mdx +- page_id: '544375808' + type: page + kind: navigation + path: installation/_meta.ts +- page_id: '954761289' + type: page + kind: mdx + path: installation/container-environment-variables.mdx +- page_id: '954761289' + type: page + kind: navigation + path: installation/container-environment-variables/_meta.ts +- page_id: '938016931' + type: page + kind: mdx + path: installation/container-environment-variables/optimizing-dbmaxconnectionsize.mdx +- page_id: '876937310' + type: page + kind: mdx + path: installation/container-environment-variables/querypieweburl.mdx +- page_id: '1689387010' + type: page + kind: mdx + path: installation/installation.mdx +- page_id: '1689387010' + type: page + kind: navigation + path: installation/installation/_meta.ts +- page_id: '1261895760' + type: page + kind: mdx + path: installation/installation/comparison-of-setupsh-and-setupv2sh.mdx +- page_id: '1177321474' + type: page + kind: mdx + path: installation/installation/installation-guide-setupv2sh.mdx +- page_id: '964952065' + type: page + kind: mdx + path: installation/installation/installation-guide-simple-configuration.mdx +- page_id: '815235967' + type: page + kind: mdx + path: installation/installation/installing-on-aws-eks.mdx +- page_id: '912326893' + type: page + kind: mdx + path: installation/license-installation.mdx +- page_id: '1907294209' + type: page + kind: mdx + path: installation/post-installation-setup.mdx +- page_id: '862126081' + type: page + kind: mdx + path: installation/prerequisites.mdx +- page_id: '862126081' + type: page + kind: navigation + path: installation/prerequisites/_meta.ts +- page_id: '1297383451' + type: page + kind: mdx + path: installation/prerequisites/configuring-rootless-mode-with-podman.mdx +- page_id: '1298530305' + type: page + kind: mdx + path: installation/prerequisites/linux-distribution-and-docker-podman-support-status.mdx +- page_id: '1881243653' + type: page + kind: mdx + path: installation/product-versions.mdx +- page_id: '1239416833' + type: page + kind: mdx + path: installation/querypie-acp-community-edition.mdx +- page_id: '1239416833' + type: page + kind: navigation + path: installation/querypie-acp-community-edition/_meta.ts +- page_id: '1972142096' + type: page + kind: mdx + path: installation/querypie-acp-community-edition/how-to-remove-querypie-acp-community-edition.mdx +- page_id: '1990000673' + type: page + kind: mdx + path: installation/querypie-acp-community-edition/how-to-upgrade-querypie-acp-community-edition.mdx +- page_id: '1735589937' + type: page + kind: mdx + path: installation/querypie-acp-community-edition/mcp-configuration-guide.mdx +- page_id: '1805516819' + type: page + kind: mdx + path: installation/querypie-acp-community-edition/querypie-acp-community-edition-initial-configuration-guide.mdx +- page_id: '1690402874' + type: page + kind: mdx + path: installation/server-configuration-requirements.mdx +- page_id: '1690402874' + type: page + kind: navigation + path: installation/server-configuration-requirements/_meta.ts +- page_id: '1688371232' + type: page + kind: mdx + path: installation/server-configuration-requirements/on-premise-vm-requirements.mdx +- page_id: '903086124' + type: page + kind: mdx + path: installation/server-configuration-requirements/public-cloud-production-server-requirements.mdx +- page_id: '1692303361' + type: page + kind: mdx + path: installation/server-configuration-requirements/server-configuration-requirements-summary.mdx +- page_id: '862093313' + type: page + kind: mdx + path: installation/system-architecture-and-network-access-control.mdx +- page_id: '544375784' + type: page + kind: mdx + path: overview.mdx +- page_id: '544375784' + type: page + kind: navigation + path: overview/_meta.ts +- page_id: '544112942' + type: page + kind: mdx + path: overview/proxy-management.mdx +- page_id: '544112942' + type: page + kind: navigation + path: overview/proxy-management/_meta.ts +- page_id: '544377869' + type: page + kind: mdx + path: overview/proxy-management/enable-database-proxy.mdx +- page_id: '544375859' + type: page + kind: mdx + path: overview/system-architecture-overview.mdx +- page_id: '544375335' + type: page + kind: mdx + path: release-notes.mdx +- page_id: '544375355' + type: page + kind: mdx + path: release-notes/10.0.0-10.0.2.mdx +- page_id: '604995641' + type: page + kind: mdx + path: release-notes/10.1.0-10.1.11.mdx +- page_id: '703463517' + type: page + kind: mdx + path: release-notes/10.2.0-10.2.12.mdx +- page_id: '954335909' + type: page + kind: mdx + path: release-notes/10.3.0-10.3.4.mdx +- page_id: '1064830173' + type: page + kind: mdx + path: release-notes/11.0.0.mdx +- page_id: '1171488777' + type: page + kind: mdx + path: release-notes/11.1.0-11.1.2.mdx +- page_id: '1291878563' + type: page + kind: mdx + path: release-notes/11.2.0.mdx +- page_id: '1421475841' + type: page + kind: mdx + path: release-notes/11.3.0.mdx +- page_id: '1568735233' + type: page + kind: mdx + path: release-notes/11.4.0.mdx +- page_id: '1751810049' + type: page + kind: mdx + path: release-notes/11.5.0-11.5.7.mdx +- page_id: '1924891357' + type: page + kind: mdx + path: release-notes/11.6.0-11.6.5.mdx +- page_id: '544375607' + type: page + kind: mdx + path: release-notes/9.10.0-9.10.4.mdx +- page_id: '544375607' + type: page + kind: navigation + path: release-notes/9.10.0-9.10.4/_meta.ts +- page_id: '544375624' + type: page + kind: mdx + path: release-notes/9.10.0-9.10.4/external-api-changes-9100-version.mdx +- page_id: '544375587' + type: page + kind: mdx + path: release-notes/9.11.0-9.11.5.mdx +- page_id: '544375485' + type: page + kind: mdx + path: release-notes/9.12.0-9.12.14.mdx +- page_id: '544375485' + type: page + kind: navigation + path: release-notes/9.12.0-9.12.14/_meta.ts +- page_id: '544375505' + type: page + kind: mdx + path: release-notes/9.12.0-9.12.14/menu-improvement-guide-9120.mdx +- page_id: '544375471' + type: page + kind: mdx + path: release-notes/9.13.0-9.13.5.mdx +- page_id: '544375457' + type: page + kind: mdx + path: release-notes/9.14.0-9.14.3.mdx +- page_id: '544375443' + type: page + kind: mdx + path: release-notes/9.15.0-9.15.4.mdx +- page_id: '544375429' + type: page + kind: mdx + path: release-notes/9.16.0-9.16.4.mdx +- page_id: '544375414' + type: page + kind: mdx + path: release-notes/9.17.0-9.17.1.mdx +- page_id: '544375399' + type: page + kind: mdx + path: release-notes/9.18.0-9.18.3.mdx +- page_id: '544375385' + type: page + kind: mdx + path: release-notes/9.19.0.mdx +- page_id: '544375370' + type: page + kind: mdx + path: release-notes/9.20.0-9.20.2.mdx +- page_id: '544375768' + type: page + kind: mdx + path: release-notes/9.8.0-9.8.12.mdx +- page_id: '544375659' + type: page + kind: mdx + path: release-notes/9.9.0-9.9.8.mdx +- page_id: '544375659' + type: page + kind: navigation + path: release-notes/9.9.0-9.9.8/_meta.ts +- page_id: '544375685' + type: page + kind: mdx + path: release-notes/9.9.0-9.9.8/external-api-changes-9810-version-994-version.mdx +- page_id: '544375741' + type: page + kind: mdx + path: release-notes/9.9.0-9.9.8/external-api-changes-994-version-995-version.mdx +- page_id: '544375335' + type: page + kind: navigation + path: release-notes/_meta.ts +- page_id: '1844969501' + type: page + kind: mdx + path: support.mdx +- page_id: '1844969501' + type: page + kind: navigation + path: support/_meta.ts +- page_id: '1853358081' + type: page + kind: mdx + path: support/premium-support.mdx +- page_id: '2288353307' + type: page + kind: mdx + path: support/querypie-acp-operational-log-collection-guide.mdx +- page_id: '1923285023' + type: page + kind: mdx + path: support/standard-edition-license-policy.mdx +- page_id: '1924169748' + type: page + kind: mdx + path: support/standard-edition.mdx +- page_id: '1911423023' + type: page + kind: mdx + path: unreleased.mdx +- page_id: '1911423023' + type: page + kind: navigation + path: unreleased/_meta.ts +- page_id: '1911652402' + type: page + kind: mdx + path: unreleased/reverse-sync-test-page.mdx +- page_id: '544211126' + type: page + kind: mdx + path: user-manual.mdx +- page_id: '544211126' + type: page + kind: navigation + path: user-manual/_meta.ts +- page_id: '2166521863' + type: page + kind: mdx + path: user-manual/ai-chat.mdx +- page_id: '544380204' + type: page + kind: mdx + path: user-manual/database-access-control.mdx +- page_id: '544380204' + type: page + kind: navigation + path: user-manual/database-access-control/_meta.ts +- page_id: '880181257' + type: page + kind: mdx + path: user-manual/database-access-control/connecting-to-custom-data-source.mdx +- page_id: '559906893' + type: page + kind: mdx + path: user-manual/database-access-control/connecting-to-proxy-without-agent.mdx +- page_id: '820609510' + type: page + kind: mdx + path: user-manual/database-access-control/connecting-via-google-bigquery-oauth-authentication.mdx +- page_id: '544380222' + type: page + kind: mdx + path: user-manual/database-access-control/connecting-with-web-sql-editor.mdx +- page_id: '544380354' + type: page + kind: mdx + path: user-manual/database-access-control/setting-default-privilege.mdx +- page_id: '544384011' + type: page + kind: mdx + path: user-manual/kubernetes-access-control.mdx +- page_id: '544384011' + type: page + kind: navigation + path: user-manual/kubernetes-access-control/_meta.ts +- page_id: '544384025' + type: page + kind: mdx + path: user-manual/kubernetes-access-control/checking-access-permission-list.mdx +- page_id: '2262630428' + type: page + kind: mdx + path: user-manual/kubernetes-access-control/web-client.mdx +- page_id: '2168455203' + type: folder + kind: mdx + path: user-manual/mcp-access-control.mdx +- page_id: '2168455203' + type: folder + kind: navigation + path: user-manual/mcp-access-control/_meta.ts +- page_id: '2166816845' + type: page + kind: mdx + path: user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx +- page_id: '852066413' + type: page + kind: mdx + path: user-manual/multi-agent.mdx +- page_id: '852066413' + type: page + kind: navigation + path: user-manual/multi-agent/_meta.ts +- page_id: '919240916' + type: page + kind: mdx + path: user-manual/multi-agent/multi-agent-3rd-party-tool-support-list-by-os.mdx +- page_id: '912425276' + type: page + kind: mdx + path: user-manual/multi-agent/multi-agent-linux-installation-and-usage-guide.mdx +- page_id: '2173796362' + type: page + kind: mdx + path: user-manual/multi-agent/multi-agent-qpctl-cli-usage-guide.mdx +- page_id: '912425288' + type: page + kind: mdx + path: user-manual/multi-agent/multi-agent-seamless-ssh-usage-guide.mdx +- page_id: '578945174' + type: page + kind: mdx + path: user-manual/my-dashboard.mdx +- page_id: '578945174' + type: page + kind: navigation + path: user-manual/my-dashboard/_meta.ts +- page_id: '793542657' + type: page + kind: mdx + path: user-manual/my-dashboard/user-password-reset-via-email.mdx +- page_id: '568950885' + type: page + kind: mdx + path: user-manual/preferences.mdx +- page_id: '544381369' + type: page + kind: mdx + path: user-manual/server-access-control.mdx +- page_id: '544381369' + type: page + kind: navigation + path: user-manual/server-access-control/_meta.ts +- page_id: '544381383' + type: page + kind: mdx + path: user-manual/server-access-control/connecting-to-authorized-servers.mdx +- page_id: '544381477' + type: page + kind: mdx + path: user-manual/server-access-control/using-web-sftp.mdx +- page_id: '544381410' + type: page + kind: mdx + path: user-manual/server-access-control/using-web-terminal.mdx +- page_id: '544112828' + type: page + kind: mdx + path: user-manual/user-agent.mdx +- page_id: '1064829218' + type: page + kind: mdx + path: user-manual/web-access-control.mdx +- page_id: '1064829218' + type: page + kind: navigation + path: user-manual/web-access-control/_meta.ts +- page_id: '1064796396' + type: page + kind: mdx + path: user-manual/web-access-control/accessing-web-applications-websites.mdx +- page_id: '1073709107' + type: page + kind: mdx + path: user-manual/web-access-control/installing-root-ca-certificate-and-extension.mdx +- page_id: '544377922' + type: page + kind: mdx + path: user-manual/workflow.mdx +- page_id: '544377922' + type: page + kind: navigation + path: user-manual/workflow/_meta.ts +- page_id: '568918170' + type: page + kind: mdx + path: user-manual/workflow/approval-additional-features-proxy-approval-resubmission-etc.mdx +- page_id: '544378348' + type: page + kind: mdx + path: user-manual/workflow/requesting-access-role.mdx +- page_id: '544377968' + type: page + kind: mdx + path: user-manual/workflow/requesting-db-access.mdx +- page_id: '1070006273' + type: page + kind: mdx + path: user-manual/workflow/requesting-db-policy-exception.mdx +- page_id: '1055358996' + type: page + kind: mdx + path: user-manual/workflow/requesting-ip-registration.mdx +- page_id: '1060306945' + type: page + kind: mdx + path: user-manual/workflow/requesting-restricted-data-access.mdx +- page_id: '544378254' + type: page + kind: mdx + path: user-manual/workflow/requesting-server-access.mdx +- page_id: '878936417' + type: page + kind: mdx + path: user-manual/workflow/requesting-server-privilege.mdx +- page_id: '544378182' + type: page + kind: mdx + path: user-manual/workflow/requesting-sql-export.mdx +- page_id: '544378069' + type: page + kind: mdx + path: user-manual/workflow/requesting-sql.mdx +- page_id: '544378069' + type: page + kind: navigation + path: user-manual/workflow/requesting-sql/_meta.ts +- page_id: '692355151' + type: page + kind: mdx + path: user-manual/workflow/requesting-sql/using-execution-plan-explain-feature.mdx +- page_id: '712769539' + type: page + kind: mdx + path: user-manual/workflow/requesting-unmasking-mask-removal-request.mdx diff --git a/confluence-mdx/var/pages.qm.yaml b/confluence-mdx/var/pages.qm.yaml index 0c50816ae..8d182a50b 100644 --- a/confluence-mdx/var/pages.qm.yaml +++ b/confluence-mdx/var/pages.qm.yaml @@ -1,4 +1,5 @@ - "page_id": "608501837" + "type": "page" "title": "QueryPie Docs" "title_orig": "QueryPie Docs" "breadcrumbs": @@ -8,6 +9,7 @@ "path": - "querypie-docs" - "page_id": "544375784" + "type": "page" "title": "Overview" "title_orig": "Overview" "breadcrumbs": @@ -17,6 +19,7 @@ "path": - "overview" - "page_id": "544375859" + "type": "page" "title": "시스템 구성도 개요" "title_orig": "시스템 구성도 개요" "breadcrumbs": @@ -29,6 +32,7 @@ - "overview" - "system-architecture-overview" - "page_id": "544112942" + "type": "page" "title": "Proxy Management" "title_orig": "Proxy Management" "breadcrumbs": @@ -41,6 +45,7 @@ - "overview" - "proxy-management" - "page_id": "544377869" + "type": "page" "title": "Database Proxy 사용 활성화" "title_orig": "Database Proxy 사용 활성화" "breadcrumbs": @@ -56,6 +61,7 @@ - "proxy-management" - "enable-database-proxy" - "page_id": "544211126" + "type": "page" "title": "사용자 매뉴얼" "title_orig": "사용자 매뉴얼" "breadcrumbs": @@ -65,6 +71,7 @@ "path": - "user-manual" - "page_id": "578945174" + "type": "page" "title": "My Dashboard" "title_orig": "My Dashboard" "breadcrumbs": @@ -77,6 +84,7 @@ - "user-manual" - "my-dashboard" - "page_id": "793542657" + "type": "page" "title": "Email을 통한 사용자 비밀번호 초기화" "title_orig": "Email을 통한 사용자 비밀번호 초기화" "breadcrumbs": @@ -92,6 +100,7 @@ - "my-dashboard" - "user-password-reset-via-email" - "page_id": "544377922" + "type": "page" "title": "Workflow" "title_orig": "Workflow" "breadcrumbs": @@ -104,6 +113,7 @@ - "user-manual" - "workflow" - "page_id": "544377968" + "type": "page" "title": "DB Access Request 요청하기" "title_orig": "DB Access Request 요청하기" "breadcrumbs": @@ -119,6 +129,7 @@ - "workflow" - "requesting-db-access" - "page_id": "544378069" + "type": "page" "title": "SQL Request 요청하기" "title_orig": "SQL Request 요청하기" "breadcrumbs": @@ -134,6 +145,7 @@ - "workflow" - "requesting-sql" - "page_id": "692355151" + "type": "page" "title": "실행 계획(Explain) 기능 사용하기" "title_orig": "실행 계획(Explain) 기능 사용하기" "breadcrumbs": @@ -152,6 +164,7 @@ - "requesting-sql" - "using-execution-plan-explain-feature" - "page_id": "544378182" + "type": "page" "title": "SQL Export Request 요청하기" "title_orig": "SQL Export Request 요청하기" "breadcrumbs": @@ -167,6 +180,7 @@ - "workflow" - "requesting-sql-export" - "page_id": "712769539" + "type": "page" "title": "Unmasking Request 요청하기 (마스킹 해제 요청)" "title_orig": "Unmasking Request 요청하기 (마스킹 해제 요청)" "breadcrumbs": @@ -182,6 +196,7 @@ - "workflow" - "requesting-unmasking-mask-removal-request" - "page_id": "1060306945" + "type": "page" "title": "Restricted Data Access 요청하기 (제한된 데이터 접근 요청)" "title_orig": "Restricted Data Access 요청하기 (제한된 데이터 접근 요청)" "breadcrumbs": @@ -197,6 +212,7 @@ - "workflow" - "requesting-restricted-data-access" - "page_id": "544378254" + "type": "page" "title": "Server Access Request 요청하기" "title_orig": "Server Access Request 요청하기" "breadcrumbs": @@ -212,6 +228,7 @@ - "workflow" - "requesting-server-access" - "page_id": "878936417" + "type": "page" "title": "Server Privilege Request 요청하기" "title_orig": "Server Privilege Request 요청하기" "breadcrumbs": @@ -227,6 +244,7 @@ - "workflow" - "requesting-server-privilege" - "page_id": "544378348" + "type": "page" "title": "Access Role Request 요청하기" "title_orig": "Access Role Request 요청하기" "breadcrumbs": @@ -242,6 +260,7 @@ - "workflow" - "requesting-access-role" - "page_id": "1055358996" + "type": "page" "title": "IP Registration Request 요청하기" "title_orig": "IP Registration Request 요청하기" "breadcrumbs": @@ -257,6 +276,7 @@ - "workflow" - "requesting-ip-registration" - "page_id": "1070006273" + "type": "page" "title": "DB 정책 예외 요청하기 (DB Policy Exception Request)" "title_orig": "DB 정책 예외 요청하기 (DB Policy Exception Request)" "breadcrumbs": @@ -272,6 +292,7 @@ - "workflow" - "requesting-db-policy-exception" - "page_id": "568918170" + "type": "page" "title": "결재 부가 기능 (대리 결재, 재상신 등)" "title_orig": "결재 부가 기능 (대리 결재, 재상신 등)" "breadcrumbs": @@ -287,6 +308,7 @@ - "workflow" - "approval-additional-features-proxy-approval-resubmission-etc" - "page_id": "544380204" + "type": "page" "title": "Database Access Control" "title_orig": "Database Access Control" "breadcrumbs": @@ -299,6 +321,7 @@ - "user-manual" - "database-access-control" - "page_id": "544380222" + "type": "page" "title": "웹 SQL 에디터로 접속하기" "title_orig": "웹 SQL 에디터로 접속하기" "breadcrumbs": @@ -314,6 +337,7 @@ - "database-access-control" - "connecting-with-web-sql-editor" - "page_id": "544380354" + "type": "page" "title": "Default Privilege 설정하기" "title_orig": "Default Privilege 설정하기" "breadcrumbs": @@ -329,6 +353,7 @@ - "database-access-control" - "setting-default-privilege" - "page_id": "559906893" + "type": "page" "title": "에이전트 없이 프록시 접속하기" "title_orig": "에이전트 없이 프록시 접속하기" "breadcrumbs": @@ -344,6 +369,7 @@ - "database-access-control" - "connecting-to-proxy-without-agent" - "page_id": "820609510" + "type": "page" "title": "Google BigQuery OAuth 인증을 통해 접속하기" "title_orig": "Google BigQuery OAuth 인증을 통해 접속하기" "breadcrumbs": @@ -359,6 +385,7 @@ - "database-access-control" - "connecting-via-google-bigquery-oauth-authentication" - "page_id": "880181257" + "type": "page" "title": "Custom Data Source 접속하기" "title_orig": "Custom Data Source 접속하기" "breadcrumbs": @@ -374,6 +401,7 @@ - "database-access-control" - "connecting-to-custom-data-source" - "page_id": "544381369" + "type": "page" "title": "Server Access Control" "title_orig": "Server Access Control" "breadcrumbs": @@ -386,6 +414,7 @@ - "user-manual" - "server-access-control" - "page_id": "544381383" + "type": "page" "title": "권한이 있는 서버에 접속하기" "title_orig": "권한이 있는 서버에 접속하기" "breadcrumbs": @@ -401,6 +430,7 @@ - "server-access-control" - "connecting-to-authorized-servers" - "page_id": "544381410" + "type": "page" "title": "웹 터미널 사용하기" "title_orig": "웹 터미널 사용하기" "breadcrumbs": @@ -416,6 +446,7 @@ - "server-access-control" - "using-web-terminal" - "page_id": "544381477" + "type": "page" "title": "웹 SFTP 사용하기" "title_orig": "웹 SFTP 사용하기" "breadcrumbs": @@ -431,6 +462,7 @@ - "server-access-control" - "using-web-sftp" - "page_id": "544384011" + "type": "page" "title": "Kubernetes Access Control" "title_orig": "Kubernetes Access Control" "breadcrumbs": @@ -443,6 +475,7 @@ - "user-manual" - "kubernetes-access-control" - "page_id": "544384025" + "type": "page" "title": "접근 권한 목록 확인하기" "title_orig": "접근 권한 목록 확인하기" "breadcrumbs": @@ -458,6 +491,7 @@ - "kubernetes-access-control" - "checking-access-permission-list" - "page_id": "2262630428" + "type": "page" "title": "Web Client로 쿠버네티스 클러스터 접속하기" "title_orig": "Web Client로 쿠버네티스 클러스터 접속하기" "breadcrumbs": @@ -467,12 +501,13 @@ "breadcrumbs_en": - "User Manual" - "Kubernetes Access Control" - - "Web Client로 쿠버네티스 클러스터 접속하기" + - "Connecting to Kubernetes Clusters with Web Client" "path": - "user-manual" - "kubernetes-access-control" - "web-client" - "page_id": "1064829218" + "type": "page" "title": "Web Access Control" "title_orig": "Web Access Control" "breadcrumbs": @@ -485,6 +520,7 @@ - "user-manual" - "web-access-control" - "page_id": "1073709107" + "type": "page" "title": "Root CA 인증서 및 Extension 설치하기" "title_orig": "Root CA 인증서 및 Extension 설치하기" "breadcrumbs": @@ -500,6 +536,7 @@ - "web-access-control" - "installing-root-ca-certificate-and-extension" - "page_id": "1064796396" + "type": "page" "title": "웹 애플리케이션(웹사이트) 접속하기" "title_orig": "웹 애플리케이션(웹사이트) 접속하기" "breadcrumbs": @@ -514,7 +551,37 @@ - "user-manual" - "web-access-control" - "accessing-web-applications-websites" +- "page_id": "2168455203" + "type": "folder" + "title": "MCP Access Control" + "title_orig": "MCP Access Control" + "breadcrumbs": + - "사용자 매뉴얼" + - "MCP Access Control" + "breadcrumbs_en": + - "User Manual" + - "MCP Access Control" + "path": + - "user-manual" + - "mcp-access-control" +- "page_id": "2166816845" + "type": "page" + "title": "MAC을 통해 Remote MCP Servers 사용하기" + "title_orig": "MAC을 통해 Remote MCP Servers 사용하기" + "breadcrumbs": + - "사용자 매뉴얼" + - "MCP Access Control" + - "MAC을 통해 Remote MCP Servers 사용하기" + "breadcrumbs_en": + - "User Manual" + - "MCP Access Control" + - "Using Remote MCP Servers through MAC" + "path": + - "user-manual" + - "mcp-access-control" + - "using-remote-mcp-servers-through-mac" - "page_id": "568950885" + "type": "page" "title": "Preferences" "title_orig": "Preferences" "breadcrumbs": @@ -527,6 +594,7 @@ - "user-manual" - "preferences" - "page_id": "544112828" + "type": "page" "title": "User Agent" "title_orig": "User Agent" "breadcrumbs": @@ -539,6 +607,7 @@ - "user-manual" - "user-agent" - "page_id": "852066413" + "type": "page" "title": "Multi Agent" "title_orig": "Multi Agent" "breadcrumbs": @@ -551,6 +620,7 @@ - "user-manual" - "multi-agent" - "page_id": "912425276" + "type": "page" "title": "Multi Agent Linux 설치 및 사용 가이드" "title_orig": "Multi Agent Linux 설치 및 사용 가이드" "breadcrumbs": @@ -566,6 +636,7 @@ - "multi-agent" - "multi-agent-linux-installation-and-usage-guide" - "page_id": "912425288" + "type": "page" "title": "Multi Agent Seamless SSH 사용 가이드" "title_orig": "Multi Agent Seamless SSH 사용 가이드" "breadcrumbs": @@ -581,6 +652,7 @@ - "multi-agent" - "multi-agent-seamless-ssh-usage-guide" - "page_id": "919240916" + "type": "page" "title": "Multi Agent OS별 3rd Party Tool 지원 목록" "title_orig": "Multi Agent OS별 3rd Party Tool 지원 목록" "breadcrumbs": @@ -596,6 +668,7 @@ - "multi-agent" - "multi-agent-3rd-party-tool-support-list-by-os" - "page_id": "2173796362" + "type": "page" "title": "Multi Agent - qpctl CLI 사용 가이드" "title_orig": "Multi Agent - qpctl CLI 사용 가이드" "breadcrumbs": @@ -611,6 +684,7 @@ - "multi-agent" - "multi-agent-qpctl-cli-usage-guide" - "page_id": "2166521863" + "type": "page" "title": "AI Chat" "title_orig": "AI Chat" "breadcrumbs": @@ -623,6 +697,7 @@ - "user-manual" - "ai-chat" - "page_id": "544178405" + "type": "page" "title": "관리자 매뉴얼" "title_orig": "관리자 매뉴얼" "breadcrumbs": @@ -632,6 +707,7 @@ "path": - "administrator-manual" - "page_id": "544080057" + "type": "page" "title": "General" "title_orig": "General" "breadcrumbs": @@ -644,6 +720,7 @@ - "administrator-manual" - "general" - "page_id": "543948978" + "type": "page" "title": "Company Management" "title_orig": "Company Management" "breadcrumbs": @@ -659,6 +736,7 @@ - "general" - "company-management" - "page_id": "544145591" + "type": "page" "title": "General" "title_orig": "General​" "breadcrumbs": @@ -677,6 +755,7 @@ - "company-management" - "general" - "page_id": "544178422" + "type": "page" "title": "Security" "title_orig": "Security" "breadcrumbs": @@ -695,6 +774,7 @@ - "company-management" - "security" - "page_id": "544112846" + "type": "page" "title": "Allowed Zones" "title_orig": "Allowed Zones" "breadcrumbs": @@ -713,6 +793,7 @@ - "company-management" - "allowed-zones" - "page_id": "544243925" + "type": "page" "title": "Channels" "title_orig": "Channels" "breadcrumbs": @@ -731,6 +812,7 @@ - "company-management" - "channels" - "page_id": "543981760" + "type": "page" "title": "Alerts" "title_orig": "Alerts" "breadcrumbs": @@ -749,6 +831,7 @@ - "company-management" - "alerts" - "page_id": "793608206" + "type": "page" "title": "New Request > 요청 타입별 템플릿 변수" "title_orig": "New Request > 요청 타입별 템플릿 변수" "breadcrumbs": @@ -770,6 +853,7 @@ - "alerts" - "new-request-template-variables-by-request-type" - "page_id": "544178443" + "type": "page" "title": "Licenses" "title_orig": "Licenses" "breadcrumbs": @@ -788,6 +872,7 @@ - "company-management" - "licenses" - "page_id": "544375969" + "type": "page" "title": "User Management" "title_orig": "User Management" "breadcrumbs": @@ -803,6 +888,7 @@ - "general" - "user-management" - "page_id": "544047331" + "type": "page" "title": "Users" "title_orig": "Users" "breadcrumbs": @@ -821,6 +907,7 @@ - "user-management" - "users" - "page_id": "544376787" + "type": "page" "title": "사용자 프로필" "title_orig": "사용자 프로필" "breadcrumbs": @@ -842,6 +929,7 @@ - "users" - "user-profile" - "page_id": "920944732" + "type": "page" "title": "qp-admin 기본 계정에 대한 패스워드 변경 강제화 및 계정 삭제 기능" "title_orig": "qp-admin 기본 계정에 대한 패스워드 변경 강제화 및 계정 삭제 기능" "breadcrumbs": @@ -864,6 +952,7 @@ - "users" - "password-change-enforcement-and-account-deletion-feature-for-qp-admin-default-account" - "page_id": "544047341" + "type": "page" "title": "Groups" "title_orig": "Groups" "breadcrumbs": @@ -882,6 +971,7 @@ - "user-management" - "groups" - "page_id": "543948996" + "type": "page" "title": "Roles" "title_orig": "Roles" "breadcrumbs": @@ -900,6 +990,7 @@ - "user-management" - "roles" - "page_id": "544376982" + "type": "page" "title": "Profile Editor" "title_orig": "Profile Editor" "breadcrumbs": @@ -918,6 +1009,7 @@ - "user-management" - "profile-editor" - "page_id": "953221256" + "type": "page" "title": "Custom Attribute" "title_orig": "Custom Attribute" "breadcrumbs": @@ -939,6 +1031,7 @@ - "profile-editor" - "custom-attribute" - "page_id": "544375984" + "type": "page" "title": "Authentication" "title_orig": "Authentication" "breadcrumbs": @@ -956,49 +1049,52 @@ - "general" - "user-management" - "authentication" -- "page_id": "544376004" - "title": "LDAP 연동하기" - "title_orig": "LDAP 연동하기" +- "page_id": "544376100" + "type": "page" + "title": "Okta 연동하기" + "title_orig": "Okta 연동하기" "breadcrumbs": - "관리자 매뉴얼" - "General" - "User Management" - "Authentication" - - "LDAP 연동하기" + - "Okta 연동하기" "breadcrumbs_en": - "Administrator Manual" - "General" - "User Management" - "Authentication" - - "Integrating with LDAP" + - "Integrating with Okta" "path": - "administrator-manual" - "general" - "user-management" - "authentication" - - "integrating-with-ldap" -- "page_id": "544376100" - "title": "Okta 연동하기" - "title_orig": "Okta 연동하기" + - "integrating-with-okta" +- "page_id": "544376004" + "type": "page" + "title": "LDAP 연동하기" + "title_orig": "LDAP 연동하기" "breadcrumbs": - "관리자 매뉴얼" - "General" - "User Management" - "Authentication" - - "Okta 연동하기" + - "LDAP 연동하기" "breadcrumbs_en": - "Administrator Manual" - "General" - "User Management" - "Authentication" - - "Integrating with Okta" + - "Integrating with LDAP" "path": - "administrator-manual" - "general" - "user-management" - "authentication" - - "integrating-with-okta" + - "integrating-with-ldap" - "page_id": "544376183" + "type": "page" "title": "AWS SSO 연동하기" "title_orig": "AWS SSO 연동하기" "breadcrumbs": @@ -1020,6 +1116,7 @@ - "authentication" - "integrating-with-aws-sso" - "page_id": "619381289" + "type": "page" "title": "Google SAML 연동하기" "title_orig": "Google SAML 연동하기" "breadcrumbs": @@ -1041,6 +1138,7 @@ - "authentication" - "integrating-with-google-saml" - "page_id": "793575425" + "type": "page" "title": "Multi-Factor Authentication 설정하기" "title_orig": "Multi-Factor Authentication 설정하기" "breadcrumbs": @@ -1062,6 +1160,7 @@ - "authentication" - "setting-up-multi-factor-authentication" - "page_id": "544376236" + "type": "page" "title": "Provisioning" "title_orig": "Provisioning" "breadcrumbs": @@ -1080,6 +1179,7 @@ - "user-management" - "provisioning" - "page_id": "544376265" + "type": "page" "title": "Provisioning 활성화 하기" "title_orig": "Provisioning 활성화 하기" "breadcrumbs": @@ -1101,6 +1201,7 @@ - "provisioning" - "activating-provisioning" - "page_id": "544376394" + "type": "page" "title": "[Okta] 프로비저닝 연동 가이드" "title_orig": "[Okta] 프로비저닝 연동 가이드" "breadcrumbs": @@ -1122,6 +1223,7 @@ - "provisioning" - "okta-provisioning-integration-guide" - "page_id": "544178462" + "type": "page" "title": "Workflow Management" "title_orig": "Workflow Management" "breadcrumbs": @@ -1137,6 +1239,7 @@ - "general" - "workflow-management" - "page_id": "544047359" + "type": "page" "title": "All Requests" "title_orig": "All Requests" "breadcrumbs": @@ -1155,6 +1258,7 @@ - "workflow-management" - "all-requests" - "page_id": "544378513" + "type": "page" "title": "Approval Rules" "title_orig": "Approval Rules" "breadcrumbs": @@ -1173,6 +1277,7 @@ - "workflow-management" - "approval-rules" - "page_id": "561414376" + "type": "page" "title": "Workflow Configurations" "title_orig": "Workflow Configurations" "breadcrumbs": @@ -1191,6 +1296,7 @@ - "workflow-management" - "workflow-configurations" - "page_id": "544112865" + "type": "page" "title": "System" "title_orig": "System" "breadcrumbs": @@ -1206,6 +1312,7 @@ - "general" - "system" - "page_id": "544080097" + "type": "page" "title": "Integrations" "title_orig": "Integrations" "breadcrumbs": @@ -1224,6 +1331,7 @@ - "system" - "integrations" - "page_id": "544379393" + "type": "page" "title": "Syslog 연동" "title_orig": "Syslog 연동" "breadcrumbs": @@ -1245,6 +1353,7 @@ - "integrations" - "integrating-with-syslog" - "page_id": "557940795" + "type": "page" "title": "Splunk 연동" "title_orig": "Splunk 연동" "breadcrumbs": @@ -1266,6 +1375,7 @@ - "integrations" - "integrating-with-splunk" - "page_id": "544379587" + "type": "page" "title": "Secret Store 연동" "title_orig": "Secret Store 연동" "breadcrumbs": @@ -1287,6 +1397,7 @@ - "integrations" - "integrating-with-secret-store" - "page_id": "798064641" + "type": "page" "title": "Email 연동" "title_orig": "Email 연동" "breadcrumbs": @@ -1308,6 +1419,7 @@ - "integrations" - "integrating-with-email" - "page_id": "1267007528" + "type": "page" "title": "Event Callback 연동" "title_orig": "Event Callback 연동" "breadcrumbs": @@ -1329,6 +1441,7 @@ - "integrations" - "integrating-with-event-callback" - "page_id": "811401365" + "type": "page" "title": "OAuth 2.0을 사용하기 위한 Google Cloud API 연동" "title_orig": "OAuth 2.0을 사용하기 위한 Google Cloud API 연동" "breadcrumbs": @@ -1350,6 +1463,7 @@ - "integrations" - "integrating-google-cloud-api-for-oauth-20" - "page_id": "883654669" + "type": "page" "title": "Slack DM 연동" "title_orig": "Slack DM 연동" "breadcrumbs": @@ -1371,6 +1485,7 @@ - "integrations" - "integrating-with-slack-dm" - "page_id": "544378759" + "type": "page" "title": "Slack DM - Workflow 알림 유형" "title_orig": "Slack DM - Workflow 알림 유형" "breadcrumbs": @@ -1395,6 +1510,7 @@ - "integrating-with-slack-dm" - "slack-dm-workflow-notification-types" - "page_id": "1453588486" + "type": "page" "title": "OAuth Client Application" "title_orig": "OAuth Client Application" "breadcrumbs": @@ -1416,6 +1532,7 @@ - "integrations" - "oauth-client-application" - "page_id": "1454342158" + "type": "page" "title": "Identity Providers" "title_orig": "Identity Providers" "breadcrumbs": @@ -1437,6 +1554,7 @@ - "integrations" - "identity-providers" - "page_id": "1495433217" + "type": "page" "title": "AWS SSO 연동하기 (SAML 2.0)" "title_orig": "AWS SSO 연동하기 (SAML 2.0)" "breadcrumbs": @@ -1461,6 +1579,7 @@ - "identity-providers" - "integrating-with-aws-sso-saml-20" - "page_id": "2166784044" + "type": "page" "title": "LLM Provider 설정" "title_orig": "LLM Provider 설정" "breadcrumbs": @@ -1482,6 +1601,7 @@ - "integrations" - "llm-provider-configuration" - "page_id": "544377652" + "type": "page" "title": "API Token" "title_orig": "API Token" "breadcrumbs": @@ -1500,6 +1620,7 @@ - "system" - "api-token" - "page_id": "544211220" + "type": "page" "title": "Jobs" "title_orig": "Jobs" "breadcrumbs": @@ -1518,6 +1639,7 @@ - "system" - "jobs" - "page_id": "1456144391" + "type": "page" "title": "Maintenance" "title_orig": "Maintenance" "breadcrumbs": @@ -1536,6 +1658,7 @@ - "system" - "maintenance" - "page_id": "544379638" + "type": "page" "title": "Databases" "title_orig": "Databases" "breadcrumbs": @@ -1548,6 +1671,7 @@ - "administrator-manual" - "databases" - "page_id": "956071939" + "type": "page" "title": "DAC General Configurations" "title_orig": "DAC General Configurations" "breadcrumbs": @@ -1563,6 +1687,7 @@ - "databases" - "dac-general-configurations" - "page_id": "921436219" + "type": "page" "title": "Unmasking Zones" "title_orig": "Unmasking Zones" "breadcrumbs": @@ -1581,6 +1706,7 @@ - "dac-general-configurations" - "unmasking-zones" - "page_id": "1275396097" + "type": "page" "title": "Masking Pattern (메뉴 위치 이동)" "title_orig": "Masking Pattern (메뉴 위치 이동)" "breadcrumbs": @@ -1599,6 +1725,7 @@ - "dac-general-configurations" - "masking-pattern-menu-relocated" - "page_id": "544379705" + "type": "page" "title": "Connection Management" "title_orig": "Connection Management" "breadcrumbs": @@ -1614,6 +1741,7 @@ - "databases" - "connection-management" - "page_id": "544145672" + "type": "page" "title": "Cloud Providers" "title_orig": "Cloud Providers" "breadcrumbs": @@ -1632,6 +1760,7 @@ - "connection-management" - "cloud-providers" - "page_id": "544379719" + "type": "page" "title": "AWS에서 DB 리소스 동기화" "title_orig": "AWS에서 DB 리소스 동기화" "breadcrumbs": @@ -1653,6 +1782,7 @@ - "cloud-providers" - "synchronizing-db-resources-from-aws" - "page_id": "562167871" + "type": "page" "title": "MS Azure에서 DB 리소스 동기화" "title_orig": "MS Azure에서 DB 리소스 동기화" "breadcrumbs": @@ -1674,6 +1804,7 @@ - "cloud-providers" - "synchronizing-db-resources-from-ms-azure" - "page_id": "562167809" + "type": "page" "title": "Google Cloud에서 DB 리소스 동기화" "title_orig": "Google Cloud에서 DB 리소스 동기화" "breadcrumbs": @@ -1695,6 +1826,7 @@ - "cloud-providers" - "synchronizing-db-resources-from-google-cloud" - "page_id": "712507393" + "type": "page" "title": "Dry Run 기능으로 클라우드 동기화 설정 확인하기" "title_orig": "Dry Run 기능으로 클라우드 동기화 설정 확인하기" "breadcrumbs": @@ -1716,6 +1848,7 @@ - "cloud-providers" - "verifying-cloud-synchronization-settings-with-dry-run-feature" - "page_id": "544014712" + "type": "page" "title": "DB Connections" "title_orig": "DB Connections" "breadcrumbs": @@ -1734,6 +1867,7 @@ - "connection-management" - "db-connections" - "page_id": "544380381" + "type": "page" "title": "MongoDB 전용 가이드" "title_orig": "MongoDB 전용 가이드" "breadcrumbs": @@ -1755,6 +1889,7 @@ - "db-connections" - "mongodb-specific-guide" - "page_id": "568852692" + "type": "page" "title": "DocumentDB 전용 가이드" "title_orig": "DocumentDB 전용 가이드" "breadcrumbs": @@ -1776,6 +1911,7 @@ - "db-connections" - "documentdb-specific-guide" - "page_id": "811434142" + "type": "page" "title": "Google BigQuery OAuth 인증 설정" "title_orig": "Google BigQuery OAuth 인증 설정" "breadcrumbs": @@ -1797,6 +1933,7 @@ - "db-connections" - "google-bigquery-oauth-authentication-configuration" - "page_id": "820806182" + "type": "page" "title": "AWS Athena 전용 가이드" "title_orig": "AWS Athena 전용 가이드" "breadcrumbs": @@ -1818,6 +1955,7 @@ - "db-connections" - "aws-athena-specific-guide" - "page_id": "880082945" + "type": "page" "title": "Custom Data Source 설정 및 로그 확인" "title_orig": "Custom Data Source 설정 및 로그 확인" "breadcrumbs": @@ -1839,6 +1977,7 @@ - "db-connections" - "custom-data-source-configuration-and-log-verification" - "page_id": "544145691" + "type": "page" "title": "SSL Configurations" "title_orig": "SSL Configurations" "breadcrumbs": @@ -1857,6 +1996,7 @@ - "connection-management" - "ssl-configurations" - "page_id": "544047436" + "type": "page" "title": "SSH Configurations" "title_orig": "SSH Configurations" "breadcrumbs": @@ -1875,6 +2015,7 @@ - "connection-management" - "ssh-configurations" - "page_id": "544112932" + "type": "page" "title": "Kerberos Configurations" "title_orig": "Kerberos Configurations" "breadcrumbs": @@ -1893,6 +2034,7 @@ - "connection-management" - "kerberos-configurations" - "page_id": "2010153049" + "type": "page" "title": "Custom JDBC Configs" "title_orig": "Custom JDBC Configs" "breadcrumbs": @@ -1911,6 +2053,7 @@ - "connection-management" - "custom-jdbc-configs" - "page_id": "2010120237" + "type": "page" "title": "QSI Parser Selection" "title_orig": "QSI Parser Selection" "breadcrumbs": @@ -1932,6 +2075,7 @@ - "custom-jdbc-configs" - "qsi-parser-selection" - "page_id": "2010153057" + "type": "page" "title": "Custom JDBC Configs - Databricks 예시" "title_orig": "Custom JDBC Configs - Databricks 예시" "breadcrumbs": @@ -1953,6 +2097,7 @@ - "custom-jdbc-configs" - "custom-jdbc-configs-databricks-example" - "page_id": "544380126" + "type": "page" "title": "DB Access Control" "title_orig": "DB Access Control​" "breadcrumbs": @@ -1968,6 +2113,7 @@ - "databases" - "db-access-control" - "page_id": "544380140" + "type": "page" "title": "Privilege Type" "title_orig": "Privilege Type" "breadcrumbs": @@ -1985,7 +2131,30 @@ - "databases" - "db-access-control" - "privilege-type" +- "page_id": "2288549894" + "type": "page" + "title": "MongoDB / Document DB 의 Privilege Type Mapping" + "title_orig": "MongoDB / Document DB 의 Privilege Type Mapping" + "breadcrumbs": + - "관리자 매뉴얼" + - "Databases" + - "DB Access Control" + - "Privilege Type" + - "MongoDB / Document DB 의 Privilege Type Mapping" + "breadcrumbs_en": + - "Administrator Manual" + - "Databases" + - "DB Access Control" + - "Privilege Type" + - "MongoDB / Document DB Privilege Type Mapping" + "path": + - "administrator-manual" + - "databases" + - "db-access-control" + - "privilege-type" + - "mongodb-document-db-privilege-type-mapping" - "page_id": "544380173" + "type": "page" "title": "Access Control" "title_orig": "Access Control" "breadcrumbs": @@ -2004,6 +2173,7 @@ - "db-access-control" - "access-control" - "page_id": "544379868" + "type": "page" "title": "Policies" "title_orig": "Policies" "breadcrumbs": @@ -2019,6 +2189,7 @@ - "databases" - "policies" - "page_id": "544379937" + "type": "page" "title": "Data Access" "title_orig": "Data Access" "breadcrumbs": @@ -2037,6 +2208,7 @@ - "policies" - "data-access" - "page_id": "569376769" + "type": "page" "title": "Masking Pattern" "title_orig": "Masking Pattern" "breadcrumbs": @@ -2055,6 +2227,7 @@ - "policies" - "masking-pattern" - "page_id": "544379882" + "type": "page" "title": "Data Masking" "title_orig": "Data Masking" "breadcrumbs": @@ -2073,6 +2246,7 @@ - "policies" - "data-masking" - "page_id": "544379993" + "type": "page" "title": "Sensitive Data" "title_orig": "Sensitive Data" "breadcrumbs": @@ -2091,6 +2265,7 @@ - "policies" - "sensitive-data" - "page_id": "713129986" + "type": "page" "title": "Policy Exception" "title_orig": "Policy Exception" "breadcrumbs": @@ -2109,6 +2284,7 @@ - "policies" - "policy-exception" - "page_id": "2010153040" + "type": "page" "title": "Query Rules" "title_orig": "Query Rules" "breadcrumbs": @@ -2127,6 +2303,7 @@ - "policies" - "query-rules" - "page_id": "571277577" + "type": "page" "title": "Ledger Management" "title_orig": "Ledger Management" "breadcrumbs": @@ -2142,6 +2319,7 @@ - "databases" - "ledger-management" - "page_id": "544380061" + "type": "page" "title": "Ledger Table Policy" "title_orig": "Ledger Table Policy" "breadcrumbs": @@ -2160,6 +2338,7 @@ - "ledger-management" - "ledger-table-policy" - "page_id": "571277650" + "type": "page" "title": "Ledger Approval Rules" "title_orig": "Ledger Approval Rules" "breadcrumbs": @@ -2178,6 +2357,7 @@ - "ledger-management" - "ledger-approval-rules" - "page_id": "873136365" + "type": "page" "title": "(New) Policy Management" "title_orig": "(New) Policy Management" "breadcrumbs": @@ -2193,6 +2373,7 @@ - "databases" - "new-policy-management" - "page_id": "878805502" + "type": "page" "title": "Data Paths" "title_orig": "Data Paths" "breadcrumbs": @@ -2211,6 +2392,7 @@ - "new-policy-management" - "data-paths" - "page_id": "879198569" + "type": "page" "title": "Data Policies" "title_orig": "Data Policies" "breadcrumbs": @@ -2229,6 +2411,7 @@ - "new-policy-management" - "data-policies" - "page_id": "1064796485" + "type": "page" "title": "Exception Management" "title_orig": "Exception Management" "breadcrumbs": @@ -2247,6 +2430,7 @@ - "new-policy-management" - "exception-management" - "page_id": "954139156" + "type": "page" "title": "Monitoring" "title_orig": "Monitoring" "breadcrumbs": @@ -2262,6 +2446,7 @@ - "databases" - "monitoring" - "page_id": "954172219" + "type": "page" "title": "Running Queries" "title_orig": "Running Queries‎" "breadcrumbs": @@ -2280,6 +2465,7 @@ - "monitoring" - "running-queries" - "page_id": "954204974" + "type": "page" "title": "Proxy Management" "title_orig": "Proxy Management​" "breadcrumbs": @@ -2298,6 +2484,7 @@ - "monitoring" - "proxy-management" - "page_id": "544380588" + "type": "page" "title": "Servers" "title_orig": "Servers" "breadcrumbs": @@ -2310,6 +2497,7 @@ - "administrator-manual" - "servers" - "page_id": "954336174" + "type": "page" "title": "SAC General Configurations" "title_orig": "SAC General Configurations" "breadcrumbs": @@ -2325,6 +2513,7 @@ - "servers" - "sac-general-configurations" - "page_id": "544380635" + "type": "page" "title": "Connection Management" "title_orig": "Connection Management​" "breadcrumbs": @@ -2340,6 +2529,7 @@ - "servers" - "connection-management" - "page_id": "544178567" + "type": "page" "title": "Cloud Providers" "title_orig": "Cloud Providers​​" "breadcrumbs": @@ -2358,6 +2548,7 @@ - "connection-management" - "cloud-providers" - "page_id": "544380650" + "type": "page" "title": "AWS에서 서버 리소스 동기화" "title_orig": "AWS에서 서버 리소스 동기화" "breadcrumbs": @@ -2379,6 +2570,7 @@ - "cloud-providers" - "synchronizing-server-resources-from-aws" - "page_id": "544380741" + "type": "page" "title": "Azure에서 서버 리소스 동기화" "title_orig": "Azure에서 서버 리소스 동기화" "breadcrumbs": @@ -2400,6 +2592,7 @@ - "cloud-providers" - "synchronizing-server-resources-from-azure" - "page_id": "544380708" + "type": "page" "title": "GCP에서 서버 리소스 동기화" "title_orig": "GCP에서 서버 리소스 동기화" "breadcrumbs": @@ -2421,6 +2614,7 @@ - "cloud-providers" - "synchronizing-server-resources-from-gcp" - "page_id": "544211361" + "type": "page" "title": "Servers" "title_orig": "Servers​" "breadcrumbs": @@ -2439,6 +2633,7 @@ - "connection-management" - "servers" - "page_id": "544380774" + "type": "page" "title": "수동으로 개별 서버 등록하기" "title_orig": "수동으로 개별 서버 등록하기" "breadcrumbs": @@ -2460,6 +2655,7 @@ - "servers" - "manually-registering-individual-servers" - "page_id": "544080186" + "type": "page" "title": "Server Groups" "title_orig": "Server Groups" "breadcrumbs": @@ -2478,6 +2674,7 @@ - "connection-management" - "server-groups" - "page_id": "544380846" + "type": "page" "title": "서버를 그룹으로 관리하기" "title_orig": "서버를 그룹으로 관리하기" "breadcrumbs": @@ -2499,6 +2696,7 @@ - "server-groups" - "managing-servers-as-groups" - "page_id": "544211376" + "type": "page" "title": "Server Agents for RDP" "title_orig": "Server Agents for RDP" "breadcrumbs": @@ -2517,6 +2715,7 @@ - "connection-management" - "server-agents-for-rdp" - "page_id": "565575990" + "type": "page" "title": "Server Agent 설치 및 제거하기" "title_orig": "Server Agent 설치 및 제거하기" "breadcrumbs": @@ -2538,6 +2737,7 @@ - "server-agents-for-rdp" - "installing-and-removing-server-agent" - "page_id": "615710737" + "type": "page" "title": "ProxyJump Configurations" "title_orig": "ProxyJump Configurations" "breadcrumbs": @@ -2556,6 +2756,7 @@ - "connection-management" - "proxyjump-configurations" - "page_id": "615743551" + "type": "page" "title": "ProxyJump 생성하기" "title_orig": "ProxyJump 생성하기" "breadcrumbs": @@ -2577,6 +2778,7 @@ - "proxyjump-configurations" - "creating-proxyjump" - "page_id": "613777446" + "type": "page" "title": "Server Account Management" "title_orig": "Server Account Management" "breadcrumbs": @@ -2592,6 +2794,7 @@ - "servers" - "server-account-management" - "page_id": "544380991" + "type": "page" "title": "Server Account Templates" "title_orig": "Server Account Templates" "breadcrumbs": @@ -2610,6 +2813,7 @@ - "server-account-management" - "server-account-templates" - "page_id": "544380960" + "type": "page" "title": "SSH Key Configurations" "title_orig": "SSH Key Configurations" "breadcrumbs": @@ -2628,6 +2832,7 @@ - "server-account-management" - "ssh-key-configurations" - "page_id": "615743501" + "type": "page" "title": "Account Management" "title_orig": "Account Management" "breadcrumbs": @@ -2646,6 +2851,7 @@ - "server-account-management" - "account-management" - "page_id": "615677962" + "type": "page" "title": "Password Provisioning" "title_orig": "Password Provisioning" "breadcrumbs": @@ -2664,6 +2870,7 @@ - "server-account-management" - "password-provisioning" - "page_id": "619380898" + "type": "page" "title": "패스워드 변경 Job 생성하기" "title_orig": "패스워드 변경 Job 생성하기" "breadcrumbs": @@ -2685,6 +2892,7 @@ - "password-provisioning" - "creating-password-change-job" - "page_id": "1760657435" + "type": "page" "title": "Session Monitoring" "title_orig": "Session Monitoring" "breadcrumbs": @@ -2700,6 +2908,7 @@ - "servers" - "session-monitoring" - "page_id": "543949216" + "type": "page" "title": "Server Access Control" "title_orig": "Server Access Control​" "breadcrumbs": @@ -2715,6 +2924,7 @@ - "servers" - "server-access-control" - "page_id": "544381186" + "type": "page" "title": "Access Control" "title_orig": "Access Control​​" "breadcrumbs": @@ -2733,6 +2943,7 @@ - "server-access-control" - "access-control" - "page_id": "544381282" + "type": "page" "title": "Permissions 부여 및 회수하기" "title_orig": "Permissions 부여 및 회수하기" "breadcrumbs": @@ -2754,6 +2965,7 @@ - "access-control" - "granting-and-revoking-permissions" - "page_id": "544381200" + "type": "page" "title": "Role 부여 및 회수하기" "title_orig": "Role 부여 및 회수하기" "breadcrumbs": @@ -2775,6 +2987,7 @@ - "access-control" - "granting-and-revoking-roles" - "page_id": "878838349" + "type": "page" "title": "Server Privilege 부여하기" "title_orig": "Server Privilege 부여하기" "breadcrumbs": @@ -2796,6 +3009,7 @@ - "access-control" - "granting-server-privilege" - "page_id": "544381150" + "type": "page" "title": "Roles" "title_orig": "Roles​" "breadcrumbs": @@ -2814,6 +3028,7 @@ - "server-access-control" - "roles" - "page_id": "544381025" + "type": "page" "title": "Policies" "title_orig": "Policies​" "breadcrumbs": @@ -2832,6 +3047,7 @@ - "server-access-control" - "policies" - "page_id": "544381039" + "type": "page" "title": "서버 접근 정책 설정하기" "title_orig": "서버 접근 정책 설정하기" "breadcrumbs": @@ -2853,6 +3069,7 @@ - "policies" - "setting-server-access-policy" - "page_id": "544377895" + "type": "page" "title": "Server Proxy 사용 활성화" "title_orig": "Server Proxy 사용 활성화" "breadcrumbs": @@ -2874,6 +3091,7 @@ - "policies" - "enabling-server-proxy" - "page_id": "544381118" + "type": "page" "title": "Command Templates" "title_orig": "Command Templates" "breadcrumbs": @@ -2892,6 +3110,7 @@ - "server-access-control" - "command-templates" - "page_id": "544244109" + "type": "page" "title": "Blocked Accounts" "title_orig": "Blocked Accounts" "breadcrumbs": @@ -2910,6 +3129,7 @@ - "server-access-control" - "blocked-accounts" - "page_id": "544381596" + "type": "page" "title": "Kubernetes" "title_orig": "Kubernetes" "breadcrumbs": @@ -2922,6 +3142,7 @@ - "administrator-manual" - "kubernetes" - "page_id": "954172232" + "type": "page" "title": "KAC General Configurations" "title_orig": "KAC General​​​​​ Configurations" "breadcrumbs": @@ -2937,6 +3158,7 @@ - "kubernetes" - "kac-general-configurations" - "page_id": "544381637" + "type": "page" "title": "Connection Management" "title_orig": "Connection Management​​" "breadcrumbs": @@ -2952,6 +3174,7 @@ - "kubernetes" - "connection-management" - "page_id": "544381651" + "type": "page" "title": "Cloud Providers" "title_orig": "Cloud Providers​" "breadcrumbs": @@ -2970,6 +3193,7 @@ - "connection-management" - "cloud-providers" - "page_id": "544381739" + "type": "page" "title": "AWS에서 쿠버네티스 리소스 동기화" "title_orig": "AWS에서 쿠버네티스 리소스 동기화" "breadcrumbs": @@ -2991,6 +3215,7 @@ - "cloud-providers" - "synchronizing-kubernetes-resources-from-aws" - "page_id": "544381839" + "type": "page" "title": "Clusters" "title_orig": "Clusters" "breadcrumbs": @@ -3009,6 +3234,7 @@ - "connection-management" - "clusters" - "page_id": "544381877" + "type": "page" "title": "수동으로 쿠버네티스 클러스터 등록하기" "title_orig": "수동으로 쿠버네티스 클러스터 등록하기" "breadcrumbs": @@ -3030,6 +3256,7 @@ - "clusters" - "manually-registering-kubernetes-clusters" - "page_id": "544383110" + "type": "page" "title": "K8s Access Control" "title_orig": "K8s Access Control" "breadcrumbs": @@ -3045,6 +3272,7 @@ - "kubernetes" - "k8s-access-control" - "page_id": "544383124" + "type": "page" "title": "Access Control" "title_orig": "Access Control​" "breadcrumbs": @@ -3063,6 +3291,7 @@ - "k8s-access-control" - "access-control" - "page_id": "544383381" + "type": "page" "title": "쿠버네티스 역할 부여 및 회수하기" "title_orig": "쿠버네티스 역할 부여 및 회수하기" "breadcrumbs": @@ -3084,6 +3313,7 @@ - "access-control" - "granting-and-revoking-kubernetes-roles" - "page_id": "544382741" + "type": "page" "title": "Roles" "title_orig": "Rolesㅤㅤㅤ" "breadcrumbs": @@ -3102,6 +3332,7 @@ - "k8s-access-control" - "roles" - "page_id": "544382963" + "type": "page" "title": "쿠버네티스 역할 설정하기" "title_orig": "쿠버네티스 역할 설정하기" "breadcrumbs": @@ -3123,6 +3354,7 @@ - "roles" - "setting-kubernetes-roles" - "page_id": "544382060" + "type": "page" "title": "Policies" "title_orig": "Policiesㅤㅤㅤ" "breadcrumbs": @@ -3141,6 +3373,7 @@ - "k8s-access-control" - "policies" - "page_id": "544382274" + "type": "page" "title": "쿠버네티스 정책 설정하기" "title_orig": "쿠버네티스 정책 설정하기" "breadcrumbs": @@ -3162,6 +3395,7 @@ - "policies" - "setting-kubernetes-policies" - "page_id": "544382364" + "type": "page" "title": "쿠버네티스 정책 YAML Code 문법 안내" "title_orig": "쿠버네티스 정책 YAML Code 문법 안내" "breadcrumbs": @@ -3183,6 +3417,7 @@ - "policies" - "kubernetes-policy-yaml-code-syntax-guide" - "page_id": "544382445" + "type": "page" "title": "쿠버네티스 정책 Tips 안내" "title_orig": "쿠버네티스 정책 Tips 안내" "breadcrumbs": @@ -3204,6 +3439,7 @@ - "policies" - "kubernetes-policy-tips-guide" - "page_id": "544382522" + "type": "page" "title": "쿠버네티스 정책 UI 코드 헬퍼 안내" "title_orig": "쿠버네티스 정책 UI 코드 헬퍼 안내" "breadcrumbs": @@ -3225,6 +3461,7 @@ - "policies" - "kubernetes-policy-ui-code-helper-guide" - "page_id": "544382659" + "type": "page" "title": "쿠버네티스 정책 Action 설정 참고 가이드" "title_orig": "쿠버네티스 정책 Action 설정 참고 가이드" "breadcrumbs": @@ -3246,6 +3483,7 @@ - "policies" - "kubernetes-policy-action-configuration-reference-guide" - "page_id": "783515900" + "type": "page" "title": "Web Apps" "title_orig": "Web Apps" "breadcrumbs": @@ -3258,6 +3496,7 @@ - "administrator-manual" - "web-apps" - "page_id": "1064829276" + "type": "page" "title": "Connection Management" "title_orig": "Connection Management‎‎" "breadcrumbs": @@ -3273,6 +3512,7 @@ - "web-apps" - "connection-management" - "page_id": "1070694423" + "type": "page" "title": "Web Apps" "title_orig": "Web Apps‎" "breadcrumbs": @@ -3291,6 +3531,7 @@ - "connection-management" - "web-apps" - "page_id": "1064829246" + "type": "page" "title": "Web App Configurations" "title_orig": "Web App Configurations" "breadcrumbs": @@ -3309,6 +3550,7 @@ - "connection-management" - "web-app-configurations" - "page_id": "1070596135" + "type": "page" "title": "Web App Access Control" "title_orig": "Web App Access Control" "breadcrumbs": @@ -3324,6 +3566,7 @@ - "web-apps" - "web-app-access-control" - "page_id": "1070628904" + "type": "page" "title": "Access Control" "title_orig": "Access Control‎‎‎‎‎‎‎" "breadcrumbs": @@ -3342,6 +3585,7 @@ - "web-app-access-control" - "access-control" - "page_id": "1064599910" + "type": "page" "title": "Role 부여 및 회수하기" "title_orig": "Role 부여 및 회수하기‎‎‎" "breadcrumbs": @@ -3363,6 +3607,7 @@ - "access-control" - "granting-and-revoking-roles" - "page_id": "1070628923" + "type": "page" "title": "Roles" "title_orig": "Roles‎‎‎" "breadcrumbs": @@ -3381,6 +3626,7 @@ - "web-app-access-control" - "roles" - "page_id": "1064829343" + "type": "page" "title": "Policies" "title_orig": "Policies‎‎‎‎‎" "breadcrumbs": @@ -3399,6 +3645,7 @@ - "web-app-access-control" - "policies" - "page_id": "783417593" + "type": "page" "title": "WAC Quickstart" "title_orig": "WAC Quickstart" "breadcrumbs": @@ -3414,6 +3661,7 @@ - "web-apps" - "wac-quickstart" - "page_id": "783745324" + "type": "page" "title": "[~10.2.7] WAC Role & Policy Guide" "title_orig": "[~10.2.7] WAC Role & Policy Guide" "breadcrumbs": @@ -3432,6 +3680,7 @@ - "wac-quickstart" - "1027-wac-role-policy-guide" - "page_id": "924287097" + "type": "page" "title": "[10.2.8~] WAC RBAC Guide" "title_orig": "[10.2.8~] WAC RBAC Guide" "breadcrumbs": @@ -3450,6 +3699,7 @@ - "wac-quickstart" - "1028-wac-rbac-guide" - "page_id": "956235931" + "type": "page" "title": "[10.3.0 ~] WAC JIT 권한 획득 Guide" "title_orig": "[10.3.0 ~] WAC JIT 권한 획득 Guide" "breadcrumbs": @@ -3468,6 +3718,7 @@ - "wac-quickstart" - "1030-wac-jit-permission-acquisition-guide" - "page_id": "805962425" + "type": "page" "title": "Root CA 인증서 설치 가이드" "title_orig": "Root CA 인증서 설치 가이드" "breadcrumbs": @@ -3486,6 +3737,7 @@ - "wac-quickstart" - "root-ca-certificate-installation-guide" - "page_id": "883654785" + "type": "page" "title": "Web App Configurations에서 WAC 초기 설정하기" "title_orig": "Web App Configurations에서 WAC 초기 설정하기" "breadcrumbs": @@ -3504,6 +3756,7 @@ - "wac-quickstart" - "initial-wac-setup-in-web-app-configurations" - "page_id": "924319936" + "type": "page" "title": "WAC 트러블슈팅 가이드" "title_orig": "WAC 트러블슈팅 가이드" "breadcrumbs": @@ -3522,6 +3775,7 @@ - "wac-quickstart" - "wac-troubleshooting-guide" - "page_id": "927629410" + "type": "page" "title": "WAC FAQ" "title_orig": "WAC FAQ" "breadcrumbs": @@ -3539,7 +3793,69 @@ - "web-apps" - "wac-quickstart" - "wac-faq" +- "page_id": "2167636017" + "type": "folder" + "title": "MCP Server" + "title_orig": "MCP Server" + "breadcrumbs": + - "관리자 매뉴얼" + - "MCP Server" + "breadcrumbs_en": + - "Administrator Manual" + - "MCP Server" + "path": + - "administrator-manual" + - "mcp-server" +- "page_id": "2167242794" + "type": "page" + "title": "MCP Server Connection Management" + "title_orig": "MCP Server Connection Management" + "breadcrumbs": + - "관리자 매뉴얼" + - "MCP Server" + - "MCP Server Connection Management" + "breadcrumbs_en": + - "Administrator Manual" + - "MCP Server" + - "MCP Server Connection Management" + "path": + - "administrator-manual" + - "mcp-server" + - "mcp-server-connection-management" +- "page_id": "2167144528" + "type": "page" + "title": "MAC General Configurations" + "title_orig": "MAC General Configurations" + "breadcrumbs": + - "관리자 매뉴얼" + - "MCP Server" + - "MAC General Configurations" + "breadcrumbs_en": + - "Administrator Manual" + - "MCP Server" + - "MAC General Configurations" + "path": + - "administrator-manual" + - "mcp-server" + - "mac-general-configurations" +- "page_id": "2167799919" + "type": "page" + "title": "MCP Access Control" + "title_orig": "MCP Access Control" + "breadcrumbs": + - "관리자 매뉴얼" + - "MCP Server" + - "MCP Access Control" + "breadcrumbs_en": + - "Administrator Manual" + - "MCP Server" + - "MCP Access Control" + "path": + - "administrator-manual" + - "mcp-server" + - "mcp-access-control" - "page_id": "544379062" + "type": "page" "title": "Audit" "title_orig": "Audit" "breadcrumbs": @@ -3552,6 +3868,7 @@ - "administrator-manual" - "audit" - "page_id": "693043522" + "type": "page" "title": "Reports" "title_orig": "Reportsㅤ" "breadcrumbs": @@ -3567,6 +3884,7 @@ - "audit" - "reports" - "page_id": "544384417" + "type": "page" "title": "Reports" "title_orig": "Reports" "breadcrumbs": @@ -3585,6 +3903,7 @@ - "reports" - "reports" - "page_id": "544379140" + "type": "page" "title": "Audit Log Export" "title_orig": "Audit Log Export" "breadcrumbs": @@ -3603,6 +3922,7 @@ - "reports" - "audit-log-export" - "page_id": "544211450" + "type": "page" "title": "General Logs" "title_orig": "General Logs" "breadcrumbs": @@ -3618,6 +3938,7 @@ - "audit" - "general-logs" - "page_id": "544080230" + "type": "page" "title": "User Access History" "title_orig": "User Access History" "breadcrumbs": @@ -3636,6 +3957,7 @@ - "general-logs" - "user-access-history" - "page_id": "544113108" + "type": "page" "title": "Activity Logs" "title_orig": "Activity Logs" "breadcrumbs": @@ -3654,6 +3976,7 @@ - "general-logs" - "activity-logs" - "page_id": "544047557" + "type": "page" "title": "Admin Role History" "title_orig": "Admin Role History" "breadcrumbs": @@ -3672,6 +3995,7 @@ - "general-logs" - "admin-role-history" - "page_id": "705724442" + "type": "page" "title": "Workflow Logs" "title_orig": "Workflow Logs" "breadcrumbs": @@ -3690,6 +4014,7 @@ - "general-logs" - "workflow-logs" - "page_id": "775455036" + "type": "page" "title": "Reverse Tunnels" "title_orig": "Reverse Tunnels" "breadcrumbs": @@ -3708,6 +4033,7 @@ - "general-logs" - "reverse-tunnels" - "page_id": "811434216" + "type": "page" "title": "Reverse Tunnel을 통해 서버에 통신하기" "title_orig": "Reverse Tunnel을 통해 서버에 통신하기" "breadcrumbs": @@ -3729,6 +4055,7 @@ - "reverse-tunnels" - "communicating-with-servers-through-reverse-tunnel" - "page_id": "811466988" + "type": "page" "title": "Reverse Tunnel을 통해 클러스터에 통신하기" "title_orig": "Reverse Tunnel을 통해 클러스터에 통신하기" "breadcrumbs": @@ -3750,6 +4077,7 @@ - "reverse-tunnels" - "communicating-with-clusters-through-reverse-tunnel" - "page_id": "955318273" + "type": "page" "title": "Reverse Tunnel을 통해 DB에 통신하기" "title_orig": "Reverse Tunnel을 통해 DB에 통신하기" "breadcrumbs": @@ -3771,6 +4099,7 @@ - "reverse-tunnels" - "communicating-with-db-through-reverse-tunnel" - "page_id": "2167111691" + "type": "page" "title": "AI Chat Audit" "title_orig": "AI Chat Audit" "breadcrumbs": @@ -3789,6 +4118,7 @@ - "general-logs" - "ai-chat-audit" - "page_id": "544080248" + "type": "page" "title": "Database Logs" "title_orig": "Database Logs" "breadcrumbs": @@ -3804,6 +4134,7 @@ - "audit" - "database-logs" - "page_id": "544113141" + "type": "page" "title": "DB Access History" "title_orig": "DB Access History" "breadcrumbs": @@ -3822,6 +4153,7 @@ - "database-logs" - "db-access-history" - "page_id": "544244149" + "type": "page" "title": "Query Audit" "title_orig": "Query Audit" "breadcrumbs": @@ -3840,6 +4172,7 @@ - "database-logs" - "query-audit" - "page_id": "544145819" + "type": "page" "title": "Running Queries" "title_orig": "Running Queries" "breadcrumbs": @@ -3858,6 +4191,7 @@ - "database-logs" - "running-queries" - "page_id": "544244163" + "type": "page" "title": "DML Snapshots" "title_orig": "DML Snapshots" "breadcrumbs": @@ -3876,6 +4210,7 @@ - "database-logs" - "dml-snapshots" - "page_id": "544014894" + "type": "page" "title": "Account Lock History" "title_orig": "Account Lock History" "breadcrumbs": @@ -3894,6 +4229,7 @@ - "database-logs" - "account-lock-history" - "page_id": "544080264" + "type": "page" "title": "Access Control Logs" "title_orig": "Access Control Logs" "breadcrumbs": @@ -3912,6 +4248,7 @@ - "database-logs" - "access-control-logs" - "page_id": "1070694532" + "type": "page" "title": "Policy Audit Logs" "title_orig": "Policy Audit Logs" "breadcrumbs": @@ -3930,6 +4267,7 @@ - "database-logs" - "policy-audit-logs" - "page_id": "1164705793" + "type": "page" "title": "Policy Exception Logs" "title_orig": "Policy Exception Logs" "breadcrumbs": @@ -3948,6 +4286,7 @@ - "database-logs" - "policy-exception-logs" - "page_id": "544014907" + "type": "page" "title": "Server Logs" "title_orig": "Server Logs" "breadcrumbs": @@ -3963,6 +4302,7 @@ - "audit" - "server-logs" - "page_id": "544244182" + "type": "page" "title": "Server Access History" "title_orig": "Server Access History" "breadcrumbs": @@ -3981,6 +4321,7 @@ - "server-logs" - "server-access-history" - "page_id": "544244208" + "type": "page" "title": "Command Audit" "title_orig": "Command Audit" "breadcrumbs": @@ -3999,6 +4340,7 @@ - "server-logs" - "command-audit" - "page_id": "544014927" + "type": "page" "title": "Session Logs" "title_orig": "Session Logs" "breadcrumbs": @@ -4017,6 +4359,7 @@ - "server-logs" - "session-logs" - "page_id": "544014940" + "type": "page" "title": "Session Monitoring (Moved)" "title_orig": "Session Monitoring (Moved)" "breadcrumbs": @@ -4035,6 +4378,7 @@ - "server-logs" - "session-monitoring-moved" - "page_id": "544244234" + "type": "page" "title": "Access Control Logs" "title_orig": "Access Control Logs​ㅤ" "breadcrumbs": @@ -4053,6 +4397,7 @@ - "server-logs" - "access-control-logs" - "page_id": "544244244" + "type": "page" "title": "Server Role History" "title_orig": "Server Role History" "breadcrumbs": @@ -4071,6 +4416,7 @@ - "server-logs" - "server-role-history" - "page_id": "543949311" + "type": "page" "title": "Account Lock History" "title_orig": "Account Lock Historyㅤ" "breadcrumbs": @@ -4089,6 +4435,7 @@ - "server-logs" - "account-lock-history" - "page_id": "544383513" + "type": "page" "title": "Kubernetes Logs" "title_orig": "Kubernetes Logs" "breadcrumbs": @@ -4104,6 +4451,7 @@ - "audit" - "kubernetes-logs" - "page_id": "544383587" + "type": "page" "title": "Request Audit" "title_orig": "Request Auditㅤ" "breadcrumbs": @@ -4122,6 +4470,7 @@ - "kubernetes-logs" - "request-audit" - "page_id": "544383693" + "type": "page" "title": "Pod Session Recordings" "title_orig": "Pod Session Recordingsㅤ" "breadcrumbs": @@ -4140,6 +4489,7 @@ - "kubernetes-logs" - "pod-session-recordings" - "page_id": "544383799" + "type": "page" "title": "Kubernetes Role History" "title_orig": "Kubernetes Role Historyㅤ" "breadcrumbs": @@ -4158,6 +4508,7 @@ - "kubernetes-logs" - "kubernetes-role-history" - "page_id": "1064829366" + "type": "page" "title": "Web App Logs" "title_orig": "Web App Logs" "breadcrumbs": @@ -4173,6 +4524,7 @@ - "audit" - "web-app-logs" - "page_id": "1064829380" + "type": "page" "title": "Web Access History" "title_orig": "Web Access History" "breadcrumbs": @@ -4191,6 +4543,7 @@ - "web-app-logs" - "web-access-history" - "page_id": "1070563457" + "type": "page" "title": "Web Event Audit" "title_orig": "Web Event Audit" "breadcrumbs": @@ -4209,6 +4562,7 @@ - "web-app-logs" - "web-event-audit" - "page_id": "1070694561" + "type": "page" "title": "User Activity Recordings" "title_orig": "User Activity Recordings" "breadcrumbs": @@ -4227,6 +4581,7 @@ - "web-app-logs" - "user-activity-recordings" - "page_id": "1070563469" + "type": "page" "title": "Web App Role History" "title_orig": "Web App Role History" "breadcrumbs": @@ -4245,6 +4600,7 @@ - "web-app-logs" - "web-app-role-history" - "page_id": "1070694552" + "type": "page" "title": "JIT Access Control Logs" "title_orig": "JIT Access Control Logs" "breadcrumbs": @@ -4262,7 +4618,62 @@ - "audit" - "web-app-logs" - "jit-access-control-logs" +- "page_id": "2167472160" + "type": "folder" + "title": "MCP" + "title_orig": "MCP" + "breadcrumbs": + - "관리자 매뉴얼" + - "Audit" + - "MCP" + "breadcrumbs_en": + - "Administrator Manual" + - "Audit" + - "MCP" + "path": + - "administrator-manual" + - "audit" + - "mcp" +- "page_id": "2167308318" + "type": "page" + "title": "Request Audit" + "title_orig": "Request Audit" + "breadcrumbs": + - "관리자 매뉴얼" + - "Audit" + - "MCP" + - "Request Audit" + "breadcrumbs_en": + - "Administrator Manual" + - "Audit" + - "MCP" + - "Request Audit" + "path": + - "administrator-manual" + - "audit" + - "mcp" + - "request-audit" +- "page_id": "2167078929" + "type": "page" + "title": "MCP Server Role History" + "title_orig": "MCP Server Role History" + "breadcrumbs": + - "관리자 매뉴얼" + - "Audit" + - "MCP" + - "MCP Server Role History" + "breadcrumbs_en": + - "Administrator Manual" + - "Audit" + - "MCP" + - "MCP Server Role History" + "path": + - "administrator-manual" + - "audit" + - "mcp" + - "mcp-server-role-history" - "page_id": "851280543" + "type": "page" "title": "Multi Agent 제약사항" "title_orig": "Multi Agent 제약사항" "breadcrumbs": @@ -4275,6 +4686,7 @@ - "administrator-manual" - "multi-agent-limitations" - "page_id": "544375335" + "type": "page" "title": "Release Notes" "title_orig": "Release Notes" "breadcrumbs": @@ -4284,6 +4696,7 @@ "path": - "release-notes" - "page_id": "1924891357" + "type": "page" "title": "11.6.0 ~ 11.6.5" "title_orig": "11.6.0 ~ 11.6.5" "breadcrumbs": @@ -4296,6 +4709,7 @@ - "release-notes" - "11.6.0-11.6.5" - "page_id": "1751810049" + "type": "page" "title": "11.5.0 ~ 11.5.7" "title_orig": "11.5.0 ~ 11.5.7" "breadcrumbs": @@ -4308,6 +4722,7 @@ - "release-notes" - "11.5.0-11.5.7" - "page_id": "1568735233" + "type": "page" "title": "11.4.0" "title_orig": "11.4.0" "breadcrumbs": @@ -4320,6 +4735,7 @@ - "release-notes" - "11.4.0" - "page_id": "1421475841" + "type": "page" "title": "11.3.0" "title_orig": "11.3.0" "breadcrumbs": @@ -4332,6 +4748,7 @@ - "release-notes" - "11.3.0" - "page_id": "1291878563" + "type": "page" "title": "11.2.0" "title_orig": "11.2.0" "breadcrumbs": @@ -4344,6 +4761,7 @@ - "release-notes" - "11.2.0" - "page_id": "1171488777" + "type": "page" "title": "11.1.0 ~ 11.1.2" "title_orig": "11.1.0 ~ 11.1.2" "breadcrumbs": @@ -4356,6 +4774,7 @@ - "release-notes" - "11.1.0-11.1.2" - "page_id": "1064830173" + "type": "page" "title": "11.0.0" "title_orig": "11.0.0" "breadcrumbs": @@ -4368,6 +4787,7 @@ - "release-notes" - "11.0.0" - "page_id": "954335909" + "type": "page" "title": "10.3.0 ~ 10.3.4" "title_orig": "10.3.0 ~ 10.3.4" "breadcrumbs": @@ -4380,6 +4800,7 @@ - "release-notes" - "10.3.0-10.3.4" - "page_id": "703463517" + "type": "page" "title": "10.2.0 ~ 10.2.12" "title_orig": "10.2.0 ~ 10.2.12" "breadcrumbs": @@ -4392,6 +4813,7 @@ - "release-notes" - "10.2.0-10.2.12" - "page_id": "604995641" + "type": "page" "title": "10.1.0 ~ 10.1.11" "title_orig": "10.1.0 ~ 10.1.11" "breadcrumbs": @@ -4404,6 +4826,7 @@ - "release-notes" - "10.1.0-10.1.11" - "page_id": "544375355" + "type": "page" "title": "10.0.0 ~ 10.0.2" "title_orig": "10.0.0 ~ 10.0.2" "breadcrumbs": @@ -4416,6 +4839,7 @@ - "release-notes" - "10.0.0-10.0.2" - "page_id": "544375370" + "type": "page" "title": "9.20.0 ~ 9.20.2" "title_orig": "9.20.0 ​~ 9.20.2" "breadcrumbs": @@ -4428,6 +4852,7 @@ - "release-notes" - "9.20.0-9.20.2" - "page_id": "544375385" + "type": "page" "title": "9.19.0 " "title_orig": "9.19.0 ​" "breadcrumbs": @@ -4440,6 +4865,7 @@ - "release-notes" - "9.19.0" - "page_id": "544375399" + "type": "page" "title": "9.18.0 ~ 9.18.3" "title_orig": "9.18.0 ~ 9.18.3" "breadcrumbs": @@ -4452,6 +4878,7 @@ - "release-notes" - "9.18.0-9.18.3" - "page_id": "544375414" + "type": "page" "title": "9.17.0 ~ 9.17.1" "title_orig": "9.17.0 ~ 9.17.1" "breadcrumbs": @@ -4464,6 +4891,7 @@ - "release-notes" - "9.17.0-9.17.1" - "page_id": "544375429" + "type": "page" "title": "9.16.0 ~ 9.16.4" "title_orig": "9.16.0 ~ 9.16.4" "breadcrumbs": @@ -4476,6 +4904,7 @@ - "release-notes" - "9.16.0-9.16.4" - "page_id": "544375443" + "type": "page" "title": "9.15.0 ~ 9.15.4" "title_orig": "9.15.0 ~ 9.15.4" "breadcrumbs": @@ -4488,6 +4917,7 @@ - "release-notes" - "9.15.0-9.15.4" - "page_id": "544375457" + "type": "page" "title": "9.14.0 ~ 9.14.3" "title_orig": "9.14.0 ~ 9.14.3" "breadcrumbs": @@ -4500,6 +4930,7 @@ - "release-notes" - "9.14.0-9.14.3" - "page_id": "544375471" + "type": "page" "title": "9.13.0 ~ 9.13.5" "title_orig": "9.13.0 ~ 9.13.5" "breadcrumbs": @@ -4512,6 +4943,7 @@ - "release-notes" - "9.13.0-9.13.5" - "page_id": "544375485" + "type": "page" "title": "9.12.0 ~ 9.12.14" "title_orig": "9.12.0 ~ 9.12.14" "breadcrumbs": @@ -4524,6 +4956,7 @@ - "release-notes" - "9.12.0-9.12.14" - "page_id": "544375505" + "type": "page" "title": "메뉴 개선 가이드 (9.12.0)" "title_orig": "메뉴 개선 가이드 (9.12.0)" "breadcrumbs": @@ -4539,6 +4972,7 @@ - "9.12.0-9.12.14" - "menu-improvement-guide-9120" - "page_id": "544375587" + "type": "page" "title": "9.11.0 ~ 9.11.5" "title_orig": "9.11.0 ~ 9.11.5" "breadcrumbs": @@ -4551,6 +4985,7 @@ - "release-notes" - "9.11.0-9.11.5" - "page_id": "544375607" + "type": "page" "title": "9.10.0 ~ 9.10.4" "title_orig": "9.10.0 ~ 9.10.4" "breadcrumbs": @@ -4563,6 +4998,7 @@ - "release-notes" - "9.10.0-9.10.4" - "page_id": "544375624" + "type": "page" "title": "External API 변경사항 (9.10.0 버전)" "title_orig": "External API 변경사항 (9.10.0 버전)" "breadcrumbs": @@ -4578,6 +5014,7 @@ - "9.10.0-9.10.4" - "external-api-changes-9100-version" - "page_id": "544375659" + "type": "page" "title": "9.9.0 ~ 9.9.8" "title_orig": "9.9.0 ~ 9.9.8" "breadcrumbs": @@ -4590,6 +5027,7 @@ - "release-notes" - "9.9.0-9.9.8" - "page_id": "544375685" + "type": "page" "title": "External API 변경사항 (9.8.10 버전 > 9.9.4 버전)" "title_orig": "External API 변경사항 (9.8.10 버전 > 9.9.4 버전)" "breadcrumbs": @@ -4605,6 +5043,7 @@ - "9.9.0-9.9.8" - "external-api-changes-9810-version-994-version" - "page_id": "544375741" + "type": "page" "title": "External API 변경사항 (9.9.4 버전 > 9.9.5 버전)" "title_orig": "External API 변경사항 (9.9.4 버전 > 9.9.5 버전)" "breadcrumbs": @@ -4620,6 +5059,7 @@ - "9.9.0-9.9.8" - "external-api-changes-994-version-995-version" - "page_id": "544375768" + "type": "page" "title": "9.8.0 ~ 9.8.12" "title_orig": "9.8.0 ~ 9.8.12" "breadcrumbs": @@ -4632,6 +5072,7 @@ - "release-notes" - "9.8.0-9.8.12" - "page_id": "544375808" + "type": "page" "title": "제품 설치" "title_orig": "제품 설치" "breadcrumbs": @@ -4641,6 +5082,7 @@ "path": - "installation" - "page_id": "1881243653" + "type": "page" "title": "제품 버전" "title_orig": "제품 버전" "breadcrumbs": @@ -4653,6 +5095,7 @@ - "installation" - "product-versions" - "page_id": "862126081" + "type": "page" "title": "설치 전 준비사항" "title_orig": "설치 전 준비사항" "breadcrumbs": @@ -4665,6 +5108,7 @@ - "installation" - "prerequisites" - "page_id": "1298530305" + "type": "page" "title": "리눅스 배포본과 Docker, Podman 지원 현황" "title_orig": "리눅스 배포본과 Docker, Podman 지원 현황" "breadcrumbs": @@ -4680,6 +5124,7 @@ - "prerequisites" - "linux-distribution-and-docker-podman-support-status" - "page_id": "1297383451" + "type": "page" "title": "Podman 으로 Rootless Mode 구성하기" "title_orig": "Podman 으로 Rootless Mode 구성하기" "breadcrumbs": @@ -4695,6 +5140,7 @@ - "prerequisites" - "configuring-rootless-mode-with-podman" - "page_id": "1689387010" + "type": "page" "title": "설치하기" "title_orig": "설치하기" "breadcrumbs": @@ -4707,6 +5153,7 @@ - "installation" - "installation" - "page_id": "964952065" + "type": "page" "title": "설치 가이드 - 간단한 구성" "title_orig": "설치 가이드 - 간단한 구성" "breadcrumbs": @@ -4722,6 +5169,7 @@ - "installation" - "installation-guide-simple-configuration" - "page_id": "1177321474" + "type": "page" "title": "설치 가이드 - setup.v2.sh" "title_orig": "설치 가이드 - setup.v2.sh" "breadcrumbs": @@ -4737,6 +5185,7 @@ - "installation" - "installation-guide-setupv2sh" - "page_id": "1261895760" + "type": "page" "title": "setup.sh, setup.v2.sh 비교" "title_orig": "setup.sh, setup.v2.sh 비교" "breadcrumbs": @@ -4752,6 +5201,7 @@ - "installation" - "comparison-of-setupsh-and-setupv2sh" - "page_id": "815235967" + "type": "page" "title": "AWS EKS 환경에서 설치하기" "title_orig": "AWS EKS 환경에서 설치하기" "breadcrumbs": @@ -4767,6 +5217,7 @@ - "installation" - "installing-on-aws-eks" - "page_id": "1907294209" + "type": "page" "title": "설치 후 초기 설정" "title_orig": "설치 후 초기 설정" "breadcrumbs": @@ -4779,6 +5230,7 @@ - "installation" - "post-installation-setup" - "page_id": "862093313" + "type": "page" "title": "시스템 아키텍처와 네트워크 접근제어" "title_orig": "시스템 아키텍처와 네트워크 접근제어" "breadcrumbs": @@ -4791,6 +5243,7 @@ - "installation" - "system-architecture-and-network-access-control" - "page_id": "954761289" + "type": "page" "title": "컨테이너 환경변수" "title_orig": "컨테이너 환경변수" "breadcrumbs": @@ -4803,6 +5256,7 @@ - "installation" - "container-environment-variables" - "page_id": "876937310" + "type": "page" "title": "QUERYPIE_WEB_URL" "title_orig": "QUERYPIE_WEB_URL" "breadcrumbs": @@ -4818,6 +5272,7 @@ - "container-environment-variables" - "querypieweburl" - "page_id": "938016931" + "type": "page" "title": "DB_MAX_CONNECTION_SIZE 최적화" "title_orig": "DB_MAX_CONNECTION_SIZE 최적화" "breadcrumbs": @@ -4833,6 +5288,7 @@ - "container-environment-variables" - "optimizing-dbmaxconnectionsize" - "page_id": "912326893" + "type": "page" "title": "라이선스 설치" "title_orig": "라이선스 설치" "breadcrumbs": @@ -4845,6 +5301,7 @@ - "installation" - "license-installation" - "page_id": "1690402874" + "type": "page" "title": "서버구성 요구사항" "title_orig": "서버구성 요구사항" "breadcrumbs": @@ -4857,6 +5314,7 @@ - "installation" - "server-configuration-requirements" - "page_id": "903086124" + "type": "page" "title": "Public Cloud 운영서버 요구사항" "title_orig": "Public Cloud 운영서버 요구사항" "breadcrumbs": @@ -4872,6 +5330,7 @@ - "server-configuration-requirements" - "public-cloud-production-server-requirements" - "page_id": "1688371232" + "type": "page" "title": "On-Premise VM 요구사항" "title_orig": "On-Premise VM 요구사항" "breadcrumbs": @@ -4887,6 +5346,7 @@ - "server-configuration-requirements" - "on-premise-vm-requirements" - "page_id": "1692303361" + "type": "page" "title": "서버구성 요구사항 요약표" "title_orig": "서버구성 요구사항 요약표" "breadcrumbs": @@ -4902,6 +5362,7 @@ - "server-configuration-requirements" - "server-configuration-requirements-summary" - "page_id": "1239416833" + "type": "page" "title": "QueryPie ACP Community Edition" "title_orig": "QueryPie ACP Community Edition" "breadcrumbs": @@ -4914,6 +5375,7 @@ - "installation" - "querypie-acp-community-edition" - "page_id": "1805516819" + "type": "page" "title": "QueryPie ACP Community Edition 초기 구성 가이드" "title_orig": "QueryPie ACP Community Edition 초기 구성 가이드" "breadcrumbs": @@ -4929,6 +5391,7 @@ - "querypie-acp-community-edition" - "querypie-acp-community-edition-initial-configuration-guide" - "page_id": "1990000673" + "type": "page" "title": "QueryPie ACP Community Edition 업그레이드 방법" "title_orig": "QueryPie ACP Community Edition 업그레이드 방법" "breadcrumbs": @@ -4944,6 +5407,7 @@ - "querypie-acp-community-edition" - "how-to-upgrade-querypie-acp-community-edition" - "page_id": "1972142096" + "type": "page" "title": "QueryPie ACP Community Edition 제거 방법" "title_orig": "QueryPie ACP Community Edition 제거 방법" "breadcrumbs": @@ -4959,6 +5423,7 @@ - "querypie-acp-community-edition" - "how-to-remove-querypie-acp-community-edition" - "page_id": "1735589937" + "type": "page" "title": "MCP 설정 가이드" "title_orig": "MCP 설정 가이드" "breadcrumbs": @@ -4974,6 +5439,7 @@ - "querypie-acp-community-edition" - "mcp-configuration-guide" - "page_id": "1844969501" + "type": "page" "title": "지원" "title_orig": "지원" "breadcrumbs": @@ -4983,6 +5449,7 @@ "path": - "support" - "page_id": "1853358081" + "type": "page" "title": "프리미엄 지원" "title_orig": "프리미엄 지원" "breadcrumbs": @@ -4995,6 +5462,7 @@ - "support" - "premium-support" - "page_id": "1924169748" + "type": "page" "title": "Standard Edition" "title_orig": "Standard Edition" "breadcrumbs": @@ -5007,6 +5475,7 @@ - "support" - "standard-edition" - "page_id": "1923285023" + "type": "page" "title": "Standard Edition 라이선스 정책" "title_orig": "Standard Edition 라이선스 정책" "breadcrumbs": @@ -5018,7 +5487,21 @@ "path": - "support" - "standard-edition-license-policy" +- "page_id": "2288353307" + "type": "page" + "title": "QueryPie ACP 운영 로그 수집 가이드" + "title_orig": "QueryPie ACP 운영 로그 수집 가이드" + "breadcrumbs": + - "지원" + - "QueryPie ACP 운영 로그 수집 가이드" + "breadcrumbs_en": + - "Support" + - "QueryPie ACP Operational Log Collection Guide" + "path": + - "support" + - "querypie-acp-operational-log-collection-guide" - "page_id": "1911423023" + "type": "page" "title": "Unreleased" "title_orig": "Unreleased" "breadcrumbs": @@ -5028,6 +5511,7 @@ "path": - "unreleased" - "page_id": "1911652402" + "type": "page" "title": "Reverse Sync Test Page" "title_orig": "Reverse Sync Test Page" "breadcrumbs": diff --git a/openspec/changes/confluence-folder-mdx/design.md b/openspec/changes/confluence-folder-mdx/design.md index cad49abf4..16e5df218 100644 --- a/openspec/changes/confluence-folder-mdx/design.md +++ b/openspec/changes/confluence-folder-mdx/design.md @@ -117,6 +117,14 @@ Folder는 V1 ancestor 응답이 없으므로 `Stage4Processor`가 `page.v1.yaml` 이 분리는 `--recent`가 기존 page title/body를 갱신했을 때 folder의 cached child snapshot을 다시 받지 않아도 landing page의 label과 link가 최신 catalog를 사용하게 합니다. +### Decision: 표시용 번역과 canonical slug를 별도 입력으로 관리합니다 + +`etc/korean-titles-translations.txt`는 한국어 제목의 정확한 영어 표시 번역만 저장합니다. 기존 public route를 유지해야 하는 content는 `etc/content-slug-overrides.yaml`에 Confluence content ID와 canonical slug를 별도로 기록합니다. + +Fetcher는 `breadcrumbs_en`을 번역 파일에서 생성하되, `path`는 parent node에서 확정한 path를 상속하고 현재 node의 기본 영어 slug 또는 content ID 기반 override를 마지막 segment로 추가합니다. 따라서 parent에 override가 있으면 모든 descendant path도 같은 canonical parent segment를 사용합니다. + +이 분리는 번역을 route alias로 축약하여 public 영어 제목과 catalog metadata가 달라지는 문제를 방지합니다. Title이 바뀌어도 content ID가 유지되는 한 canonical route는 안정적으로 보존할 수 있습니다. + ### Decision: 계층 구조는 `--remote`에서만 갱신합니다 실행 모드별 책임은 다음과 같습니다. diff --git a/openspec/changes/confluence-folder-mdx/specs/contract-confluence-mdx-conversion/spec.md b/openspec/changes/confluence-folder-mdx/specs/contract-confluence-mdx-conversion/spec.md index 395f96f48..617171f1a 100644 --- a/openspec/changes/confluence-folder-mdx/specs/contract-confluence-mdx-conversion/spec.md +++ b/openspec/changes/confluence-folder-mdx/specs/contract-confluence-mdx-conversion/spec.md @@ -31,6 +31,14 @@ Confluence fetcher는 지원되는 모든 content node를 `page` 또는 `folder` - THEN 해당 child를 catalog, MDX, navigation에서 제외해야 합니다(SHALL). - AND parent ID, child ID, type, title을 식별할 수 있는 경고를 기록해야 합니다(SHALL). +#### Scenario: current가 아닌 child status + +- GIVEN `direct-children` 응답에 `status`가 `current`가 아닌 page 또는 folder child가 있습니다. +- WHEN content tree를 순회합니다. +- THEN 해당 child를 catalog, MDX, navigation에서 제외해야 합니다(SHALL). +- AND parent ID, child ID, type, status, title을 식별할 수 있는 경고를 기록해야 합니다(SHALL). +- AND 해당 child의 page 또는 folder metadata endpoint를 호출하지 않아야 합니다(SHALL NOT). + ### Requirement: Direct children API and pagination Fetcher는 parent type에 맞는 V2 `direct-children` endpoint를 사용하고 모든 cursor page를 수집해야 합니다(SHALL). @@ -84,6 +92,25 @@ Fetcher는 folder API 결과를 해당 content ID 디렉터리에 type별 파일 - WHEN `fetch_cli.py --local`을 실행합니다. - THEN API 호출 없이 같은 typed catalog와 ordering을 재구성해야 합니다(SHALL). +### Requirement: 표시용 번역과 canonical slug 분리 + +Fetcher는 `breadcrumbs_en`의 표시용 영어 번역과 public route의 canonical slug를 독립적으로 관리해야 합니다(SHALL). + +#### Scenario: content ID 기반 slug override + +- GIVEN content의 한국어 제목에 정확한 영어 번역이 있습니다. +- AND 해당 content ID에 canonical slug override가 있습니다. +- WHEN `--remote`, `--recent`, `--local` 중 하나로 catalog를 생성합니다. +- THEN `breadcrumbs_en`에는 축약하지 않은 영어 번역을 기록해야 합니다(SHALL). +- AND 현재 content의 마지막 `path` segment에는 canonical slug override를 기록해야 합니다(SHALL). +- AND descendant content의 `path`는 override가 적용된 parent path를 상속해야 합니다(SHALL). + +#### Scenario: slug override가 없는 content + +- GIVEN content ID에 canonical slug override가 없습니다. +- WHEN catalog를 생성합니다. +- THEN 기존과 같이 표시용 영어 breadcrumb를 `slugify`하여 `path`를 생성해야 합니다(SHALL). + ### Requirement: Hierarchy freshness by mode Fetcher는 hierarchy snapshot을 `--remote`에서 갱신하고 `--recent`와 `--local`에서는 저장된 snapshot을 사용해야 합니다(SHALL). diff --git a/openspec/changes/confluence-folder-mdx/tasks.md b/openspec/changes/confluence-folder-mdx/tasks.md index 96975d87f..81ff88c0a 100644 --- a/openspec/changes/confluence-folder-mdx/tasks.md +++ b/openspec/changes/confluence-folder-mdx/tasks.md @@ -17,6 +17,8 @@ - [x] 2.9 `var/convert-manifests/convert-manifest..yaml`의 atomic update와 stale generated output 안전 삭제를 구현합니다. - [x] 2.10 folder MDX가 reverse sync 대상이 아닐 때 명확한 오류를 반환하도록 관련 entry point를 확인하고 필요한 guard를 추가합니다. - [x] 2.11 Compose 실행 사이에 profile manifest directory를 host에 보존하고 다른 profile 소유 output을 stale cleanup에서 제외합니다. +- [x] 2.12 `direct-children`의 `status`가 `current`가 아닌 page/folder를 metadata 조회 전에 제외합니다. +- [x] 2.13 표시용 영어 제목과 content ID 기반 canonical slug override를 분리하고 descendant path에 parent override를 상속합니다. ## 3. Verification @@ -35,6 +37,8 @@ - [x] 3.13 focused Python test, `git diff --check`, 관련 `rg` source scan을 실행합니다. - [x] 3.14 ephemeral container의 manifest directory mount, atomic replace, 공유 output root의 profile 소유권 이전 회귀 테스트를 추가합니다. - [x] 3.15 `full-all` catalog 선갱신과 profile 간 current output path 충돌 사전 차단 회귀 테스트를 추가합니다. +- [x] 3.16 draft child가 catalog traversal과 metadata API 호출에서 제외되고 식별 가능한 경고가 남는지 검증합니다. +- [x] 3.17 정확한 영어 breadcrumb를 유지하면서 `web-client` canonical slug와 descendant path 상속을 검증합니다. 권장 focused 명령: @@ -61,6 +65,7 @@ bin/convert_all.py --sync-code qm - [x] 4.3 README, CLI help, sync profile 설명에서 `--recent`를 full hierarchy sync처럼 설명하는 stale 문구가 없는지 확인합니다. - [x] 4.4 folder MDX가 translation/skeleton/reverse-sync workflow에서 일반 page body로 잘못 취급되지 않는지 확인합니다. - [x] 4.5 manifest cleanup이 sync code가 다른 출력이나 attachment를 삭제하지 않는지 확인합니다. +- [x] 4.6 title translation을 route alias로 축약한 항목이 남아 있지 않은지 확인합니다. ## 5. OpenSpec Cleanup diff --git a/public/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping/image-20260724-045953.png b/public/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping/image-20260724-045953.png new file mode 100644 index 000000000..a34525c0c Binary files /dev/null and b/public/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping/image-20260724-045953.png differ diff --git a/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-124439.png b/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-124439.png new file mode 100644 index 000000000..5143d3ab0 Binary files /dev/null and b/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-124439.png differ diff --git a/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-125151.png b/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-125151.png new file mode 100644 index 000000000..c7da43381 Binary files /dev/null and b/public/administrator-manual/mcp-server/mac-general-configurations/image-20260602-125151.png differ diff --git a/public/administrator-manual/mcp-server/mcp-server-connection-management/image-20260602-110554.png b/public/administrator-manual/mcp-server/mcp-server-connection-management/image-20260602-110554.png new file mode 100644 index 000000000..49a63714c Binary files /dev/null and b/public/administrator-manual/mcp-server/mcp-server-connection-management/image-20260602-110554.png differ diff --git a/public/support/querypie-acp-operational-log-collection-guide/image-20260707-104923.png b/public/support/querypie-acp-operational-log-collection-guide/image-20260707-104923.png new file mode 100644 index 000000000..6810b5ec7 Binary files /dev/null and b/public/support/querypie-acp-operational-log-collection-guide/image-20260707-104923.png differ diff --git a/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260602-133009.png b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260602-133009.png new file mode 100644 index 000000000..274648717 Binary files /dev/null and b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260602-133009.png differ diff --git a/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-035129.png b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-035129.png new file mode 100644 index 000000000..6555065f1 Binary files /dev/null and b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-035129.png differ diff --git a/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-044959.png b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-044959.png new file mode 100644 index 000000000..871b99570 Binary files /dev/null and b/public/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac/image-20260605-044959.png differ diff --git a/src/content/en/administrator-manual/_meta.ts b/src/content/en/administrator-manual/_meta.ts index 660fd35dd..bc5db18c6 100644 --- a/src/content/en/administrator-manual/_meta.ts +++ b/src/content/en/administrator-manual/_meta.ts @@ -4,6 +4,7 @@ export default { 'servers': 'Servers', 'kubernetes': 'Kubernetes', 'web-apps': 'Web Apps', + 'mcp-server': 'MCP Server', 'audit': 'Audit', 'multi-agent-limitations': 'Multi Agent Limitations', }; diff --git a/src/content/en/administrator-manual/audit/_meta.ts b/src/content/en/administrator-manual/audit/_meta.ts index 54eee6939..def469c90 100644 --- a/src/content/en/administrator-manual/audit/_meta.ts +++ b/src/content/en/administrator-manual/audit/_meta.ts @@ -5,4 +5,5 @@ export default { 'server-logs': 'Server Logs', 'kubernetes-logs': 'Kubernetes Logs', 'web-app-logs': 'Web App Logs', + 'mcp': 'MCP', }; diff --git a/src/content/en/administrator-manual/audit/mcp.mdx b/src/content/en/administrator-manual/audit/mcp.mdx new file mode 100644 index 000000000..eda9255e3 --- /dev/null +++ b/src/content/en/administrator-manual/audit/mcp.mdx @@ -0,0 +1,11 @@ +--- +title: 'MCP' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167472160' +--- + +# MCP + +## Subpages + +- [Request Audit](./mcp/request-audit) +- [MCP Server Role History](./mcp/mcp-server-role-history) diff --git a/src/content/en/administrator-manual/audit/mcp/_meta.ts b/src/content/en/administrator-manual/audit/mcp/_meta.ts new file mode 100644 index 000000000..00f663d3e --- /dev/null +++ b/src/content/en/administrator-manual/audit/mcp/_meta.ts @@ -0,0 +1,4 @@ +export default { + 'request-audit': 'Request Audit', + 'mcp-server-role-history': 'MCP Server Role History', +}; diff --git a/src/content/en/administrator-manual/audit/mcp/mcp-server-role-history.mdx b/src/content/en/administrator-manual/audit/mcp/mcp-server-role-history.mdx new file mode 100644 index 000000000..1cf6acc71 --- /dev/null +++ b/src/content/en/administrator-manual/audit/mcp/mcp-server-role-history.mdx @@ -0,0 +1,116 @@ +--- +title: 'MCP Server Role History' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167078929/MCP+Server+Role+History' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Role History + +### Overview + +MCP Audit lets you audit MCP proxy usage and changes to MCP access permissions in QueryPie. + +Under `Admin > Audit > MCP`, two screens are available for different purposes. + +* **Request Audit**: View MCP request processing history +* **MCP Server Role History**: View the history of MCP roles granted to or revoked from users or groups + +In other words, **Audit Settings** on the `MCP Server settings` screen determines what to record, while the screens for viewing the recorded audit history are provided separately under `Admin > Audit > MCP`. + +* Menu path: `Admin > Audit > MCP` +* Submenus + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* Required permission: `PERMISSION_MAC_AUDIT` + +### Understanding MCP Server Role History + +**MCP Server Role History** shows when an MCP role was granted to or revoked from a user or group and who performed the action. + +This is an audit screen for permission change history, separate from `Admin > MCP > MCP Access Control > Access Control`, where you manage the current permission state. + +#### Opening MCP Server Role History + +1. Go to `Admin > Audit > MCP > MCP Server Role History`. +2. When the screen opens, it displays history from the beginning of the current month through the present by default. +3. Adjust the filters at the top to view only the history you need. +4. Click the refresh button in the upper-right corner to reload the list with the current conditions. + +### Searching and filtering MCP Server Role History + +This screen provides the following default filters. + +* **Event**: `GRANTED`, `REVOKED` +* **User Type**: `USER`, `GROUP` +* **Action At**: Time range when the action occurred + +The list also uses cursor-based pagination. + +### Information available in the MCP Server Role History list + +The list contains the following columns. + +* **No**: Log sequence number +* **Action At**: Time when the role was granted or revoked +* **Event**: `GRANTED` or `REVOKED` +* **User Type**: `USER` or `GROUP` +* **Name**: Name of the target user or group +* **Email**: Email address of the target user. This may be empty for a group. +* **Role**: Name of the changed MCP role +* **Expiration Date**: Role expiration date and time +* **Action By**: Name of the administrator or user who performed the action + +### Viewing MCP Server Role History details + +Click a row in the list to open the detail drawer. + +The detail drawer shows the following information. + +* **Role Name**: Name of the granted or revoked role +* **Event**: `GRANTED` or `REVOKED` +* **Name**: Name of the target user or group +* **Email**: Email address of the target user +* **User Type**: `USER` or `GROUP` +* **Action At**: Time when the action occurred +* **Action By**: User who performed the action +* **Expiration Date**: Role expiration time +* **Role Description**: Role description + +If policies are associated with the role, the **Policies** section at the bottom of the drawer also shows the following information. + +* **Name** +* **Description** +* **Version** + + +A `REVOKED` history entry may have no `Expiration Date` when saved, so the screen may display `-`. + + +### Notes on interpreting MCP Server Role History + +* `GRANTED` is a role grant event. +* `REVOKED` is a role revocation event. +* This screen shows how permissions changed, not which permissions currently remain. +* **Role Description** and **Policies** in the detail drawer are loaded from the role definition at the time of the query. + +### Differences between Request Audit and MCP Server Role History + +Both screens are under MCP Audit, but they audit different subjects. + +* **Request Audit**: Audits actual MCP request execution history +* **MCP Server Role History**: Audits changes to MCP access permissions + +From an operational perspective, they are generally used together as follows. + +* To see which requests were actually executed: **Request Audit** +* To see which role was granted to or revoked from a specific user or group and when: **MCP Server Role History** +* To trace actual request flows after a permission change: Review both screens together + +### Operational notes + +* **Enable Request Audit** and **Include payload in Request Audit** in `MCP Server settings` control whether upstream requests are recorded and whether payloads are stored. +* The client audit settings in `Admin > MCP Servers > General > Configurations` control whether client-originated requests are recorded. +* In other words, the settings screens define the scope of audit collection, while the `Admin > Audit > MCP` screens display the collected results. +* If a payload is not visible in Request Audit, first check whether payload auditing is disabled for that scope. +* MCP Server Role History is appropriate for auditing role grants and revocations. To view the servers that are currently accessible, use `Admin > MCP > MCP Access Control > Access Control`. diff --git a/src/content/en/administrator-manual/audit/mcp/request-audit.mdx b/src/content/en/administrator-manual/audit/mcp/request-audit.mdx new file mode 100644 index 000000000..a52b538c6 --- /dev/null +++ b/src/content/en/administrator-manual/audit/mcp/request-audit.mdx @@ -0,0 +1,135 @@ +--- +title: 'Request Audit' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167308318/Request+Audit' +--- + +import { Callout } from 'nextra/components' + +# Request Audit + +### Overview + +MCP Audit lets you audit MCP proxy usage and changes to MCP access permissions in QueryPie. + +* **Request Audit**: View MCP request processing history +* **MCP Server Role History**: View the history of MCP roles granted to or revoked from users or groups + +In other words, **Audit Settings** on the `MCP Server settings` screen determines what to record, while the screens for viewing the recorded audit history are provided separately under `Admin > Audit > MCP`. + +* Menu path: `Admin > Audit > MCP` + +* Submenus + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* Required permission: `PERMISSION_MAC_AUDIT` + +### Understanding Request Audit + +**Request Audit** shows how MCP requests were processed within each scope. + +The following two types of logs can be recorded together on this screen. + +* `CLIENT`: Requests sent from a client to the MCP proxy +* `PROXY_UPSTREAM`: Requests forwarded from the MCP proxy to an individual upstream MCP Server + +Therefore, a parent request and its upstream child requests may appear together for a single user request. + +#### Opening Request Audit + +1. Go to `Admin > Audit > MCP > Request Audit`. +2. When the screen opens, it displays logs for the current date by default. +3. Adjust the filters at the top to query only the log range you need. +4. Click the refresh button in the upper-right corner to reload the list with the current conditions. + +### Searching and filtering Request Audit + +The `Request Audit` screen provides the following default filters. + +* **Server**: View only upstream logs related to a specific MCP Server +* **Event**: `ALLOW`, `DENY` +* **Request Scope**: `CLIENT`, `PROXY_UPSTREAM` +* **Executed At**: Time range when the logs occurred + +The list uses cursor-based pagination, and you can load additional logs by scrolling. + +### Information available in the Request Audit list + +The list contains the following columns. + +* **No**: Log sequence number +* **Executed At**: Time when the request was recorded +* **Request Origin**: `CLIENT` or `PROXY_UPSTREAM` +* **Root Request ID**: Parent request ID that groups the same request flow +* **Event**: Permission or policy decision (`ALLOW`, `DENY`) +* **Status**: Actual processing result (`SUCCESS`, `ERROR`) +* **Name**: Name of the user who made the request +* **Email**: Email address of the user who made the request +* **Client IP**: IP address of the client that sent the request +* **Server**: Name of the target MCP Server +* **Method**: MCP method name +* **Client Tool Name**: Tool name requested by the client +* **Target Tool Name**: Tool name resolved for the upstream target +* **Duration**: Processing time (ms) + + +`Event` and `Status` have different meanings. +For example, even when `Event` is `ALLOW`, `Status` may be recorded as `ERROR` if an error occurs during execution. + + +### Viewing Request Audit details + +Click a row in the list to open the detail drawer. + +The detail drawer shows the following information. + +#### Request Info + +* **Request ID**: Unique ID of the individual audit log record +* **Root Request ID**: ID that groups logs belonging to the same request chain +* **Request Origin**: `CLIENT` or `PROXY_UPSTREAM` +* **Executed At**: Time when the request was recorded +* **Server**: Name of the target MCP Server +* **Method**: MCP method and tool name +* **Client Tool Name**: Tool name from the client's perspective +* **Target Tool Name**: Actual upstream target tool name +* **Transport**: Transport used to communicate with the upstream MCP Server +* **Upstream Endpoint**: Upstream MCP Server endpoint +* **HTTP Status**: HTTP processing status code +* **Event**: Allow or deny event +* **Status**: Success or failure status +* **Duration**: Processing time +* **Denied Reason** or **Error**: Denial reason or error message + +#### Subject Info + +* **Name** +* **Email** +* **Subject ID** + +#### Client Info + +* **Client IP** +* **User Agent** + +#### Payload + +If the payload was stored, you can view the request body in JSON format in the **Payload** section. + +However, payload visibility depends on the audit settings. + +* Client-originated requests are affected by the client audit payload setting in `Admin > MCP Servers > General > Configurations`. +* Upstream requests are affected by **Include payload in Request Audit** on each MCP Server detail page. + +Values identified as sensitive information may be masked instead of being stored as-is. + + +The current admin `Request Audit` detail screen displays the **Payload**, but does not expose an internally stored response body in a separate section. + + +### Notes on interpreting Request Audit + +* Logs with the same `Root Request ID` are part of the same request flow. +* A `CLIENT` log represents a request sent by a user to the MCP proxy. +* A `PROXY_UPSTREAM` log represents a downstream request forwarded by the proxy to a specific MCP Server. +* `Server`, `Transport`, `Upstream Endpoint`, and `Target Tool Name` are primarily meaningful for `PROXY_UPSTREAM` logs. +* Server information may be empty in a `CLIENT` log. diff --git a/src/content/en/administrator-manual/databases/db-access-control/privilege-type/_meta.ts b/src/content/en/administrator-manual/databases/db-access-control/privilege-type/_meta.ts new file mode 100644 index 000000000..524e02806 --- /dev/null +++ b/src/content/en/administrator-manual/databases/db-access-control/privilege-type/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'mongodb-document-db-privilege-type-mapping': 'MongoDB / Document DB Privilege Type Mapping', +}; diff --git a/src/content/en/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx b/src/content/en/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx new file mode 100644 index 000000000..c29acb4b7 --- /dev/null +++ b/src/content/en/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx @@ -0,0 +1,34 @@ +--- +title: 'MongoDB / Document DB Privilege Type Mapping' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288549894/MongoDB+Document+DB+Privilege+Type+Mapping' +--- + +# MongoDB / Document DB Privilege Type Mapping + +The privilege types for each MongoDB and Document DB statement are mapped as shown in the table below. + +| **Category** | **Privilege Type** | **MongoDB / Document DB** | +| ------------ | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | +| DML | Select | ~.find(), ~.findOne(), general ~.aggregate() | +| DML | Select + Delete | ~.findOneAndDelete(), findAndModify `{ remove: true }` | +| DML | Select + Update | ~.findOneAndUpdate(), ~.findOneAndReplace(), findAndModify `{ update: ... }`
Adds Insert when upsert: true | +| DML | Update | ~.update(), ~.updateOne(), ~.updateMany(), ~.replaceOne()
Adds Insert when upsert: true | +| DML | Insert + Create | ~.insert(), ~.insertOne(), ~.insertMany()
Adds Create when the target collection does not exist | +| DML | Select + Insert + Update | Final aggregate stage: $merge
Adds Create when the target collection does not exist | +| DML | Select + Insert + Create + Rename + Delete | Final aggregate stage: $out | +| DCL | Grant | db.grantRolesToUser(), db.grantRolesToRole(), db.grantPrivilegesToRole() | +| DCL | Revoke | db.revokeRolesFromUser(), db.revokeRolesFromRole(), db.revokePrivilegesFromRole() | +| DCL | Alter | db.updateUser() | +| DCL | Update | db.updateRole() | +| DDL | Create | ~.createIndex(), ~.createIndexes(), db.createCollection(), db.createView(), db.createUser(), db.createRole() | +| DDL | Drop | ~.drop(), db.dropDatabase(), db.dropUser(), db.dropAllUsers(), db.dropRole(), db.dropAllRoles() | +| DDL | Rename | ~.renameCollection() | +| Others | Etc. | ~.commitTransaction(), ~.abortTransaction(), ~.startTransaction() | + +
+Example of creating a Privilege Type +
+Example of creating a Privilege Type +
+
+
diff --git a/src/content/en/administrator-manual/general/user-management/authentication/_meta.ts b/src/content/en/administrator-manual/general/user-management/authentication/_meta.ts index 415aafa2a..41f9ff9fa 100644 --- a/src/content/en/administrator-manual/general/user-management/authentication/_meta.ts +++ b/src/content/en/administrator-manual/general/user-management/authentication/_meta.ts @@ -1,6 +1,6 @@ export default { - 'integrating-with-ldap': 'Integrating with LDAP', 'integrating-with-okta': 'Integrating with Okta', + 'integrating-with-ldap': 'Integrating with LDAP', 'integrating-with-aws-sso': 'Integrating with AWS SSO', 'integrating-with-google-saml': 'Integrating with Google SAML', 'setting-up-multi-factor-authentication': 'Setting up Multi-Factor Authentication', diff --git a/src/content/en/administrator-manual/mcp-server.mdx b/src/content/en/administrator-manual/mcp-server.mdx new file mode 100644 index 000000000..7b39caddc --- /dev/null +++ b/src/content/en/administrator-manual/mcp-server.mdx @@ -0,0 +1,12 @@ +--- +title: 'MCP Server' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167636017' +--- + +# MCP Server + +## Subpages + +- [MCP Server Connection Management](./mcp-server/mcp-server-connection-management) +- [MAC General Configurations](./mcp-server/mac-general-configurations) +- [MCP Access Control](./mcp-server/mcp-access-control) diff --git a/src/content/en/administrator-manual/mcp-server/_meta.ts b/src/content/en/administrator-manual/mcp-server/_meta.ts new file mode 100644 index 000000000..bf01d1a17 --- /dev/null +++ b/src/content/en/administrator-manual/mcp-server/_meta.ts @@ -0,0 +1,5 @@ +export default { + 'mcp-server-connection-management': 'MCP Server Connection Management', + 'mac-general-configurations': 'MAC General Configurations', + 'mcp-access-control': 'MCP Access Control', +}; diff --git a/src/content/en/administrator-manual/mcp-server/mac-general-configurations.mdx b/src/content/en/administrator-manual/mcp-server/mac-general-configurations.mdx new file mode 100644 index 000000000..d043a1a09 --- /dev/null +++ b/src/content/en/administrator-manual/mcp-server/mac-general-configurations.mdx @@ -0,0 +1,63 @@ +--- +title: 'MAC General Configurations' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167144528/MAC+General+Configurations' +--- + +# MAC General Configurations + +### Overview + +In the QueryPie MCP Access Control General settings, you can configure global security settings such as the client-oriented request audit scope and forward proxy settings. + +QueryPie MCP Access Control divides security audit records into two scopes.
MCP Client – :1_one_circle_red: `Client-oriented request` --> QueryPie MAC – :2_two_circle_red: `upstream request` --> Remote MCP Server + +General Configuration determines whether to record events for client-oriented requests. +Event recording for upstream requests is controlled in the settings for each MCP Server. + +If internet access is blocked, you can configure communication with remote MCP Servers through a forward proxy server. + +
+Admin > MCP Servers > General > Configurations +
+Admin > MCP Servers > General > Configurations +
+
+ +You can use masking patterns to mask responses received from an MCP Server based on regular expressions. + +### Client Request Audit and Include payload in Client Request Audit + +* Client Request Audit: Enabled by default. When enabled, it records events for requests sent from a client to an MCP Server in the segment between the MCP Client and QueryPie MAC. +* Include payload in Client Request Audit: Enabled by default. It also records the payload content in Client Request Audit events. + +### Forward Proxy + +**Forward Proxy** on the `Admin > MCP Servers > General > Configurations` screen is a global network setting applied to all MCP connections. + +* When you turn on **Enable Forward Proxy**, you can enter a **Host** and **Port**, and configure a **Username** and **Password** if necessary. +* This setting applies to admin `Test Connection`, `Sync Tools`, OAuth-related upstream calls, and runtime MCP proxy upstream connections. +* You may need this **Forward Proxy** configuration in an environment where the remote MCP Server is not directly reachable. +* If QueryPie and the MCP proxy can directly access the remote MCP Server over the network, they can connect without a Forward Proxy. + +### Masking Patterns + +
+Admin > MCP Servers > General > Masking Patterns +
+Admin > MCP Servers > General > Masking Patterns +
+
+ +By default, 25 predefined masking patterns are provided. You can also add and manage custom masking patterns. + +* Detecting Pattern: Pattern for detecting sensitive information +* Masking Pattern: Pattern for masking sensitive information +* Masking Pattern Preview: Preview of the masking pattern result +* Sample Data: Sample data +* Detected Data: Area detected as sensitive information in the sample data by the Detecting Pattern (blue shading) +* In the Preview table, Masked Data shows the result of masking sensitive information in the sample data + +Click `Save` to save your changes. + +To delete a masking pattern, click `Delete`, then click Delete in the confirmation modal. +Alternatively, select the item to delete using its checkbox in the Masking Patterns list, then click Delete. diff --git a/src/content/en/administrator-manual/mcp-server/mcp-access-control.mdx b/src/content/en/administrator-manual/mcp-server/mcp-access-control.mdx new file mode 100644 index 000000000..df8c7ee6b --- /dev/null +++ b/src/content/en/administrator-manual/mcp-server/mcp-access-control.mdx @@ -0,0 +1,189 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167799919/MCP+Access+Control' +--- + +import { Callout } from 'nextra/components' + +# MCP Access Control + +### Overview + +MCP Access Control manages which users or groups can access MCP Servers registered in QueryPie and the Tools they provide, based on Roles and Policies. +It is available in version 11.6.1 and later. + +You can use this feature to perform the following tasks. + +* View the MCP access permissions granted to each user or group. +* Grant one or more MCP roles to a specific user or group, or revoke them. +* View the MCP Servers that the user or group can actually access, based on the policies associated with their roles. +* Set an expiration date and time for each role so that access permissions can be automatically cleared after a certain period. +* Track changes to access permissions based on role grant and revocation history. + +In other words, MCP Access Control does more than manage which MCP Servers a user can connect to. It standardizes MCP Server permissions by role and applies policies and expiration dates to support operational control. + +On this screen, you can view the number of roles currently granted to each user or group and grant or revoke roles on the detail screen. +You can also view the policies associated with those roles and the resulting list of accessible MCP Servers. + + +MCP access permissions are managed by granting roles to users and groups, not by assigning servers directly to users. +The servers that can actually be accessed are determined by the policies associated with the granted roles. + + +### Menu and permissions + +* Menu path: `Admin > MCP > MCP Access Control > Access Control` +* Required permission: `PERMISSION_MAC_ACL` + +The following screens are also available under the same `MCP Access Control` menu. + +* **Access Control**: Manage roles granted to each user or group +* **Roles**: Manage MCP role definitions +* **Policies**: Manage MCP policy definitions + +### Viewing MCP Access Control + +View MCP access control status for registered users and groups. + +1. Go to `Admin > MCP > MCP Access Control > Access Control`. +2. Review the access control status for each user or group in the list. +3. Filter the list using the following fields in the search box. + * **Name** + * **Email** +4. Click the refresh button in the upper-right corner to reload the list. + +The list contains the following columns. + +* **User Type**: `USER` or `GROUP` +* **Provider**: Authentication provider associated with the account +* **Name**: User or group name +* **Email**: Email address of the user account. `-` is displayed for a group. +* **Members**: Member list for a group. `-` is displayed for a user account. +* **Roles**: Number of MCP roles currently granted + + +The current UI does not provide a button to create a user directly from the `Access Control` list or to add permissions by selecting a server directly. +First select a user or group, then manage their access permissions by granting roles on the detail screen. + + +### Viewing access control details for a user or group + +View the roles granted to a specific user or group in detail. + +1. Click the user or group in the `Access Control` list. +2. Review the following metadata at the top of the detail screen. + * **Type**: User or group + * **Members**: Number of members for a group + * **Created**: Creation date and creator + * **Updated**: Last update date and updater +3. The detail screen consists of the following two tabs. + * **Roles**: List of currently granted roles + * **Accessible Servers**: List of MCP Servers accessible with the current roles + +### Granting roles + +Grant one or more MCP roles to a user or group. + +1. Go to the `Roles` tab on the access control detail screen. +2. Click `Grant Role` on the right. +3. Select the role to grant in the `Grant Role` pop-up. + * The role list displays only roles that have not yet been granted to the current user or group. + * Search for roles by **Name** in the search box. +4. Review the following information in the role list. + * **Name**: Role name. Click it to go to the role detail screen. + * **Description**: Role description + * **Assigned Policies**: Policies associated with the role +5. Select an **Expiration Date**. + * The default is one year from the current date. + * When saved, the expiration time is set to the end of the selected day. + * The expiration date is required. +6. Click `Grant Role` to save. + + +If no role is available to grant, the role list in the pop-up is empty and you cannot grant another role. + + +### Viewing granted roles + +View the roles currently granted to a user or group. + +1. Go to the `Roles` tab on the access control detail screen. +2. Search for a role by **Name** in the search box. +3. The list displays the following information. + * **Name**: Role name + * **Description**: Role description + * **Expiration**: Role expiration date and time. `(Expired)` appears if the role has already expired. + * **Granted At**: Time when the role was granted + * **Last Access**: Last access time using the role. `None` appears if there is no access history. + * **Granted By**: User who granted the role + +### Viewing granted role details + +Select a granted role to view its information and associated policies. + +1. Click a role row on the `Roles` tab of the access control detail screen. +2. Review the following information in the detail drawer on the right. + * **Role Name** + * **Description** + * **Granted At** + * **Granted By** + * **Expiration Date** + * **Last Access** +3. In the **Policies** section at the bottom of the drawer, review the policies associated with the role. + * **Name** + * **Description** + * **Version** + * **Assigned At** + * **Assigned By** + + +If no policy is associated with the role, the policy table is empty. + + +### Revoking roles + +Revoke roles granted to a user or group. + +1. Go to the `Roles` tab on the access control detail screen. +2. Select one or more roles to revoke. +3. Click `Revoke` at the top. +4. Approve the confirmation pop-up to revoke the selected roles. + + +Role revocation supports multiple selections. + + +### Viewing accessible servers + +View the MCP Servers that the current user or group can access. + +1. Go to the `Accessible Servers` tab on the access control detail screen. +2. Search for a server by **Name** in the search box. +3. The list displays the following information. + * **Name**: Server display name + * **Identifier**: Server identifier (name) + * **Endpoint**: MCP Server endpoint address + * **Tools**: Number of tools provided by the MCP Server + + +If no roles are granted, or if no servers are accessible through the policies associated with the roles, the server list is empty. + + + +**Operational notes** +* The `Access Control` screen manages access permissions from the perspective of users and groups. +* Accessible servers are calculated from the policies associated with roles. If a role is granted but no appropriate policy is associated with it, no accessible server may appear. +* After a role's expiration date and time passes, its access permission becomes eligible for automatic revocation. +* View role grant and revocation history in the separate Audit menu at `Admin > Audit > MCP > MCP Server Role History`. +* The `MCP Server Role History` screen tracks who granted or revoked which role for each user or group. +* This screen generally displays the following information. + * **Event**: Role grant or revocation event + * **User Type**: `USER` or `GROUP` + * **Name**: User or group name + * **Email**: User email address + * **Role Name**: Name of the granted or revoked role + * **Expiration Date**: Role expiration date + * **Action By**: User who performed the action + * **Action At**: Time when the action occurred +* The detail screen also shows the role information and policy list associated with the history entry, which is useful when auditing the basis for an access permission change at a specific point in time. + diff --git a/src/content/en/administrator-manual/mcp-server/mcp-server-connection-management.mdx b/src/content/en/administrator-manual/mcp-server/mcp-server-connection-management.mdx new file mode 100644 index 000000000..01f5e1c75 --- /dev/null +++ b/src/content/en/administrator-manual/mcp-server/mcp-server-connection-management.mdx @@ -0,0 +1,153 @@ +--- +title: 'MCP Server Connection Management' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167242794/MCP+Server+Connection+Management' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Connection Management + +### Overview + +MCP Server Connection Management lets you register server information so that QueryPie can connect to external MCP (Model Context Protocol) servers and manage connection settings, credential settings, audit settings, and tool synchronization status. + +You can perform the following tasks on this screen. + +* View the MCP Server list. +* Register a new MCP Server. +* Modify Basic Information, Connection Settings, and Audit Settings for a registered MCP Server. +* Synchronize and view the list of Tools provided by a server. +* Delete a registered MCP Server when necessary. + + +If QueryPie's `Web Base URL` is not configured, QueryPie cannot create an OAuth callback URL and cannot start `Connect` for an MCP Server that uses OAuth. [Learn more about Web Base URL](../../installation/container-environment-variables/querypieweburl) + + +### Viewing the MCP Server list + +View the list of registered MCP Servers. + +
+Admin > MCP Servers > Connection Management > MCP Servers +
+Admin > MCP Servers > Connection Management > MCP Servers +
+
+ +1. Go to `Admin > MCP Servers > Connection Management > MCP Servers`. +2. Review the server information in the list. +3. Click `Create Server` in the upper-right corner to register a new server. +4. Click the refresh button to reload the list. +5. Click a server in the list to go to its detail page. + +The list contains the following columns. + +* **Name**: Display name of the server +* **Identifier**: Internal server name +* **Endpoint**: MCP Server address +* **Transport**: Transport type used for the connection +* **Tools**: Number of synchronized tools +* **Audit**: Whether Request Audit is enabled +* **Updated**: Time of the last update + +### Adding an MCP Server + +Register a new MCP Server. + +1. Click `Create Server`. +2. Enter the following information in **Basic Information**. + * **Identifier:** Identifier used internally for the remote MCP Server. Uppercase letters are not allowed. It cannot be changed after creation. + * **Name:** Display name of the remote MCP Server. + * **Icon:** Upload and register an icon of your choice. + * **Description:** Description of the remote MCP Server. +3. Enter the following information in **Connection Settings**. + * **Endpoint URL:** Endpoint URL for connecting to the remote MCP Server. + * **Transport:** Select the transport type of the remote MCP Server. Select either SSE or Streamable HTTP. + * **Credential Mode:** Select None, QueryPie Registered Credential, or User OAuth. + * None: Use this when the remote MCP Server does not require authentication. + * QueryPie Registered Credential: Select this to manage the authentication token in QueryPie MAC. When you select QueryPie Registered Credential, the QueryPie Upstream Access Token field appears. Enter the MCP Server authentication token in this field. **MAC does not generate an MCP Server authentication token. You must generate a token for MCP use in the corresponding service. For detailed instructions, refer to that service's guide.** + * User OAuth: Use this when the remote MCP Server uses OAuth authentication. The administrator must authenticate with OAuth on behalf of a user to retrieve the list of tools available from the MCP Server. This is unrelated to the user's OAuth authentication and is used only to retrieve the tool list. +4. If necessary, run `Test Connection` to check whether QueryPie can connect using the values currently entered. +5. Configure the request audit options in **Audit Settings**. + * Refer to "Understanding Audit Settings" below. +6. Click `Save`. + + +`Test Connection`, subsequent `Sync Tools` operations, and OAuth-related upstream communication may all be affected by the **Forward Proxy** setting in the global MCP **Configurations**. + + +### Understanding Audit Settings + +Audit settings in MCP Access Control are divided into two audit scopes. + +* **Audit Settings** on each MCP Server detail page: Per-server audit settings for requests forwarded to a specific upstream MCP Server +* Audit settings in `Admin > MCP Servers > General > Configurations`: Global audit settings for requests sent from an MCP client to QueryPie MAC + +Therefore, when interpreting request audits, check which setting applies to each log scope. + +#### Audit scope: QueryPie MAC to Remote MCP Server + +* When Enable Request Audit is enabled in Audit Settings for an MCP Server,
QueryPie MAC records upstream requests forwarded to that Remote MCP Server in the request audit log. + * The **Audit** column on the MCP Server list also reflects this value. + * When this option is turned off, upstream request audit logs for that server are not recorded. + * View request audit logs in `Admin > Audit > MCP > Request Audit`. +* When Include payload in Request Audit is enabled in Audit Settings for an MCP Server,
the payload and response are stored with request audit logs for that MCP Server. + * In addition to recording the upstream request itself, the audit record includes the payload and response. + * This option is available only when `Enable Request Audit` is enabled. + * When `Enable Request Audit` is turned off, this option is disabled and its value is also turned off when you save. + +#### Audit scope: MCP Client to QueryPie MAC + +The `Admin > MCP Servers > General > Configurations` screen contains global settings for client-originated audits. + +* Client Request Audit: When enabled, MCP requests sent from a client to QueryPie MAC are recorded in the audit log. + * The audit subject is a client-originated MCP request, not an individual upstream MCP Server. + * When disabled, no client request audit event is created. +* Include payload in Client Request Audit: When enabled, the payload and response are stored with the client-originated MCP request audit log. + * This option appears only when `Client Request Audit` is enabled. + * When disabled, the client request audit event is recorded, but the payload and response bodies are excluded. + +### Modifying an MCP Server + +Change the settings of an existing MCP Server. +You can synchronize Tools for an MCP Server only from the edit detail screen after registering the server. + +1. Click the server to modify in the MCP Server list. +2. On the detail page, review and modify the following sections. + * **Basic Information** + * **Connection Settings** + * **Audit Settings** + * **Tools**
Synchronize the list of tools provided by the registered MCP Server.
If authentication is required, you must authenticate before synchronization. + * Click `Sync Tools`. + * When synchronization is complete, you can see the number of detected tools and the last synchronization time. + * The Tools table shows the following information. + * Tool Name: Name of the tool. + * Description: Detailed description of the tool. + * Last Synced: Time of the last synchronization. +3. Click `Save Changes` after making changes. + + +On the server edit screen, **Identifier** is read-only and cannot be changed. + + +### Deleting an MCP Server + +Delete a registered MCP Server. + +1. Select one or more servers in the list. +2. Run the delete action. +3. Approve the confirmation message to delete the selected servers. + +You can also delete a single server from its detail page. + + + +**Operational notes** +* By default, both **Enable Request Audit** and **Include payload in Request Audit** are enabled when you create a server. +* **Include payload in Request Audit** on the server detail page cannot be enabled independently and always depends on **Enable Request Audit**. +* **Client Request Audit** and **Include payload in Client Request Audit** in `Admin > MCP Servers > General > Configurations` are also enabled by default. +* The **Client Request Audit** settings and per-server **Request Audit** settings do not inherit from each other. They are separate settings applied to different request scopes. +* If the remote MCP Server cannot be reached directly over the internet, you may need to configure **Forward Proxy** in `Admin > MCP Servers > General > Configurations`. Your organization must provide the forward proxy separately; QueryPie MAC does not provide a proxy server. +* Synchronize the Tools list separately on the server detail page to reflect the latest server state. +* When Credential Mode is User OAuth, you can check the admin OAuth connection status separately on the detail page. + diff --git a/src/content/en/support/_meta.ts b/src/content/en/support/_meta.ts index b0ffd735b..eddec2b04 100644 --- a/src/content/en/support/_meta.ts +++ b/src/content/en/support/_meta.ts @@ -1,3 +1,4 @@ export default { 'premium-support': 'Premium Support', + 'querypie-acp-operational-log-collection-guide': 'QueryPie ACP Operational Log Collection Guide', }; diff --git a/src/content/en/support/premium-support.mdx b/src/content/en/support/premium-support.mdx index 2701f1216..60a85e3d7 100644 --- a/src/content/en/support/premium-support.mdx +++ b/src/content/en/support/premium-support.mdx @@ -31,7 +31,7 @@ You can submit tickets for bug reports and urgent issues, and track ticket progr * Bug Report - Bug and error reports -For feature additions and improvement requests, please contact us by email. [ai_connection@querypie.com](mailto:ai_connection@querypie.com) +For feature additions and improvement requests, please contact us by email. [AI_Connect@querypie.com](mailto:AI_Connect@querypie.com) #### Upgrades and Regular Maintenance diff --git a/src/content/en/support/querypie-acp-operational-log-collection-guide.mdx b/src/content/en/support/querypie-acp-operational-log-collection-guide.mdx new file mode 100644 index 000000000..7cccf7cac --- /dev/null +++ b/src/content/en/support/querypie-acp-operational-log-collection-guide.mdx @@ -0,0 +1,346 @@ +--- +title: 'QueryPie ACP Operational Log Collection Guide' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288353307/QueryPie+ACP' +--- + +import { Callout } from 'nextra/components' + +# QueryPie ACP Operational Log Collection Guide + +### Overview + +When you need to analyze an incident or provide information for technical support, collect operational logs and diagnostic data from the QueryPie server according to the symptoms. +This document describes the basic logs to collect first in an operational environment, data to collect only when additionally required, and information to include when submitting the data. + +Whenever possible, the basic collection should cover a range before and after the incident time. +If the issue can be reproduced, record the reproduction time as well so that the logs can be compared more easily. + +### Basic collection items + +When an issue requires analysis, collect the following four items first. + +1. QueryPie file logs +2. Container standard output logs +3. `/api/config/monitoring` dump +4. Multi Agent or Windows Server Agent logs + + +You do not always need to collect every log for every symptom. +However, if the potential cause has a broad scope or the issue is difficult to reproduce, it is best to collect all four basic items. + + +### Collecting QueryPie file logs + +File logs are application logs written by each component under `/var/log/querypie`. +The path inside the container is the same, but the path visible from the host may differ by version. + +#### Checking the log path + +1. Check the QueryPie version. +2. Check the log path on the host. + * `9.x ~ 10.4.x`: `/var/log/querypie` + * `11.0.x+`: Generally the `log` path in the parent directory of the compose file +3. If necessary, check the log path directly inside the app container. + +The following example checks file logs directly from the host. +``` +ls -al ../log +``` + +In an environment where the host path is `/var/log/querypie`, use the following command. +``` +ls -al /var/log/querypie +``` + +The following example checks file logs inside the app container. +``` +docker exec -it querypie-app-1 sh +ls -al /var/log/querypie +``` + +#### Compressing file logs + +1. Prepare a directory for collecting logs from before and after the incident time. +2. Verify that logs related to `api`, `engine`, `nginx`, and `proxy` are included. +3. Compress the logs using the path for your environment. +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz -C .. log +``` + +In an environment where the host path is `/var/log/querypie`, collect the logs as follows. +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz /var/log/querypie +``` + +### Collecting container standard output logs + +Along with file logs, collect the container's `stdout` and `stderr` logs. + +1. Save the app container logs. +2. If the `tools` profile is running, save the tools logs as well. +``` +mkdir -p support-logs +docker logs querypie-app-1 > support-logs/app.docker.log 2>&1 +docker logs querypie-tools-1 > support-logs/tools.docker.log 2>&1 || true +``` + + +When `kill -3` is used as a thread dump fallback, the result is generally written to the container's standard output. In this case, collecting `docker logs` is especially important. + + +### Collecting a monitoring dump + +For suspected API hangs, response delays, or deadlocks, use `/api/config/monitoring` first. + +
+Example: https://<QueryPie address>/api/config/monitoring +
+Example: https://<QueryPie address>/api/config/monitoring +
+
+ + +1. Sign in with the Owner account or an account with the `SYSTEM_PROPERTIES` permission. +2. In a browser, go to `/api/config/monitoring`. +3. Check the required time range.
You can also click `Create New Dump` to create a new dump file. +4. Select one of the following options. + * Download only the dump + * Download the dump and application logs together using `Dumps + All Logs` + + +The default `logHome` value for `Dumps + All Logs` is `/var/log/querypie`. +If your environment uses a custom log path, verify the actual log home path before using this feature. + + + +The monitoring dump archive includes `thread.dump`. Providing it together with the file logs significantly speeds up analysis. + + + +**When monitoring dumps are created automatically** + +A monitoring dump may be created automatically under the following conditions. + +* The number of idle connections in the MetaDB or LogDB connection pool drops to 10% or less of the maximum pool size +* A `SQLTransientConnectionException` occurs and its message contains `Connection is not available, request timed out after` + +Automatic dumps are created at intervals of at least 10 minutes. +Even if the same symptom repeats within a short time, a new dump may not be created each time. + + +### Temporarily changing the log level + +Only when the basic logs are insufficient to identify the cause, temporarily raise the log level to debug and collect reproduction logs. + +1. Record the time before changing the log level to debug. +2. Raise the log level of the target component. +3. Reproduce the same symptom. +4. Collect the logs. +5. Restore the original level. + 1. The default log level is `warn` for `api` and `info` for the other components: `engine`, `arisa`, `cabinet`, `kubepie`, `rotatepie`, and `novas`. (`arisa` is the proxy component.) +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug api +``` + +To apply the setting to all components, omit the component. +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug +``` + +The following components are supported. + +* `api` +* `engine` +* `arisa` +* `cabinet` +* `kubepie` +* `rotatepie` +* `novas` +* `all` + + +You can specify a timeout in seconds as the third argument. +Do not operate at debug level for an extended period. Always restore the original level after collection is complete. +`docker exec -it querypie-app-1 /app/change-log-level.sh debug api 30` + + +### Logs to collect first by symptom + +You do not always need to raise every component's log level to debug. +Use the following criteria to collect the logs that match the symptom first, and expand the scope only when necessary. + +| **Symptom / Scenario** | **Logs to collect first** | **Additional useful logs** | +| ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------- | +| Sign-in failure, screen API error, settings save failure, or approval request processing error | `api` file logs, `docker logs querypie-app-1`, and `api` debug logs if necessary| `nginx` logs | +| Web page does not open, 502/504 error, or static page appears but API calls fail | `nginx` file logs, `docker logs querypie-app-1` | `api` file logs | +| DAC connection succeeds but query execution fails, or DB session creation or proxy connection is unstable | `proxy` file logs, `arisa` file logs | `api` logs and `arisa` debug logs if necessary | +| Slow query execution or results, engine processing failure, or snapshot/analysis processing issue | `engine` file logs | `api` logs, `engine` debug logs if necessary, monitoring dump | +| KAC cluster connection failure, Kubernetes resource query failure, or kubectl issue | `kubepie` file logs | `api` logs and `kubepie` debug logs if necessary | +| RotatePie scheduling or rotation processing issue | `rotatepie` file logs | `rotatepie` debug logs if necessary | +| Nova, SSH, or gateway integration connection failure | `novas` file logs | `novas` debug logs and related gateway logs if necessary | +| Multi Agent connection issue, local app connection failure, WebView error, or issue reproduced only on a specific user PC | Multi Agent logs, `webView.log` | Server-side `proxy` and `api` logs | +| SAC Windows Server Agent connection failure, RDP timeout, or issue reproduced only in a specific Windows session | Windows Server Agent service logs | Per-user Agent logs, Multi Agent logs, server-side `proxy`/`api` logs| +| Suspected API hang, response delay, deadlock, or insufficient DB connection pool | `/api/config/monitoring` dump, `api` file logs | `engine` logs, `docker logs`, thread dump fallback | + + +If you are unsure which logs to review first, collect `api`, `nginx`, `docker logs`, and the `/api/config/monitoring` dump. For connection or proxy issues, add `proxy` or `arisa`; for client issues, add Multi Agent or Windows Server Agent logs. + + +### Collecting Multi Agent logs + +If the environment uses Multi Agent, collect the desktop app logs as well. + +1. Check the log path for the operating system in use. + * Windows: `%USERPROFILE%\.querypie-multi-agent\logs\` + * macOS: `$HOME/.querypie-multi-agent/logs/` + * Linux: `$HOME/.querypie-multi-agent/logs/` +2. Collect the general logs and `webView.log`. +3. If detailed logs are required, turn on `Diagnostic Tools > Enable Tracing`, then reproduce the issue. +4. Turn tracing off again after collection. +5. If necessary, use `Diagnostic Tools > Export Log` to create an archive. + + +Use the `QPMA_TRACE=1` environment variable only when detailed logs are required from application startup. +Avoid using it for an extended period during normal operation. + + +### Collecting SAC Windows Server Agent logs + +If the environment uses Windows Server Agent with SAC, collect the agent logs as well. + +#### Collecting basic service logs + +1. Check the following path on the Windows Server. + * `%ProgramData%\QueryPie\Server Agent\Logs\` +2. Compress the service logs first. +``` +$logRoot = "$env:ProgramData\QueryPie\Server Agent\Logs" +$outFile = "$env:TEMP\querypie-server-agent-logs.zip" +Compress-Archive -Path "$logRoot\*" -DestinationPath $outFile -Force +``` + +#### When per-user logs are required + +If the issue is reproduced only in a specific Windows user session or you need to check per-user behavior, collect the following path as well. + +* `%ProgramData%\QueryPie\Server Agent\Logs\Users\\` + +#### When verbose logs are required + +1. Open PowerShell on the Windows Server. +2. Check the current LogLevel. +``` +Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" | Select-Object LogLevel +``` + +3. If necessary, change LogLevel to `Verbose`. +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Verbose" +``` + +4. Reproduce the symptom and collect the logs. +5. Restore it to `Information` after collection. +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Information" +``` + + +When tracing an RDP timeout or connection failure, include the QueryPie server-side Proxy/API logs and the Multi Agent logs from the user's PC to make analysis easier. + + +### Collecting additional data only when required + +Collect the following data only when you need to analyze a configuration issue, deployment difference, or thread dump fallback. + +#### Collecting configuration files + +1. Check the current deployment configuration files. +2. Mask sensitive information before submitting them. + +Examples of additional items to collect include the following. + +* `.env` or `compose-env` +* `compose.yml` or `docker-compose.yml` +* `nginx.d/` +* Custom configuration files +* `logrotate.d/querypie` + + +In some compose packages, `logrotate.d/querypie` may be directly linked to the app container's `/etc/logrotate.d/querypie` configuration. +Include it only when you need to check log rotation behavior or the retention period. + + +#### Collecting a JVM thread dump as a fallback + +Use this only when `/api/config/monitoring` is difficult to access or you need to collect a thread dump directly inside the container. + +1. Connect to the app container from the host. +``` +docker exec -it querypie-app-1 bash +``` + +2. Find the API Java PID inside the app container and create a thread dump. +``` +ps -ef | grep '[a]pp/api/api.jar' +``` + +3. If available, collect the thread dump using `jcmd`. +``` +jcmd Thread.print > /tmp/api-thread-dump.txt +``` + +4. Exit the app container, then copy the dump file from the host. +``` +docker cp querypie-app-1:/tmp/api-thread-dump.txt support-logs/api-thread-dump.txt +``` + +5. If `jcmd` is unavailable, use `kill -3` inside the app container. +``` +kill -3 +``` + + +For this step, use the PID of the `/app/api/api.jar` process, not `commandpie-engine.jar`. + + +### Information to include when submitting logs + +Providing log files alone can increase the analysis time, so include the following information. + +| **Item** | **Description** | +| ------------------- | --------------------------------------------------------------------- | +| Time of occurrence | Example: `2026-07-07 14:23 KST` | +| Server timezone | Reference for comparing log timestamps | +| Symptom | Example: A specific API response takes more than 30 seconds after login| +| Reproducibility | Reproducible / Not reproducible | +| Reproduction steps | Record step by step when possible | +| Reproduction time | Actual time when the reproduction was performed | +| Impact scope | Whether it affects a specific user, a specific server, or all users | +| Collected log types | File logs, docker logs, monitoring dump, agent logs, and so on | + +### Checklist template + +``` +[Basic Information] +- Time of occurrence: +- Server timezone: +- Symptom: +- Impact scope: +[Reproduction Information] +- Reproducibility: +- Reproduction steps: +- Reproduction time: +[Collected Logs] +- File logs: Collected / Not collected +- docker logs: Collected / Not collected +- monitoring dump: Collected / Not collected +- Multi Agent logs: Not applicable / Collected / Not collected +- Windows Server Agent logs: Not applicable / Collected / Not collected +[Additional Collection] +- Configuration files: Collected / Not collected +- JVM thread dump fallback: Collected / Not collected +[Additional Notes] +- Notes: +``` diff --git a/src/content/en/user-manual/_meta.ts b/src/content/en/user-manual/_meta.ts index 59b6637e4..51071d920 100644 --- a/src/content/en/user-manual/_meta.ts +++ b/src/content/en/user-manual/_meta.ts @@ -5,6 +5,7 @@ export default { 'server-access-control': 'Server Access Control', 'kubernetes-access-control': 'Kubernetes Access Control', 'web-access-control': 'Web Access Control', + 'mcp-access-control': 'MCP Access Control', 'preferences': 'Preferences', 'user-agent': 'User Agent', 'multi-agent': 'Multi Agent', diff --git a/src/content/en/user-manual/mcp-access-control.mdx b/src/content/en/user-manual/mcp-access-control.mdx new file mode 100644 index 000000000..70f9bae6b --- /dev/null +++ b/src/content/en/user-manual/mcp-access-control.mdx @@ -0,0 +1,10 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2168455203' +--- + +# MCP Access Control + +## Subpages + +- [Using Remote MCP Servers through MAC](./mcp-access-control/using-remote-mcp-servers-through-mac) diff --git a/src/content/en/user-manual/mcp-access-control/_meta.ts b/src/content/en/user-manual/mcp-access-control/_meta.ts new file mode 100644 index 000000000..94b5d6079 --- /dev/null +++ b/src/content/en/user-manual/mcp-access-control/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'using-remote-mcp-servers-through-mac': 'Using Remote MCP Servers through MAC', +}; diff --git a/src/content/en/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx b/src/content/en/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx new file mode 100644 index 000000000..fca5c0173 --- /dev/null +++ b/src/content/en/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx @@ -0,0 +1,179 @@ +--- +title: 'Using Remote MCP Servers through MAC' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2166816845/MAC+Remote+MCP+Servers' +--- + +import { Callout } from 'nextra/components' + +# Using Remote MCP Servers through MAC + +### Overview + +`MCP Servers` is a user screen where you can view the remote MCP Servers you are allowed to access and connect external MCP Clients through the MCP endpoint provided by QueryPie. +On this screen, you can view the servers available to you and review each server's `Basic Info`, `Tools`, and `Accessible Roles`. When an MCP Server's Credential Mode is "`User OAuth`" (configured on the administrator page), you can also establish the upstream OAuth connection yourself. + +
+image-20260605-035129.png +
+ +This document explains how to perform the following tasks on the user page. + +* View the MCP Servers you can access +* View connection instructions for each MCP Client +* Review **Basic Info**, **Tools**, and **Accessible Roles** for each server +* Establish an upstream OAuth connection when necessary + +
+User > MCP Servers +
+User > MCP Servers +
+
+ +### Before you begin + +The following conditions must be met. + +* QueryPie ACP must have a MAC license. +* An administrator must grant you a Role that provides access to an MCP Server. +* The policy associated with the granted Role must provide access to at least one MCP Server. + + +If no Role is granted to you, an informational screen appears instead of the server list, and you may need to request access. +Currently, only an administrator can grant a Role. You cannot request access through a workflow. + + + +You connect to the MCP endpoint provided by QueryPie, not directly to the upstream MCP Server's original URL. The connection instructions under `Connect with` are generated based on the QueryPie endpoint (`/mac/mcp`). + + +### Opening the MCP Servers screen + +1. Click `MCP Servers` in the top menu. +2. The MCP Servers screen consists of the `Connect with` section, the `server list (server cards)`, and the `detail panel`. +3. If you have permission to access MCP Servers through a granted Role, the server card list appears. + +#### Information available on the screen + +| **Item** | **Description** | +| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | +| Connect with | Select the MCP Client you use from the drop-down list to view connection instructions for that Client. | +| Server list (server cards)| Displays the accessible MCP Servers. Each server card shows the MCP Server name and endpoint address configured by the administrator. | +| Authentication badge | Servers that require OAuth display an `Authenticated` or `Not Authenticated` status. | +| Detail panel | Shows `Basic Information`, `Available Tools`, and `Accessible Roles` for the selected MCP Server. | + +### Viewing MCP Client connection information under Connect with + +The `Connect with` section shows how to register the QueryPie MCP endpoint in an external MCP Client. + +1. Select the MCP Client you want to use from the `Connect with` drop-down. +2. QueryPie displays connection instructions for that Client. +3. Copy the command, URL, or configuration example shown in the instructions and register it in the MCP Client. + +The supported instruction method may differ by Client. + +| **Method** | **Description** | +| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| One-click | Opens the Client and passes connection information through the `Connect` button. (Example: VS Code) | +| Command | Copy a terminal command and register it in the MCP Client CLI. (Example: `claude mcp add --transport http querypie-mac "https:///mac/mcp"`) | +| Terminal URL | Copy the displayed URL and enter it in the Client settings. | +| Connector steps | Copy and enter the URL or configuration value on the Client settings screen. (Example: LibreChat) | + + +The values shown in the connection instructions are generated from QueryPie's common MCP root URL, not the upstream URL of the selected server.
For example, the Notion endpoint URL is "`https://mcp.notion.com/mcp`", but the connection instructions under Connect with for the QueryPie MCP Server show "`https:///mac/mcp`". + + +### Viewing accessible MCP Servers + +1. Click the server you want in the server card list. +2. The card displays the following information. + * MCP Server display name + * Endpoint + * OAuth authentication status badge (when required) +3. The detail panel for the selected server opens. + +#### Tabs available in the detail panel + + ++++ + + + + + + + + + + + + + + + + + + +
+**Tab** + +**Description** +
+Basic Information + +* Server Name: Display name that identifies the MCP Server. +* Identifier: Internal identifier for the remote MCP Server. +* Upstream Endpoint: Actual endpoint URL for connecting to the remote MCP Server. You cannot use this address to connect. +* Transport: Transport type of the remote MCP Server. (SSE / Streamable HTTP) +
+Available Tools + +View the Tools currently available to you.
The list shows only the Tools accessible based on the Roles and Policies granted to you, not every Tool provided by the MCP Server. +
+Accessible Roles + +* Role Name: Name of the Role assigned to you for the MCP Server. +* Expiration Date: Time when your access permission to the MCP Server expires. +* Status: Role grant status. (Active / Expired) +* Policies: Names of one or more policies associated with the MCP Server. +
+ +### Connecting to an MCP Server that requires OAuth + +When a server's `Credential Mode` is `User OAuth`, an OAuth connection section appears below the `Basic Information` tab. + + +Only an administrator can configure Credential Mode. Users cannot change it. + + +#### Establishing an OAuth connection + +1. Select the server and open the `Basic Information` tab. +2. If the OAuth status is `Not Authenticated`, click `Connect` to start authentication. +3. QueryPie opens an OAuth authentication window in your web browser. +4. Complete authentication on the upstream OAuth provider screen. +5. When authentication is complete, the status changes to `Authenticated`. + +#### Disconnecting OAuth + +1. Open a server that already has an OAuth connection. +2. Click `Reset Token`. +3. The stored OAuth connection is removed, and the status changes back to `Not Authenticated`. + +### When you do not have access or cannot see an MCP Server + +#### When you have no Role + +* The `MCP Servers` screen displays an empty state instead of a server list. +
+ image-20260605-044959.png +
+* In this case, ask an administrator to grant you a MAC Role. + +#### When you have a Role but no server + +* Even if you have a Role, no server appears if the Role's Policy does not grant access to any server. +* Ask an administrator to check the Policy associated with the Role or its server access scope. diff --git a/src/content/ja/administrator-manual/_meta.ts b/src/content/ja/administrator-manual/_meta.ts index 108490a72..373b9c006 100644 --- a/src/content/ja/administrator-manual/_meta.ts +++ b/src/content/ja/administrator-manual/_meta.ts @@ -4,6 +4,7 @@ export default { 'servers': 'Servers', 'kubernetes': 'Kubernetes', 'web-apps': 'Web Apps', + 'mcp-server': 'MCP Server', 'audit': 'Audit', 'multi-agent-limitations': 'Multi Agent 制約事項', }; diff --git a/src/content/ja/administrator-manual/audit/_meta.ts b/src/content/ja/administrator-manual/audit/_meta.ts index 54eee6939..def469c90 100644 --- a/src/content/ja/administrator-manual/audit/_meta.ts +++ b/src/content/ja/administrator-manual/audit/_meta.ts @@ -5,4 +5,5 @@ export default { 'server-logs': 'Server Logs', 'kubernetes-logs': 'Kubernetes Logs', 'web-app-logs': 'Web App Logs', + 'mcp': 'MCP', }; diff --git a/src/content/ja/administrator-manual/audit/mcp.mdx b/src/content/ja/administrator-manual/audit/mcp.mdx new file mode 100644 index 000000000..1ebac85c7 --- /dev/null +++ b/src/content/ja/administrator-manual/audit/mcp.mdx @@ -0,0 +1,11 @@ +--- +title: 'MCP' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167472160' +--- + +# MCP + +## サブドキュメント + +- [Request Audit](./mcp/request-audit) +- [MCP Server Role History](./mcp/mcp-server-role-history) diff --git a/src/content/ja/administrator-manual/audit/mcp/_meta.ts b/src/content/ja/administrator-manual/audit/mcp/_meta.ts new file mode 100644 index 000000000..00f663d3e --- /dev/null +++ b/src/content/ja/administrator-manual/audit/mcp/_meta.ts @@ -0,0 +1,4 @@ +export default { + 'request-audit': 'Request Audit', + 'mcp-server-role-history': 'MCP Server Role History', +}; diff --git a/src/content/ja/administrator-manual/audit/mcp/mcp-server-role-history.mdx b/src/content/ja/administrator-manual/audit/mcp/mcp-server-role-history.mdx new file mode 100644 index 000000000..bfd915aef --- /dev/null +++ b/src/content/ja/administrator-manual/audit/mcp/mcp-server-role-history.mdx @@ -0,0 +1,116 @@ +--- +title: 'MCP Server Role History' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167078929/MCP+Server+Role+History' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Role History + +### Overview + +MCP Auditは、QueryPieのMCP proxyの利用履歴とMCPアクセス権限の変更履歴を監査するための機能です。 + +`Admin > Audit > MCP`メニューには、目的が異なる2つの画面があります。 + +* **Request Audit**：MCPリクエストの処理履歴を確認する画面 +* **MCP Server Role History**：ユーザーまたはグループにMCPロールが付与または回収された履歴を確認する画面 + +つまり、`MCP Server settings`画面の**Audit Settings**は「何を記録するか」を設定する領域で、実際に記録された監査履歴を照会する画面は`Admin > Audit > MCP`配下に別途用意されています。 + +* メニューパス：`Admin > Audit > MCP` +* サブメニュー + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* 必要な権限：`PERMISSION_MAC_AUDIT` + +### MCP Server Role Historyについて + +**MCP Server Role History**は、ユーザーまたはグループにMCPロール（Role）がいつ、誰によって付与または回収されたかを確認する画面です。 + +この画面は、現在の権限状態を管理する`Admin > MCP > MCP Access Control > Access Control`とは別の、権限変更履歴を監査するための画面です。 + +#### MCP Server Role Historyを開く + +1. `Admin > Audit > MCP > MCP Server Role History`メニューに移動します。 +2. 画面を開くと、デフォルトでは当月の開始日から現在までの履歴が表示されます。 +3. 上部のfilterで条件を調整し、必要な履歴のみを確認します。 +4. 右上のrefreshボタンをクリックすると、現在の条件で一覧が再読み込みされます。 + +### MCP Server Role Historyの検索とフィルター + +この画面では、次の条件がデフォルトのfilterとして提供されます。 + +* **Event** : `GRANTED`、`REVOKED` +* **User Type** : `USER`、`GROUP` +* **Action At**：操作日時の範囲 + +一覧もcursorベースで続けて照会されます。 + +### MCP Server Role History一覧で確認できる情報 + +一覧のカラムは次のとおりです。 + +* **No**：ログの連番 +* **Action At**：ロールの付与または回収日時 +* **Event**：`GRANTED`または`REVOKED` +* **User Type**：`USER`または`GROUP` +* **Name**：対象ユーザーまたはグループ名 +* **Email**：対象ユーザーのメールアドレス。グループの場合は空欄になることがあります。 +* **Role**：変更されたMCPロール名 +* **Expiration Date**：ロールの有効期限 +* **Action By**：操作を実行した管理者またはユーザー名 + +### MCP Server Role Historyの詳細を表示する + +一覧の行をクリックすると、detail drawerが開きます。 + +detail drawerでは、次の情報を確認できます。 + +* **Role Name**：付与または回収されたロール名 +* **Event**：`GRANTED`または`REVOKED` +* **Name**：対象ユーザーまたはグループ名 +* **Email**：対象ユーザーのメールアドレス +* **User Type**：`USER`または`GROUP` +* **Action At**：操作が発生した日時 +* **Action By**：操作の実行者 +* **Expiration Date**：ロールの有効期限 +* **Role Description**：ロールの説明 + +ロールに紐づくポリシーがある場合は、drawer下部の**Policies**セクションで次の情報も確認できます。 + +* **Name** +* **Description** +* **Version** + + +`REVOKED`の履歴では、保存時に`Expiration Date`が空の場合があるため、画面でも`-`と表示されることがあります。 + + +### MCP Server Role Historyを解釈する際の参考事項 + +* `GRANTED`はロール付与イベントです。 +* `REVOKED`はロール回収イベントです。 +* この画面は「現在どの権限が残っているか」ではなく、「権限がどのように変更されたか」を示す監査画面です。 +* detail drawerの**Role Description**と**Policies**は、照会時点のロール定義を基準に読み込まれます。 + +### Request AuditとMCP Server Role Historyの違い + +どちらもMCP Audit配下の画面ですが、監査対象が異なります。 + +* **Request Audit**：実際のMCPリクエスト実行履歴を監査 +* **MCP Server Role History**：MCPアクセス権限の変更履歴を監査 + +運用時には、通常次のように組み合わせて使用します。 + +* 実際に実行されたリクエストを確認する場合：**Request Audit** +* 特定のユーザーまたはグループに、いつどのロールが付与または回収されたかを確認する場合：**MCP Server Role History** +* 権限変更後の実際のリクエストフローまで追跡する場合：両方の画面を併せて照会 + +### 運用時の参考事項 + +* `MCP Server settings`の**Enable Request Audit**と**Include payload in Request Audit**は、upstream requestを記録するかどうかとpayloadを保存するかどうかを制御します。 +* `Admin > MCP Servers > General > Configurations`のclient audit設定は、client-originated requestを記録するかどうかを制御します。 +* つまり、設定画面では監査の収集範囲を定め、`Admin > Audit > MCP`画面では収集された結果を照会します。 +* Request Auditでpayloadが表示されない場合は、まず該当scopeのpayload audit設定が無効になっていないか確認してください。 +* MCP Server Role Historyはロール付与・回収履歴の監査に適していますが、現時点で実際にアクセス可能なサーバー一覧は`Admin > MCP > MCP Access Control > Access Control`画面で別途確認する必要があります。 diff --git a/src/content/ja/administrator-manual/audit/mcp/request-audit.mdx b/src/content/ja/administrator-manual/audit/mcp/request-audit.mdx new file mode 100644 index 000000000..1458c8148 --- /dev/null +++ b/src/content/ja/administrator-manual/audit/mcp/request-audit.mdx @@ -0,0 +1,135 @@ +--- +title: 'Request Audit' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167308318/Request+Audit' +--- + +import { Callout } from 'nextra/components' + +# Request Audit + +### Overview + +MCP Auditは、QueryPieのMCP proxyの利用履歴とMCPアクセス権限の変更履歴を監査するための機能です。 + +* **Request Audit**：MCPリクエストの処理履歴を確認する画面 +* **MCP Server Role History**：ユーザーまたはグループにMCPロールが付与または回収された履歴を確認する画面 + +つまり、`MCP Server settings`画面の**Audit Settings**は「何を記録するか」を設定する領域で、実際に記録された監査履歴を照会する画面は`Admin > Audit > MCP`配下に別途用意されています。 + +* メニューパス：`Admin > Audit > MCP` + +* サブメニュー + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* 必要な権限：`PERMISSION_MAC_AUDIT` + +### Request Auditについて + +**Request Audit**は、MCPリクエストが各範囲でどのように処理されたかを確認する画面です。 + +この画面には、次の2種類のログが併せて記録される場合があります。 + +* `CLIENT`：クライアントがMCP proxyに送信したリクエスト +* `PROXY_UPSTREAM`：MCP proxyが個別のupstream MCP Serverに転送したリクエスト + +そのため、1つのユーザーリクエストに対してparent requestとupstream child requestが一緒に表示されることがあります。 + +#### Request Auditを開く + +1. `Admin > Audit > MCP > Request Audit`メニューに移動します。 +2. 画面を開くと、デフォルトでは当日のログが表示されます。 +3. 上部のfilterで条件を調整し、必要なログ範囲のみを再照会できます。 +4. 右上のrefreshボタンをクリックすると、現在の条件で一覧が再読み込みされます。 + +### Request Auditの検索とフィルター + +`Request Audit`画面では、次の条件がデフォルトのfilterとして提供されます。 + +* **Server**：特定のMCP Serverに関連するupstreamログのみを確認 +* **Event** : `ALLOW`、`DENY` +* **Request Scope** : `CLIENT`、`PROXY_UPSTREAM` +* **Executed At**：ログ発生日時の範囲 + +一覧はcursorベースで続けて照会され、スクロールすると次のログを追加で読み込めます。 + +### Request Audit一覧で確認できる情報 + +一覧のカラムは次のとおりです。 + +* **No**：ログの連番 +* **Executed At**：リクエストが記録された日時 +* **Request Origin**：`CLIENT`または`PROXY_UPSTREAM` +* **Root Request ID**：同じリクエストフローをまとめる上位リクエストID +* **Event**：権限またはポリシーの判定結果（`ALLOW`、`DENY`） +* **Status**：実際の処理結果（`SUCCESS`、`ERROR`） +* **Name**：リクエストを実行したユーザー名 +* **Email**：リクエストを実行したユーザーのメールアドレス +* **Client IP**：リクエストを送信したクライアントIP +* **Server**：対象MCP Server名 +* **Method**：MCP method名 +* **Client Tool Name**：クライアントがリクエストしたtool名 +* **Target Tool Name**：upstreamの対象として解釈されたtool名 +* **Duration**：処理時間（ms） + + +`Event`と`Status`は意味が異なります。 +たとえば、`Event`が`ALLOW`でも、実行中にエラーが発生すると`Status`は`ERROR`として記録されることがあります。 + + +### Request Auditの詳細を表示する + +一覧の行をクリックすると、detail drawerが開きます。 + +detail drawerでは、次の情報を確認できます。 + +#### Request Info + +* **Request ID**：個別のaudit logレコードの一意なID +* **Root Request ID**：同じリクエストチェーンに属するログをまとめるID +* **Request Origin**：`CLIENT`または`PROXY_UPSTREAM` +* **Executed At**：リクエストが記録された日時 +* **Server**：対象MCP Server名 +* **Method**：MCP methodとtool名 +* **Client Tool Name**：クライアント側のtool名 +* **Target Tool Name**：実際のupstream対象tool名 +* **Transport**：upstream MCP Serverとの通信に使用したtransport +* **Upstream Endpoint**：upstream MCP Serverのendpoint +* **HTTP Status**：HTTP処理ステータスコード +* **Event**：許可または拒否イベント +* **Status**：成功または失敗ステータス +* **Duration**：処理時間 +* **Denied Reason**または**Error**：拒否理由またはエラーメッセージ + +#### Subject Info + +* **Name** +* **Email** +* **Subject ID** + +#### Client Info + +* **Client IP** +* **User Agent** + +#### Payload + +payloadが保存されている場合は、**Payload**セクションでリクエスト本文をJSON形式で確認できます。 + +ただし、payloadを表示するかどうかはaudit設定によって異なります。 + +* client-originated requestは、`Admin > MCP Servers > General > Configurations`のclient audit payload設定の影響を受けます。 +* upstream requestは、各MCP Serverのdetail pageにある**Include payload in Request Audit**設定の影響を受けます。 + +また、機密情報と判断された値は、そのまま保存されずマスキングされる場合があります。 + + +現在のadminの`Request Audit` detail画面には**Payload**が表示されますが、内部で保存される可能性があるresponse本文を別のセクションとして公開することはありません。 + + +### Request Auditを解釈する際の参考事項 + +* `Root Request ID`が同じログは、同じリクエストフローで発生したものとみなせます。 +* `CLIENT`ログは、ユーザーがMCP proxyに送信したリクエストを意味します。 +* `PROXY_UPSTREAM`ログは、proxyが特定のMCP Serverに転送したdownstreamリクエストを意味します。 +* `Server`、`Transport`、`Upstream Endpoint`、`Target Tool Name`は、主に`PROXY_UPSTREAM`ログで意味を持ちます。 +* `CLIENT`ログでは、server情報が空の場合があります。 diff --git a/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/_meta.ts b/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/_meta.ts new file mode 100644 index 000000000..524e02806 --- /dev/null +++ b/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'mongodb-document-db-privilege-type-mapping': 'MongoDB / Document DB Privilege Type Mapping', +}; diff --git a/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx b/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx new file mode 100644 index 000000000..c7ccc1671 --- /dev/null +++ b/src/content/ja/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx @@ -0,0 +1,34 @@ +--- +title: 'MongoDB / Document DB Privilege Type Mapping' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288549894/MongoDB+Document+DB+Privilege+Type+Mapping' +--- + +# MongoDB / Document DB Privilege Type Mapping + +MongoDBおよびDocument DBの各構文に対応するprivilegeタイプは、次の表のようにマッピングされます。 + +| **区分** | **Privilege Type** | **MongoDB / Document DB** | +| -------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | +| DML | Select | ~.find(), ~.findOne(), 一般的な~.aggregate() | +| DML | Select + Delete | ~.findOneAndDelete(), findAndModify `{ remove: true }` | +| DML | Select + Update | ~.findOneAndUpdate(), ~.findOneAndReplace(), findAndModify `{ update: ... }`
upsert: trueの場合はInsertを追加 | +| DML | Update | ~.update(), ~.updateOne(), ~.updateMany(), ~.replaceOne()
upsert: trueの場合はInsertを追加 | +| DML | Insert + Create | ~.insert(), ~.insertOne(), ~.insertMany()
対象collectionが存在しない場合はCreateを追加 | +| DML | Select + Insert + Update | aggregateの最終stage：$merge
target collectionが存在しない場合はCreateを追加 | +| DML | Select + Insert + Create + Rename + Delete | aggregateの最終stage：$out | +| DCL | Grant | db.grantRolesToUser(), db.grantRolesToRole(), db.grantPrivilegesToRole() | +| DCL | Revoke | db.revokeRolesFromUser(), db.revokeRolesFromRole(), db.revokePrivilegesFromRole() | +| DCL | Alter | db.updateUser() | +| DCL | Update | db.updateRole() | +| DDL | Create | ~.createIndex(), ~.createIndexes(), db.createCollection(), db.createView(), db.createUser(), db.createRole() | +| DDL | Drop | ~.drop(), db.dropDatabase(), db.dropUser(), db.dropAllUsers(), db.dropRole(), db.dropAllRoles() | +| DDL | Rename | ~.renameCollection() | +| Others | Etc. | ~.commitTransaction(), ~.abortTransaction(), ~.startTransaction() | + +
+Privilege Typeの作成例 +
+Privilege Typeの作成例 +
+
+
diff --git a/src/content/ja/administrator-manual/general/user-management/authentication/_meta.ts b/src/content/ja/administrator-manual/general/user-management/authentication/_meta.ts index eea5ec5b1..f292368e7 100644 --- a/src/content/ja/administrator-manual/general/user-management/authentication/_meta.ts +++ b/src/content/ja/administrator-manual/general/user-management/authentication/_meta.ts @@ -1,6 +1,6 @@ export default { - 'integrating-with-ldap': 'LDAP連携', 'integrating-with-okta': 'Okta連携', + 'integrating-with-ldap': 'LDAP連携', 'integrating-with-aws-sso': 'AWS SSO連携', 'integrating-with-google-saml': 'Google SAML連携', 'setting-up-multi-factor-authentication': 'Multi-Factor Authentication設定', diff --git a/src/content/ja/administrator-manual/mcp-server.mdx b/src/content/ja/administrator-manual/mcp-server.mdx new file mode 100644 index 000000000..c1e992a9e --- /dev/null +++ b/src/content/ja/administrator-manual/mcp-server.mdx @@ -0,0 +1,12 @@ +--- +title: 'MCP Server' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167636017' +--- + +# MCP Server + +## サブドキュメント + +- [MCP Server Connection Management](./mcp-server/mcp-server-connection-management) +- [MAC General Configurations](./mcp-server/mac-general-configurations) +- [MCP Access Control](./mcp-server/mcp-access-control) diff --git a/src/content/ja/administrator-manual/mcp-server/_meta.ts b/src/content/ja/administrator-manual/mcp-server/_meta.ts new file mode 100644 index 000000000..bf01d1a17 --- /dev/null +++ b/src/content/ja/administrator-manual/mcp-server/_meta.ts @@ -0,0 +1,5 @@ +export default { + 'mcp-server-connection-management': 'MCP Server Connection Management', + 'mac-general-configurations': 'MAC General Configurations', + 'mcp-access-control': 'MCP Access Control', +}; diff --git a/src/content/ja/administrator-manual/mcp-server/mac-general-configurations.mdx b/src/content/ja/administrator-manual/mcp-server/mac-general-configurations.mdx new file mode 100644 index 000000000..096d43bea --- /dev/null +++ b/src/content/ja/administrator-manual/mcp-server/mac-general-configurations.mdx @@ -0,0 +1,63 @@ +--- +title: 'MAC General Configurations' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167144528/MAC+General+Configurations' +--- + +# MAC General Configurations + +### Overview + +QueryPie MCP Access ControlのGeneral設定では、Client-oriented requestの監査範囲やforward proxy設定など、グローバルセキュリティ設定を構成できます。 + +QueryPie MCP Access Controlのセキュリティ監査記録は、2つの範囲に分かれています。
MCP Client – :1_one_circle_red: `Client-oriented request` --> QueryPie MAC – :2_two_circle_red: `upstream request` --> Remote MCP Server + +General Configurationでは、Client-oriented requestのイベントを記録するかどうかを設定します。 +upstream requestのイベント記録は、各MCP Serverの設定で制御します。 + +インターネットアクセスが遮断されている場合は、forward proxyサーバーを経由してremote MCP Serverと通信するように構成できます。 + +
+Admin > MCP Servers > General > Configurations +
+Admin > MCP Servers > General > Configurations +
+
+ +Masking patternを使用すると、MCP Serverから受信したレスポンスを正規表現に基づいてマスキングできます。 + +### Client Request AuditおよびInclude payload in Client Request Audit + +* Client Request Audit：デフォルトはEnableです。有効な場合、ClientがMCP Serverに送信したリクエストのイベントを、MCP ClientとQueryPie MACの間の区間で記録します。 +* Include payload in Client Request Audit：デフォルトはEnableです。Client Request Auditイベントのpayload内容も記録します。 + +### Forward Proxy + +`Admin > MCP Servers > General > Configurations`画面の**Forward Proxy**は、MCP接続に共通して適用されるグローバルネットワーク設定です。 + +* **Enable Forward Proxy**をオンにすると、**Host**と**Port**を入力でき、必要に応じて**Username**と**Password**も設定できます。 +* この設定は、adminの`Test Connection`、`Sync Tools`、OAuth関連のupstream呼び出し、およびruntimeのMCP proxy upstream接続に共通して適用されます。 +* remote MCP Serverに直接到達できない環境では、この**Forward Proxy**設定が必要になる場合があります。 +* QueryPieとMCP proxyがremote MCP Serverにネットワーク経由で直接アクセスできる場合は、Forward Proxyなしでも接続できます。 + +### Masking Patterns + +
+Admin > MCP Servers > General > Masking Patterns +
+Admin > MCP Servers > General > Masking Patterns +
+
+ +デフォルトでは25個の定義済みマスキングパターンが提供され、カスタムマスキングパターンを追加して管理することもできます。 + +* Detecting Pattern：機密情報を検出するパターン +* Masking Pattern：機密情報をマスキングするパターン +* Masking Pattern Preview：マスキングパターンを適用した結果のプレビュー +* Sample Data：サンプルデータ +* Detected Data：サンプルデータ内でDetecting Patternによって機密情報として検出された領域（青色の網掛け） +* PreviewテーブルのMasked Dataで、サンプルデータに対する機密情報のマスキング結果を確認できます + +`Save`ボタンをクリックすると、変更内容が保存されます。 + +マスキングパターンを削除するには、`Delete`ボタンをクリックし、確認モーダルでもDeleteボタンをクリックします。 +または、Masking Patterns一覧で削除するアイテムをチェックボックスで選択し、Deleteボタンをクリックします。 diff --git a/src/content/ja/administrator-manual/mcp-server/mcp-access-control.mdx b/src/content/ja/administrator-manual/mcp-server/mcp-access-control.mdx new file mode 100644 index 000000000..9c6e09628 --- /dev/null +++ b/src/content/ja/administrator-manual/mcp-server/mcp-access-control.mdx @@ -0,0 +1,189 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167799919/MCP+Access+Control' +--- + +import { Callout } from 'nextra/components' + +# MCP Access Control + +### Overview + +MCP Access Controlは、QueryPieに登録されたMCP Serverと、そのサーバーが提供するToolに対して、どのユーザーまたはグループがアクセスできるかをRoleとPolicyに基づいて管理する機能です。 +バージョン11.6.1以降で使用できます。 + +この機能を使用すると、次の操作を実行できます。 + +* ユーザーまたはグループごとに、MCPアクセス権限の付与状況を照会できます。 +* 特定のユーザーまたはグループに、1つ以上のMCPロールを付与または回収できます。 +* ロールに紐づくポリシーに基づいて、そのユーザーまたはグループが実際にアクセスできるMCP Server一覧を確認できます。 +* ロールごとに有効期限を設定し、一定期間後にアクセス権限が自動的に整理されるように運用できます。 +* ロールの付与・回収履歴に基づいて、アクセス権限の変更内容を追跡できます。 + +つまり、MCP Access Controlは単に「どのMCP Serverに接続できるか」を管理するだけでなく、MCP Serverの利用権限をロール単位で標準化し、ポリシーと有効期限を併せて適用することで運用上の統制を可能にする管理機能です。 + +この画面では、ユーザーまたはグループごとに現在付与されているロール数を確認し、詳細画面でロールを追加付与または回収できます。 +ロールに紐づくポリシーと、その結果アクセス可能になるMCP Server一覧も併せて確認できます。 + + +MCPアクセス権限は、ユーザーにサーバーを直接割り当てるのではなく、ユーザーまたはグループにロールを付与する方式で管理します。 +実際にアクセスできるサーバーは、付与されたロールに紐づくポリシーによって決まります。 + + +### メニューと権限 + +* メニューパス：`Admin > MCP > MCP Access Control > Access Control` +* 必要な権限：`PERMISSION_MAC_ACL` + +同じ`MCP Access Control`メニューには、次の画面も用意されています。 + +* **Access Control**：ユーザーまたはグループごとのロール付与状況を管理 +* **Roles**：MCPロール定義を管理 +* **Policies**：MCPポリシー定義を管理 + +### MCP Access Controlを照会する + +登録済みのユーザーまたはグループごとに、MCPアクセス制御の状況を確認します。 + +1. `Admin > MCP > MCP Access Control > Access Control`メニューに移動します。 +2. 一覧でユーザーまたはグループごとのアクセス制御状況を確認します。 +3. 検索ボックスで、次の条件を使用して一覧を絞り込めます。 + * **Name** + * **Email** +4. 右上のrefreshボタンをクリックすると、一覧が再読み込みされます。 + +一覧のカラムは次のとおりです。 + +* **User Type**：`USER`または`GROUP` +* **Provider**：アカウントが属する認証プロバイダー +* **Name**：ユーザー名またはグループ名 +* **Email**：ユーザーアカウントのメールアドレス。グループの場合は`-`と表示されます。 +* **Members**：グループの場合はメンバー一覧が表示されます。ユーザーアカウントの場合は`-`と表示されます。 +* **Roles**：現在付与されているMCPロール数 + + +現在のUIでは、`Access Control`一覧からユーザーを直接作成したり、サーバーを直接選択して権限を追加したりするためのボタンは提供されていません。 +まずユーザーまたはグループを選択し、詳細画面でロールを付与する方法でアクセス権限を管理します。 + + +### ユーザーまたはグループのアクセス制御詳細を表示する + +特定のユーザーまたはグループに付与されているロールを詳しく確認します。 + +1. `Access Control`一覧で、照会するユーザーまたはグループをクリックします。 +2. 詳細画面の上部で、次のmetadataを確認できます。 + * **Type**：ユーザーまたはグループ + * **Members**：グループの場合はメンバー数 + * **Created**：作成日時と作成者 + * **Updated**：最終更新日時と更新者 +3. 詳細画面は、次の2つのtabで構成されます。 + * **Roles**：現在付与されているロール一覧 + * **Accessible Servers**：現在のロールに基づいてアクセスできるMCP Server一覧 + +### ロールを付与する + +ユーザーまたはグループに、1つ以上のMCPロールを付与します。 + +1. アクセス制御の詳細画面で`Roles`タブに移動します。 +2. 右側の`Grant Role`ボタンをクリックします。 +3. `Grant Role`ポップアップで、付与するロールを選択します。 + * ロール一覧には、現在のユーザーまたはグループにまだ付与されていないロールのみが表示されます。 + * 検索ボックスで**Name**を基準にロールを検索できます。 +4. ロール一覧で次の情報を確認できます。 + * **Name**：ロール名。クリックすると該当ロールの詳細画面に移動できます。 + * **Description**：ロールの説明 + * **Assigned Policies**：ロールに紐づくポリシー一覧 +5. **Expiration Date**を選択します。 + * デフォルトは現在から1年後の日付です。 + * 保存時には、選択した日の終了時刻（end of day）が有効期限として保存されます。 + * 有効期限の日付は必須入力項目です。 +6. `Grant Role`ボタンをクリックして保存します。 + + +付与できるロールがない場合、ポップアップのロール一覧は空になり、追加のロールを付与できません。 + + +### 付与済みロールを照会する + +ユーザーまたはグループに現在付与されているロール一覧を確認します。 + +1. アクセス制御の詳細画面で`Roles`タブに移動します。 +2. 検索ボックスで**Name**を基準にロールを検索できます。 +3. 一覧で次の情報を確認できます。 + * **Name**：ロール名 + * **Description**：ロールの説明 + * **Expiration**：ロールの有効期限。すでに期限切れの場合は`（期限切れ）`と表示されます。 + * **Granted At**：ロールが付与された日時 + * **Last Access**：そのロールで最後にアクセスした日時。アクセス履歴がない場合は`なし`と表示されます。 + * **Granted By**：ロールを付与したユーザー + +### 付与済みロールの詳細を表示する + +付与済みロールを1つ選択し、ロール情報と紐づくポリシーを確認します。 + +1. アクセス制御の詳細画面にある`Roles`タブで、ロールの行をクリックします。 +2. 右側の詳細drawerで、次の情報を確認できます。 + * **Role Name** + * **Description** + * **Granted At** + * **Granted By** + * **Expiration Date** + * **Last Access** +3. drawer下部の**Policies**セクションで、このロールに紐づくポリシー一覧を確認できます。 + * **Name** + * **Description** + * **Version** + * **Assigned At** + * **Assigned By** + + +ロールに紐づくポリシーがない場合、ポリシーテーブルは空です。 + + +### ロールを回収する + +ユーザーまたはグループに付与されているロールを回収します。 + +1. アクセス制御の詳細画面で`Roles`タブに移動します。 +2. 回収するロールを1つ以上選択します。 +3. 上部に表示される`Revoke`ボタンをクリックします。 +4. 確認ポップアップで承認すると、選択したロールが回収されます。 + + +ロールの回収では複数選択をサポートしています。 + + +### アクセス可能なサーバーを照会する + +現在のユーザーまたはグループがアクセスできるMCP Server一覧を確認します。 + +1. アクセス制御の詳細画面で`Accessible Servers`タブに移動します。 +2. 検索ボックスで**Name**を基準にサーバーを検索できます。 +3. 一覧で次の情報を確認できます。 + * **Name**：サーバーの表示名 + * **Identifier**：サーバー識別子（name） + * **Endpoint**：MCP Serverのendpointアドレス + * **Tools**：MCP Serverが提供するtool数 + + +付与されたロールがない場合、またはロールに紐づくポリシーによってアクセスできるサーバーがない場合、サーバー一覧は空です。 + + + +**運用時の参考事項** +* `Access Control`画面は、ユーザーまたはグループを中心にアクセス権限を管理する画面です。 +* 実際のアクセス対象サーバーはロールに紐づくポリシーから算出されるため、ロールのみを付与し、ポリシーが適切に紐づいていない場合は、アクセス可能なサーバーが表示されないことがあります。 +* ロールの有効期限が過ぎると、アクセス権限は自動回収の対象になります。 +* ロールの付与・回収履歴は、別のAuditメニューである`Admin > Audit > MCP > MCP Server Role History`で確認できます。 +* `MCP Server Role History`画面では、誰がどのユーザーまたはグループにどのロールを付与または回収したかを追跡できます。 +* この画面では、通常次の情報を確認します。 + * **Event**：ロール付与または回収イベント + * **User Type**：`USER`または`GROUP` + * **Name**：ユーザー名またはグループ名 + * **Email**：ユーザーのメールアドレス + * **Role Name**：付与または回収されたロール名 + * **Expiration Date**：ロールの有効期限 + * **Action By**：操作を実行したユーザー + * **Action At**：操作日時 +* 詳細画面では、その履歴に紐づくロール情報とポリシー一覧も確認できるため、特定時点のアクセス権限変更の根拠を監査する際に役立ちます。 + diff --git a/src/content/ja/administrator-manual/mcp-server/mcp-server-connection-management.mdx b/src/content/ja/administrator-manual/mcp-server/mcp-server-connection-management.mdx new file mode 100644 index 000000000..09b224e28 --- /dev/null +++ b/src/content/ja/administrator-manual/mcp-server/mcp-server-connection-management.mdx @@ -0,0 +1,153 @@ +--- +title: 'MCP Server Connection Management' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167242794/MCP+Server+Connection+Management' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Connection Management + +### Overview + +MCP Server Connection Managementは、QueryPieが外部のMCP（Model Context Protocol）Serverに接続できるようにサーバー情報を登録し、connection settings、credential settings、audit settings、tool synchronization statusを管理する機能です。 + +この画面では、次の操作を実行できます。 + +* MCP Server一覧を照会できます。 +* 新しいMCP Serverを登録できます。 +* 登録済みMCP ServerのBasic Information、Connection Settings、Audit Settingsを変更できます。 +* サーバーが提供するTools一覧を同期して照会できます。 +* 必要に応じて、登録済みMCP Serverを削除できます。 + + +QueryPieの`Web Base URL`が設定されていない場合、OAuth callback URLを作成できないため、OAuthを使用するMCP Serverに対して`Connect`を開始できません。[Web Base URLの詳細](../../installation/container-environment-variables/querypieweburl) + + +### MCP Server一覧を照会する + +登録済みMCP Serverの一覧を確認します。 + +
+Admin > MCP Servers > Connection Management > MCP Servers +
+Admin > MCP Servers > Connection Management > MCP Servers +
+
+ +1. `Admin > MCP Servers > Connection Management > MCP Servers`メニューに移動します。 +2. 一覧でサーバー情報を確認します。 +3. 右上の`Create Server`ボタンから新しいサーバーを登録できます。 +4. refreshボタンをクリックすると、一覧が再読み込みされます。 +5. 一覧で特定のサーバーをクリックすると、detail pageに移動します。 + +一覧のカラムは次のとおりです。 + +* **Name**：サーバーのdisplay name +* **Identifier**：内部のserver name値 +* **Endpoint**：MCP Serverのアドレス +* **Transport**：接続に使用するtransportタイプ +* **Tools**：同期済みtool数 +* **Audit**：Request Auditが有効かどうか +* **Updated**：最終更新日時 + +### MCP Serverを追加する + +新しいMCP Serverを登録します。 + +1. `Create Server`ボタンをクリックします。 +2. **Basic Information**セクションに次の項目を入力します。 + * **Identifier：** 内部で使用するremote MCP Serverの識別名です。大文字は使用できません。一度作成すると変更できません。 + * **Name：** remote MCP Serverのdisplay nameです。 + * **Icon：** 任意のアイコンをアップロードして登録できます。 + * **Description：** remote MCP Serverの説明を入力します。 +3. **Connection Settings**セクションに次の項目を入力します。 + * **Endpoint URL：** remote MCP Serverに接続するendpoint URLを入力します。 + * **Transport：** remote MCP Serverのtransportタイプを選択します。SSEまたはStreamable HTTPのいずれかを選択します。 + * **Credential Mode：** None、QueryPie Registered Credential、User OAuthのいずれかを選択します。 + * None：remote MCP Serverが認証を要求しない場合に使用します。 + * QueryPie Registered Credential：QueryPie MACで認証トークンを管理する場合に選択します。QueryPie Registered Credentialを選択するとQueryPie Upstream Access Token入力欄が表示されるため、MCP Serverの認証トークンを入力します。**MCP Serverの認証トークンはMACでは生成されません。該当サービスでMCP利用用の認証トークンを生成する必要があるため、詳しい生成方法は各サービスのガイドを参照してください。** + * User OAuth：remote MCP Serverの認証方式がOAuthの場合に使用します。管理者は、MCP Serverで利用可能なtool一覧を照会するため、ユーザーに代わってOAuth認証を行う必要があります。これはユーザー自身のOAuth認証とは関係なく、tool一覧の照会にのみ使用されます。 +4. 必要に応じて`Test Connection`を実行し、現在入力した値で接続できるか確認します。 +5. **Audit Settings**セクションでrequest audit関連のオプションを設定します。 + * 以下の「Audit Settingsについて」を参照してください。 +6. `Save`ボタンをクリックして保存します。 + + +`Test Connection`、その後の`Sync Tools`、OAuth関連のupstream通信は、すべてMCPのグローバル**Configurations**にある**Forward Proxy**設定の影響を受ける場合があります。 + + +### Audit Settingsについて + +MCP Access Controlのaudit設定では、監査対象の範囲が2層に分かれています。 + +* 各MCP Serverのdetail pageにある**Audit Settings**：特定のupstream MCP Serverに転送されるリクエストに対するサーバー別のaudit設定 +* `Admin > MCP Servers > General > Configurations`のaudit設定：MCPクライアントがQueryPie MACに送信したリクエストに対するグローバルaudit設定 + +そのため、request auditを解釈するときは、どの設定がどの範囲のログに適用されるかも併せて確認する必要があります。 + +#### 監査対象範囲：QueryPie MAC～Remote MCP Server + +* 各MCP ServerのAudit SettingsでEnable Request Auditオプションを有効にした場合、
QueryPie MACが該当するRemote MCP Serverに転送するupstream requestをrequest audit logに記録します。 + * MCP Server一覧画面の**Audit**カラムにも、この値が反映されます。 + * このオプションをオフにすると、そのサーバーに対するupstream request audit logは記録されません。 + * request audit logは`Admin > Audit > MCP > Request Audit`メニューで確認します。 +* 各MCP ServerのAudit SettingsでInclude payload in Request Auditオプションを有効にした場合、
該当するMCP Serverのrequest audit logにpayloadとresponseを併せて保存します。 + * upstream request自体の記録に加えて、audit recordにpayloadとresponseも含まれます。 + * `Enable Request Audit`が有効な場合にのみ使用できます。 + * `Enable Request Audit`をオフにすると、このオプションは無効になり、保存時に値もオフになります。 + +#### 監査対象範囲：MCP Client～QueryPie MAC + +`Admin > MCP Servers > General > Configurations`画面には、client-originated auditに対するグローバル設定があります。 + +* Client Request Audit：このオプションをオンにすると、クライアントがQueryPie MACに送信したMCPリクエストをaudit logに記録します。 + * 監査対象は個別のupstream MCP Serverではなく、client-originated MCP requestです。 + * 無効にすると、client request audit event自体が作成されません。 +* Include payload in Client Request Audit：このオプションをオンにすると、client-originated MCP request audit logにpayloadとresponseを併せて保存します。 + * `Client Request Audit`が有効な場合にのみ画面に表示されます。 + * 無効にするとclient request audit eventは記録されますが、payloadとresponseの本文は除外されます。 + +### MCP Serverを変更する + +既存のMCP Server設定を変更します。 +MCP ServerのTool同期は、MCP Serverを登録した後、編集detail画面でのみ実行できます。 + +1. MCP Server一覧で変更するサーバーをクリックします。 +2. detail pageで次のセクションを確認し、変更できます。 + * **Basic Information** + * **Connection Settings** + * **Audit Settings** + * **Tools**
登録済みMCP Serverが提供するtool一覧を同期します。
認証が必要な場合は、認証後に同期できます。 + * `Sync Tools`ボタンをクリックします。 + * 同期が完了すると、検出されたtool数と最終同期日時を確認できます。 + * Tools tableでは、次の情報を照会できます。 + * Tool Name：tool名です。 + * Description：toolの詳細な説明です。 + * Last Synced：最終同期日時です。 +3. 変更後に`Save Changes`をクリックします。 + + +サーバー編集画面では、**Identifier**は読み取り専用で変更できません。 + + +### MCP Serverを削除する + +登録済みMCP Serverを削除します。 + +1. 一覧から1つ以上のサーバーを選択します。 +2. 削除操作を実行します。 +3. 確認メッセージで承認すると、選択したサーバーが削除されます。 + +detail pageから単一のサーバーを削除することもできます。 + + + +**運用時の参考事項** +* サーバー作成時のデフォルトでは、**Enable Request Audit**と**Include payload in Request Audit**の両方が有効です。 +* サーバーdetail pageの**Include payload in Request Audit**は単独では有効にできず、常に**Enable Request Audit**に依存します。 +* `Admin > MCP Servers > General > Configurations`の**Client Request Audit**と**Include payload in Client Request Audit**もデフォルトで有効です。 +* **Client Request Audit**系列の設定とサーバー別の**Request Audit**系列の設定には継承関係がなく、それぞれ異なるrequest scopeに適用される個別の設定です。 +* remote MCP Serverにインターネット経由で直接接続できない場合は、`Admin > MCP Servers > General > Configurations`の**Forward Proxy**設定が必要になることがあります。forward proxyは組織側で別途用意する必要があり、QueryPie MACはproxyサーバーを提供しません。 +* サーバーdetail pageでは、Tools一覧を別途同期して最新のサーバー状態を反映する必要があります。 +* Credential ModeがUser OAuthの場合は、detail pageでadmin OAuth connection statusを別途確認できます。 + diff --git a/src/content/ja/support/_meta.ts b/src/content/ja/support/_meta.ts index d27d597eb..cbe352ab4 100644 --- a/src/content/ja/support/_meta.ts +++ b/src/content/ja/support/_meta.ts @@ -1,3 +1,4 @@ export default { 'premium-support': 'プレミアムサポート', + 'querypie-acp-operational-log-collection-guide': 'QueryPie ACP運用ログ収集ガイド', }; diff --git a/src/content/ja/support/premium-support.mdx b/src/content/ja/support/premium-support.mdx index f64a64dab..dc72d1761 100644 --- a/src/content/ja/support/premium-support.mdx +++ b/src/content/ja/support/premium-support.mdx @@ -31,7 +31,7 @@ Customer Portalは、QueryPieと直接契約しているお客様のみご利用 * バグレポート - バグおよびエラーの報告 -機能追加や改善に関するお問い合わせは、メールでご依頼ください。[ai_connection@querypie.com](mailto:ai_connection@querypie.com) +機能追加や改善に関するお問い合わせは、メールでご依頼ください。[AI_Connect@querypie.com](mailto:AI_Connect@querypie.com) #### アップグレードおよび定期メンテナンス diff --git a/src/content/ja/support/querypie-acp-operational-log-collection-guide.mdx b/src/content/ja/support/querypie-acp-operational-log-collection-guide.mdx new file mode 100644 index 000000000..8bcc3c1db --- /dev/null +++ b/src/content/ja/support/querypie-acp-operational-log-collection-guide.mdx @@ -0,0 +1,346 @@ +--- +title: 'QueryPie ACP運用ログ収集ガイド' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288353307/QueryPie+ACP' +--- + +import { Callout } from 'nextra/components' + +# QueryPie ACP運用ログ収集ガイド + +### Overview + +障害分析やテクニカルサポートへの情報提供が必要な場合は、症状に応じてQueryPie Serverの運用ログと診断データを収集する必要があります。 +このドキュメントでは、運用環境で最初に確保する基本ログ、追加で必要な場合にのみ収集するデータ、および提出時に併せて整理する情報について説明します。 + +基本収集の対象には、可能な限り障害発生時刻の前後を含めてください。 +再現できる場合は再現時刻も記録すると、ログを照合しやすくなります。 + +### 基本収集項目 + +問題の分析が必要な場合は、次の4項目を優先して収集します。 + +1. QueryPieファイルログ +2. コンテナの標準出力ログ +3. `/api/config/monitoring` dump +4. Multi AgentまたはWindows Server Agentログ + + +症状ごとに、常にすべてのログを収集する必要はありません。 +ただし、原因の範囲が広い問題や再現が難しい問題では、4つの基本収集項目をまとめて確保することをお勧めします。 + + +### QueryPieファイルログを収集する + +ファイルログは、各コンポーネントが`/var/log/querypie`配下に出力するアプリケーションログです。 +コンテナ内のパスは同じですが、ホストから見えるパスはバージョンによって異なる場合があります。 + +#### ログパスを確認する + +1. QueryPieのバージョンを確認します。 +2. ホスト上のログパスを確認します。 + * `9.x ~ 10.4.x` : `/var/log/querypie` + * `11.0.x+`：通常はcomposeファイルの親ディレクトリにある`log`パス +3. 必要に応じて、appコンテナ内でもログパスを直接確認します。 + +ホストからファイルログを直接確認する例は次のとおりです。 +``` +ls -al ../log +``` + +ホストパスが`/var/log/querypie`の環境では、次のように確認できます。 +``` +ls -al /var/log/querypie +``` + +appコンテナ内でファイルログを確認する例は次のとおりです。 +``` +docker exec -it querypie-app-1 sh +ls -al /var/log/querypie +``` + +#### ファイルログを圧縮する + +1. 障害発生時刻の前後のログを収集するディレクトリを用意します。 +2. `api`、`engine`、`nginx`、`proxy`関連のログが含まれていることを確認します。 +3. 環境に適したパスを基準に圧縮します。 +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz -C .. log +``` + +ホストパスが`/var/log/querypie`の環境では、次のように収集できます。 +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz /var/log/querypie +``` + +### コンテナの標準出力ログを収集する + +ファイルログと併せて、コンテナの`stdout`と`stderr`のログも収集します。 + +1. appコンテナのログを保存します。 +2. `tools` profileが実行中の場合は、toolsログも保存します。 +``` +mkdir -p support-logs +docker logs querypie-app-1 > support-logs/app.docker.log 2>&1 +docker logs querypie-tools-1 > support-logs/tools.docker.log 2>&1 || true +``` + + +thread dump fallbackで`kill -3`を使用した場合、通常は結果がコンテナの標準出力に残ります。この場合、`docker logs`の収集が特に重要です。 + + +### monitoring dumpを収集する + +API hang、レスポンス遅延、deadlockが疑われる場合は、まず`/api/config/monitoring`を使用します。 + +
+例：https://<QueryPieのアドレス>/api/config/monitoring +
+例：https://<QueryPieのアドレス>/api/config/monitoring +
+
+ + +1. Ownerアカウント、または`SYSTEM_PROPERTIES`権限を持つアカウントでログインします。 +2. ブラウザで`/api/config/monitoring`画面に移動します。 +3. 必要な時間範囲を確認します。
`Create New Dump`ボタンをクリックして、新しいDumpファイルを作成することもできます。 +4. 次のいずれかを選択します。 + * dumpのみをダウンロード + * `Dumps + All Logs`でdumpとアプリケーションログをまとめてダウンロード + + +`Dumps + All Logs`機能の`logHome`のデフォルト値は`/var/log/querypie`です。 +カスタムログパスを使用する環境では、実際のログホームパスを確認してから使用してください。 + + + +monitoring dumpの圧縮ファイルには`thread.dump`が含まれます。ファイルログと一緒に提出すると、分析を大幅に迅速化できます。 + + + +**monitoring dumpが自動生成される場合** + +次の条件では、monitoring dumpが自動生成される場合があります。 + +* MetaDBまたはLogDB connection poolのidle connectionが、最大pool sizeの10%以下に低下した場合 +* `SQLTransientConnectionException`が発生し、メッセージに`Connection is not available, request timed out after`が含まれる場合 + +自動dumpは、10分以上の間隔を空けて生成されます。 +短時間に同じ症状が繰り返されても、毎回新しいdumpが作成されるとは限りません。 + + +### ログレベルを一時的に変更する + +基本ログだけでは原因を特定できない場合に限り、一時的にdebugレベルに上げて再現ログを収集します。 + +1. debugレベルに変更する前の時刻を記録します。 +2. 対象コンポーネントのログレベルを上げます。 +3. 同じ症状を再現します。 +4. ログを収集します。 +5. 元のレベルに戻します。 + 1. デフォルトのログレベルは、`api`が`warn`、その他の`engine`、`arisa`、`cabinet`、`kubepie`、`rotatepie`、`novas`が`info`です。（`arisa`はproxyコンポーネントです。） +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug api +``` + +すべてのコンポーネントに適用する場合は、componentを省略できます。 +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug +``` + +サポートされるcomponentは次のとおりです。 + +* `api` +* `engine` +* `arisa` +* `cabinet` +* `kubepie` +* `rotatepie` +* `novas` +* `all` + + +3番目の引数にtimeout（秒）を指定できます。 +debugレベルで長時間運用せず、収集が完了したら必ず元のレベルに戻してください。 +`docker exec -it querypie-app-1 /app/change-log-level.sh debug api 30` + + +### 症状別に優先して収集するログ + +すべてのコンポーネントのログを常にdebugに上げる必要はありません。 +次の基準で症状に合うログを先に収集し、必要な場合にのみ範囲を広げることをお勧めします。 + +| **症状 / シナリオ** | **優先して収集するログ** | **追加で確認するとよいログ** | +| ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------- | +| ログイン失敗、画面APIエラー、設定の保存失敗、承認リクエストの処理エラー | `api`ファイルログ、`docker logs querypie-app-1`、必要に応じて`api` debugログ | `nginx`ログ | +| Web画面が開かない、502/504、静的画面は表示されるがAPI呼び出しに失敗 | `nginx`ファイルログ、`docker logs querypie-app-1` | `api`ファイルログ | +| DAC接続は成功するがクエリ実行に失敗する、またはDBセッション作成やproxy接続が不安定 | `proxy`ファイルログ、`arisa`ファイルログ | `api`ログ、必要に応じて`arisa` debugログ | +| クエリ実行または結果照会の遅延、engine処理中の失敗、snapshot/analysis関連の処理異常 | `engine`ファイルログ | `api`ログ、必要に応じて`engine` debugログ、monitoring dump | +| KACクラスタ接続失敗、Kubernetesリソースの照会失敗、kubectlの動作異常 | `kubepie`ファイルログ | `api`ログ、必要に応じて`kubepie` debugログ | +| RotatePie関連のスケジュール処理またはrotation処理の異常 | `rotatepie`ファイルログ | 必要に応じて`rotatepie` debugログ | +| Nova、SSH、gateway連携関連の接続失敗 | `novas`ファイルログ | 必要に応じて`novas` debugログ、関連gatewayログ | +| Multi Agentベースの接続問題、ローカルアプリ接続失敗、WebViewエラー、特定のユーザーPCでのみ再現 | Multi Agentログ、`webView.log` | サーバー側の`proxy`、`api`ログ | +| SAC Windows Server Agent接続失敗、RDP timeout、特定のWindowsセッションでのみ再現 | Windows Server Agentサービスログ | ユーザー別Agentログ、Multi Agentログ、サーバー側の`proxy`/`api`ログ | +| API hang、レスポンス遅延、deadlock、DB connection pool不足の疑い | `/api/config/monitoring` dump、`api`ファイルログ | `engine`ログ、`docker logs`、thread dump fallback | + + +どのログから確認すべきか判断できない場合は、まず`api`、`nginx`、`docker logs`、`/api/config/monitoring` dumpを確保してください。接続またはproxy関連の症状では`proxy`または`arisa`を、クライアント関連ではMulti AgentまたはWindows Server Agentログを追加する方法が実用的です。 + + +### Multi Agentログを収集する + +Multi Agentを使用する環境では、desktop appのログも収集します。 + +1. 使用中のOSのログパスを確認します。 + * Windows: `%USERPROFILE%\.querypie-multi-agent\logs\` + * macOS: `$HOME/.querypie-multi-agent/logs/` + * Linux: `$HOME/.querypie-multi-agent/logs/` +2. 一般ログと`webView.log`を併せて確保します。 +3. 詳細ログが必要な場合は、`Diagnostic Tools > Enable Tracing`をオンにしてから再現します。 +4. 収集後にtracingを再度オフにします。 +5. 必要に応じて、`Diagnostic Tools > Export Log`で圧縮ファイルを作成します。 + + +アプリ起動時から詳細ログが必要な場合にのみ、`QPMA_TRACE=1`環境変数を設定して実行します。 +通常の運用状態では長時間使用しないことをお勧めします。 + + +### SAC Windows Server Agentログを収集する + +SACでWindows Server Agentを使用する環境では、agentログも収集します。 + +#### 基本サービスログを収集する + +1. Windows Serverで次のパスを確認します。 + * `%ProgramData%\QueryPie\Server Agent\Logs\` +2. まずサービスログを圧縮します。 +``` +$logRoot = "$env:ProgramData\QueryPie\Server Agent\Logs" +$outFile = "$env:TEMP\querypie-server-agent-logs.zip" +Compress-Archive -Path "$logRoot\*" -DestinationPath $outFile -Force +``` + +#### ユーザー別ログが必要な場合 + +特定のWindowsユーザーセッションでのみ再現する場合や、ユーザー別の動作確認が必要な場合は、次のパスも収集します。 + +* `%ProgramData%\QueryPie\Server Agent\Logs\Users\\` + +#### Verboseログが必要な場合 + +1. Windows ServerでPowerShellを起動します。 +2. 現在のLogLevelを確認します。 +``` +Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" | Select-Object LogLevel +``` + +3. 必要に応じて、LogLevelを`Verbose`に変更します。 +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Verbose" +``` + +4. 症状を再現してログを収集します。 +5. 収集後に`Information`へ戻します。 +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Information" +``` + + +RDP timeoutや接続失敗の問題を追跡する場合は、QueryPie Server側のProxy/APIログとユーザーPCのMulti Agentログも併せて提供すると、分析が容易になります。 + + +### 必要な場合にのみ追加収集する + +次のデータは、設定の問題、デプロイの差異、またはthread dump fallbackの分析が必要な場合にのみ追加で収集します。 + +#### 設定ファイルを収集する + +1. 現在のデプロイ設定ファイルを確認します。 +2. 機密情報をマスキングしてから提出します。 + +追加収集の対象例は次のとおりです。 + +* `.env`または`compose-env` +* `compose.yml`または`docker-compose.yml` +* `nginx.d/` +* カスタム設定ファイル +* `logrotate.d/querypie` + + +一部のcompose packageでは、`logrotate.d/querypie`がappコンテナの`/etc/logrotate.d/querypie`設定に直接リンクされている場合があります。 +ログのrotation動作や保持期間を確認する必要がある場合にのみ、追加で含めてください。 + + +#### JVM thread dump fallbackを収集する + +`/api/config/monitoring`へのアクセスが難しい場合や、コンテナ内でthread dumpを直接収集する必要がある場合にのみ使用します。 + +1. ホストからappコンテナに接続します。 +``` +docker exec -it querypie-app-1 bash +``` + +2. appコンテナ内でAPI Java PIDを探し、thread dumpを作成します。 +``` +ps -ef | grep '[a]pp/api/api.jar' +``` + +3. 使用できる場合は、`jcmd`でthread dumpを収集します。 +``` +jcmd Thread.print > /tmp/api-thread-dump.txt +``` + +4. appコンテナを終了した後、ホストからdumpファイルをコピーします。 +``` +docker cp querypie-app-1:/tmp/api-thread-dump.txt support-logs/api-thread-dump.txt +``` + +5. `jcmd`がない場合は、appコンテナ内で`kill -3`を使用します。 +``` +kill -3 +``` + + +この手順では、`commandpie-engine.jar`ではなく`/app/api/api.jar`プロセスのPIDを使用してください。 + + +### 提出時に併記する内容 + +ログファイルだけを提出すると分析に時間がかかる場合があるため、次の情報も併せて整理します。 + +| **項目** | **説明** | +| ------------------ | ---------------------------------------------------------------------- | +| 発生時刻 | 例：`2026-07-07 14:23 KST` | +| サーバーtimezone | ログ時刻を照合する際の基準 | +| 症状 | 例：ログイン後、特定のAPIレスポンスに30秒以上かかる | +| 再現可否 | 可能 / 不可能 | +| 再現手順 | 可能な場合は手順ごとに記録 | +| 再現時刻 | 再現を実行した実際の時刻 | +| 影響範囲 | 特定のユーザー、特定のサーバー、または全ユーザーか | +| 収集したログの種類 | ファイルログ、docker logs、monitoring dump、agentログなど | + +### チェックリストテンプレート + +``` +[基本情報] +- 発生時刻: +- サーバーのタイムゾーン: +- 症状: +- 影響範囲: +[再現情報] +- 再現可否: +- 再現手順: +- 再現時刻: +[収集ログ] +- ファイルログ: 収集済み / 未収集 +- docker logs: 収集済み / 未収集 +- monitoring dump: 収集済み / 未収集 +- Multi Agentログ: 該当なし / 収集済み / 未収集 +- Windows Server Agentログ: 該当なし / 収集済み / 未収集 +[追加収集] +- 設定ファイル: 収集済み / 未収集 +- JVM thread dump fallback: 収集済み / 未収集 +[追加説明] +- 特記事項: +``` diff --git a/src/content/ja/user-manual/_meta.ts b/src/content/ja/user-manual/_meta.ts index 59b6637e4..51071d920 100644 --- a/src/content/ja/user-manual/_meta.ts +++ b/src/content/ja/user-manual/_meta.ts @@ -5,6 +5,7 @@ export default { 'server-access-control': 'Server Access Control', 'kubernetes-access-control': 'Kubernetes Access Control', 'web-access-control': 'Web Access Control', + 'mcp-access-control': 'MCP Access Control', 'preferences': 'Preferences', 'user-agent': 'User Agent', 'multi-agent': 'Multi Agent', diff --git a/src/content/ja/user-manual/mcp-access-control.mdx b/src/content/ja/user-manual/mcp-access-control.mdx new file mode 100644 index 000000000..8dd9b2e2a --- /dev/null +++ b/src/content/ja/user-manual/mcp-access-control.mdx @@ -0,0 +1,10 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2168455203' +--- + +# MCP Access Control + +## サブドキュメント + +- [MACを使用してRemote MCP Serversを利用する](./mcp-access-control/using-remote-mcp-servers-through-mac) diff --git a/src/content/ja/user-manual/mcp-access-control/_meta.ts b/src/content/ja/user-manual/mcp-access-control/_meta.ts new file mode 100644 index 000000000..10ee685e5 --- /dev/null +++ b/src/content/ja/user-manual/mcp-access-control/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'using-remote-mcp-servers-through-mac': 'MACを使用してRemote MCP Serversを利用する', +}; diff --git a/src/content/ja/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx b/src/content/ja/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx new file mode 100644 index 000000000..ddf4ae3e2 --- /dev/null +++ b/src/content/ja/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx @@ -0,0 +1,179 @@ +--- +title: 'MACを使用してRemote MCP Serversを利用する' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2166816845/MAC+Remote+MCP+Servers' +--- + +import { Callout } from 'nextra/components' + +# MACを使用してRemote MCP Serversを利用する + +### Overview + +`MCP Servers`は、自分に許可されたremote MCP Serverを照会し、QueryPieが提供するMCP endpointを介して外部MCP Clientと接続するためのユーザー画面です。 +この画面では、自分に許可されたサーバー一覧を確認し、サーバーごとの`Basic Info`、`Tools`、`Accessible Roles`情報を照会できます。MCP ServerのCredential Modeが「`User OAuth`」（管理者ページで設定）の場合は、upstream OAuth接続も自分で実行できます。 + +
+image-20260605-035129.png +
+ +このドキュメントでは、ユーザーページで次の操作を実行する方法について説明します。 + +* 自分がアクセスできるMCP Server一覧を確認する +* MCP Clientごとの接続ガイドを確認する +* サーバーごとの**Basic Info**、**Tools**、**Accessible Roles**を確認する +* 必要に応じてupstream OAuth接続を実行する + +
+User > MCP Servers +
+User > MCP Servers +
+
+ +### はじめる前に + +次の条件を満たしている必要があります。 + +* QueryPie ACPにMACライセンスが必要です。 +* 管理者から、MCP ServerにアクセスできるRoleが付与されている必要があります。 +* 付与されたRoleのPolicyによって、1つ以上のMCP Serverへのアクセス権限が提供されている必要があります。 + + +ユーザーにRoleが付与されていない場合、サーバー一覧の代わりに案内画面が表示され、アクセス権限のリクエストが必要になることがあります。 +現在、Roleを付与できるのは管理者のみで、workflowから権限を申請することはできません。 + + + +実際の接続先はupstream MCP Serverの元のURLではなく、QueryPieが提供するMCP endpointです。`Connect with`の接続ガイドはQueryPie endpoint（`/mac/mcp`）を基準に生成されます。 + + +### MCP Servers画面を開く + +1. 上部メニューで`MCP Servers`をクリックします。 +2. MCP Servers画面は、`Connect with`領域、`サーバー一覧（サーバーカード）`、`詳細パネル`で構成されています。 +3. 権限のある（Roleが付与されている）MCP Serverがある場合は、サーバーカード一覧が表示されます。 + +#### 画面で確認できる情報 + +| **項目** | **説明** | +| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | +| Connect with | ドロップダウンリストで使用するMCP Clientを選択すると、そのClientに対応する接続ガイドが表示されます。 | +| サーバー一覧（カード） | アクセス可能なMCP Server一覧を表示します。各カードには、管理者が指定したMCP Serverの名前とendpointアドレスが表示されます。 | +| 認証ステータスバッジ | OAuthが必要なサーバーは、`Authenticated`または`Not Authenticated`ステータスで表示されます。 | +| 詳細パネル | 選択したMCP Serverの`Basic Information`、`Available Tools`、`Accessible Roles`を確認できます。 | + +### Connect withでMCP Clientの接続情報を確認する + +`Connect with`領域では、QueryPie MCP endpointを外部MCP Clientに登録する方法を確認できます。 + +1. `Connect with`ドロップダウンで使用するMCP Clientを選択します。 +2. QueryPieが、そのClientに対応する接続ガイドを表示します。 +3. ガイドに表示されたコマンド、URL、または設定例をコピーし、MCP Clientに登録します。 + +サポートされるガイド方式はClientによって異なる場合があります。 + +| **方式** | **説明** | +| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| One-click | `Connect`ボタンでClientを直接開き、接続情報を渡します。（例：VS Code） | +| Command | ターミナルコマンドをコピーし、MCP Client CLIに登録します。（例：`claude mcp add --transport http querypie-mac "https:///mac/mcp"`） | +| Terminal URL | 表示されたURLをコピーし、Clientの設定に入力します。 | +| Connector steps | Clientの設定画面でURLまたは設定値をコピーして入力します。（例：LibreChat） | + + +接続ガイドに表示される値は、選択した特定サーバーのupstream URLではなく、QueryPieの共通MCP root URLを基準に生成されます。
たとえば、Notionのendpoint URLは「`https://mcp.notion.com/mcp`」ですが、QueryPie MCP ServerのConnect withに表示される接続ガイドには「`https:///mac/mcp`」と表示されます。 + + +### アクセス可能なMCP Serverを確認する + +1. サーバーカード一覧で、目的のサーバーをクリックします。 +2. カードには次の情報が表示されます。 + * MCP Serverの表示名 + * Endpoint + * OAuth認証ステータスバッジ（必要な場合） +3. 選択したサーバーの詳細パネルが開きます。 + +#### 詳細パネルで確認できるタブ + + ++++ + + + + + + + + + + + + + + + + + + +
+**タブ** + +**説明** +
+Basic Information + +* Server Name：MCP Serverを識別できる表示名です。 +* Identifier：内部で使用するremote MCP Serverの識別名です。 +* Upstream Endpoint：remote MCP Serverの実際の接続endpoint URLです。ユーザーが接続するときは、このアドレスを使用できません。 +* Transport：remote MCP Serverのtransportタイプです。（SSE / Streamable HTTP） +
+Available Tools + +現在のユーザーに許可されているTool一覧を確認します。
一覧にはMCP ServerのすべてのToolではなく、現在のユーザーに付与されたRoleとPolicyに基づいてアクセスできるToolのみが表示されます。 +
+Accessible Roles + +* Role Name：ユーザーに割り当てられた、該当するMCP ServerのRole名です。 +* Expiration Date：該当するMCP Serverへのアクセス権限が期限切れになる日時です。 +* Status：Roleの付与ステータスを示します。（Active / Expired） +* Policies：該当するMCP Serverに紐づく1つ以上のpolicy名を示します。 +
+ +### OAuthが必要なMCP Serverに接続する + +サーバーの`Credential Mode`が`User OAuth`の場合、`Basic Information`タブの下にOAuth接続セクションが表示されます。 + + +Credential Modeはユーザーが設定できず、管理者のみが設定できます。 + + +#### OAuthを接続する + +1. サーバーを選択し、`Basic Information`タブを開きます。 +2. OAuthステータスが`Not Authenticated`の場合は、`Connect`ボタンをクリックして認証を開始できます。 +3. QueryPieがWebブラウザでOAuth認証ウィンドウを開きます。 +4. upstream OAuthプロバイダーの画面で認証を完了します。 +5. 認証が完了すると、ステータスが`Authenticated`に変わります。 + +#### OAuth接続を解除する + +1. OAuthがすでに接続されているサーバーを開きます。 +2. `Reset Token`ボタンをクリックします。 +3. 保存済みのOAuth接続が解除され、ステータスが再び`Not Authenticated`に変わります。 + +### アクセス権限がない、またはMCP Serverが表示されない場合 + +#### Roleがない場合 + +* `MCP Servers`画面には、サーバー一覧の代わりに空のステータス画面が表示されます。 +
+ image-20260605-044959.png +
+* この場合は、管理者にMAC Roleの付与を依頼する必要があります。 + +#### Roleはあるがサーバーがない場合 + +* Roleがあっても、そのRoleのPolicyによってアクセスできるサーバーがない場合は、利用できるサーバーが表示されません。 +* この場合は、Roleに紐づくPolicyまたはサーバーへのアクセス範囲を管理者に確認してください。 diff --git a/src/content/ko/administrator-manual/_meta.ts b/src/content/ko/administrator-manual/_meta.ts index 255dc309f..158b1dc30 100644 --- a/src/content/ko/administrator-manual/_meta.ts +++ b/src/content/ko/administrator-manual/_meta.ts @@ -4,6 +4,7 @@ export default { 'servers': 'Servers', 'kubernetes': 'Kubernetes', 'web-apps': 'Web Apps', + 'mcp-server': 'MCP Server', 'audit': 'Audit', 'multi-agent-limitations': 'Multi Agent 제약사항', }; diff --git a/src/content/ko/administrator-manual/audit/_meta.ts b/src/content/ko/administrator-manual/audit/_meta.ts index 54eee6939..def469c90 100644 --- a/src/content/ko/administrator-manual/audit/_meta.ts +++ b/src/content/ko/administrator-manual/audit/_meta.ts @@ -5,4 +5,5 @@ export default { 'server-logs': 'Server Logs', 'kubernetes-logs': 'Kubernetes Logs', 'web-app-logs': 'Web App Logs', + 'mcp': 'MCP', }; diff --git a/src/content/ko/administrator-manual/audit/mcp.mdx b/src/content/ko/administrator-manual/audit/mcp.mdx new file mode 100644 index 000000000..dc394635b --- /dev/null +++ b/src/content/ko/administrator-manual/audit/mcp.mdx @@ -0,0 +1,11 @@ +--- +title: 'MCP' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167472160' +--- + +# MCP + +## 하위 문서 + +- [Request Audit](./mcp/request-audit) +- [MCP Server Role History](./mcp/mcp-server-role-history) diff --git a/src/content/ko/administrator-manual/audit/mcp/_meta.ts b/src/content/ko/administrator-manual/audit/mcp/_meta.ts new file mode 100644 index 000000000..00f663d3e --- /dev/null +++ b/src/content/ko/administrator-manual/audit/mcp/_meta.ts @@ -0,0 +1,4 @@ +export default { + 'request-audit': 'Request Audit', + 'mcp-server-role-history': 'MCP Server Role History', +}; diff --git a/src/content/ko/administrator-manual/audit/mcp/mcp-server-role-history.mdx b/src/content/ko/administrator-manual/audit/mcp/mcp-server-role-history.mdx new file mode 100644 index 000000000..57ee662e2 --- /dev/null +++ b/src/content/ko/administrator-manual/audit/mcp/mcp-server-role-history.mdx @@ -0,0 +1,116 @@ +--- +title: 'MCP Server Role History' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167078929/MCP+Server+Role+History' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Role History + +### Overview + +MCP Audit은 QueryPie의 MCP proxy 사용 이력과 MCP 접근 권한 변경 이력을 감사하기 위한 기능입니다. + +`Admin > Audit > MCP` 메뉴 아래에는 서로 목적이 다른 두 개의 화면이 있습니다. + +* **Request Audit** : MCP 요청 처리 이력을 확인하는 화면 +* **MCP Server Role History** : 사용자 또는 그룹에 MCP 역할이 부여되거나 회수된 이력을 확인하는 화면 + +즉, `MCP Server settings` 화면의 **Audit Settings** 는 "무엇을 기록할지"를 설정하는 영역이고, 실제로 기록된 감사 이력을 조회하는 화면은 `Admin > Audit > MCP` 아래에 별도로 제공됩니다. + +* 메뉴 경로: `Admin > Audit > MCP` +* 하위 메뉴 + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* 필요 권한: `PERMISSION_MAC_AUDIT` + +### MCP Server Role History 이해하기 + +**MCP Server Role History** 는 사용자 또는 그룹에 MCP 역할(Role)이 언제, 누구에 의해 부여되었거나 회수되었는지를 확인하는 화면입니다. + +이 화면은 현재 권한 상태를 관리하는 `Admin > MCP > MCP Access Control > Access Control` 과 별개로, 권한 변경 이력을 감사하기 위한 audit 화면입니다. + +#### MCP Server Role History 열기 + +1. `Admin > Audit > MCP > MCP Server Role History` 메뉴로 이동합니다. +2. 화면이 열리면 기본적으로 이번 달 시작일~현재까지의 이력을 조회합니다. +3. 상단 filter에서 조건을 조정해 필요한 이력만 확인합니다. +4. 우측 상단 refresh 버튼을 클릭하면 현재 조건으로 목록을 다시 조회합니다. + +### MCP Server Role History 검색 및 필터 + +이 화면에서는 다음 조건을 기본 filter로 제공합니다. + +* **Event** : `GRANTED`, `REVOKED` +* **User Type** : `USER`, `GROUP` +* **Action At** : 작업 시각 범위 + +목록 역시 cursor 기반으로 이어서 조회됩니다. + +### MCP Server Role History 목록에서 확인할 수 있는 정보 + +목록 컬럼은 다음과 같습니다. + +* **No** : 로그 순번 +* **Action At** : 역할 부여/회수 시각 +* **Event** : `GRANTED` 또는 `REVOKED` +* **User Type** : `USER` 또는 `GROUP` +* **Name** : 대상 사용자 또는 그룹 이름 +* **Email** : 대상 사용자 이메일. 그룹은 비어 있을 수 있습니다. +* **Role** : 변경된 MCP 역할 이름 +* **Expiration Date** : 역할 만료 일시 +* **Action By** : 작업을 수행한 관리자 또는 사용자 이름 + +### MCP Server Role History 상세 보기 + +목록에서 행을 클릭하면 detail drawer가 열립니다. + +detail drawer에서는 다음 정보를 확인할 수 있습니다. + +* **Role Name** : 부여 또는 회수된 역할 이름 +* **Event** : `GRANTED` 또는 `REVOKED` +* **Name** : 대상 사용자 또는 그룹 이름 +* **Email** : 대상 사용자 이메일 +* **User Type** : `USER` 또는 `GROUP` +* **Action At** : 작업이 발생한 시각 +* **Action By** : 작업 수행자 +* **Expiration Date** : 역할 만료 시각 +* **Role Description** : 역할 설명 + +역할에 연결된 정책이 있으면 drawer 하단의 **Policies** 섹션에서 다음 정보를 함께 확인할 수 있습니다. + +* **Name** +* **Description** +* **Version** + + +`REVOKED` 이력은 저장 시 `Expiration Date` 가 비어 있을 수 있으므로 화면에서도 `-` 로 표시될 수 있습니다. + + +### MCP Server Role History 해석 시 참고 사항 + +* `GRANTED` 는 역할 부여 이벤트입니다. +* `REVOKED` 는 역할 회수 이벤트입니다. +* 이 화면은 "현재 어떤 권한이 남아 있는가"를 보여주는 화면이 아니라, "권한이 어떻게 변경되었는가"를 보여주는 감사 화면입니다. +* 상세 drawer의 **Role Description** 과 **Policies** 는 조회 시점의 역할 정의를 기준으로 불러옵니다. + +### Request Audit과 MCP Server Role History의 차이 + +두 화면은 모두 MCP Audit 아래에 있지만, 감사 대상이 다릅니다. + +* **Request Audit** : 실제 MCP 요청 실행 이력 감사 +* **MCP Server Role History** : MCP 접근 권한 변경 이력 감사 + +운영 관점에서는 보통 다음과 같이 함께 사용합니다. + +* 어떤 요청이 실제로 실행되었는지 확인할 때: **Request Audit** +* 특정 사용자 또는 그룹에 언제 어떤 역할이 부여/회수되었는지 확인할 때: **MCP Server Role History** +* 권한 변경 이후 실제 요청 흐름까지 함께 추적할 때: 두 화면을 함께 조회 + +### 운영 시 참고 사항 + +* `MCP Server settings` 의 **Enable Request Audit** 과 **Include payload in Request Audit** 은 upstream request 기록 여부와 payload 저장 여부를 제어합니다. +* `Admin > MCP Servers > General > Configurations` 의 client audit 설정은 client-originated request 기록 여부를 제어합니다. +* 즉, 설정 화면은 감사 수집 범위를 정하고, `Admin > Audit > MCP` 화면은 수집된 결과를 조회하는 역할을 합니다. +* Request Audit에서 payload가 보이지 않으면 해당 scope의 payload audit 설정이 비활성화되었는지 먼저 확인하는 것이 좋습니다. +* MCP Server Role History는 역할 부여/회수 이력 감사에 적합하지만, 현재 시점의 실제 접근 가능 서버 목록은 `Admin > MCP > MCP Access Control > Access Control` 화면에서 별도로 확인해야 합니다. diff --git a/src/content/ko/administrator-manual/audit/mcp/request-audit.mdx b/src/content/ko/administrator-manual/audit/mcp/request-audit.mdx new file mode 100644 index 000000000..509a03b5c --- /dev/null +++ b/src/content/ko/administrator-manual/audit/mcp/request-audit.mdx @@ -0,0 +1,135 @@ +--- +title: 'Request Audit' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167308318/Request+Audit' +--- + +import { Callout } from 'nextra/components' + +# Request Audit + +### Overview + +MCP Audit은 QueryPie의 MCP proxy 사용 이력과 MCP 접근 권한 변경 이력을 감사하기 위한 기능입니다. + +* **Request Audit** : MCP 요청 처리 이력을 확인하는 화면 +* **MCP Server Role History** : 사용자 또는 그룹에 MCP 역할이 부여되거나 회수된 이력을 확인하는 화면 + +즉, `MCP Server settings` 화면의 **Audit Settings** 는 "무엇을 기록할지"를 설정하는 영역이고, 실제로 기록된 감사 이력을 조회하는 화면은 `Admin > Audit > MCP` 아래에 별도로 제공됩니다. + +* 메뉴 경로: `Admin > Audit > MCP` + +* 하위 메뉴 + * `Admin > Audit > MCP > Request Audit` + * `Admin > Audit > MCP > MCP Server Role History` +* 필요 권한: `PERMISSION_MAC_AUDIT` + +### Request Audit 이해하기 + +**Request Audit** 은 MCP 요청이 어떤 범위에서 어떻게 처리되었는지를 확인하는 화면입니다. + +이 화면에는 다음 두 종류의 로그가 함께 기록될 수 있습니다. + +* `CLIENT` : 클라이언트가 MCP proxy 로 보낸 요청 +* `PROXY_UPSTREAM` : MCP proxy 가 개별 upstream MCP Server 로 전달한 요청 + +따라서 하나의 사용자 요청에 대해 parent request와 upstream child request가 함께 보일 수 있습니다. + +#### Request Audit 열기 + +1. `Admin > Audit > MCP > Request Audit` 메뉴로 이동합니다. +2. 화면이 열리면 기본적으로 오늘 날짜 기준의 로그를 조회합니다. +3. 상단 filter에서 조건을 조정해 원하는 로그 범위만 다시 조회할 수 있습니다. +4. 우측 상단 refresh 버튼을 클릭하면 현재 조건으로 목록을 다시 불러옵니다. + +### Request Audit 검색 및 필터 + +`Request Audit` 화면에서는 다음 조건을 기본 filter로 제공합니다. + +* **Server** : 특정 MCP Server 관련 upstream 로그만 확인 +* **Event** : `ALLOW`, `DENY` +* **Request Scope** : `CLIENT`, `PROXY_UPSTREAM` +* **Executed At** : 로그 발생 시각 범위 + +목록은 cursor 기반으로 이어서 조회되며, 스크롤하면서 다음 로그를 추가로 불러올 수 있습니다. + +### Request Audit 목록에서 확인할 수 있는 정보 + +목록 컬럼은 다음과 같습니다. + +* **No** : 로그 순번 +* **Executed At** : 요청이 기록된 시각 +* **Request Origin** : `CLIENT` 또는 `PROXY_UPSTREAM` +* **Root Request ID** : 같은 요청 흐름을 묶는 상위 요청 ID +* **Event** : 권한/정책 판단 결과 (`ALLOW`, `DENY`) +* **Status** : 실제 처리 결과 (`SUCCESS`, `ERROR`) +* **Name** : 요청을 수행한 사용자 이름 +* **Email** : 요청을 수행한 사용자 이메일 +* **Client IP** : 요청을 보낸 클라이언트 IP +* **Server** : 대상 MCP Server 이름 +* **Method** : MCP method 이름 +* **Client Tool Name** : 클라이언트가 요청한 tool 이름 +* **Target Tool Name** : upstream 대상으로 해석된 tool 이름 +* **Duration** : 처리 시간(ms) + + +`Event` 와 `Status` 는 의미가 다릅니다. +예를 들어 `Event` 가 `ALLOW` 여도 실행 과정에서 오류가 발생하면 `Status` 는 `ERROR` 로 기록될 수 있습니다. + + +### Request Audit 상세 보기 + +목록에서 행을 클릭하면 detail drawer가 열립니다. + +detail drawer에서는 다음 정보를 확인할 수 있습니다. + +#### Request Info + +* **Request ID** : 개별 audit log 레코드의 고유 ID +* **Root Request ID** : 같은 요청 체인에 속한 로그를 묶는 ID +* **Request Origin** : `CLIENT` 또는 `PROXY_UPSTREAM` +* **Executed At** : 요청 기록 시각 +* **Server** : 대상 MCP Server 이름 +* **Method** : MCP method와 tool 이름 +* **Client Tool Name** : 클라이언트 관점의 tool 이름 +* **Target Tool Name** : 실제 upstream 대상 tool 이름 +* **Transport** : upstream MCP Server 와 통신할 때 사용한 transport +* **Upstream Endpoint** : upstream MCP Server endpoint +* **HTTP Status** : HTTP 처리 상태 코드 +* **Event** : 허용/거부 이벤트 +* **Status** : 성공/실패 상태 +* **Duration** : 처리 시간 +* **Denied Reason** 또는 **Error** : 거부 사유 또는 오류 메시지 + +#### Subject Info + +* **Name** +* **Email** +* **Subject ID** + +#### Client Info + +* **Client IP** +* **User Agent** + +#### Payload + +payload가 저장된 경우 **Payload** 섹션에서 JSON 형태로 요청 본문을 확인할 수 있습니다. + +단, payload 표시 여부는 audit 설정에 따라 달라집니다. + +* client-originated request는 `Admin > MCP Servers > General > Configurations` 의 client audit payload 설정 영향을 받습니다. +* upstream request는 각 MCP Server detail page의 **Include payload in Request Audit** 설정 영향을 받습니다. + +또한 민감정보로 판단되는 값은 그대로 저장되지 않고 마스킹될 수 있습니다. + + +현재 admin의 `Request Audit` detail 화면은 **Payload** 를 표시하지만, 내부적으로 저장될 수 있는 response 본문을 별도 섹션으로 노출하지는 않습니다. + + +### Request Audit 해석 시 참고 사항 + +* `Root Request ID` 가 같으면 같은 요청 흐름에서 발생한 로그로 볼 수 있습니다. +* `CLIENT` 로그는 사용자가 MCP proxy 로 보낸 요청을 의미합니다. +* `PROXY_UPSTREAM` 로그는 proxy가 특정 MCP Server로 전달한 downstream 요청을 의미합니다. +* `Server`, `Transport`, `Upstream Endpoint`, `Target Tool Name` 은 주로 `PROXY_UPSTREAM` 로그에서 의미가 있습니다. +* `CLIENT` 로그는 server 정보가 비어 있을 수 있습니다. diff --git a/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/_meta.ts b/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/_meta.ts new file mode 100644 index 000000000..3317afcb5 --- /dev/null +++ b/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'mongodb-document-db-privilege-type-mapping': 'MongoDB / Document DB 의 Privilege Type Mapping', +}; diff --git a/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx b/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx new file mode 100644 index 000000000..f420f0124 --- /dev/null +++ b/src/content/ko/administrator-manual/databases/db-access-control/privilege-type/mongodb-document-db-privilege-type-mapping.mdx @@ -0,0 +1,34 @@ +--- +title: 'MongoDB / Document DB 의 Privilege Type Mapping' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288549894/MongoDB+Document+DB+Privilege+Type+Mapping' +--- + +# MongoDB / Document DB 의 Privilege Type Mapping + +MongoDB, Document DB의 구문별 privilege 유형은 아래표와 같이 매핑됩니다. + +| **구분** | **Privilege Type** | **MongoDB / Document DB** | +| -------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------- | +| DML | Select | ~.find(), ~.findOne(), 일반 ~.aggregate() | +| DML | Select + Delete | ~.findOneAndDelete(), findAndModify `{ remove: true }` | +| DML | Select + Update | ~.findOneAndUpdate(), ~.findOneAndReplace(), findAndModify `{ update: ... }`
upsert: true이면 Insert 추가 | +| DML | Update | ~.update(), ~.updateOne(), ~.updateMany(), ~.replaceOne()
upsert: true이면 Insert 추가 | +| DML | Insert + Create | ~.insert(), ~.insertOne(), ~.insertMany()
대상 collection이 없으면 Create 추가 | +| DML | Select + Insert + Update | aggregate 마지막 stage: $merge
target collection이 없으면 Create 추가 | +| DML | Select + Insert + Create + Rename + Delete | aggregate 마지막 stage: $out | +| DCL | Grant | db.grantRolesToUser(), db.grantRolesToRole(), db.grantPrivilegesToRole() | +| DCL | Revoke | db.revokeRolesFromUser(), db.revokeRolesFromRole(), db.revokePrivilegesFromRole() | +| DCL | Alter | db.updateUser() | +| DCL | Update | db.updateRole() | +| DDL | Create | ~.createIndex(), ~.createIndexes(), db.createCollection(), db.createView(), db.createUser(), db.createRole() | +| DDL | Drop | ~.drop(), db.dropDatabase(), db.dropUser(), db.dropAllUsers(), db.dropRole(), db.dropAllRoles() | +| DDL | Rename | ~.renameCollection() | +| Others | Etc. | ~.commitTransaction(), ~.abortTransaction(), ~.startTransaction() | + +
+Privilege Type 생성 예시 +
+Privilege Type 생성 예시 +
+
+
diff --git a/src/content/ko/administrator-manual/general/user-management/authentication/_meta.ts b/src/content/ko/administrator-manual/general/user-management/authentication/_meta.ts index 22cb14a41..d33cdf184 100644 --- a/src/content/ko/administrator-manual/general/user-management/authentication/_meta.ts +++ b/src/content/ko/administrator-manual/general/user-management/authentication/_meta.ts @@ -1,6 +1,6 @@ export default { - 'integrating-with-ldap': 'LDAP 연동하기', 'integrating-with-okta': 'Okta 연동하기', + 'integrating-with-ldap': 'LDAP 연동하기', 'integrating-with-aws-sso': 'AWS SSO 연동하기', 'integrating-with-google-saml': 'Google SAML 연동하기', 'setting-up-multi-factor-authentication': 'Multi-Factor Authentication 설정하기', diff --git a/src/content/ko/administrator-manual/mcp-server.mdx b/src/content/ko/administrator-manual/mcp-server.mdx new file mode 100644 index 000000000..15280a0dd --- /dev/null +++ b/src/content/ko/administrator-manual/mcp-server.mdx @@ -0,0 +1,12 @@ +--- +title: 'MCP Server' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2167636017' +--- + +# MCP Server + +## 하위 문서 + +- [MCP Server Connection Management](./mcp-server/mcp-server-connection-management) +- [MAC General Configurations](./mcp-server/mac-general-configurations) +- [MCP Access Control](./mcp-server/mcp-access-control) diff --git a/src/content/ko/administrator-manual/mcp-server/_meta.ts b/src/content/ko/administrator-manual/mcp-server/_meta.ts new file mode 100644 index 000000000..bf01d1a17 --- /dev/null +++ b/src/content/ko/administrator-manual/mcp-server/_meta.ts @@ -0,0 +1,5 @@ +export default { + 'mcp-server-connection-management': 'MCP Server Connection Management', + 'mac-general-configurations': 'MAC General Configurations', + 'mcp-access-control': 'MCP Access Control', +}; diff --git a/src/content/ko/administrator-manual/mcp-server/mac-general-configurations.mdx b/src/content/ko/administrator-manual/mcp-server/mac-general-configurations.mdx new file mode 100644 index 000000000..ba3cb64ec --- /dev/null +++ b/src/content/ko/administrator-manual/mcp-server/mac-general-configurations.mdx @@ -0,0 +1,63 @@ +--- +title: 'MAC General Configurations' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167144528/MAC+General+Configurations' +--- + +# MAC General Configurations + +### Overview + +QueryPie MCP Access Control의 General 설정에서 Client-oriented request 감사 영역 설정과 forward proxy 설정과 같은 전역 보안 설정을 할 수 있습니다. + +QueryPie MCP Access Control은 보안 감사 기록의 영역이 두개로 나눠져 있습니다.
MCP Client – :1_one_circle_red: `Client-oriented request` --> QueryPie MAC – :2_two_circle_red: `upstream request` --> Remote MCP 서버 + +General Configuration의 설정은 Client oriented request 의 이벤트를 기록하는 설정입니다. +upstream request 에대한 이벤트 기록은 각 MCP server의 설정으로 제어합니다. + +인터넷이 차단되어 있는 경우 forward proxy 서버를 통해 remote MCP 서버와 통신하도록 구성할 수 있습니다. + +
+Admin > MCP Servers > General > Configurations +
+Admin > MCP Servers > General > Configurations +
+
+ +Masking pattern을 사용하여 MCP server로 받은 응답을 정규식 기반으로 마스킹 할 수 있습니다. + +### Client Request Audit 및 Include payload in Client Request Audit + +* Client Request Audit : 기본값은 Enable 입니다. 활성화 되어 있으면 Client가 MCP 서버로 요청한 이벤트를 MCP Client와 QueryPie MAC 사이의 구간에서 기록합니다. +* Include payload in Client Request Audit : 기본 값은 Enable 입니다. Client Request Audit 이벤트에서 payload의 내용도 기록합니다. + +### Forward Proxy + +`Admin > MCP Servers > General > Configurations` 화면의 **Forward Proxy** 는 MCP 연결에 공통으로 적용되는 전역 네트워크 설정입니다. + +* **Enable Forward Proxy** 를 켜면 **Host**, **Port** 를 입력할 수 있고, 필요 시 **Username**, **Password** 를 함께 설정할 수 있습니다. +* 이 설정은 admin의 `Test Connection`, `Sync Tools`, OAuth 관련 upstream 호출과 runtime의 MCP proxy upstream 연결에 공통 적용됩니다. +* remote MCP Server가 직접 reachable 하지 않은 환경에서는 이 **Forward Proxy** 구성이 필요할 수 있습니다. +* 반대로 QueryPie와 MCP proxy가 해당 remote MCP Server에 네트워크적으로 직접 접근할 수 있다면 Forward Proxy 없이도 연결할 수 있습니다. + +### Masking Patterns + +
+Admin > MCP Servers > General > Masking Patterns +
+Admin > MCP Servers > General > Masking Patterns +
+
+ +기본적으로 사전 정의된 25개의 마스킹 패턴을 제공하고 사용자 정의 마스킹 패턴을 추가하여 관리할 수 있습니다. + +* Detecting Pattern : 민감정보 검출 패턴 +* Masking Pattern : 민감정보 마스킹 패턴 +* Masking Pattern Preview : 마스킹 패턴 적용 결과 미리보기 +* Sample Data : 샘플 데이터 +* Detected Data : 샘플 데이터에서 Detecting Pattern에 의해 민감정보로 검출된 영역 (푸른색 음영) +* Preview 테이블 내 Masked Data에서 샘플 데이터에 대한 민감정보 마스킹 결과를 확인할 수 있음 + +`Save` 버튼을 클릭하면 변경 내용이 저장됩니다. + +`Delete` 버튼을 클릭하고, 확인 모달에서 Delete 버튼을 클릭하면 마스킹 패턴 삭제가 완료됩니다. +또는 Masking Patterns 목록에서 삭제하려는 아이템을 체크박스로 선택하고 Delete 버튼을 클릭하여 삭제할 수 있습니다. diff --git a/src/content/ko/administrator-manual/mcp-server/mcp-access-control.mdx b/src/content/ko/administrator-manual/mcp-server/mcp-access-control.mdx new file mode 100644 index 000000000..ecdc6cd13 --- /dev/null +++ b/src/content/ko/administrator-manual/mcp-server/mcp-access-control.mdx @@ -0,0 +1,189 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167799919/MCP+Access+Control' +--- + +import { Callout } from 'nextra/components' + +# MCP Access Control + +### Overview + +MCP 접근 제어는 QueryPie에 등록된 MCP 서버와 그 서버가 제공하는 도구(Tool)에 대해, 어떤 사용자 또는 그룹이 접근할 수 있는지를 역할(Role)과 정책(Policy) 기반으로 관리하는 기능입니다. +11.6.1 이상 버전에서 사용가능합니다. + +이 기능을 사용하면 다음과 같은 작업을 수행할 수 있습니다. + +* 사용자 또는 그룹별로 MCP 접근 권한 부여 현황을 조회할 수 있습니다. +* 특정 사용자 또는 그룹에 하나 이상의 MCP 역할을 부여하거나 회수할 수 있습니다. +* 역할에 연결된 정책을 기준으로, 해당 사용자 또는 그룹이 실제로 접근 가능한 MCP 서버 목록을 확인할 수 있습니다. +* 역할별 만료 일시를 설정하여 일정 기간 이후 접근 권한이 자동으로 정리되도록 운영할 수 있습니다. +* 역할 부여/회수 이력을 기반으로 접근 권한 변경 내역을 추적할 수 있습니다. + +즉, MCP 접근 제어는 단순히 "어떤 MCP 서버에 접속할 수 있는가"만 관리하는 기능이 아니라, MCP 서버 사용 권한을 역할 단위로 표준화하고, 정책과 만료 일시를 함께 적용하여 운영 통제를 가능하게 하는 관리 기능입니다. + +이 화면에서는 사용자/그룹별로 현재 부여된 역할 수를 확인하고, 상세 화면에서 역할을 추가로 부여하거나 회수할 수 있습니다. +역할에 연결된 정책과, 그 결과로 접근 가능한 MCP 서버 목록도 함께 확인할 수 있습니다. + + +MCP 접근 권한은 사용자에게 서버를 직접 지정하는 방식이 아니라, 사용자/그룹에 역할을 부여하는 방식으로 관리됩니다. +실제 접근 가능한 서버는 부여된 역할에 연결된 정책에 따라 결정됩니다. + + +### 메뉴 및 권한 + +* 메뉴 경로: `Admin > MCP > MCP Access Control > Access Control` +* 필요 권한: `PERMISSION_MAC_ACL` + +같은 `MCP Access Control` 메뉴 아래에는 다음 화면도 함께 제공됩니다. + +* **Access Control** : 사용자/그룹별 역할 부여 현황 관리 +* **Roles** : MCP 역할 정의 관리 +* **Policies** : MCP 정책 정의 관리 + +### MCP 접근 제어 조회하기 + +등록된 사용자/그룹별 MCP 접근 제어 현황을 확인합니다. + +1. `Admin > MCP > MCP Access Control > Access Control` 메뉴로 이동합니다. +2. 목록에서 사용자 또는 그룹별 접근 제어 현황을 확인합니다. +3. 검색창에서 다음 조건으로 목록을 필터링할 수 있습니다. + * **Name** + * **Email** +4. 우측 상단의 refresh 버튼을 클릭하면 목록을 다시 조회합니다. + +목록 컬럼은 다음과 같습니다. + +* **User Type** : `USER` 또는 `GROUP` +* **Provider** : 계정이 속한 인증 제공자 +* **Name** : 사용자명 또는 그룹명 +* **Email** : 사용자 계정의 이메일 주소. 그룹은 `-`로 표시됩니다. +* **Members** : 그룹인 경우 멤버 목록이 표시됩니다. 사용자 계정은 `-`로 표시됩니다. +* **Roles** : 현재 부여된 MCP 역할 수 + + +현재 UI에는 `Access Control` 목록에서 사용자를 직접 생성하거나, 서버를 직접 선택해 권한을 추가하는 버튼은 제공되지 않습니다. +먼저 사용자 또는 그룹을 선택한 뒤, 상세 화면에서 역할을 부여하는 방식으로 접근 권한을 관리합니다. + + +### 사용자 또는 그룹의 접근 제어 상세 보기 + +특정 사용자 또는 그룹에 어떤 역할이 부여되었는지 상세하게 확인합니다. + +1. `Access Control` 목록에서 조회할 사용자 또는 그룹을 클릭합니다. +2. 상세 화면 상단에서 다음 metadata를 확인할 수 있습니다. + * **Type** : 사용자 또는 그룹 + * **Members** : 그룹인 경우 구성원 수 + * **Created** : 생성 일시와 생성자 + * **Updated** : 최종 수정 일시와 수정자 +3. 상세 화면은 다음 두 개의 tab으로 구성됩니다. + * **Roles** : 현재 부여된 역할 목록 + * **Accessible Servers** : 현재 역할 기준으로 접근 가능한 MCP 서버 목록 + +### 역할 부여하기 + +사용자 또는 그룹에 하나 이상의 MCP 역할을 부여합니다. + +1. 접근 제어 상세 화면의 `Roles` 탭으로 이동합니다. +2. 우측의 `Grant Role` 버튼을 클릭합니다. +3. `Grant Role` 팝업에서 부여할 역할을 선택합니다. + * 역할 목록은 현재 사용자/그룹에 아직 부여되지 않은 역할만 표시됩니다. + * 검색창에서 **Name** 기준으로 역할을 검색할 수 있습니다. +4. 역할 목록에서 다음 정보를 확인할 수 있습니다. + * **Name** : 역할 이름. 클릭하면 해당 역할 상세 화면으로 이동할 수 있습니다. + * **Description** : 역할 설명 + * **Assigned Policies** : 역할에 연결된 정책 목록 +5. **Expiration Date**를 선택합니다. + * 기본값은 현재 시점 기준 1년 후 날짜입니다. + * 저장 시 선택한 날짜의 하루 끝 시각(end of day)으로 만료 일시가 저장됩니다. + * 만료 날짜는 필수 입력 항목입니다. +6. `Grant Role` 버튼을 클릭하여 저장합니다. + + +부여 가능한 역할이 없으면 팝업에 역할 목록이 비어 있으며, 추가로 부여할 수 없습니다. + + +### 부여된 역할 조회하기 + +사용자 또는 그룹에 현재 부여된 역할 목록을 확인합니다. + +1. 접근 제어 상세 화면의 `Roles` 탭으로 이동합니다. +2. 검색창에서 **Name** 기준으로 역할을 검색할 수 있습니다. +3. 목록에서 다음 정보를 확인할 수 있습니다. + * **Name** : 역할 이름 + * **Description** : 역할 설명 + * **Expiration** : 역할 만료 일시. 이미 만료된 경우 `(만료)` 표시가 추가됩니다. + * **Granted At** : 역할이 부여된 시각 + * **Last Access** : 해당 역할로 마지막 접근한 시각. 접근 이력이 없으면 `없음`으로 표시됩니다. + * **Granted By** : 역할을 부여한 사용자 + +### 부여된 역할 상세 보기 + +부여된 역할 하나를 선택하여 역할 정보와 연결된 정책을 확인합니다. + +1. 접근 제어 상세 화면의 `Roles` 탭에서 역할 행을 클릭합니다. +2. 우측 상세 드로어에서 다음 정보를 확인할 수 있습니다. + * **Role Name** + * **Description** + * **Granted At** + * **Granted By** + * **Expiration Date** + * **Last Access** +3. 드로어 하단의 **Policies** 섹션에서 이 역할에 연결된 정책 목록을 확인할 수 있습니다. + * **Name** + * **Description** + * **Version** + * **Assigned At** + * **Assigned By** + + +역할에 연결된 정책이 없으면 정책 테이블은 비어 있습니다. + + +### 역할 회수하기 + +사용자 또는 그룹에 부여된 역할을 회수합니다. + +1. 접근 제어 상세 화면의 `Roles` 탭으로 이동합니다. +2. 회수할 역할을 하나 이상 선택합니다. +3. 상단에 나타나는 `Revoke` 버튼을 클릭합니다. +4. 확인 팝업에서 승인하면 선택한 역할이 회수됩니다. + + +역할 회수는 다중 선택을 지원합니다. + + +### 접근 가능한 서버 조회하기 + +현재 사용자 또는 그룹이 접근할 수 있는 MCP 서버 목록을 확인합니다. + +1. 접근 제어 상세 화면의 `Accessible Servers` 탭으로 이동합니다. +2. 검색창에서 **Name** 기준으로 서버를 검색할 수 있습니다. +3. 목록에서 다음 정보를 확인할 수 있습니다. + * **Name** : 서버 표시 이름 + * **Identifier** : 서버 식별자(name) + * **Endpoint** : MCP 서버 엔드포인트 주소 + * **Tools** : 해당 MCP 서버가 제공하는 도구 수 + + +부여된 역할이 없거나, 역할에 연결된 정책으로 접근 가능한 서버가 없으면 서버 목록은 비어 있습니다. + + + +**운영 시 참고 사항** +* `Access Control` 화면은 사용자/그룹 중심으로 접근 권한을 관리하는 화면입니다. +* 실제 접근 대상 서버는 역할에 연결된 정책에 의해 계산되므로, 역할만 부여하고 정책이 적절히 연결되지 않으면 접근 가능한 서버가 나타나지 않을 수 있습니다. +* 역할 만료 일시가 지나면 접근 권한은 자동 회수 대상이 됩니다. +* 역할 부여/회수 이력은 별도의 Audit 메뉴인 `Admin > Audit > MCP > MCP Server Role History`에서 확인할 수 있습니다. +* `MCP Server Role History` 화면에서는 누가 어떤 사용자 또는 그룹에 어떤 역할을 부여하거나 회수했는지 추적할 수 있습니다. +* 이 화면에서는 일반적으로 다음 정보를 확인합니다. + * **Event** : 역할 부여 또는 회수 이벤트 + * **User Type** : `USER` 또는 `GROUP` + * **Name** : 사용자명 또는 그룹명 + * **Email** : 사용자 이메일 주소 + * **Role Name** : 부여되거나 회수된 역할 이름 + * **Expiration Date** : 역할 만료일 + * **Action By** : 작업을 수행한 사용자 + * **Action At** : 작업 시각 +* 상세 화면에서는 해당 이력에 연결된 역할 정보와 정책 목록까지 함께 확인할 수 있어, 특정 시점의 접근 권한 변경 근거를 감사할 때 유용합니다. + diff --git a/src/content/ko/administrator-manual/mcp-server/mcp-server-connection-management.mdx b/src/content/ko/administrator-manual/mcp-server/mcp-server-connection-management.mdx new file mode 100644 index 000000000..8a4a97574 --- /dev/null +++ b/src/content/ko/administrator-manual/mcp-server/mcp-server-connection-management.mdx @@ -0,0 +1,153 @@ +--- +title: 'MCP Server Connection Management' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2167242794/MCP+Server+Connection+Management' +--- + +import { Callout } from 'nextra/components' + +# MCP Server Connection Management + +### Overview + +MCP Server Connection Management는 QueryPie가 외부 MCP(Model Context Protocol) 서버에 연결할 수 있도록 서버 정보를 등록하고, connection settings, credential settings, audit settings, tool synchronization status를 관리하는 기능입니다. + +이 화면에서는 다음 작업을 수행할 수 있습니다. + +* MCP Server 목록을 조회할 수 있습니다. +* 새 MCP Server를 등록할 수 있습니다. +* 등록된 MCP Server의 Basic Information, Connection Settings, Audit Settings를 수정할 수 있습니다. +* 서버가 제공하는 Tools 목록을 동기화하고 조회할 수 있습니다. +* 필요 시 등록된 MCP Server를 삭제할 수 있습니다. + + +QueryPie의 `Web Base URL`이 설정되지 않으면 OAuth callback URL을 만들 수 없어 OAuth를 사용하는 MCP server에 대해 `Connect`를 시작할 수 없습니다. [Web Base URL 에 대한 자세한 내용](../../installation/container-environment-variables/querypieweburl) + + +### MCP Server 목록 조회하기 + +등록된 MCP Server 목록을 확인합니다. + +
+Admin > MCP Servers > Connection Management > MCP Servers +
+Admin > MCP Servers > Connection Management > MCP Servers +
+
+ +1. `Admin > MCP Servers > Connection Management > MCP Servers` 메뉴로 이동합니다. +2. 목록에서 서버 정보를 확인합니다. +3. 우측 상단의 `Create Server` 버튼으로 새 서버를 등록할 수 있습니다. +4. 새로고침 버튼을 클릭하면 목록을 다시 조회합니다. +5. 목록에서 특정 서버를 클릭하면 detail page로 이동합니다. + +목록 컬럼은 다음과 같습니다. + +* **Name** : 서버의 display name +* **Identifier** : 내부 server name 값 +* **Endpoint** : MCP Server 주소 +* **Transport** : 연결에 사용하는 transport 유형 +* **Tools** : 동기화된 tool 수 +* **Audit** : Request Audit 활성화 여부 +* **Updated** : 마지막 수정 시각 + +### MCP Server 추가하기 + +새 MCP Server를 등록합니다. + +1. `Create Server` 버튼을 클릭합니다. +2. **Basic Information** 섹션에서 다음 항목을 입력합니다. + * **Identifier :** 내부적으로 사용하는 remote MCP 서버의 식별 이름입니다. 대문자를 사용할 수 없습니다. 한번 생성한 뒤에는 수정할 수 없습니다. + * **Name :** remote MCP 서버의 display name 입니다. + * **Icon :** 사용자가 원하는 아이콘을 업로드 하여 등록 할 수 있습니다. + * **Description :** 해당 remote MCP 서버에 대한 설명을 입력합니다. +3. **Connection Settings** 섹션에서 다음 항목을 입력합니다. + * **Endpoint URL :** remote MCP 서버의 접속 endpoint URL을 입력합니다. + * **Transport :** remote MCP 서버의 transport 유형을 선택합니다. (SSE / Streamable HTTP 둘 중 하나를 선택합니다.) + * **Credential Mode :** None / QueryPie Registered Credential / User OAuth 중 하나를 선택합니다. + * None : remote MCP 서버가 인증을 요구하지 않는 경우 사용합니다. + * QueryPie Registered Credential : QueryPie MAC에서 인증 토큰을 관리하도록 하는 경우 선택합니다. QueryPie Registered Credential을 선택하면 QueryPie Upstream Access Token 입력란이 노출되고 입력란에 MCP 서버의 인증 토큰을 입력합니다. **MCP 서버의 인증토큰은 MAC에서 생성하지 않습니다. 해당 서비스에서 MCP 사용을 위한 인증 토큰을 생성해야하므로 자세한 토큰 생성 방법은 해당 서비스 가이드를 참고 바랍니다.** + * User OAuth : remote MCP 서버의 인증 방식이 OAuth 인증 방식인 경우 사용합니다. 관리자는 MCP 서버에서 사용가능한 tool 목록을 조회하기 위해 사용자 대신 OAuth 인증을 해야합니다. 이는 사용자의 OAuth 인증과는 관계가 없고 tool 목록을 조회하는 것에만 사용됩니다. +4. 필요하면 `Test Connection`을 실행해 현재 입력한 값으로 연결 가능 여부를 확인합니다. +5. **Audit Settings** 섹션에서 request audit 관련 옵션을 설정합니다. + * 아래에 설명된 “Audit Setting 이해하기” 를 참고합니다. +6. `Save` 버튼을 클릭해 저장합니다. + + +`Test Connection`과 이후 `Sync Tools`, OAuth 관련 upstream 통신은 모두 MCP 전역 **Configurations** 의 **Forward Proxy** 설정 영향을 받을 수 있습니다. + + +### Audit Settings 이해하기 + +MCP Access Control의 audit 설정은 감사 대상 범위가 두 층으로 나뉩니다. + +* 각 MCP Server detail page의 **Audit Settings** : 특정 upstream MCP Server 로 전달되는 요청에 대한 서버별 audit 설정 +* `Admin > MCP Servers > General > Configurations` 의 audit 설정 : MCP 클라이언트가 QueryPie MAC 로 보낸 요청에 대한 전역 audit 설정 + +따라서 request audit를 해석할 때는 어떤 설정이 어떤 범위의 로그에 적용되는지 함께 확인해야 합니다. + +#### 감사 대상 영역 : QueryPie MAC ~ Remote MCP Server + +* 각 MCP Server 설정의 Audit Settings에서 Enable Request Audit 옵션을 활성화 한 경우
QueryPie MAC이 해당 Remote MCP Server로 전달하는 upstream request를 request audit log에 기록합니다. + * MCP 서버 목록 화면의 **Audit** 컬럼에도 이 값이 반영됩니다. + * 이 옵션을 끄면 해당 서버에 대한 upstream request audit log가 기록되지 않습니다. + * request audit log는 `Admin > Audit > MCP > Request Audit` 메뉴에서 확인합니다. +* 각 MCP Server 설정의 Audit Settings에서 Include payload in Request Audit 옵션을 활성화 한 경우
해당 MCP Server에 대한 request audit log에 payload와 response를 함께 저장합니다. + * upstream request 자체를 기록하는 것에 더해, audit record에 payload/response까지 포함합니다. + * `Enable Request Audit`이 활성화된 경우에만 사용할 수 있습니다. + * `Enable Request Audit`을 끄면 이 옵션은 비활성화되며, 저장 시 값도 함께 꺼집니다. + +#### 감사 대상 영역 : MCP Client ~ QueryPie MAC + +`Admin > MCP Servers > General > Configurations` 화면에는 client-originated audit에 대한 전역 설정이 있습니다. + +* Client Request Audit : 이 옵션을 켜면 클라이언트가 QueryPie MAC으로 보낸 MCP 요청을 audit log에 기록합니다. + * 감사 대상은 개별 upstream MCP Server가 아니라 client-originated MCP request입니다. + * 비활성화하면 client request audit event 자체가 생성되지 않습니다. +* Include payload in Client Request Audit : 이 옵션을 켜면 client-originated MCP request audit log에 payload와 response를 함께 저장합니다. + * `Client Request Audit`이 활성화된 경우에만 화면에 표시됩니다. + * 비활성화하면 client request audit event는 기록되지만 payload/response 본문은 제외됩니다. + +### MCP Server 수정하기 + +기존 MCP Server의 설정을 변경합니다. +MCP 서버의 Tool 동기화는 MCP 서버를 등록한 후 수정 상세 화면에서만 가능합니다. + +1. MCP Server 목록에서 수정할 서버를 클릭합니다. +2. 상세 페이지에서 다음 섹션을 확인하고 수정할 수 있습니다. + * **Basic Information** + * **Connection Settings** + * **Audit Settings** + * **Tools**
등록된 MCP 서버가 제공하는 tool 목록을 동기화합니다.
인증이 필요한 경우 인증이 되어야 동기화 할 수 있습니다. + * `Sync Tools` 버튼을 클릭합니다. + * 동기화가 완료되면 감지된 tool 수와 마지막 동기화 시각을 확인할 수 있습니다. + * Tools table에서 다음 정보를 조회할 수 있습니다. + * Tool Name : tool의 이름입니다. + * Description : tool에 대한 상세 설명입니다. + * Last Synced : 마지막으로 동기화한 시점입니다. +3. 수정 후 `Save Changes`를 클릭합니다. + + +서버 수정 화면에서는 **Identifier** 는 읽기 전용이며 변경할 수 없습니다. + + +### MCP Server 삭제하기 + +등록된 MCP Server를 삭제합니다. + +1. 목록에서 서버를 하나 이상 선택합니다. +2. 삭제 동작을 실행합니다. +3. 확인 메시지에서 승인하면 선택한 서버가 삭제됩니다. + +또는 detail page에서 단일 서버를 삭제할 수도 있습니다. + + + +**운영 시 참고 사항** +* 서버 생성 시 기본값 기준으로 **Enable Request Audit** 과 **Include payload in Request Audit** 은 모두 활성화되어 있습니다. +* 서버 detail page의 **Include payload in Request Audit** 은 단독으로 켤 수 없고, 항상 **Enable Request Audit** 에 종속됩니다. +* `Admin > MCP Servers > General > Configurations` 의 **Client Request Audit** 과 **Include payload in Client Request Audit** 도 기본값 기준으로 활성화되어 있습니다. +* **Client Request Audit** 계열 설정과 서버별 **Request Audit** 계열 설정은 상속 관계가 아니라, 서로 다른 request scope에 적용되는 별도 설정입니다. +* remote MCP Server가 직접 인터넷을 통해 접속할 수 없는 경우 `Admin > MCP Servers > General > Configurations` 의 **Forward Proxy** 구성이 필요할 수 있습니다. forward proxy 는 조직에서 별도 마련해야하고 QueryPie MAC에서 proxy 서버를 제공하지 않습니다. +* 서버 detail page에서는 Tools 목록을 별도 동기화해야 최신 서버 상태가 반영됩니다. +* Credential Mode가 User OAuth인 경우, detail page에서 admin OAuth connection status를 별도로 확인할 수 있습니다. + diff --git a/src/content/ko/support/_meta.ts b/src/content/ko/support/_meta.ts index 5525f3b13..b3bad5154 100644 --- a/src/content/ko/support/_meta.ts +++ b/src/content/ko/support/_meta.ts @@ -2,4 +2,5 @@ export default { 'premium-support': '프리미엄 지원', 'standard-edition': 'Standard Edition', 'standard-edition-license-policy': 'Standard Edition 라이선스 정책', + 'querypie-acp-operational-log-collection-guide': 'QueryPie ACP 운영 로그 수집 가이드', }; diff --git a/src/content/ko/support/premium-support.mdx b/src/content/ko/support/premium-support.mdx index b7039ca87..870f96032 100644 --- a/src/content/ko/support/premium-support.mdx +++ b/src/content/ko/support/premium-support.mdx @@ -31,7 +31,7 @@ Customer Portal 사용은 QueryPie와 직계약한 고객에 한해서 이용할 * 버그 리포트 - 버그 및 오류 제보 -기능 추가 및 개선 문의는 메일로 요청 부탁드립니다. [ai_connection@querypie.com](mailto:ai_connection@querypie.com) +기능 추가 및 개선 문의는 메일로 요청 부탁드립니다. [AI_Connect@querypie.com](mailto:AI_Connect@querypie.com) #### 업그레이드 및 정기 유지/보수 점검 diff --git a/src/content/ko/support/querypie-acp-operational-log-collection-guide.mdx b/src/content/ko/support/querypie-acp-operational-log-collection-guide.mdx new file mode 100644 index 000000000..bfc43a7cd --- /dev/null +++ b/src/content/ko/support/querypie-acp-operational-log-collection-guide.mdx @@ -0,0 +1,346 @@ +--- +title: 'QueryPie ACP 운영 로그 수집 가이드' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2288353307/QueryPie+ACP' +--- + +import { Callout } from 'nextra/components' + +# QueryPie ACP 운영 로그 수집 가이드 + +### Overview + +장애 분석이나 기술 지원 전달이 필요한 경우, QueryPie 서버의 운영 로그와 진단 자료를 증상에 맞게 수집해야 합니다. +이 문서는 운영 환경에서 우선 확보해야 하는 기본 로그, 추가로 필요한 경우에만 수집할 자료, 그리고 전달 시 함께 정리해야 하는 정보를 설명합니다. + +기본 수집 대상은 가능한 한 장애 발생 시각 전후 범위를 포함해야 합니다. +재현이 가능한 경우에는 재현 시각도 함께 기록해야 로그 대조가 쉬워집니다. + +### 기본 수집 항목 + +문제 분석이 필요할 때는 아래 4가지를 우선 수집합니다. + +1. QueryPie 파일 로그 +2. 컨테이너 표준 출력 로그 +3. `/api/config/monitoring` dump +4. Multi Agent 또는 Windows Server Agent 로그 + + +증상별로 모든 로그를 항상 다 수집할 필요는 없습니다. +다만 원인 범위가 넓거나 재현이 어려운 이슈는 기본 수집 항목 4가지를 함께 확보하는 편이 좋습니다. + + +### QueryPie 파일 로그 수집하기 + +파일 로그는 각 컴포넌트가 `/var/log/querypie` 아래에 남기는 애플리케이션 로그입니다. +컨테이너 내부 경로는 동일하지만, 호스트에서 보이는 경로는 버전에 따라 다를 수 있습니다. + +#### 로그 경로 확인하기 + +1. QueryPie 버전을 확인합니다. +2. 호스트 기준 로그 경로를 확인합니다. + * `9.x ~ 10.4.x` : `/var/log/querypie` + * `11.0.x+` : 일반적으로 compose 파일 기준 상위 디렉터리의 `log` 경로 +3. 필요하면 app 컨테이너 내부에서도 로그 경로를 직접 확인합니다. + +호스트에서 직접 파일 로그를 확인하는 예시는 아래와 같습니다. +``` +ls -al ../log +``` + +호스트 경로가 `/var/log/querypie`인 환경에서는 아래처럼 확인할 수 있습니다. +``` +ls -al /var/log/querypie +``` + +app 컨테이너 내부에서 파일 로그를 확인하는 예시는 아래와 같습니다. +``` +docker exec -it querypie-app-1 sh +ls -al /var/log/querypie +``` + +#### 파일 로그 압축하기 + +1. 장애 발생 시각 전후의 로그를 수집할 디렉터리를 준비합니다. +2. `api`, `engine`, `nginx`, `proxy` 관련 로그가 포함되었는지 확인합니다. +3. 환경에 맞는 경로를 기준으로 압축합니다. +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz -C .. log +``` + +호스트 경로가 `/var/log/querypie`인 환경에서는 아래처럼 수집할 수 있습니다. +``` +mkdir -p support-logs +tar -czf support-logs/querypie-file-logs.tar.gz /var/log/querypie +``` + +### 컨테이너 표준 출력 로그 수집하기 + +파일 로그와 함께 컨테이너의 `stdout`/`stderr` 로그도 수집합니다. + +1. app 컨테이너 로그를 저장합니다. +2. `tools` profile이 실행 중이면 tools 로그도 함께 저장합니다. +``` +mkdir -p support-logs +docker logs querypie-app-1 > support-logs/app.docker.log 2>&1 +docker logs querypie-tools-1 > support-logs/tools.docker.log 2>&1 || true +``` + + +thread dump fallback에서 `kill -3`를 사용한 경우 결과가 보통 컨테이너 표준 출력으로 남으므로, 이 경우에는 `docker logs` 수집이 특히 중요합니다. + + +### monitoring dump 수집하기 + +API hang, 응답 지연, deadlock 의심 상황에서는 `/api/config/monitoring`을 우선 사용합니다. + +
+예시 : https://<querypie 주소>/api/config/monitoring +
+예시 : https://<querypie 주소>/api/config/monitoring +
+
+ + +1. Owner 계정 또는 `SYSTEM_PROPERTIES` 권한이 있는 계정으로 로그인합니다. +2. 브라우저에서 `/api/config/monitoring` 화면으로 이동합니다. +3. 필요한 시간 범위를 확인합니다.
`Create New Dump` 버튼을 눌러서 새로운 Dump 파일을 생성할 수도 있습니다. +4. 아래 중 하나를 선택합니다. + * dump만 다운로드 + * `Dumps + All Logs`로 dump와 애플리케이션 로그를 함께 다운로드 + + +`Dumps + All Logs` 기능의 `logHome` 기본값은 `/var/log/querypie` 입니다. +커스텀 로그 경로를 사용하는 환경이라면 실제 로그 홈 경로를 확인한 뒤 사용하세요. + + + +monitoring dump 압축 파일에는 `thread.dump`가 포함되며, 파일 로그와 함께 전달하면 분석 속도가 훨씬 좋아집니다. + + + +**자동으로 monitoring dump가 생성되는 경우** + +아래 조건에서는 monitoring dump가 자동 생성될 수 있습니다. + +* MetaDB 또는 LogDB connection pool의 idle connection이 최대 pool size의 10% 이하로 떨어진 경우 +* `SQLTransientConnectionException`이 발생하고 메시지에 `Connection is not available, request timed out after`가 포함된 경우 + +자동 dump는 최소 10분 간격으로만 생성됩니다. +짧은 시간 안에 동일 증상이 반복되더라도 매번 새 dump가 생기지 않을 수 있습니다. + + +### 로그 레벨을 일시적으로 변경하기 + +기본 로그만으로 원인 파악이 어려울 때만 잠시 debug 레벨로 올려 재현 로그를 수집합니다. + +1. debug 레벨 변경 전 시각을 기록합니다. +2. 대상 컴포넌트의 로그 레벨을 올립니다. +3. 동일 증상을 재현합니다. +4. 로그를 수집합니다. +5. 원래 레벨로 복원합니다. + 1. Default 로그 레벨은 `api` 는 `warn`, 나머지 `engine`, `arisa`, `cabinet`, `kubepie`, `rotatepie`, `novas` 는 `info` 입니다. (`arisa` 는 proxy 컴포넌트입니다.) +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug api +``` + +모든 컴포넌트에 적용하려면 component를 생략할 수 있습니다. +``` +docker exec -it querypie-app-1 /app/change-log-level.sh debug +``` + +지원 가능한 component는 아래와 같습니다. + +* `api` +* `engine` +* `arisa` +* `cabinet` +* `kubepie` +* `rotatepie` +* `novas` +* `all` + + +세 번째 인자로 timeout(초)을 지정할 수 있습니다. +장시간 debug 레벨로 운영하지 말고, 수집이 끝나면 반드시 원래 레벨로 복원하세요. +`docker exec -it querypie-app-1 /app/change-log-level.sh debug api 30` + + +### 증상별 우선 수집 로그 + +모든 컴포넌트 로그를 항상 debug로 올릴 필요는 없습니다. +아래 기준으로 증상에 맞는 로그를 먼저 수집한 뒤, 필요할 때만 범위를 넓히는 것이 좋습니다. + +| **증상 / 시나리오** | **우선 수집 로그** | **추가로 보면 좋은 로그** | +| -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------- | +| 로그인 실패, 화면 API 오류, 설정 저장 실패, 승인 요청 처리 오류 | `api` 파일 로그, `docker logs querypie-app-1`, 필요 시 `api` debug 로그 | `nginx` 로그 | +| 웹 화면이 열리지 않음, 502/504, 정적 화면은 보이지만 API 호출이 실패함 | `nginx` 파일 로그, `docker logs querypie-app-1` | `api` 파일 로그 | +| DAC 접속은 되지만 쿼리 실행이 실패하거나 DB 세션 생성/프록시 연결이 불안정함 | `proxy` 파일 로그, `arisa` 파일 로그 | `api` 로그, 필요 시 `arisa` debug 로그 | +| 쿼리 실행 지연, 결과 조회 지연, 엔진 처리 중 실패, snapshot/analysis 계열 처리 이상 | `engine` 파일 로그 | `api` 로그, 필요 시 `engine` debug 로그, monitoring dump | +| KAC 클러스터 접속 실패, Kubernetes 리소스 조회 실패, kubectl 동작 이상 | `kubepie` 파일 로그 | `api` 로그, 필요 시 `kubepie` debug 로그 | +| RotatePie 관련 스케줄 작업 또는 rotation 처리 이상 | `rotatepie` 파일 로그 | 필요 시 `rotatepie` debug 로그 | +| Nova / SSH / 게이트웨이 연동 계열 연결 실패 | `novas` 파일 로그 | 필요 시 `novas` debug 로그, 관련 gateway 로그 | +| Multi Agent 기반 접속 문제, 로컬 앱 연결 실패, WebView 오류, 특정 사용자 PC에서만 재현 | Multi Agent 로그, `webView.log` | 서버 측 `proxy`, `api` 로그 | +| SAC Windows Server Agent 연결 실패, RDP timeout, 특정 Windows 세션에서만 실패 | Windows Server Agent 서비스 로그 | 사용자별 Agent 로그, Multi Agent 로그, 서버 측 `proxy` / `api` 로그 | +| API hang, 응답 지연, deadlock 의심, DB connection pool 부족 의심 | `/api/config/monitoring` dump, `api` 파일 로그 | `engine` 로그, `docker logs`, thread dump fallback | + + +어떤 로그부터 봐야 할지 애매하면 `api`, `nginx`, `docker logs`, `/api/config/monitoring` dump를 먼저 확보하고, 증상이 접속/프록시 계열이면 `proxy` 또는 `arisa`, 클라이언트 계열이면 Multi Agent 또는 Windows Server Agent 로그를 추가하는 방식이 가장 실용적입니다. + + +### Multi Agent 로그 수집하기 + +Multi Agent를 사용하는 환경이면 desktop app 로그도 함께 수집합니다. + +1. 사용 중인 OS의 로그 경로를 확인합니다. + * Windows: `%USERPROFILE%\.querypie-multi-agent\logs\` + * macOS: `$HOME/.querypie-multi-agent/logs/` + * Linux: `$HOME/.querypie-multi-agent/logs/` +2. 일반 로그와 `webView.log`를 함께 확보합니다. +3. 상세 로그가 필요하면 `Diagnostic Tools > Enable Tracing`을 켠 뒤 재현합니다. +4. 수집 후 tracing을 다시 끕니다. +5. 필요하면 `Diagnostic Tools > Export Log`로 압축본을 생성합니다. + + +앱 시작 시점부터 상세 로그가 필요할 때만 `QPMA_TRACE=1` 환경변수로 실행합니다. +일반 운영 상태에서는 장시간 사용하지 않는 것이 좋습니다. + + +### SAC Windows Server Agent 로그 수집하기 + +SAC에서 Windows Server Agent를 사용하는 환경이면 agent 로그도 함께 수집합니다. + +#### 기본 서비스 로그 수집하기 + +1. Windows Server에서 아래 경로를 확인합니다. + * `%ProgramData%\QueryPie\Server Agent\Logs\` +2. 서비스 로그를 먼저 압축합니다. +``` +$logRoot = "$env:ProgramData\QueryPie\Server Agent\Logs" +$outFile = "$env:TEMP\querypie-server-agent-logs.zip" +Compress-Archive -Path "$logRoot\*" -DestinationPath $outFile -Force +``` + +#### 사용자별 로그가 필요한 경우 + +특정 Windows 사용자 세션에서만 재현되거나 사용자별 동작 확인이 필요한 경우 아래 경로도 같이 수집합니다. + +* `%ProgramData%\QueryPie\Server Agent\Logs\Users\\` + +#### Verbose 로그가 필요한 경우 + +1. Windows Server에서 PowerShell을 실행합니다. +2. 현재 LogLevel을 확인합니다. +``` +Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" | Select-Object LogLevel +``` + +3. 필요 시 LogLevel을 `Verbose`로 변경합니다. +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Verbose" +``` + +4. 증상을 재현하고 로그를 수집합니다. +5. 수집 후 `Information`으로 복원합니다. +``` +Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\QueryPie Server Agent Persistent" -Name "LogLevel" -Value "Information" +``` + + +RDP timeout이나 연결 실패 이슈를 추적할 때는 QueryPie 서버 측 Proxy/API 로그와 사용자 PC의 Multi Agent 로그까지 함께 있어야 분석이 쉬워집니다. + + +### 추가로 필요한 경우만 수집하기 + +아래 자료는 설정 문제, 배포 차이, 또는 thread dump fallback 분석이 필요할 때만 추가로 수집합니다. + +#### 설정 파일 수집하기 + +1. 현재 배포 설정 파일을 확인합니다. +2. 민감정보를 마스킹한 뒤 전달합니다. + +추가 수집 대상 예시는 아래와 같습니다. + +* `.env` 또는 `compose-env` +* `compose.yml` 또는 `docker-compose.yml` +* `nginx.d/` +* 커스텀 설정 파일 +* `logrotate.d/querypie` + + +`logrotate.d/querypie`는 일부 compose package에서 app 컨테이너의 `/etc/logrotate.d/querypie` 설정과 직접 연결될 수 있습니다. +로그 rotation 동작이나 보존 기간 확인이 필요할 때만 추가로 포함하세요. + + +#### JVM thread dump fallback 수집하기 + +`/api/config/monitoring` 접근이 어렵거나 컨테이너 내부에서 직접 thread dump를 수집해야 할 때만 사용합니다. + +1. host에서 app 컨테이너에 접속합니다. +``` +docker exec -it querypie-app-1 bash +``` + +2. app 컨테이너 안에서 API Java PID를 찾고 thread dump를 생성합니다. +``` +ps -ef | grep '[a]pp/api/api.jar' +``` + +3. 가능한 경우 `jcmd`로 thread dump를 수집합니다. +``` +jcmd Thread.print > /tmp/api-thread-dump.txt +``` + +4. app 컨테이너에서 나온 뒤, host에서 dump 파일을 복사합니다. +``` +docker cp querypie-app-1:/tmp/api-thread-dump.txt support-logs/api-thread-dump.txt +``` + +5. `jcmd`가 없으면 app 컨테이너 안에서 `kill -3`을 사용합니다. +``` +kill -3 +``` + + +이 단계에서는 `commandpie-engine.jar`가 아니라 `/app/api/api.jar` 프로세스의 PID를 사용해야 합니다. + + +### 전달 시 함께 적어야 하는 내용 + +로그 파일만 전달하면 분석 시간이 길어질 수 있으므로, 아래 정보를 함께 정리합니다. + +| **항목** | **설명** | +| ---------------- | ------------------------------------------------------ | +| 발생 시각 | 예: `2026-07-07 14:23 KST` | +| 서버 timezone | 로그 시각 대조 기준 | +| 증상 | 예: 로그인 후 특정 API 응답이 30초 이상 지연됨 | +| 재현 가능 여부 | 가능 / 불가능 | +| 재현 절차 | 가능한 경우 단계별로 기록 | +| 재현 시각 | 재현을 수행한 실제 시각 | +| 영향 범위 | 특정 사용자, 특정 서버, 전체 사용자 여부 | +| 수집한 로그 종류 | 파일 로그, docker logs, monitoring dump, agent 로그 등 | + +### 체크리스트 템플릿 + +``` +[기본 정보] +- 발생 시각: +- 서버 timezone: +- 증상: +- 영향 범위: +[재현 정보] +- 재현 가능 여부: +- 재현 절차: +- 재현 시각: +[수집 로그] +- 파일 로그: 수집 완료 / 미수집 +- docker logs: 수집 완료 / 미수집 +- monitoring dump: 수집 완료 / 미수집 +- Multi Agent 로그: 해당 없음 / 수집 완료 / 미수집 +- Windows Server Agent 로그: 해당 없음 / 수집 완료 / 미수집 +[추가 수집] +- 설정 파일: 수집 완료 / 미수집 +- JVM thread dump fallback: 수집 완료 / 미수집 +[추가 설명] +- 특이사항: +``` diff --git a/src/content/ko/user-manual/_meta.ts b/src/content/ko/user-manual/_meta.ts index 59b6637e4..51071d920 100644 --- a/src/content/ko/user-manual/_meta.ts +++ b/src/content/ko/user-manual/_meta.ts @@ -5,6 +5,7 @@ export default { 'server-access-control': 'Server Access Control', 'kubernetes-access-control': 'Kubernetes Access Control', 'web-access-control': 'Web Access Control', + 'mcp-access-control': 'MCP Access Control', 'preferences': 'Preferences', 'user-agent': 'User Agent', 'multi-agent': 'Multi Agent', diff --git a/src/content/ko/user-manual/mcp-access-control.mdx b/src/content/ko/user-manual/mcp-access-control.mdx new file mode 100644 index 000000000..a1301113a --- /dev/null +++ b/src/content/ko/user-manual/mcp-access-control.mdx @@ -0,0 +1,10 @@ +--- +title: 'MCP Access Control' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/folder/2168455203' +--- + +# MCP Access Control + +## 하위 문서 + +- [MAC을 통해 Remote MCP Servers 사용하기](./mcp-access-control/using-remote-mcp-servers-through-mac) diff --git a/src/content/ko/user-manual/mcp-access-control/_meta.ts b/src/content/ko/user-manual/mcp-access-control/_meta.ts new file mode 100644 index 000000000..78b0e45ac --- /dev/null +++ b/src/content/ko/user-manual/mcp-access-control/_meta.ts @@ -0,0 +1,3 @@ +export default { + 'using-remote-mcp-servers-through-mac': 'MAC을 통해 Remote MCP Servers 사용하기', +}; diff --git a/src/content/ko/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx b/src/content/ko/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx new file mode 100644 index 000000000..492c4f15d --- /dev/null +++ b/src/content/ko/user-manual/mcp-access-control/using-remote-mcp-servers-through-mac.mdx @@ -0,0 +1,179 @@ +--- +title: 'MAC을 통해 Remote MCP Servers 사용하기' +confluenceUrl: 'https://querypie.atlassian.net/wiki/spaces/QM/pages/2166816845/MAC+Remote+MCP+Servers' +--- + +import { Callout } from 'nextra/components' + +# MAC을 통해 Remote MCP Servers 사용하기 + +### Overview + +`MCP Servers`는 사용자에게 허용된 원격 MCP Server를 조회하고, QueryPie가 제공하는 MCP endpoint를 통해 외부 MCP Client와 연결할 수 있도록 도와주는 사용자 화면입니다. +사용자는 이 화면에서 자신에게 허용된 서버 목록을 확인하고, 서버별 `Basic Info`, `Tools`, `Accessible Roles` 정보를 조회할 수 있으며, MCP 서버의 Credential Mode가 “`User OAuth`"(관리자 페이지에서 설정)인 경우 upstream OAuth 연결도 직접 수행할 수 있습니다. + +
+image-20260605-035129.png +
+ +이 문서에서는 사용자 페이지에서 다음 작업을 수행하는 방법을 설명합니다. + +* 내가 접근할 수 있는 MCP Server 목록 확인 +* MCP Client별 연결 가이드 확인 +* 서버별 **Basic Info**, **Tools**, **Accessible Roles** 확인 +* 필요한 경우 upstream OAuth 연결 수행 + +
+User > MCP Servers +
+User > MCP Servers +
+
+ +### 시작하기 전에 + +다음 조건이 충족되어야 합니다. + +* QueryPie ACP에 MAC 라이선스가 있어야 합니다.. +* 관리자에 의해 MCP Server에 접근할 수 있는 역할(Role)이 부여되어 있어야 합니다. +* 부여된 Role의 Policy에 따라 하나 이상의 MCP Server 접근 권한이 있어야 합니다. + + +사용자에게 부여된 Role이 없으면 서버 목록 대신 안내 화면이 표시되며, 접근 권한 요청이 필요할 수 있습니다. +현재 관리자만 Role을 부여할 수 있고 workflow를 통한 권한 신청은 할 수 없습니다. + + + +사용자가 실제로 연결하는 대상은 upstream MCP Server의 원본 URL이 아니라, QueryPie가 제공하는 MCP endpoint입니다. `Connect with` 의 연결 가이드는 QueryPie endpoint(`/mac/mcp`)를 기준으로 생성됩니다. + + +### MCP Servers 화면 열기 + +1. 상단 메뉴에서 `MCP Servers`를 클릭합니다. +2. MCP Server 화면은 `Connect with` 영역과 `서버 목록(서버 카드)`, `상세 패널`로 구성되어 있습니다. +3. 권한이 있는(Role을 부여받은) MCP 서버가 있으면 서버 카드 목록이 표시됩니다. + +#### 화면에서 확인할 수 있는 정보 + +| **항목** | **설명** | +| --------------------- | ------------------------------------------------------------------------------------------------------------------------ | +| Connect with | 드랍다운 목록에서 사용하는 MCP Client를 선택하면 해당 Client 기준의 연결 가이드를 보여줍니다. | +| 서버 목록 (서버 카드) | 접근 가능한 MCP Server 목록을 표시합니다. 서버카드에는 관리자가 지정한 MCP Server의 이름과 엔드포인트 주소가 표시됩니다. | +| 인증 상태 배지 | OAuth가 필요한 서버는 `Authenticated` 또는 `Not Authenticated` 상태로 표시됩니다. | +| 상세 패널 | 선택한 MCP 서버의 `Basic Information`, `Available Tools`, `Accessible Roles`를 확인할 수 있습니다. | + +### Connect with 에서 MCP Client 연결 정보 확인하기 + +`Connect with` 영역에서는 QueryPie MCP endpoint를 외부 MCP Client에 등록하는 방법을 확인할 수 있습니다. + +1. `Connect with` 드롭다운에서 사용할 MCP Client를 선택합니다. +2. QueryPie가 해당 Client에 맞는 연결 가이드를 표시합니다. +3. 가이드에 표시된 명령어, URL 또는 설정 예시를 복사해 MCP Client에 등록합니다. + +지원되는 가이드 방식은 Client에 따라 다를 수 있습니다. + +| **방식** | **설명** | +| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | +| One-click | `Connect` 버튼으로 Client를 바로 열어 연결 정보를 전달합니다. (예: vs code) | +| Command | 터미널 명령어를 복사해 MCP Client CLI에 등록합니다. (예: `claude mcp add --transport http querypie-mac "https:///mac/mcp"` ) | +| Terminal URL | 표시된 URL을 복사해 Client 설정에 입력합니다. | +| Connector steps | Client의 설정 화면에서 URL 또는 설정 값을 복사해서 입력합니다. (예: LibreChat) | + + +연결 가이드에 표시되는 값은 선택한 특정 서버의 upstream URL이 아니라, QueryPie의 공용 MCP root URL을 기준으로 생성됩니다.
예 : notion 의 endpoint url은 “`https://mcp.notion.com/mcp`” 이지만 QueryPie MCP server의 connect with 에 표시되는 연결가이드에는 “`https:///mac/mcp`” 로 표시됩니다. + + +### 접근 가능한 MCP Server 확인하기 + +1. 서버 카드 목록에서 원하는 서버를 클릭합니다. +2. 카드에는 다음 정보가 표시됩니다. + * MCP 서버 표시 이름 + * Endpoint + * OAuth 인증 상태 배지(필요한 경우) +3. 선택한 서버의 상세 패널이 열립니다. + +#### 상세 패널에서 확인할 수 있는 탭 + + ++++ + + + + + + + + + + + + + + + + + + +
+**탭** + +**설명** +
+Basic Information + +* Server Name : MCP Server 를 식별가능하게 해주는 표시 이름입니다. +* Identifier : 내부적으로 사용하는 remote MCP 서버의 식별 이름입니다. +* Upstream Endpoint : remote MCP 서버의 실제 접속 endpoint URL 입니다. 사용자가 접속할 때는 이 주소를 사용할 수 없습니다. +* Transport : remote MCP 서버의 transport 유형입니다. (SSE / Streamable HTTP +
+Available Tools + +현재 사용자에게 허용된 Tool 목록을 확인합니다.
목록은 MCP 서버의 전체 Tool 목록이 아니라, 현재 사용자에게 부여된 Role과 Policy 기준으로 접근 가능한 Tool만 표시됩니다. +
+Accessible Roles + +* Role Name : 사용자에게 할당된 해당 MCP 서버에 대한 Role 이름입니다. +* Expiration Date : 해당 MCP 서버에 접근 권한이 만료되는 시점입니다. +* Status : Role 부여 상태를 보여줍니다. (Active / Expired) +* Policies: 해당 MCP server에 연결된 하나 이상의 policy 이름을 보여줍니다. +
+ +### OAuth가 필요한 MCP Server 연결하기 + +서버의 `Credential Mode`가 `User OAuth`인 경우, `Basic Information` 탭 아래에 OAuth 연결 섹션이 표시됩니다. + + +Credential Mode는 사용자가 설정할 수 없고 관리자만 설정할 수 있습니다. + + +#### OAuth 연결하기 + +1. 서버를 선택한 뒤 `Basic Information` 탭을 엽니다. +2. OAuth 상태가 `Not Authenticated`이면 `Connect` 버튼을 눌러 인증을 시작할 수 있습니다. +3. QueryPie가 웹 브라우저로 OAuth 인증 창을 엽니다. +4. upstream OAuth 제공자 화면에서 인증을 완료합니다. +5. 인증이 완료되면 상태가 `Authenticated`로 바뀝니다. + +#### OAuth 연결 해제하기 + +1. OAuth가 이미 연결된 서버를 엽니다. +2. `Reset Token` 버튼을 클릭합니다. +3. 저장된 OAuth 연결이 해제되고 상태가 다시 `Not Authenticated`로 바뀝니다. + +### 접근 권한이 없거나 MCP 서버가 보이지 않는 경우 + +#### Role이 없는 경우 + +* `MCP Servers` 화면에는 서버 목록 대신 빈 상태 화면이 표시됩니다. +
+ image-20260605-044959.png +
+* 이 경우 관리자에게 MAC Role 부여를 요청해야 합니다. + +#### Role은 있지만 서버가 없는 경우 + +* Role은 있어도 해당 Role의 Policy로 접근 가능한 서버가 없으면 사용할 서버가 표시되지 않습니다. +* 이 경우 Role에 연결된 Policy 또는 서버 접근 범위를 관리자에게 확인해야 합니다.