GameOps Investigator makes its safety claims executable

A new open-source analytics agent is trying to make a narrower claim than “the model can investigate an incident.” GameOps Investigator packages the measurable parts of that workflow—metric definitions, SQL policy, cohort comparison, anomaly tests and evidence-backed reporting—as five MCP tools, then checks those parts with a fixed offline evaluation.[1]

The Python project, created August 30, had 98 GitHub stars and four forks when this article cleared review on September 1. Its repository includes a Streamlit workbench, synthetic data for 5,000 players and 136,164 events, three injected incident scenarios, generated reports with tool traces, 17 automated tests and a CI workflow.[1][2] It has no tagged release yet, so the adoption signal is early, fast-moving and repository-only.[2]

The useful boundary is what the evaluation does not claim

The checked-in eval_results.json reports 40 of 40 deterministic cases passing. Twenty cases test tool routing, eight test SQL-policy outcomes, three test whether the injected cause appears in the top three candidates, five test metric contracts and four test governance behaviors.[3] The artifact explicitly says these are not Claude scores: they validate the harness, deterministic replay coordinator, tool functions, safety controls and citation pipeline. The repository records Claude as installed but unauthenticated, with its model-quality, cost and latency fields left null.[3]

That restraint matters. A perfect score on fixed synthetic cases does not establish general incident-investigation quality, but it does expose a reproducible contract that another project can inspect or break.

Read-only is implemented in several places

The SQL tool accepts only SELECT or WITH, rejects semicolons, comments, mutations, DDL and extension loading, opens SQLite read-only, enables query_only, applies a table allowlist and enforces row and timeout caps.[4] The evaluation includes negative cases for writes, multiple statements, comments and access to a hidden ground-truth table.[3]

Reports must remain marked for human review. Evidence references are SHA-256 digests of tool outputs, and the validator rejects references it cannot resolve. No tool can deploy code, edit a game economy or message a player.[4]

Those controls are still a demo boundary, not a production guarantee. The project’s own hardening checklist calls for identity-aware warehouse credentials, row- and column-level controls, cost estimation, central audit logs, PII masking and an approval workflow outside the model before real deployment.[4]

For NL2SQL builders, the notable contribution is therefore less the incident dashboard than the separation of claims: deterministic components get deterministic tests; the unmeasured model path stays visibly unmeasured. That is a stronger starting point than rolling policy, reasoning and evidence quality into one opaque accuracy number.