sf-opensearch-logging-mcp

Remote HTTP Streamable MCP server for ShareFile OpenSearch production logs with EntraID OAuth.

Overview

This service wraps opensearch-mcp-server-py with:

• HTTP Streamable transport at /mcp (and SSE fallback at /sse)
• EntraID OAuth with RFC 9728 Protected Resource Metadata for zero-config client discovery
• SigV4 auth to OpenSearch via IRSA (cross-account assume role)

User Setup

Add to your VS Code settings.json or .vscode/mcp.json:

{
  "mcpServers": {
    "sharefile-opensearch": {
      "type": "http",
      "url": "https://mcp.sharefile-coretools.com/mcp"
    }
  }
}

That's it. The MCP client handles OAuth discovery and login automatically.

Requirements: Must be on the Progress corporate network.

Architecture

VS Code MCP Client
    │ HTTPS + OAuth Bearer token
    ▼
Internal ALB (ops-coretools)
    │
    ▼
MCP Server Pod (this service)
    │ SigV4 via IRSA
    ▼
OpenSearch VPC Endpoint (381491976936)

Environment Variables

Variable	Required	Description
AZURE_TENANT_ID	No	EntraID tenant (default: db266a67-cbe0-4d26-ae1a-d0581fe03535)
AZURE_CLIENT_ID	Yes	EntraID app registration client ID
AZURE_ALLOWED_GROUP_ID	No	EntraID group ID for access control (empty = any authenticated user)
MCP_BASE_URL	No	Public base URL (default: https://mcp.sharefile-coretools.com)
MCP_PORT	No	Server port (default: 8080)
OPENSEARCH_URL	Yes	OpenSearch VPC endpoint URL
AWS_REGION	No	AWS region (default: us-east-1)

Local Development

uv venv && source .venv/bin/activate
uv pip install -e ".[dev]"

# Set required env vars
export AZURE_CLIENT_ID="your-app-id"
export OPENSEARCH_URL="https://vpc-prod-us-east-1-....es.amazonaws.com"

python -m opensearch_mcp_remote

Deployment

Deployed on ops-coretools EKS cluster via ArgoCD. See the coretools repo for K8s manifests.

Endpoints

Path	Method	Auth	Description
/mcp	POST	Bearer	MCP Streamable HTTP
/sse	GET	Bearer	SSE transport (fallback)
/health	GET	None	ALB health check
/.well-known/oauth-protected-resource	GET	None	OAuth discovery metadata