Network Data Analysis (read-only SQL)

MCP Server

• Server: analysis-mcp (NetClaw-authored, spec 092)
• Tools: analysis_status, analysis_datasets, analysis_query
• Engine: DuckDB, in-memory, sandboxed and locked

What this reads, and what it can never read

Loads files from an allowlist of roots — ~/.openclaw/nsm/runs (Zeek/Suricata output from nsm-mcp), the workspace output directory, and ~/.openclaw/analysis for your own exports.

NetClaw's own stores are permanently unreachable: ~/.openclaw/memory/, ~/.openclaw/rag/, ~/.openclaw/n2n/ and ~/.openclaw/gait/, plus .ssh, .aws, .kube and .env. A generic SQL surface over those would be a backdoor, not an analysis tool.