Harden runtime for Lambda: cache catalog, redact key, pg keepAlive

Three small production-hardening tweaks driven by running on Lambda
and RDS:

- list-datasets: cache the ~2MB Census data.json catalog in
  module-level memory with a 1h TTL. Persists across warm Lambda
  invocations so repeated calls don't refetch the catalog every time.
- fetch-aggregate-data: redact the Census API key from the URL before
  logging it. Matters in Lambda because DEBUG_LOGS=true ships these
  lines to persistent CloudWatch.
- seed-runner: enable keepAlive on the pg Client to stop RDS from
  silently dropping idle connections mid-seed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: brendanbabb

mcp-db/src/seeds/scripts/seed-runner.ts

@@ -41,7 +41,11 @@ export class SeedRunner {
     dataPath?: string,
     rateLimitConfig?: Partial<RateLimitConfig>,
   ) {
-    this.client = new Client({ connectionString: dbUrl })
+    this.client = new Client({
+      connectionString: dbUrl,
+      keepAlive: true,
+      keepAliveInitialDelayMillis: 10000,
+    })
     // Only use __dirname as fallback if no dataPath provided
     const defaultPath = path.join(__dirname, '../../../data')
     this.dataPath = dataPath || defaultPath

mcp-server/src/tools/fetch-aggregate-data.tool.ts

@@ -143,7 +143,7 @@ export class FetchAggregateDataTool extends BaseTool<TableArgs> {
       const fetch = (await import('node-fetch')).default
       const res = await fetch(url)
 
-      console.log(`URL Attempted: ${url}`)
+      console.log(`URL Attempted: ${url.replace(/key=[^&]*/g, 'key=REDACTED')}`)
 
       if (!res.ok) {
         return this.createErrorResponse(

mcp-server/src/tools/list-datasets.tool.ts

@@ -16,6 +16,11 @@ import { ToolContent } from '../types/base.types.js'
 
 export const toolDescription = `Call this FIRST when the user asks for Census data but has not named a specific dataset; do not guess the dataset_id. Returns the full Census Bureau catalog of dataset IDs, titles, and available vintages so you can pick the right one. Workflow: list-datasets -> search-data-tables -> fetch-dataset-geography -> resolve-geography-fips -> fetch-aggregate-data.`
 
+// Module-level cache — persists across warm Lambda invocations so repeated
+// calls don't refetch Census's ~2MB data.json catalog every time.
+const CATALOG_TTL_MS = 60 * 60 * 1000
+let catalogCache: { json: string; expiresAt: number } | null = null
+
 export class ListDatasetsTool extends BaseTool<object> {
   name = 'list-datasets'
   description = toolDescription
@@ -133,6 +138,13 @@ export class ListDatasetsTool extends BaseTool<object> {
     args: object,
     apiKey: string,
   ): Promise<{ content: ToolContent[] }> {
+    const now = Date.now()
+    if (catalogCache && catalogCache.expiresAt > now) {
+      return {
+        content: [{ type: 'text', text: catalogCache.json }],
+      }
+    }
+
     try {
       const fetch = (await import('node-fetch')).default
       const catalogUrl = `https://api.census.gov/data.json?key=${apiKey}`
@@ -162,15 +174,14 @@ export class ListDatasetsTool extends BaseTool<object> {
 
       const aggregated = this.aggregateDatasets(simplified)
 
+      const json = JSON.stringify(aggregated, (key, value) => {
+        return value === null ? undefined : value
+      })
+
+      catalogCache = { json, expiresAt: now + CATALOG_TTL_MS }
+
       return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify(aggregated, (key, value) => {
-              return value === null ? undefined : value
-            }),
-          },
-        ],
+        content: [{ type: 'text', text: json }],
       }
     } catch (error) {
       const errorMessage =