Skip to content

Adding resource principal and instance principal auth methods for OCI Database MCP Server#181

Open
shyam2511 wants to merge 1 commit intooracle:mainfrom
shyam2511:ip-and-rp-auth
Open

Adding resource principal and instance principal auth methods for OCI Database MCP Server#181
shyam2511 wants to merge 1 commit intooracle:mainfrom
shyam2511:ip-and-rp-auth

Conversation

@shyam2511
Copy link
Copy Markdown
Member

Database MCP server

Description

This change adds multiple authentication methods to the OCI Database MCP server:

  • Existing token-based auth (default)
  • Instance Principal auth (--auth-method instance_principal)
  • Resource Principal auth (--auth-method resource_principal) with RPST flow

It introduces CLI arguments for selecting auth mode and passing RP-specific values, updates client initialization logic to branch by auth method, and documents local vs SSH-remote usage patterns (including required RP parameters).

Version was bumped from 1.0.3 to 1.1.0.

Motivation and context

Previously, the server was effectively tied to security-token config-file auth. This limited deployability for OCI-native runtime environments (compute instances / OCI resources) where instance principal or resource principal auth is preferred and more secure for automation.

This update enables those deployment patterns and clarifies how to pass auth configuration correctly in remote SSH MCP setups.

Dependencies required for this change

  • No new direct project dependencies were added in pyproject.toml.
  • Existing dependency set is used (fastmcp, oci, mcp, pytest-cov).
  • Runtime relies on modules used in the implementation (requests, cryptography) via current environment/dependency resolution.

Fixes #

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

Tested the changes locally, as well as on a DB System (to test RP based auth) and Compute Instance (to test IP auth)

@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Apr 3, 2026
@shyam2511 shyam2511 force-pushed the ip-and-rp-auth branch 3 times, most recently from 0e5b6ab to db761e7 Compare April 14, 2026 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant