Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

README.md

@@ -95,6 +95,24 @@ Replay uses a temporary SQLite baseline and evaluates events in timestamp order.
 It reports detector counts and the findings that would have been generated. Use
 the configured stream ID so the export is evaluated with that stream's profile.
 
+Replay directly from Graylog MCP without touching the live baseline:
+
+```bash
+signalscope replay-graylog --range-seconds 86400
+```
+
+By default this uses the enabled streams from the dashboard configuration. Limit
+the run to one or more streams with repeated `--stream-id` flags. To test a
+candidate detector/profile configuration before applying it, compare it against
+the current runtime config:
+
+```bash
+signalscope replay-graylog --range-seconds 86400 --compare-config-file exports/candidate-config.json
+```
+
+The comparison reports detector-count, field-finding, and source-anomaly deltas
+using the same fetched event window.
+
 The current MCP endpoint is `http://<graylog-host>:9000/api/mcp`. Enable it in
 Graylog under `System -> Configurations -> MCP` and use stream IDs internally;
 the fgAI stream picker resolves titles in the UI.