Dollar Data Context Guard

A read-only DataHub MCP safety layer that resolves ownership, PII fields, and downstream lineage before an AI agent changes production data.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Dollar Data Context Guard

Inspiration

AI coding agents can change a schema in seconds, but approval prompts rarely explain who owns the data, whether the affected field is classified, or what will break downstream. A fast agent without metadata context can turn a small-looking command into a production incident.

Dollar Data Context Guard explores a safer pattern: use DataHub as the organizational context layer, then make the final safety decision locally and deterministically.

What it does

Before an agent performs a potentially destructive data change, Dollar:

  1. minimizes the requested intent and identifies the target asset;
  2. searches a real DataHub catalog through the official read-only MCP server;
  3. resolves environment, ownership, tags, schema fields, and up to three downstream lineage hops;
  4. applies a deterministic local policy; and
  5. returns an explainable allow, review, or block decision.

In the live demo, an agent proposes to drop the email field from the production Snowflake asset commerce.customer_profile. DataHub resolves the responsible owner, the PII and Tier1 classifications, the PII field contract, and three downstream dependencies. Dollar classifies the action as EXTREME and blocks it pending owner approval.

How we built it

The project runs against a self-hosted DataHub Core 1.6.0 catalog seeded only with clearly labelled synthetic retail metadata. Dollar launches the official mcp-server-datahub process and uses its live search, get_entities, list_schema_fields, and get_lineage tools.

The adapter normalizes the current official MCP response shapes into a small internal context object. A separate local policy engine then evaluates production scope, destructive intent, classifications, field sensitivity, ownership, and lineage. The language model or coding agent never decides whether its own action is safe.

The repository also includes a fixture path for fast judging, a live CLI path, a live web judge path, seeded DataHub metadata, a verification record, and ten tests covering policy, redaction, MCP normalization, lineage, error handling, and write-back safeguards.

Why DataHub matters

This is not a static command filter. The decision depends on context that DataHub is designed to own:

  • the asset is in PROD;
  • email is classified as PII;
  • the dataset is tagged PII and Tier1;
  • a named owner is accountable; and
  • three downstream assets are exposed to the change.

Without DataHub, Dollar would only know that a field is being removed. With DataHub, it can explain the real organizational blast radius.

Safety and privacy boundary

The MCP integration is read-only and exposes no mutation tools. Dollar sends only a minimized intent and asset identifier. Source files, API keys, secret values, absolute home paths, and full agent transcripts are not sent to DataHub. If DataHub or MCP fails, Dollar holds instead of guessing. Write-back remains disabled unless a future workflow receives separate human approval.

Challenges

The largest integration challenge was adapting to the exact live MCP schemas. Current responses represent tags and platforms as nested objects, ownership under ownership.owners, and lineage through upstream, max_hops, and max_results. We added explicit normalization tests instead of relying on assumptions.

Windows Quickstart also exposed a console-encoding issue: the containers became healthy, but a Chinese GBK terminal could not print a Unicode success mark. We verified the actual frontend and GMS health endpoints rather than treating console rendering as service failure.

Accomplishments

  • Real DataHub Core catalog, not a mocked metadata API
  • Official DataHub MCP tools used end to end
  • Three-hop downstream blast-radius analysis
  • Deterministic fail-closed local policy
  • Read-only integration with explicit privacy boundaries
  • 10/10 tests passing
  • Reproducible live and fixture judge paths

What we learned

Metadata becomes much more valuable when it is used before an action, not only after an incident. DataHub's graph can serve as a preflight safety contract for agents: ownership tells us who must approve, classifications tell us what is sensitive, and lineage tells us who else will be affected.

What's next

Next steps include post-action scope verification, policy packs for common data tools, an optional human-approved write-back audit event, and an official MCP conformance suite across DataHub releases.

Quick judge path

Built With

Share this project:

Updates