You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ai/gen-ai-agents/oci-enterprise-ai-agents-oac-mcp-server/README.md
+21-23Lines changed: 21 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
-
# OCI Enterprise AI Agents — OAC MCP Server
1
+
# OCI Enterprise AI Agents - OAC MCP Server
2
2
3
-
A React assistant that lets [OCI Enterprise AI](https://www.oracle.com/artificial-intelligence/enterprise-ai/) query **governed Oracle Analytics Cloud data** through the **OAC MCP server**. The model reasons through the OCI Generative AI Responses API, the app executes the delegated OAC MCP tool calls, and every numeric result is rendered as a chart — with the Logical SQL and the full tool timeline shown next to it.
3
+
A React assistant that lets [OCI Enterprise AI](https://www.oracle.com/artificial-intelligence/enterprise-ai/) query **governed Oracle Analytics Cloud data** through the **OAC MCP server**. The model reasons through the OCI Generative AI Responses API, the app executes the delegated OAC MCP tool calls, and every numeric result is rendered as a chart - with the Logical SQL and the full tool timeline shown next to it.
4
4
5
5
Built with **Next.js 16**, **React 19**, **Recharts**, and a small **Python bridge**.
6
6
@@ -36,29 +36,29 @@ Open [http://localhost:3000](http://localhost:3000). Click the **Graph Demo** qu
36
36
Create `files/.env` (copy `.env.example`):
37
37
38
38
```env
39
-
# OCI Generative AI — OpenAI-compatible Responses API for your region
39
+
# OCI Generative AI - OpenAI-compatible Responses API for your region
# Optional — python used by the API route (default: files/.venv/bin/python, then python3)
50
+
# Optional - python used by the API route (default: files/.venv/bin/python, then python3)
51
51
# PYTHON_BIN=/usr/bin/python3
52
52
```
53
53
54
54
### OAC authentication
55
55
56
56
Two options, in the order the bridge resolves them:
57
57
58
-
1.**Access token**— set `OAC_ACCESS_TOKEN` (or `MCP_BEARER_TOKEN`) in `.env`, or paste a token in the UI. OAC access tokens expire after ~1 hour.
59
-
2.**`tokens.json` (recommended)**— in OAC go to **Profile → Mobile Authentication → Download token file** and save it as `files/tokens.json` (shape in `tokens.example.json`). The bridge reads it on every request and **refreshes it automatically**~10 minutes before expiry, persisting the rotated refresh token back to the file. This survives well beyond the 1-hour access-token window.
58
+
1.**Access token**- set `OAC_ACCESS_TOKEN` (or `MCP_BEARER_TOKEN`) in `.env`, or paste a token in the UI. OAC access tokens expire after ~1 hour.
59
+
2.**`tokens.json` (recommended)**- in OAC go to **Profile → Mobile Authentication → Download token file** and save it as `files/tokens.json` (shape in `tokens.example.json`). The bridge reads it on every request and **refreshes it automatically**~10 minutes before expiry, persisting the rotated refresh token back to the file. This survives well beyond the 1-hour access-token window.
60
60
61
-
> The refresh endpoint authenticates with the *access token itself*, so once a downloaded token file fully expires it cannot be refreshed — download a fresh `tokens.json` from OAC.
61
+
> The refresh endpoint authenticates with the *access token itself*, so once a downloaded token file fully expires it cannot be refreshed - download a fresh `tokens.json` from OAC.
62
62
63
63
---
64
64
@@ -96,7 +96,7 @@ Follow-up questions keep `previous_response_id`, so "break that down by month" w
96
96

97
97
98
98
### Governed analytics through MCP
99
-
The assistant discovers the right subject area or dataset, describes only the relevant metadata, and builds Logical SQL from the exact described column names — including the `XSA('owner'.'Dataset')` syntax for uploaded datasets.
99
+
The assistant discovers the right subject area or dataset, describes only the relevant metadata, and builds Logical SQL from the exact described column names - including the `XSA('owner'.'Dataset')` syntax for uploaded datasets.
100
100
101
101
### Automatic result charts
102
102
Any executed Logical SQL result with at least one category column and one numeric measure is rendered as a bar chart. A **Graph Demo** quick prompt renders a deterministic local chart to verify the UI path with no OAC access at all.
@@ -105,7 +105,7 @@ Any executed Logical SQL result with at least one category column and one numeri
105
105
Every MCP call is listed with status, arguments, and compacted output; all executed Logical SQL statements are shown verbatim.
106
106
107
107
### Token diagnostics
108
-
On 401/403 the bridge reports the token source used, whether the JWT is readable/expired, and whether the token audience matches the OAC host — the usual failure causes, stated directly in the error message.
108
+
On 401/403 the bridge reports the token source used, whether the JWT is readable/expired, and whether the token audience matches the OAC host - the usual failure causes, stated directly in the error message.
109
109
110
110
### Display masking
111
111
Dataset owner e-mails, OCIDs, and `XSA('owner'...)` identifiers are masked in the rendered UI so demo recordings don't leak identifiers.
1. UI POSTs `{action: "chat", prompt, previousResponseId, ...}` to `/api/oac-demo`
147
147
2. The route spawns `scripts/oac_react_api.py` and writes the payload to stdin
148
-
3. The bridge resolves an OAC token (see below) and preflights `initialize` against the OAC MCP endpoint — 401/403 fail fast with token diagnostics
148
+
3. The bridge resolves an OAC token (see below) and preflights `initialize` against the OAC MCP endpoint - 401/403 fail fast with token diagnostics
149
149
4. The bridge lists the OAC MCP tools and exposes them to the model as function tools via the Responses API
150
150
5. Each model tool call is executed by the bridge against OAC MCP (`tools/call`), compacted, and returned to the model; the loop repeats until the model produces a final answer
151
151
6. The bridge extracts Logical SQL, builds the chart payload from the last SQL result rows, and emits one JSON object to stdout; the route returns it to the UI
152
152
153
153
### Token resolution order
154
154
155
155
1.`accessToken` pasted in the UI payload
156
-
2.`files/tokens.json`— used directly while valid, auto-refreshed (and persisted) when within 10 minutes of expiry
156
+
2.`files/tokens.json`- used directly while valid, auto-refreshed (and persisted) when within 10 minutes of expiry
-`POST {GENAI_BASE_URL}/responses`— model reasoning with function tools, chained via `previous_response_id` (OpenAI-compatible Responses API; authenticated with `GENAI_API_KEY` + `GENAI_PROJECT_ID`)
168
+
-`POST {GENAI_BASE_URL}/responses`- model reasoning with function tools, chained via `previous_response_id` (OpenAI-compatible Responses API; authenticated with `GENAI_API_KEY` + `GENAI_PROJECT_ID`)
-`POST .../api/dv/api/v1/tokens/token/refresh`— refreshes a downloaded token file: current access token in the `Authorization` header, refresh token as `text/plain` body; returns rotated `accessToken`/`refreshToken`
-`POST .../api/dv/api/v1/tokens/token/refresh`- refreshes a downloaded token file: current access token in the `Authorization` header, refresh token as `text/plain` body; returns rotated `accessToken`/`refreshToken`
173
173
174
174
---
175
175
@@ -217,12 +217,12 @@ The chart needs at least one text/category column and one numeric measure in the
Licensed under the Universal Permissive License (UPL), Version 1.0.
234
234
235
235
See [LICENSE](LICENSE) for more details.
236
-
237
-
ORACLE AND ITS AFFILIATES DO NOT PROVIDE ANY WARRANTY WHATSOEVER, EXPRESS OR IMPLIED, FOR ANY SOFTWARE, MATERIAL OR CONTENT OF ANY KIND CONTAINED OR PRODUCED WITHIN THIS REPOSITORY, AND IN PARTICULAR SPECIFICALLY DISCLAIM ANY AND ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. FURTHERMORE, ORACLE AND ITS AFFILIATES DO NOT REPRESENT THAT ANY CUSTOMARY SECURITY REVIEW HAS BEEN PERFORMED WITH RESPECT TO ANY SOFTWARE, MATERIAL OR CONTENT CONTAINED OR PRODUCED WITHIN THIS REPOSITORY. IN ADDITION, AND WITHOUT LIMITING THE FOREGOING, THIRD PARTIES MAY HAVE POSTED SOFTWARE, MATERIAL OR CONTENT TO THIS REPOSITORY WITHOUT ANY REVIEW. USE AT YOUR OWN RISK.
0 commit comments