Enterprise MCP Server

Python MCP License

A secure, multi-tenant Model Context Protocol server that gives AI clients controlled access to enterprise knowledge bases, SQL databases, REST APIs, files, and GitHub.

It is designed to integrate with enterprise RAG platforms, AI agent systems, and other MCP-compatible clients and services.

What it demonstrates

MCP tools, resources, and prompts over Streamable HTTP or stdio
Authorization-filtered capability discovery and default-deny policies
Enterprise RAG search with citations
Parsed, bounded, read-only SQL
Allowlisted REST operations
Root-confined file search and reads
Allowlisted GitHub file access at revisions
Tenant-scoped, hash-chained audit records
Typed plugin/registry contracts
Health, metrics, Docker, CI, and adversarial tests

Architecture

flowchart LR
    C["MCP clients<br/>Agents, Codex, IDEs"] --> T["HTTP / stdio"]
    T --> A["Authentication"]
    A --> P["Policy engine"]
    P --> R["Capability registry"]
    R --> X["Bounded executor"]
    X --> KB["Knowledge/RAG"]
    X --> SQL["Read-only SQL"]
    X --> API["Allowlisted REST"]
    X --> FS["Confined files"]
    X --> GH["GitHub"]
    X --> AU[("Audit store")]

Quick start

Local Python

cp .env.example .env
uv sync --all-groups
uv run uvicorn enterprise_mcp.app:create_app --factory --reload

Open:

MCP endpoint: http://localhost:8000/mcp/
Health: http://localhost:8000/health/ready
API documentation: http://localhost:8000/docs
Metrics: http://localhost:8000/metrics

Docker

docker compose up --build

The Compose demo includes PostgreSQL, Redis, the MCP server, a synthetic REST/knowledge service, and confined sample files. It does not require paid credentials. The container endpoint is published at http://localhost:8013 so it can run beside the other portfolio projects.

Try the operational API

Development mode uses an explicit synthetic principal:

curl http://localhost:8000/api/v1/capabilities
curl http://localhost:8000/api/v1/audit/events

MCP client configuration

{
  "mcpServers": {
    "enterprise": {
      "url": "http://localhost:8000/mcp/"
    }
  }
}

Development mode is intentionally convenient. Production configuration refuses to start without OIDC settings and PostgreSQL.

Built-in tools

Tool	Purpose	Safety boundary
`system.capabilities`	List authorized capabilities	discovery filtered by policy
`knowledge.search`	Search enterprise knowledge	bounded results and citations
`sql.query`	Query a named SQL connection	parsed SELECT-only and row limits
`rest.request`	Call a named REST operation	no arbitrary URLs
`files.search`	Search an approved root	canonical root confinement
`files.read`	Read a bounded text range	size/range/path checks
`github.get_file`	Read an allowlisted repo file	repository allowlist and revision

Security model

Verified identity creates tenant context; callers cannot supply a tenant argument.
Capability discovery and invocation both enforce policy.
R3/R4 operations cannot execute without an approval design; v1 tools are read-only.
Arguments are fingerprinted for audit rather than stored raw.
SQL, URL, file, result-size, timeout, and repository boundaries are independently enforced.
Production rejects development authentication, SQLite, and wildcard CORS.

Read SECURITY.md and docs/ARCHITECTURE.md for details.

Development

make lint
make typecheck
make test-cov

Repository layout

src/enterprise_mcp/   application, MCP, security, connectors
tests/                unit, integration, MCP, security tests
docs/                 architecture, APIs, tool registry, implementation plan
deploy/               deployment assets
demo-data/            synthetic public fixtures

Roadmap

v0.1: protocol, connectors, policy, audit, Compose demo
v0.2: persistent RBAC/connector administration and API keys
v0.3: GitHub App installation authentication and plugin entry-point loader
v0.4: OpenTelemetry collector and Kubernetes reference deployment
v1.0: stable contracts, two-client compatibility, signed images and SBOM

License

Apache-2.0