sf-opensearch-logging-mcp

Remote HTTP Streamable MCP server for ShareFile OpenSearch production logs with EntraID OAuth.

Overview

This service wraps opensearch-mcp-server-py with:

• HTTP Streamable transport at /mcp (and SSE fallback at /sse)

• EntraID OAuth with RFC 9728 Protected Resource Metadata for zero-config client discovery

• SigV4 auth to OpenSearch via IRSA (cross-account assume role)

Related MCP server: mcp-obo

User Setup

Add to your VS Code settings.json or .vscode/mcp.json:

{
  "mcpServers": {
    "sharefile-opensearch": {
      "type": "http",
      "url": "https://mcp.sharefile-coretools.com/mcp"
    }
  }
}

That's it. The MCP client handles OAuth discovery and login automatically.

Requirements: Must be on the Progress corporate network.

Architecture

VS Code MCP Client
    │ HTTPS + OAuth Bearer token
    ▼
Internal ALB (ops-coretools)
    │
    ▼
MCP Server Pod (this service)
    │ SigV4 via IRSA
    ▼
OpenSearch VPC Endpoint (381491976936)

Environment Variables

Local Development

uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"

# Set required env vars
export AZURE_CLIENT_ID="your-app-id"
export OPENSEARCH_URL="https://vpc-prod-us-east-1-....es.amazonaws.com"

python -m opensearch_mcp_remote

Deployment

Deployed on ops-coretools EKS cluster via ArgoCD. See the coretools repo for K8s manifests.

Endpoints