orionbelt-semantic-layer-mcp

A thin MCP server that delegates all business logic to the OrionBelt® Semantic Layer REST API via HTTP. No embedded engine — pure API pass-through.

Architecture

The OrionBelt® Semantic Layer platform has two deployment modes. This MCP server supports both:

• Standalone — Deploy the OrionBelt® Semantic Layer API anywhere (Cloud Run, Docker, localhost) and point this MCP server at it via API_BASE_URL.

• Hosted — Connect to the public Cloud Run deployment with zero local setup (see Hosted MCP Server below).

┌────────────┐       ┌──────────────────────────────────────────────────────┐
│ LLM Client │       │                OrionBelt® Platform                   │
│            │       │                                                      │
│  Claude,   │──MCP──│──> server.py  ──HTTP /v1──>  Semantic Layer REST API │
│  Cursor,   │       │    (FastMCP                   (FastAPI: parse OBML,  │
│  any MCP   │       │     + httpx)                   validate, compile     │
│  client    │       │                                to SQL)               │
└────────────┘       └──────────────────────────────────────────────────────┘

• No business logic — all tool calls delegate to the REST API (v1 endpoints)

• Dual-mode — auto-detects single-model or multi-model API mode at startup

• Auto-session management — creates an API session on first tool call, caches the ID (multi-model mode)

• 17 tools (single-model mode) or 21 tools (multi-model mode) for querying (QueryObject), execution, batch, discovery, composability (ACR), examples, diagrams, RDF/SPARQL, OSI export, model validation (offline or against the live datasource), and OBML reference + function catalog + JSON schemas. (22 distinct tools exist in total; the API mode selects which subset is active — they overlap in 16 — and no client ever sees all 22 at once.) The visible surface is narrowed further in the design-time phase and when query execution is disabled (see Design-time vs run-time tool switching)

• 4 prompts + 2 resources for OBML / OBSQL reference and usage guidance

Related MCP server: io.github.ralfbecher/orionbelt-analytics

Live Demo

A public demo of the OrionBelt® Semantic Layer API is available at:

API endpoint: https://orionbelt.ralforion.com — Swagger UI | ReDoc | Gradio UI

Set API_BASE_URL=https://orionbelt.ralforion.com in your .env file to use it (see .env.example).

Installation

uv sync

For development (includes pytest, respx, ruff):

uv sync --all-groups

Usage

stdio (default)

uv run server.py

HTTP transport

MCP_TRANSPORT=http uv run python server.py

The HTTP transport runs stateless by default (MCP_STATELESS_HTTP=true): every request is self-contained, with no Mcp-Session-Id, no stream resumability, and no server-initiated messages. Nothing here needs that state — the tool phase is derived from explicit loaded-model state rather than from the connection, and no tool sends progress, sampling, or elicitation requests — so instances can sit behind a load balancer without session affinity. Set MCP_STATELESS_HTTP=false to restore per-connection sessions; sse always runs stateful, since it is a long-lived per-connection stream.

Note this is the transport session only. The upstream API session and the set of loaded models remain process-global and shared by every client of an instance, unchanged by this flag.

Transport security

The HTTP/SSE transport terminates no TLS and authenticates no caller — it expects an ingress in front that does both. These are two separate jobs, and no platform does both for you by default.

On Cloud Run, the intended deployment, TLS is automatic: the service URL is served over HTTPS and plain HTTP is forwarded to the container. Access control is not. It is a deploy-time choice, settled any of three ways — IAM invoker permission, an --ingress restriction, or an authenticating load balancer in front. With none of them, --allow-unauthenticated leaves the service reachable by anyone who learns its URL, over HTTPS, with no credential required. Encrypted is not the same as restricted.

This matters because the two hops have different answers:

Exposing the HTTP transport directly is the case to avoid. Anything that can reach the port can call every registered tool — including execute_query where the capability is enabled — spending this server's own API_KEY against the API, over a channel readable in transit. The credential never crosses that hop; the access it buys does.

The server warns at startup when it detects this: an http/sse transport bound to a non-loopback address, off Cloud Run, without MCP_BEHIND_PROXY=true. Bind MCP_SERVER_HOST to loopback, put an authenticating TLS ingress in front, or set MCP_BEHIND_PROXY=true to acknowledge a proxy the server has no way to see.

On Cloud Run it logs an informational note instead of that warning, naming the half that is still yours: TLS is handled, access control is whatever you deployed with. Silence there is not evidence the service is restricted — the process cannot read its own IAM policy or ingress setting. Confirm one of the three above is in place; if one is, MCP_BEHIND_PROXY=true records that and silences the note.

The API's own *_TLS_* settings are the server half and none of them is read here. PGWIRE_TLS_* and FLIGHT_TLS_* (2.28.0) secure listeners this server never connects to. API_TLS_* (2.29.0) makes the REST API serve HTTPS itself, and API_TLS_CLIENT_CA makes it require a client certificate — which is what the settings below are for.

TLS to the API

When the API serves HTTPS with a certificate from a private CA, or requires mutual TLS — API_TLS_CLIENT_CA on the API, or a gateway in front that asks for a client certificate — point this server at the material:

API_BASE_URL=https://obsl.internal:8000
API_CA_CERT=/certs/ca.crt            # trust this CA instead of the default store
API_CLIENT_CERT=/certs/mcp.crt       # present this certificate…
API_CLIENT_KEY=/certs/mcp.key        # …with this key (omit if it is in the same PEM)

The certificate is loaded when the server starts, on every transport, so a path that is missing, unreadable, or not what it claims stops startup naming the setting and the file — rather than surfacing later as an SSL error from inside the HTTP client. The startup banner's API TLS: line reports what the hop ended up with.

• API_CA_CERT replaces the default trust store, it does not extend it. Unset, verification uses httpx's default (certifi, or SSL_CERT_FILE / SSL_CERT_DIR), and adding a client certificate does not change that.

• These require an https:// API_BASE_URL. On http:// there is no handshake, so nothing would be presented or verified; that configuration is refused rather than left to read as TLS.

• Password-protected keys are refused, not prompted for. Under stdio, stdin is the MCP pipe, so OpenSSL's terminal prompt would corrupt the protocol or hang. Provide the key decrypted, protected by file permissions or a secret mount.

MCP client configuration

Add to your MCP client config (e.g. claude_desktop_config.json):

{
  "mcpServers": {
    "orionbelt": {
      "command": "uv",
      "args": ["run", "python", "server.py"],
      "cwd": "/path/to/orionbelt-semantic-layer-mcp"
    }
  }
}

Configuration

Environment variables or .env file (pydantic-settings). See .env.example for defaults.

Tools

Model lifecycle

Model discovery

Query, execution & diagrams

Semantic graph (RDF / SPARQL)

References

Utilities

Design-time vs run-time tool switching

The server presents a phase-scoped tool surface: instead of listing all all tools at once, it shows only the tools that make sense for where you are in the model lifecycle. About half the tools are meaningless until a model is loaded (execute_query, describe_model, find_artefacts, …) and the rest are about authoring or reference (get_obml_reference, get_function_catalog, get_json_schema, validate_model, list_dialects). Splitting them keeps the surface small and prevents a whole class of error — calling a query tool with no model loaded.

Three buckets, swapped by phase

Tools fall into three buckets. The visible surface is a swap at the load/unload transition, not additive — the run phase does not show the design/reference tools:

                       load_model  (returns "re-list" signal)
   ┌─────────────────┐ ────────────────────────────────▶ ┌───────────────┐
   │ design phase    │                                   │ run phase     │
   │ always + design │ ◀───────────────────────────────  │ always + run  │
   └─────────────────┘  remove_model (last model) / TTL  └───────────────┘
                        expiry — back to design phase

So design phase → always + design-only, run phase → always + run-only. Design/reference tools are hidden once a model is loaded, keeping the run surface focused on querying.

Re-listing

The MCP tools/list response is filtered to the active phase. Because the stateless MCP spec makes push notifications (notifications/tools/list_changed) unreliable, transitions are pull-based: load_model (design → run) and remove_model (run → design, once no models remain) return a short signal telling the client to re-list its tools and pick up the swapped surface.

Guard against premature calls

If a client calls a run-only verb while still in the design phase (e.g. a stale host that hasn't re-listed yet), the server returns a structured error rather than an opaque failure:

No model loaded — 'execute_query' is a run-time tool and is not available yet. Call load_model first, then re-list tools.

Capability gating (orthogonal to phase)

Separately from lifecycle phase, a tool can be hidden because the server is configured not to support it. The execution tool execute_query is gated on the API's query_execute capability: when the server runs compile-only it is dropped from tools/list and calling it returns a structured error. This composes with phase — a verb is listed only if its phase is active and its capability is enabled. The mechanism is a general capability registry, so future "the server can't do X here" flags hide their tools the same way.

Single-model mode

When the API runs in single-model mode a model is pre-loaded at startup, so the server is permanently in the run-time phase — every applicable tool is listed from the first request and there is no load_model step.

Note on caching hints. The 2026-07-28 MCP spec adds ttlMs / cacheScope hints on tools/list (SEP-2549). These are intentionally not set yet — the fields are a release candidate, and FastMCP's list-tools hook exposes only the tool list, not the result envelope. The explicit re-list signal above is the primary (and spec-recommended) transition mechanism in the meantime.

Supported SQL Dialects

postgres, snowflake, clickhouse, databricks, dremio, bigquery, duckdb

Workflow

1. Get reference — call get_obml_reference() to learn OBML syntax

2. Load model — call load_model(model_yaml) to get a model_id

3. Explore — call describe_model(model_id) or use discovery tools (find_artefacts, explain_artefact)

4. Execute — call execute_query(model_id, query_json='{"select": {"dimensions": [...], "measures": [...]}}') to compile and run SQL, returning rows (requires QUERY_EXECUTE=true on the API; see get_json_schema("query") for the QueryObject shape)

Integration Guides

Use the OrionBelt® Semantic Layer MCP server with popular AI agent frameworks and automation platforms:

Each guide includes quick-start examples, multi-agent patterns, and connection options for both the hosted demo and self-hosted deployments.

Development

# Run tests
uv run pytest

# Lint and format
uv run ruff check server.py
uv run ruff format server.py tests/

# Set up pre-commit hooks (recommended)
./scripts/setup-hooks.sh

GitHub Actions pinning

Every uses: in .github/workflows is pinned to a 40-character commit SHA with a comment naming the exact patch release it was cut from:

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

A tag such as v7 is a movable label — the action's owner can repoint it at any time, so @v7 runs whatever commit it happens to name when the job starts. A SHA cannot move. Every workflow also starts read-only (permissions: contents: read), with write scopes granted on the single job that needs them (only id-token: write, on the PyPI publish job).

Pinning makes each reference unreadable, though, and nothing inherently keeps a SHA and the comment beside it in agreement: a pull request could swap the hash for one taken from a fork, leave # v7.0.1 untouched, and the diff would look like a routine dependency bump. scripts/check-action-pins.sh closes that gap. It requires a real SHA, an owner on its ALLOWED_OWNERS allowlist, and a version comment naming an exact patch release, then resolves that tag upstream with git ls-remote and fails if the commit it names is not the one pinned.

./scripts/check-action-pins.sh            # every check, including upstream lookups
./scripts/check-action-pins.sh --offline  # skip the network; SHA and comment format only

It runs as the pins job in CI, and again as the first step after checkout in both tag-triggered publish workflows, so no release ships artifacts built by steps whose pins were never verified. Bumping an action means updating the SHA and its comment together; add a new action's owner to ALLOWED_OWNERS deliberately, since a pin verifies against its own tag no matter who published it.

Release Process

The release script (scripts/release.sh) includes comprehensive pre-flight checks to prevent issues like the v2.8.2 formatting problem:

• Code formatting check - Ensures ruff format passes

• Linting check - Ensures ruff check passes

• CI status check - Warns if CI is not green

• Test suite - Runs all tests

• Version consistency - Verifies version across files

• Changelog - Ensures changelog entry exists

Pre-commit hooks are available to catch issues early. Run ./scripts/setup-hooks.sh to install them.

Hosted MCP Server

A public hosted instance of this MCP server runs on Google Cloud Run, connected to the live OrionBelt® Semantic Layer demo API. No local install, no API key.

Endpoint

https://orionbelt.ralforion.com/mcp

Streamable HTTP (MCP spec 2025-03-26). Stateful — clients should send the initialize handshake and reuse the returned Mcp-Session-Id header.

Quick start with Claude Desktop

Claude Desktop's config schema accepts only stdio launchers — for a remote MCP server, use the mcp-remote stdio↔HTTP bridge (auto-fetched by npx, no manual install).

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows) and add:

{
  "mcpServers": {
    "orionbelt": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://orionbelt.ralforion.com/mcp",
        "--transport",
        "http"
      ]
    }
  }
}

Fully quit Claude Desktop (⌘Q on macOS — closing the window isn't enough) and reopen. The OrionBelt® tools then appear in the tools menu.

Alternatively, in newer Claude Desktop builds: Settings → Connectors → Add custom connector, paste the URL above. No file editing or npx required.

Why mcp-remote? Claude Desktop's claude_desktop_config.json schema currently only validates stdio entries (command + args). A bare {"url": "…"} entry is rejected with "not valid MCP server configurations and were skipped". mcp-remote runs a local stdio bridge that forwards to the HTTPS endpoint, so Claude Desktop sees a normal stdio server. Claude Code does support {"type": "url", "url": "…"} natively — see below.

Quick start with Claude Code

Add to .mcp.json in any repo (or ~/.config/claude-code/.mcp.json globally):

{
  "mcpServers": {
    "orionbelt": {
      "type": "url",
      "url": "https://orionbelt.ralforion.com/mcp"
    }
  }
}

Other MCP clients

Any client that supports Streamable HTTP transport (MCP spec 2025-03-26) can point at the URL above. The endpoint accepts POST /mcp with Accept: application/json, text/event-stream. See tests/cloudrun/test_mcp_cloudrun.sh for a stdlib-only Python smoke test that walks the full handshake.

Notes

• The hosted instance scales to zero when idle, so the first request after a cold period takes ~1–2 seconds longer.

• It connects to the public demo API at https://orionbelt.ralforion.com — same data, same dialects, no authentication. Don't load production data through it.

• For self-hosting, see the Installation section above and the Dockerfile.

License

Copyright 2026 RALFORION d.o.o.

Licensed under the Apache License, Version 2.0. See LICENSE for details.

Third-party licenses

The PyPI package ships only server.py — its dependencies are declared, not bundled, so it redistributes no third-party code.

The Docker image does bundle them, and carries their licenses in three places:

The aggregate is committed as THIRD_PARTY_NOTICES.md and copied into the image, so it is readable without pulling anything and is reviewed in the same diff as the dependency change that altered it. CI regenerates it from the locked set on every PR and fails if the committed copy differs, which is what keeps it from drifting. To read the one an image actually carries — the ground truth for any given tag:

docker run --rm --entrypoint cat ralforion/orionbelt-semantic-layer-mcp:latest \
    /app/THIRD_PARTY_NOTICES.md

Regenerate it with scripts/third_party_notices.py, on Linux. It resolves for the image's target rather than for your host, and a host-resolved run on macOS would silently omit jeepney and SecretStorage.

The Python dependencies are permissive with two exceptions, both recorded in ACKNOWLEDGED in scripts/third_party_notices.py rather than left to a reader's inference: certifi is MPL-2.0, and docutils offers a choice that includes the GPL. MPL-2.0 is file-level copyleft and reaches the files themselves, not the program importing them, so shipping it unmodified alongside this notice satisfies it. The docutils choice has to be made in writing before a release, and the generator fails until it is. Everything else is MIT, BSD, Apache-2.0, ISC, Unlicense or PSF-2.0, and none of it reaches the server's own code.

The Debian base is a separate matter. python:3.14-slim brings ~87 system packages, many of them GPL/LGPL (coreutils, libc6, bash, …), exactly as every Debian-based image does. They are unmodified upstream packages invoked as ordinary OS components, not linked into or derived from this server, and their licenses and written-offer text ship in the image under /usr/share/doc/ and /usr/share/common-licenses/. If your distribution policy needs to avoid them entirely, rebuild FROM a distroless or Alpine base.