Enterprise MCP Server

A secure, multi-tenant Model Context Protocol server that gives AI clients controlled access to enterprise knowledge bases, SQL databases, REST APIs, files, and GitHub.

It is designed to integrate with enterprise RAG platforms, AI agent systems, and other MCP-compatible clients and services.

What it demonstrates

• MCP tools, resources, and prompts over Streamable HTTP or stdio

• Authorization-filtered capability discovery and default-deny policies

• Enterprise RAG search with citations

• Parsed, bounded, read-only SQL

• Allowlisted REST operations

• Root-confined file search and reads

• Allowlisted GitHub file access at revisions

• Tenant-scoped, hash-chained audit records

• Typed plugin/registry contracts

• Health, metrics, Docker, CI, and adversarial tests

Related MCP server: MCP SQL Server

Architecture

flowchart LR
    C["MCP clients<br/>Agents, Codex, IDEs"] --> T["HTTP / stdio"]
    T --> A["Authentication"]
    A --> P["Policy engine"]
    P --> R["Capability registry"]
    R --> X["Bounded executor"]
    X --> KB["Knowledge/RAG"]
    X --> SQL["Read-only SQL"]
    X --> API["Allowlisted REST"]
    X --> FS["Confined files"]
    X --> GH["GitHub"]
    X --> AU[("Audit store")]

Quick start

Local Python

cp .env.example .env
uv sync --all-groups
uv run uvicorn enterprise_mcp.app:create_app --factory --reload

Open:

• MCP endpoint: http://localhost:8000/mcp/

• Health: http://localhost:8000/health/ready

• API documentation: http://localhost:8000/docs

• Metrics: http://localhost:8000/metrics

Docker

docker compose up --build

The Compose demo includes PostgreSQL, Redis, the MCP server, a synthetic REST/knowledge service, and confined sample files. It does not require paid credentials. The container endpoint is published at http://localhost:8013 so it can run beside the other portfolio projects.

Try the operational API

Development mode uses an explicit synthetic principal:

curl http://localhost:8000/api/v1/capabilities
curl http://localhost:8000/api/v1/audit/events

MCP client configuration

{
  "mcpServers": {
    "enterprise": {
      "url": "http://localhost:8000/mcp/"
    }
  }
}

Development mode is intentionally convenient. Production configuration refuses to start without OIDC settings and PostgreSQL.

Built-in tools

Security model

• Verified identity creates tenant context; callers cannot supply a tenant argument.

• Capability discovery and invocation both enforce policy.

• R3/R4 operations cannot execute without an approval design; v1 tools are read-only.

• Arguments are fingerprinted for audit rather than stored raw.

• SQL, URL, file, result-size, timeout, and repository boundaries are independently enforced.

• Production rejects development authentication, SQLite, and wildcard CORS.

Read SECURITY.md and docs/ARCHITECTURE.md for details.

Development

make lint
make typecheck
make test-cov

Repository layout

src/enterprise_mcp/   application, MCP, security, connectors
tests/                unit, integration, MCP, security tests
docs/                 architecture, APIs, tool registry, implementation plan
deploy/               deployment assets
demo-data/            synthetic public fixtures

Roadmap

• v0.1: protocol, connectors, policy, audit, Compose demo

• v0.2: persistent RBAC/connector administration and API keys

• v0.3: GitHub App installation authentication and plugin entry-point loader

• v0.4: OpenTelemetry collector and Kubernetes reference deployment

• v1.0: stable contracts, two-client compatibility, signed images and SBOM

License

Apache-2.0