# sf-opensearch-logging-mcp

Remote HTTP Streamable MCP server for ShareFile OpenSearch production logs with EntraID OAuth.

## Overview

This service wraps [opensearch-mcp-server-py](https://github.com/opensearch-project/opensearch-mcp-server-py) with:
- **HTTP Streamable transport** at `/mcp` (and SSE fallback at `/sse`)
- **EntraID OAuth** with RFC 9728 Protected Resource Metadata for zero-config client discovery
- **SigV4 auth** to OpenSearch via IRSA (cross-account assume role)

## User Setup

Add to your VS Code `settings.json` or `.vscode/mcp.json`:

```json
{
  "mcpServers": {
    "sharefile-opensearch": {
      "type": "http",
      "url": "https://mcp.sharefile-coretools.com/mcp"
    }
  }
}
```

That's it. The MCP client handles OAuth discovery and login automatically.

**Requirements**: Must be on the Progress corporate network.

## Architecture

```
VS Code MCP Client
    │ HTTPS + OAuth Bearer token
    ▼
Internal ALB (ops-coretools)
    │
    ▼
MCP Server Pod (this service)
    │ SigV4 via IRSA
    ▼
OpenSearch VPC Endpoint (381491976936)
```

## Environment Variables

| Variable | Required | Description |
|----------|----------|-------------|
| `AZURE_TENANT_ID` | No | EntraID tenant (default: `db266a67-cbe0-4d26-ae1a-d0581fe03535`) |
| `AZURE_CLIENT_ID` | Yes | EntraID app registration client ID |
| `AZURE_ALLOWED_GROUP_ID` | No | EntraID group ID for access control (empty = any authenticated user) |
| `MCP_BASE_URL` | No | Public base URL (default: `https://mcp.sharefile-coretools.com`) |
| `MCP_PORT` | No | Server port (default: `8080`) |
| `OPENSEARCH_URL` | Yes | OpenSearch VPC endpoint URL |
| `AWS_REGION` | No | AWS region (default: `us-east-1`) |

## Local Development

```bash
uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"

# Set required env vars
export AZURE_CLIENT_ID="your-app-id"
export OPENSEARCH_URL="https://vpc-prod-us-east-1-....es.amazonaws.com"

python -m opensearch_mcp_remote
```

## Deployment

Deployed on `ops-coretools` EKS cluster via ArgoCD. See the [coretools](https://github.com/progress-product-cloud-operations/coretools) repo for K8s manifests.

## Endpoints

| Path | Method | Auth | Description |
|------|--------|------|-------------|
| `/mcp` | POST | Bearer | MCP Streamable HTTP |
| `/sse` | GET | Bearer | SSE transport (fallback) |
| `/health` | GET | None | ALB health check |
| `/.well-known/oauth-protected-resource` | GET | None | OAuth discovery metadata |