Merge pull request #85 from maia-iyer/git_example_changes

📖 Add example `.env` for github examples to run on Kagenti

Author: mrsabath

a2a/git_issue_agent/.env.ollama

@@ -0,0 +1,8 @@
+MCP_URL = "http://github-tool:8000/mcp"
+LOG_LEVEL = "DEBUG"
+JWKS_URI = "http://keycloak.keycloak.svc.cluster.local:8080/realms/master/protocol/openid-connect/certs"
+TASK_MODEL_ID = "ollama/ibm/granite4:latest"
+LLM_API_BASE = "http://host.docker.internal:11434"
+LLM_API_KEY = "ollama"
+MODEL_TEMPERATURE = 0
+SERVICE_PORT = 8000

a2a/git_issue_agent/.env.openai

@@ -0,0 +1,4 @@
+TASK_MODEL_ID = "gpt-4.1-nano"
+MCP_URL = "http://github-tool:8000/mcp"
+LOG_LEVEL = "DEBUG"
+JWKS_URI = "http://keycloak.keycloak.svc.cluster.local:8080/realms/master/protocol/openid-connect/certs"

a2a/git_issue_agent/README.md

@@ -0,0 +1,36 @@
+# Github Issue Agent
+
+## Introduction
+
+The Github Issue Agent is designed to perform tasks dealing with Github issues, leveraging large language models (LLMs) to generate plans, execute steps, and summarize findings. This agent integrates with [the upstream Github MCP Server](https://github.com/github/github-mcp-server) as a tool via MCP and utilizes AI models for data extraction, summarization, and more. This agent also integrates with [this MCP Man-in-the-Middle](https://github.com/kagenti/agent-examples/tree/main/mcp/github_tool) that will verify OAuth tokens and can be configured with Github PATs to communicate with the upstream Github MPC Server. 
+
+## Architecture
+
+<TODO>
+
+### Configuration Variables
+
+| Variable Name | Description | Required? | Default Value |
+|---------------|-------------|-----------|---------------|
+| LLM_API_BASE | The URL for OpenAI compatible API | Yes | `http://localhost:11434/v1` |
+| LLM_API_KEY | The API key for OpenAI compatible API | No |  `my_api_key` |
+| TASK_MODEL_ID | The ID of the LLM | Yes | `granite3.3:8b` |
+| EXTRA_HEADERS | Extra headers for the OpenAI API, e.g. {"MY_HEADER": "my_value"} | No | `{}` |
+| MODEL_TEMPERATURE | The temperature for the model | Yes | `0` |
+| MCP_URL | Endpoint where the Slack MCP server can be found | No |  "" |
+| SERVICE_PORT | Port on which the service will run | Yes | `8000` |
+| LOG_LEVEL | Application log level | No | DEBUG |
+| GITHUB_TOKEN | If set, will send requests to Github MCP Server with `Authorization: Bearer <GITHUB_TOKEN>` header. | No | - |
+| JWKS_URI | Endpoint to obtain JWKS for token validation. Enables token validation. | No | - |
+| ISSUER | Expected `iss` value of incoming bearer tokens | No | - |
+| TOKEN_URL | Endpoint to perform token exchange. Required for token exchange. | No | - |
+| CLIENT_ID | Client ID to authenticate to auth server with. Required for token exchange. Expected `aud` value of incoming bearer tokens | No | - |
+| CLIENT_SECRET | Client secret to authenticate to auth server with. Required for token exchange. | No | - |
+| TARGET_SCOPES | Requested scopes of token exchanged token | No | - |
+| TARGET_AUDIENCE | Requested audience of token exchanged token | No | - |
+
+> **Note on Authorization configuration**
+> By default, no token validation is performed. To enable token validation, set `JWKS_URI`.
+> If `ISSUER` is additionally set, the `iss` claim will be checked to equal this value.
+> If all of `TOKEN_URL`, `CLIENT_ID`, and `CLIENT_SECRET` are set in addition, token exchange will be performed using Bearer tokens from incoming requests, to send to the MCP endpoint.
+> In addition to `TOKEN_URL`, `CLIENT_ID`, `CLIENT_SECRET`, which trigger token exchange, `TARGET_SCOPES` can be optionally configured to be the `scope` in the token exchange request.

a2a/git_issue_agent/a2a_agent.py

@@ -138,10 +138,12 @@ async def execute(self, context: RequestContext, event_queue: EventQueue):
         Returns:
             None
         """
-        if settings.JWKS_URI:
+        if settings.GITHUB_TOKEN: 
+            user_token = settings.GITHUB_TOKEN
+        elif settings.JWKS_URI:
             user_token = context.call_context.user._user.access_token
         else: 
-            user_token = settings.GITHUB_TOKEN
+            raise Exception("either JWKS_URI or GITHUB_TOKEN env var must be set")
         user_input = [context.get_user_input()]
         task = context.current_task
         if not task:
@@ -222,8 +224,10 @@ def run():
     )
 
     app = server.build()  # this returns a Starlette app
-    if not settings.JWKS_URI is None:
+    if settings.JWKS_URI:
         logging.info("JWKS_URI is set - using JWT Validation middleware")
-    app.add_middleware(AuthenticationMiddleware, backend=BearerAuthBackend(), on_error=on_auth_error)
+        app.add_middleware(AuthenticationMiddleware, backend=BearerAuthBackend(), on_error=on_auth_error)
+    elif settings.GITHUB_TOKEN is None:
+        logging.error("One of JWKS_URI or GITHUB_TOKEN must be set.")
 
     uvicorn.run(app, host="0.0.0.0", port=settings.SERVICE_PORT)

a2a/git_issue_agent/git_issue_agent/config.py

@@ -28,7 +28,7 @@ class Settings(BaseSettings):
     )
     MCP_URL: str = Field(os.getenv("MCP_URL", "https://api.githubcopilot.com/mcp/"), description="Endpoint for an option MCP server")
     SERVICE_PORT: int = Field(os.getenv("SERVICE_PORT", 8000), description="Port on which the service will run.")
-    GITHUB_TOKEN: str = Field(os.getenv("GITHUB_TOKEN", None), description="If not using agent with authorization, the default Github token to use")
+    GITHUB_TOKEN: Optional[str] = Field(os.getenv("GITHUB_TOKEN", None), description="If not using agent with authorization, the default Github token to use")
 
     # auth variables for token validation
     ISSUER: Optional[str] = Field(

mcp/github_tool/.env.template

@@ -0,0 +1,5 @@
+UPSTREAM_MCP = "https://api.githubcopilot.com/mcp/"
+REQUIRED_SCOPE = "github-full-access"
+INIT_AUTH_HEADER = "Bearer <PRIVILEGED_ACCESS_PAT>"
+UPSTREAM_HEADER_TO_USE_IF_IN_AUDIENCE = "Bearer <PRIVILEGED_ACCESS_PAT>"
+UPSTREAM_HEADER_TO_USE_IF_NOT_IN_AUDIENCE = "Bearer <PUBLIC_ACCESS_PAT>"