feat(mcp): add OIDC auth, HTTP entry point, and Dockerfile for hosted deployment by aaronsteers · Pull Request #1046 · airbytehq/PyAirbyte

Aaron ("AJ") Steers (aaronsteers) · 2026-06-17T00:01:59Z

Summary

Adds hosted HTTP deployment support for the PyAirbyte (Cloud/Replication) MCP server with optional Keycloak OIDC auth, matching the pattern from airbytehq/airbyte-ops-mcp#931.

Server: _create_oidc_auth() returns OIDCProxy when all three OIDC env vars are set (OIDC_CONFIG_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET), None otherwise. /health endpoint for LB probes. Defaults: DEFAULT_HTTP_HOST = "0.0.0.0", DEFAULT_HTTP_PORT = 8080.

Entry point: New airbyte/mcp/http_main.py — imports constants from server.py, runs app.run(transport="streamable-http", stateless_http=True). Registered as airbyte-mcp-http console script.

Container: Multi-stage Dockerfile.mcp with non-root appuser (UID 10001), entry point airbyte-mcp-http, port 8080.

Dependencies: starlette added as direct dependency (was transitive via fastmcp, flagged by deptry DEP003).

The existing mcp-serve-http poe task retains its local-dev config (127.0.0.1:8000, http transport) — intentionally different from the production entry point.

Link to Devin session: https://app.devin.ai/sessions/275fbaf2f101462e8c34c5d0fcff792d
Requested by: Aaron ("AJ") Steers (@aaronsteers)

… deployment - Add OIDCProxy auth to MCP server (env-var gated, no OIDC = unchanged behavior) - Add /health endpoint for load balancer probes - Add airbyte/mcp/http_main.py HTTP entry point module - Add airbyte-mcp-http script entry point in pyproject.toml - Add Dockerfile.mcp for containerized MCP deployment Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration · 2026-06-17T00:02:01Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

github-actions · 2026-06-17T00:02:21Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1781654305-hosted-cloud-mcp' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1781654305-hosted-cloud-mcp'

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

/fix-pr - Fixes most formatting and linting issues
/uv-lock - Updates uv.lock file
/test-pr - Runs tests with the updated PyAirbyte
/prerelease - Builds and publishes a prerelease version to PyPI

📚 Show Repo Guidance

Helpful Resources

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

starlette is a transitive dependency of fastmcp, imported directly for custom_route handler type signatures (Request, JSONResponse). Co-Authored-By: AJ Steers <aj@airbyte.io>

coderabbitai · 2026-06-17T00:03:19Z

📝 Walkthrough

Walkthrough

Adds HTTP transport support to the Airbyte MCP server. A new http_main.py module provides the HTTP entrypoint, server.py gains optional OIDC authentication via OIDCProxy and a /health endpoint, a Dockerfile.mcp packages the server as a container, and pyproject.toml registers the airbyte-mcp-http CLI script and adds starlette as a runtime dependency.

Changes

MCP HTTP Transport, OIDC Auth, and Docker Packaging

Layer / File(s)	Summary
OIDC auth helper, server wiring, and health endpoint `airbyte/mcp/server.py`	Module docstring expanded to describe HTTP operation with optional OIDC; imports updated to include `OIDCProxy`, `Request`, and `JSONResponse`; `_create_oidc_auth()` reads OIDC environment variables and returns an `OIDCProxy` configured with issuer and client credentials, or `None` when OIDC is not fully set up; auth provider wired into `FastMCP` app via `auth=_create_oidc_auth()`; `GET /health` route registered returning `{"status": "ok"}` as `JSONResponse`.
HTTP entrypoint module and CLI script registration `airbyte/mcp/http_main.py`, `pyproject.toml`	`http_main.py` added with module docstring documenting OIDC environment variables; imports `DEFAULT_HTTP_HOST`, `DEFAULT_HTTP_PORT`, and `app` from server; `main()` function configures logging, logs startup on default host/port values, and starts the app with `transport="streamable-http"` and `stateless_http=True`; `__main__` guard invokes `main()` when run as a script. Console script `airbyte-mcp-http` registered in `pyproject.toml` pointing to `airbyte.mcp.http_main:main`; `starlette` added to runtime dependencies.
MCP HTTP Docker container definition and deptry config `Dockerfile.mcp`, `pyproject.toml`	`Dockerfile.mcp` uses `python:3.12-slim` base, copies pinned `uv` and `uvx` tooling from `astral-sh/uv` image, installs `git`, sets `/app` working directory, copies project files including `pyproject.toml`, `uv.lock`, `README.md`, and `airbyte/` directory, installs frozen dependencies with `uv sync --frozen --no-dev`, creates non-root `appuser` (UID 10001), sets `PATH` to use virtual environment binaries, exposes port `8080`, and runs `airbyte-mcp-http` as container command. `tool.deptry.per_rule_ignores` entry for `DEP003` initialized as empty list.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant OIDCProxy
    participant FastMCPApp
    participant HealthRoute

    Client->>OIDCProxy: HTTP request (if OIDC configured)
    OIDCProxy->>FastMCPApp: Validated request forwarded
    Client->>FastMCPApp: GET /health (unauthenticated)
    FastMCPApp->>HealthRoute: Route dispatched
    HealthRoute-->>Client: JSONResponse {"status": "ok"}
    Client->>FastMCPApp: MCP streamable-http transport request
    FastMCPApp-->>Client: MCP response (stateless)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately and specifically describes the three main features being added: OIDC authentication, HTTP entry point, and Dockerfile support for hosted deployment.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch devin/1781654305-hosted-cloud-mcp

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-code-quality · 2026-06-17T00:10:35Z

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest-fast

The overall coverage in the devin/1781654305-hos... branch is 67%. The coverage in the main branch is 65%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1781654305-hos... `1689115`	+/-
`airbyte/_util/api_util.py`	36%	37%	+1%
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/cloud/models.py`	0%	91%	+91%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

Python / code-coverage/pytest-no-creds

The overall coverage in the devin/1781654305-hos... branch is 67%. The coverage in the main branch is 65%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1781654305-hos... `1689115`	+/-
`airbyte/_util/api_util.py`	36%	37%	+1%
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/cloud/models.py`	0%	91%	+91%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

Python / code-coverage/pytest

The overall coverage in the devin/1781654305-hos... branch is 72%. The coverage in the main branch is 71%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1781654305-hos... `1689115`	+/-
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/server.py`	69%	76%	+7%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/cloud/models.py`	0%	93%	+93%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

_{Updated June 17, 2026 00:50 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

…user - Merge MCP_HTTP_HOST/PORT into defaults (0.0.0.0:8080), MCP_SERVER_URL is the only URL config needed - Add client_id to OIDC validation - Declare starlette as direct dependency instead of deptry ignore - Add non-root user (UID 10001) to Dockerfile.mcp - Remove os import from http_main (uses server constants directly) Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration

Devin Review found 4 potential issues.

Copilot

Pull request overview

Adds hosted-deployment support for the PyAirbyte MCP server by introducing an HTTP entry point, optional OIDC auth wiring, and a container build setup suitable for Cloud Run–style platforms.

Changes:

Add optional Keycloak OIDC authentication via OIDCProxy and a /health endpoint on the MCP server app.
Introduce an HTTP transport entry point (airbyte-mcp-http) to run the MCP server over streamable-http.
Add a dedicated Dockerfile for building and running the HTTP MCP server container.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`uv.lock`	Adds `starlette` to the resolved dependency set.
`pyproject.toml`	Declares `starlette` as a direct dependency and registers the `airbyte-mcp-http` script entry point.
`Dockerfile.mcp`	Builds a minimal container image that runs `airbyte-mcp-http` on port 8080 as a non-root user.
`airbyte/mcp/server.py`	Adds OIDC auth provider creation, HTTP defaults, and a `/health` route on the server app.
`airbyte/mcp/http_main.py`	Adds a new CLI entry point to run the MCP server using `streamable-http`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration Bot assigned Aaron ("AJ") Steers (aaronsteers) Jun 17, 2026

fix(mcp): add starlette to deptry DEP003 ignore list

391f7bc

starlette is a transitive dependency of fastmcp, imported directly for custom_route handler type signatures (Request, JSONResponse). Co-Authored-By: AJ Steers <aj@airbyte.io>

This comment was marked as resolved.

Sign in to view

Aaron ("AJ") Steers (aaronsteers) marked this pull request as ready for review June 17, 2026 00:20

Copilot AI review requested due to automatic review settings June 17, 2026 00:20

Copilot started reviewing on behalf of Aaron ("AJ") Steers (aaronsteers) June 17, 2026 00:20 View session

coderabbitai Bot approved these changes Jun 17, 2026

View reviewed changes

devin-ai-integration Bot reviewed Jun 17, 2026

View reviewed changes

Comment thread pyproject.toml

Comment thread airbyte/mcp/server.py Outdated

Comment thread airbyte/mcp/server.py

Comment thread airbyte/mcp/http_main.py

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread airbyte/mcp/server.py Outdated

Comment thread airbyte/mcp/server.py

Comment thread airbyte/mcp/http_main.py

Comment thread airbyte/mcp/http_main.py

fix(mcp): correct OIDC docstrings to list all three required env vars

1689115

Co-Authored-By: AJ Steers <aj@airbyte.io>

Aaron ("AJ") Steers (aaronsteers) merged commit ad6b43f into main Jun 27, 2026
22 checks passed

Aaron ("AJ") Steers (aaronsteers) deleted the devin/1781654305-hosted-cloud-mcp branch June 27, 2026 02:07

coderabbitai Bot mentioned this pull request Jun 29, 2026

fix(mcp): derive MCP endpoint path dynamically from MCP_SERVER_URL #1051

Merged

Uh oh!

Conversation

Aaron ("AJ") Steers (aaronsteers) commented Jun 17, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Jun 17, 2026

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Jun 17, 2026

👋 Greetings, Airbyte Team Member!

Testing This PyAirbyte Version

PR Slash Commands

Helpful Resources

Community Support

Uh oh!

coderabbitai Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Uh oh!

This comment was marked as resolved.

Uh oh!

github-code-quality Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

Python / code-coverage/pytest-fast

Python / code-coverage/pytest-no-creds

Python / code-coverage/pytest

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Aaron ("AJ") Steers (aaronsteers) commented Jun 17, 2026 •

edited by devin-ai-integration Bot

Loading

coderabbitai Bot commented Jun 17, 2026 •

edited

Loading

github-code-quality Bot commented Jun 17, 2026 •

edited

Loading