pub fn statement_capability(sql: &str) -> McpCapabilityExpand description
The level a statement passed to reddb_query requires.
reddb_query is read-only as a tool, but takes arbitrary SQL, so the
statement decides. Classification is deliberately conservative: only a
recognised read verb is ReadOnly, anything touching the vault, secrets
or principals is Admin, and anything unrecognised is Write — a
statement this classifier does not know must not slip through a
read-only session.