airbyte-internal-ops 0.1.7__py3-none-any.whl → 0.1.8__py3-none-any.whl

{airbyte_internal_ops-0.1.7.dist-info → airbyte_internal_ops-0.1.8.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airbyte-internal-ops
-Version: 0.1.7
+Version: 0.1.8
 Summary: MCP and API interfaces that let the agents do the admin work
 Author-email: Aaron Steers <aj@airbyte.io>
 Keywords: admin,airbyte,api,mcp

{airbyte_internal_ops-0.1.7.dist-info → airbyte_internal_ops-0.1.8.dist-info}/RECORD

@@ -1,6 +1,7 @@
 airbyte_ops_mcp/__init__.py,sha256=HhzURuYr29_UIdMrnWYaZB8ENr_kFkBdm4uqeiIW3Vw,760
 airbyte_ops_mcp/_annotations.py,sha256=MO-SBDnbykxxHDESG7d8rviZZ4WlZgJKv0a8eBqcEzQ,1757
-airbyte_ops_mcp/constants.py,sha256=eDO262DXtlPbWENwpk9GTllmkz9S_xT7G4qX2-BcfkE,1743
+airbyte_ops_mcp/constants.py,sha256=419-AlRfwbbxeEEV9lhmXhpTUjsSdzJpfcuL_MZZtXM,1982
+airbyte_ops_mcp/gcp_auth.py,sha256=5k-k145ZoYhHLjyDES8nrA8f8BBihRI0ykrdD1IcfOs,3599
 airbyte_ops_mcp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 airbyte_ops_mcp/_legacy/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 airbyte_ops_mcp/_legacy/airbyte_ci/README.md,sha256=qEYx4geDR8AEDjrcA303h7Nol-CMDLojxUyiGzQprM8,236
@@ -361,13 +362,13 @@ airbyte_ops_mcp/cloud_admin/connection_config.py,sha256=UtbIwuB7CA3WJr9oYRwlKDsj
 airbyte_ops_mcp/cloud_admin/models.py,sha256=YZ3FbEW-tZa50khKTTl4Bzvy_LsGyyQd6qcpXo62jls,2670
 airbyte_ops_mcp/connection_config_retriever/__init__.py,sha256=Xoi-YvARrNPhECdpwEDDkdwEpnvj8zuUlwULpf4iRrU,800
 airbyte_ops_mcp/connection_config_retriever/audit_logging.py,sha256=GjT4dVa0TtvGDmiBz9qwzcYCnSf9hTo7UM6l7ubUNE8,2846
-airbyte_ops_mcp/connection_config_retriever/retrieval.py,sha256=Bpbl1qoR0z1F8dgQOj-dB95UxqzGTXbkW4nHMPBIO-g,12112
+airbyte_ops_mcp/connection_config_retriever/retrieval.py,sha256=s6yeCyrboWkUd6KdaheEo87x-rLtQNTL8XeR8O9z2HI,12160
 airbyte_ops_mcp/connection_config_retriever/secrets_resolution.py,sha256=12g0lZzhCzAPl4Iv4eMW6d76mvXjIBGspOnNhywzks4,3644
 airbyte_ops_mcp/live_tests/__init__.py,sha256=qJac67dt6DQCqif39HqeiG3Tr9xrxfP-ala8HsLZKis,1020
 airbyte_ops_mcp/live_tests/ci_output.py,sha256=NQATOGid0OCbLEl2NOtGK4cHLL5OxXhjmtanBjIlCyE,11369
 airbyte_ops_mcp/live_tests/config.py,sha256=dwWeY0tatdbwl9BqbhZ7EljoZDCtKmGO5fvOAIxeXmA,5873
 airbyte_ops_mcp/live_tests/connection_fetcher.py,sha256=5wIiA0VvCFNEc-fr6Po18gZMX3E5fyPOGf2SuVOqv5U,12799
-airbyte_ops_mcp/live_tests/connection_secret_retriever.py,sha256=C3yGoE8JSlkypKlpGYoI-5oczFexHyl5Z3avkDKyqQc,6445
+airbyte_ops_mcp/live_tests/connection_secret_retriever.py,sha256=DtZYB4Y8CXfUXTFhmzrqzjuEFoICzz5Md3Ol_y9HCq0,4861
 airbyte_ops_mcp/live_tests/connector_runner.py,sha256=fGE_TCii9zhC3pbyBupJ3JVkuxOWB59Q1DgigcF3q04,9707
 airbyte_ops_mcp/live_tests/evaluation_modes.py,sha256=lAL6pEDmy_XCC7_m4_NXjt_f6Z8CXeAhMkc0FU8bm_M,1364
 airbyte_ops_mcp/live_tests/http_metrics.py,sha256=oTD7f2MnQOvx4plOxHop2bInQ0-whvuToSsrC7TIM-M,12469
@@ -384,29 +385,29 @@ airbyte_ops_mcp/live_tests/validation/catalog_validators.py,sha256=jqqVAMOk0mtdP
 airbyte_ops_mcp/live_tests/validation/record_validators.py,sha256=-7Ir2LWGCrtadK2JLuBgppSyk0RFJX6Nsy0lrabtwrs,7411
 airbyte_ops_mcp/mcp/__init__.py,sha256=QqkNkxzdXlg-W03urBAQ3zmtOKFPf35rXgO9ceUjpng,334
 airbyte_ops_mcp/mcp/_guidance.py,sha256=48tQSnDnxqXtyGJxxgjz0ZiI814o_7Fj7f6R8jpQ7so,2375
-airbyte_ops_mcp/mcp/_mcp_utils.py,sha256=Im3J3yCtXPbW_Kp-oh5b11Z2187V3-Zsos5LBgdvQrc,9111
-airbyte_ops_mcp/mcp/cloud_connector_versions.py,sha256=G8mVzhvSCmrTEqDseV57-wwL0s3oWdydgyvgMr027tU,10443
+airbyte_ops_mcp/mcp/_mcp_utils.py,sha256=nhztHcoc-_ASPpJfoDBjxjjqEvQM6_QIrhp7F2UCrQk,11494
+airbyte_ops_mcp/mcp/cloud_connector_versions.py,sha256=XxaS6WBP0sJPRwT7TTPhVH2PzhPqVWMNU5fVdWdxLLk,10361
 airbyte_ops_mcp/mcp/connector_analysis.py,sha256=OC4KrOSkMkKPkOisWnSv96BDDE5TQYHq-Jxa2vtjJpo,298
 airbyte_ops_mcp/mcp/connector_qa.py,sha256=aImpqdnqBPDrz10BS0owsV4kuIU2XdalzgbaGZsbOL0,258
-airbyte_ops_mcp/mcp/github.py,sha256=5ZPsSTy4-gummS96xGoG-n2RwCgyg3-UWAvmEmxd5x4,7686
-airbyte_ops_mcp/mcp/github_repo_ops.py,sha256=pE6RyATBfUKBOffQ6iyNJhHfCLjwq0pzVmmFYUg39UQ,5375
-airbyte_ops_mcp/mcp/live_tests.py,sha256=KnxZLuUNmm_3Clt0DU8H9rJ01zOKefnL_wqdSCMDjkE,17992
+airbyte_ops_mcp/mcp/github.py,sha256=keB5_LUs6OULXr4Ukg-gzJfeDiC_QvBXSh56yTD9kSQ,7625
+airbyte_ops_mcp/mcp/github_repo_ops.py,sha256=PiERpt8abo20Gz4CfXhrDNlVM4o4FOt5sweZJND2a0s,5314
+airbyte_ops_mcp/mcp/live_tests.py,sha256=eHfgNkEcY1OKzYiJmkxwOluLPiFHIdP4nm_H1H0MXDg,17940
 airbyte_ops_mcp/mcp/metadata.py,sha256=fwGW97WknR5lfKcQnFtK6dU87aA6TmLj1NkKyqDAV9g,270
-airbyte_ops_mcp/mcp/prerelease.py,sha256=2Mr0LdCLhEc9Q7CEtmganJXHGHCLCXODKlkSapLsSsY,9484
-airbyte_ops_mcp/mcp/prod_db_queries.py,sha256=L0p7LlF7GV5mXoH_2GwgQp04sXL2QA5v-RiuLsTb-yA,12614
-airbyte_ops_mcp/mcp/prompts.py,sha256=6opN4ZweQxfSdtoK0gL6wTrlxkRvxTQvH1VTmAuhoBE,1645
+airbyte_ops_mcp/mcp/prerelease.py,sha256=RTEq9uguaREeZ9BqC2In3abdGuqg2IUZZ43KNoYj66Y,9444
+airbyte_ops_mcp/mcp/prod_db_queries.py,sha256=RV909zZX156WKXzwtu68Sd071tmaiJaCJz9wNHg3j0I,12399
+airbyte_ops_mcp/mcp/prompts.py,sha256=mJld9mdPECXYZffWXGSvNs4Xevx3rxqUGNlzGKVC2_s,1599
 airbyte_ops_mcp/mcp/registry.py,sha256=PW-VYUj42qx2pQ_apUkVaoUFq7VgB9zEU7-aGrkSCCw,290
 airbyte_ops_mcp/mcp/server.py,sha256=7zi91xioVTx1q-bEleekZH2c2JnbzDQt_6zxdEwnLbg,2958
-airbyte_ops_mcp/mcp/server_info.py,sha256=4yNBA_N_vUyLwVJqp7abyFuzZkcnv6-ck_Beb2SXqTE,2426
+airbyte_ops_mcp/mcp/server_info.py,sha256=Yi4B1auW64QZGBDas5mro_vwTjvrP785TFNSBP7GhRg,2361
 airbyte_ops_mcp/prod_db_access/__init__.py,sha256=5pxouMPY1beyWlB0UwPnbaLTKTHqU6X82rbbgKY2vYU,1069
 airbyte_ops_mcp/prod_db_access/db_engine.py,sha256=ia1KcuQOXi3Qhy_MnxYmccCBJ4rAt_d4nVDjcyzje6o,4289
 airbyte_ops_mcp/prod_db_access/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-airbyte_ops_mcp/prod_db_access/queries.py,sha256=bZZntlTXzvI2uSAFMkOfb_LcfCOlxyTuOddRVw4yU2M,8676
+airbyte_ops_mcp/prod_db_access/queries.py,sha256=jUGJErgDmaKf7mswgVEGin8bjsUFAxegSAOB47XzT9k,8724
 airbyte_ops_mcp/prod_db_access/sql.py,sha256=zHPucNuMlfxz3aU8vYo1ziiGk0lIncG9XmblEoRDd4c,12725
 airbyte_ops_mcp/registry/__init__.py,sha256=iEaPlt9GrnlaLbc__98TguNeZG8wuQu7S-_2QkhHcbA,858
 airbyte_ops_mcp/registry/models.py,sha256=B4L4TKr52wo0xs0CqvCBrpowqjShzVnZ5eTr2-EyhNs,2346
 airbyte_ops_mcp/registry/publish.py,sha256=VoPxsM2_0zJ829orzCRN-kjgcJtuBNyXgW4I9J680ro,12717
-airbyte_internal_ops-0.1.7.dist-info/METADATA,sha256=lIb2MpFriSDAUAYqwerfgA6a3zz3YOrwzDY17cyIZno,5282
-airbyte_internal_ops-0.1.7.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-airbyte_internal_ops-0.1.7.dist-info/entry_points.txt,sha256=eUgJ9xIy9PlR-CgRbqRMsh1NVp6jz08v9bul9vCYlU4,111
-airbyte_internal_ops-0.1.7.dist-info/RECORD,,
+airbyte_internal_ops-0.1.8.dist-info/METADATA,sha256=BSNP1wsy5PbIFtyq6RbvCGPHgY3C8vC5UNsAzjqZAOk,5282
+airbyte_internal_ops-0.1.8.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+airbyte_internal_ops-0.1.8.dist-info/entry_points.txt,sha256=eUgJ9xIy9PlR-CgRbqRMsh1NVp6jz08v9bul9vCYlU4,111
+airbyte_internal_ops-0.1.8.dist-info/RECORD,,

airbyte_ops_mcp/connection_config_retriever/retrieval.py

@@ -24,6 +24,7 @@ from airbyte_ops_mcp.connection_config_retriever.secrets_resolution import (
     get_resolved_config,
 )
 from airbyte_ops_mcp.constants import CLOUD_REGISTRY_URL, ConnectionObject
+from airbyte_ops_mcp.gcp_auth import get_secret_manager_client
 from airbyte_ops_mcp.prod_db_access.db_engine import get_pool
 
 LOGGER = logging.getLogger(__name__)
@@ -306,7 +307,7 @@ def retrieve_objects(
     """
     connection_candidates = [TestingCandidate(connection_id=connection_id)]
 
-    secret_manager_client = secretmanager.SecretManagerServiceClient()
+    secret_manager_client = get_secret_manager_client()
     connection_pool = get_pool(secret_manager_client)
 
     with connection_pool.connect() as db_conn:

airbyte_ops_mcp/constants.py

@@ -12,6 +12,10 @@ MCP_SERVER_NAME = "airbyte-internal-ops"
 ENV_AIRBYTE_INTERNAL_ADMIN_FLAG = "AIRBYTE_INTERNAL_ADMIN_FLAG"
 ENV_AIRBYTE_INTERNAL_ADMIN_USER = "AIRBYTE_INTERNAL_ADMIN_USER"
 
+# Environment variable for GCP credentials (JSON content, not file path)
+ENV_GCP_PROD_DB_ACCESS_CREDENTIALS = "GCP_PROD_DB_ACCESS_CREDENTIALS"
+"""Environment variable containing GCP service account JSON credentials for prod DB access."""
+
 # Expected values for internal admin authentication
 EXPECTED_ADMIN_FLAG_VALUE = "airbyte.io"
 EXPECTED_ADMIN_EMAIL_DOMAIN = "@airbyte.io"

airbyte_ops_mcp/gcp_auth.py

@@ -0,0 +1,99 @@
+# Copyright (c) 2025 Airbyte, Inc., all rights reserved.
+"""Centralized GCP authentication utilities.
+
+This module provides a single code path for GCP credential handling across
+the airbyte-ops-mcp codebase. It supports both standard Application Default
+Credentials (ADC) and the GCP_PROD_DB_ACCESS_CREDENTIALS environment variable
+used internally at Airbyte.
+
+Usage:
+    from airbyte_ops_mcp.gcp_auth import get_secret_manager_client
+
+    # Get a properly authenticated Secret Manager client
+    client = get_secret_manager_client()
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import tempfile
+from pathlib import Path
+
+from google.cloud import secretmanager
+
+from airbyte_ops_mcp.constants import ENV_GCP_PROD_DB_ACCESS_CREDENTIALS
+
+logger = logging.getLogger(__name__)
+
+# Environment variable name (internal to GCP libraries)
+ENV_GOOGLE_APPLICATION_CREDENTIALS = "GOOGLE_APPLICATION_CREDENTIALS"
+
+# Module-level cache for the credentials file path
+_credentials_file_path: str | None = None
+
+
+def ensure_adc_credentials() -> str | None:
+    """Ensure GCP Application Default Credentials are available.
+
+    If GOOGLE_APPLICATION_CREDENTIALS is not set but GCP_PROD_DB_ACCESS_CREDENTIALS is,
+    write the JSON credentials to a temp file and set GOOGLE_APPLICATION_CREDENTIALS
+    to point to that file. This provides a fallback for internal employees who use
+    GCP_PROD_DB_ACCESS_CREDENTIALS as their standard credential source.
+
+    Note: GOOGLE_APPLICATION_CREDENTIALS must be a file path, not JSON content.
+    The GCP_PROD_DB_ACCESS_CREDENTIALS env var contains the JSON content directly,
+    so we write it to a temp file first.
+
+    This function is idempotent and safe to call multiple times.
+
+    Returns:
+        The path to the credentials file if one was created, or None if
+        GOOGLE_APPLICATION_CREDENTIALS was already set.
+    """
+    global _credentials_file_path
+
+    # If GOOGLE_APPLICATION_CREDENTIALS is already set, nothing to do
+    if ENV_GOOGLE_APPLICATION_CREDENTIALS in os.environ:
+        return None
+
+    # Check if we have the fallback credentials
+    gsm_creds = os.getenv(ENV_GCP_PROD_DB_ACCESS_CREDENTIALS)
+    if not gsm_creds:
+        return None
+
+    # Reuse the same file path if we've already written credentials and file still exists
+    if _credentials_file_path is not None and Path(_credentials_file_path).exists():
+        os.environ[ENV_GOOGLE_APPLICATION_CREDENTIALS] = _credentials_file_path
+        return _credentials_file_path
+
+    # Write credentials to a temp file
+    # Use a unique filename based on PID to avoid collisions between processes
+    creds_file = Path(tempfile.gettempdir()) / f"gcp_prod_db_creds_{os.getpid()}.json"
+    creds_file.write_text(gsm_creds)
+
+    # Set restrictive permissions (owner read/write only)
+    creds_file.chmod(0o600)
+
+    _credentials_file_path = str(creds_file)
+    os.environ[ENV_GOOGLE_APPLICATION_CREDENTIALS] = _credentials_file_path
+
+    logger.debug(
+        f"Wrote {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} to {creds_file} and set "
+        f"{ENV_GOOGLE_APPLICATION_CREDENTIALS}"
+    )
+
+    return _credentials_file_path
+
+
+def get_secret_manager_client() -> secretmanager.SecretManagerServiceClient:
+    """Get a Secret Manager client with proper credential handling.
+
+    This function ensures GCP credentials are available (supporting the
+    GCP_PROD_DB_ACCESS_CREDENTIALS fallback) before creating the client.
+
+    Returns:
+        A configured SecretManagerServiceClient instance.
+    """
+    ensure_adc_credentials()
+    return secretmanager.SecretManagerServiceClient()

airbyte_ops_mcp/live_tests/connection_secret_retriever.py

@@ -32,15 +32,14 @@ from __future__ import annotations
 
 import logging
 import os
-import tempfile
 from dataclasses import replace
-from pathlib import Path
 from typing import TYPE_CHECKING
 
 from airbyte_ops_mcp.connection_config_retriever import (
     ConnectionObject,
     retrieve_objects,
 )
+from airbyte_ops_mcp.gcp_auth import ensure_adc_credentials
 
 if TYPE_CHECKING:
     from airbyte_ops_mcp.live_tests.connection_fetcher import ConnectionData
@@ -50,39 +49,6 @@ logger = logging.getLogger(__name__)
 # Environment variable to enable secret retrieval
 ENV_USE_SECRET_RETRIEVER = "USE_CONNECTION_SECRET_RETRIEVER"
 
-# GCP credential environment variables
-ENV_GOOGLE_APPLICATION_CREDENTIALS = "GOOGLE_APPLICATION_CREDENTIALS"
-ENV_GCP_PROD_DB_ACCESS_CREDENTIALS = "GCP_PROD_DB_ACCESS_CREDENTIALS"
-
-
-def _ensure_gcp_credentials_env() -> None:
-    """Ensure GCP credentials are available via standard env var.
-
-    If GOOGLE_APPLICATION_CREDENTIALS is not set but GCP_PROD_DB_ACCESS_CREDENTIALS is,
-    write the JSON credentials to a temp file and set GOOGLE_APPLICATION_CREDENTIALS
-    to point to that file. This provides a fallback for internal employees who use
-    GCP_PROD_DB_ACCESS_CREDENTIALS as their standard credential source for prod
-    database access.
-
-    Note: GOOGLE_APPLICATION_CREDENTIALS must be a file path, not JSON content.
-    The GCP_PROD_DB_ACCESS_CREDENTIALS env var contains the JSON content directly,
-    so we write it to a temp file first.
-
-    This function is idempotent and safe to call multiple times.
-    """
-    if ENV_GOOGLE_APPLICATION_CREDENTIALS not in os.environ:
-        gsm_creds = os.getenv(ENV_GCP_PROD_DB_ACCESS_CREDENTIALS)
-        if gsm_creds:
-            # Write credentials to a temp file since GOOGLE_APPLICATION_CREDENTIALS
-            # expects a file path, not JSON content
-            creds_file = Path(tempfile.gettempdir()) / "gcp_prod_db_creds.json"
-            creds_file.write_text(gsm_creds)
-            os.environ[ENV_GOOGLE_APPLICATION_CREDENTIALS] = str(creds_file)
-            logger.debug(
-                f"Wrote {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} to {creds_file} and set "
-                f"{ENV_GOOGLE_APPLICATION_CREDENTIALS}"
-            )
-
 
 def is_secret_retriever_enabled() -> bool:
     """Check if secret retrieval is enabled via environment variable.
@@ -120,7 +86,7 @@ def retrieve_unmasked_config(
         The unmasked source config dict, or None if retrieval fails.
     """
     # Ensure GCP credentials are available (supports GCP_PROD_DB_ACCESS_CREDENTIALS fallback)
-    _ensure_gcp_credentials_env()
+    ensure_adc_credentials()
 
     # Only request the source config - that's all we need for secrets
     requested_objects = [ConnectionObject.SOURCE_CONFIG]

airbyte_ops_mcp/mcp/_mcp_utils.py

@@ -2,14 +2,17 @@
 """Deferred MCP capability registration for tools, prompts, and resources.
 
 This module provides a decorator to tag tool functions with MCP annotations
-for deferred registration.
+for deferred registration. The domain for each tool is automatically derived
+from the file stem of the module where the tool is defined.
 """
 
 from __future__ import annotations
 
+import inspect
 from collections.abc import Callable
 from dataclasses import dataclass
 from enum import Enum
+from pathlib import Path
 from typing import Any, TypeVar
 
 from fastmcp import FastMCP
@@ -94,8 +97,39 @@ def should_register_tool(annotations: dict[str, Any]) -> bool:
     return True
 
 
+def _get_caller_file_stem() -> str:
+    """Get the file stem of the caller's module.
+
+    Walks up the call stack to find the first frame outside this module,
+    then returns the stem of that file (e.g., "github" for "github.py").
+
+    Returns:
+        The file stem of the calling module.
+    """
+    for frame_info in inspect.stack():
+        # Skip frames from this module
+        if frame_info.filename != __file__:
+            return Path(frame_info.filename).stem
+    return "unknown"
+
+
+def _normalize_domain(domain: str) -> str:
+    """Normalize a domain string to its simple form.
+
+    Handles both file stems (e.g., "github") and module names
+    (e.g., "airbyte_ops_mcp.mcp.github") by extracting the last segment.
+
+    Args:
+        domain: A domain string, either a simple name or a dotted module path.
+
+    Returns:
+        The normalized domain (last segment of a dotted path, or the input if no dots).
+    """
+    return domain.rsplit(".", 1)[-1]
+
+
 def mcp_tool(
-    domain: ToolDomain | str,
+    domain: ToolDomain | str | None = None,
     *,
     read_only: bool = False,
     destructive: bool = False,
@@ -108,8 +142,12 @@ def mcp_tool(
     This decorator stores the annotations on the function for later use during
     deferred registration. It does not register the tool immediately.
 
+    The domain is automatically derived from the file stem of the module where
+    the tool is defined (e.g., tools in "github.py" get domain "github").
+
     Args:
-        domain: The domain this tool belongs to (e.g., ToolDomain.REGISTRY, "registry")
+        domain: Optional explicit domain override. If not provided, the domain
+            is automatically derived from the caller's file stem.
         read_only: If True, tool only reads without making changes (default: False)
         destructive: If True, tool modifies/deletes existing data (default: False)
         idempotent: If True, repeated calls have same effect (default: False)
@@ -121,11 +159,18 @@ def mcp_tool(
         Decorator function that tags the tool with annotations
 
     Example:
-        @mcp_tool(ToolDomain.REGISTRY, read_only=True, idempotent=True)
+        @mcp_tool(read_only=True, idempotent=True)
         def list_connectors_in_repo():
             ...
     """
-    domain_str = domain.value if isinstance(domain, ToolDomain) else domain
+    # Auto-derive domain from caller's file stem if not provided
+    if domain is None:
+        domain_str = _get_caller_file_stem()
+    elif isinstance(domain, ToolDomain):
+        domain_str = domain.value
+    else:
+        domain_str = domain
+
     annotations: dict[str, Any] = {
         "domain": domain_str,
         READ_ONLY_HINT: read_only,
@@ -156,7 +201,8 @@ def mcp_prompt(
     Args:
         name: Unique name for the prompt
         description: Human-readable description of the prompt
-        domain: Optional domain for filtering (e.g., ToolDomain.PROMPTS)
+        domain: Optional domain for filtering. If not provided, automatically
+            derived from the caller's file stem.
 
     Returns:
         Decorator function that registers the prompt
@@ -164,15 +210,20 @@ def mcp_prompt(
     Raises:
         ValueError: If a prompt with the same name is already registered
     """
+    # Auto-derive domain from caller's file stem if not provided
+    if domain is None:
+        domain_str = _get_caller_file_stem()
+    elif isinstance(domain, ToolDomain):
+        domain_str = domain.value
+    else:
+        domain_str = domain
 
     def decorator(func: Callable[..., list[dict[str, str]]]):
-        domain_str = domain.value if isinstance(domain, ToolDomain) else domain
         annotations = {
             "name": name,
             "description": description,
+            "domain": domain_str,
         }
-        if domain_str is not None:
-            annotations["domain"] = domain_str
         _REGISTERED_PROMPTS.append((func, annotations))
         return func
 
@@ -191,7 +242,8 @@ def mcp_resource(
         uri: Unique URI for the resource
         description: Human-readable description of the resource
         mime_type: MIME type of the resource content
-        domain: Optional domain for filtering (e.g., ToolDomain.SERVER_INFO)
+        domain: Optional domain for filtering. If not provided, automatically
+            derived from the caller's file stem.
 
     Returns:
         Decorator function that registers the resource
@@ -199,16 +251,21 @@ def mcp_resource(
     Raises:
         ValueError: If a resource with the same URI is already registered
     """
+    # Auto-derive domain from caller's file stem if not provided
+    if domain is None:
+        domain_str = _get_caller_file_stem()
+    elif isinstance(domain, ToolDomain):
+        domain_str = domain.value
+    else:
+        domain_str = domain
 
     def decorator(func: Callable[..., Any]):
-        domain_str = domain.value if isinstance(domain, ToolDomain) else domain
         annotations = {
             "uri": uri,
             "description": description,
             "mime_type": mime_type,
+            "domain": domain_str,
         }
-        if domain_str is not None:
-            annotations["domain"] = domain_str
         _REGISTERED_RESOURCES.append((func, annotations))
         return func
 
@@ -226,11 +283,14 @@ def _register_mcp_callables(
 
     Args:
         app: The FastMCP app instance
-        domain: The domain to register tools for (e.g., ToolDomain.REGISTRY, "registry")
+        domain: The domain to register tools for. Can be a simple name (e.g., "github")
+            or a full module path (e.g., "airbyte_ops_mcp.mcp.github" from __name__).
         resource_list: List of (callable, annotations) tuples to register
         register_fn: Function to call for each registration
     """
     domain_str = domain.value if isinstance(domain, ToolDomain) else domain
+    # Normalize to handle both file stems and __name__ module paths
+    domain_str = _normalize_domain(domain_str)
 
     filtered_callables = [
         (func, ann) for func, ann in resource_list if ann.get("domain") == domain_str
@@ -242,14 +302,17 @@ def _register_mcp_callables(
 
 def register_mcp_tools(
     app: FastMCP,
-    domain: ToolDomain | str,
+    domain: ToolDomain | str | None = None,
 ) -> None:
     """Register tools with the FastMCP app, filtered by domain.
 
     Args:
         app: The FastMCP app instance
-        domain: The domain to register for (e.g., ToolDomain.REGISTRY, "registry")
+        domain: The domain to register for. If not provided, automatically
+            derived from the caller's file stem.
     """
+    if domain is None:
+        domain = _get_caller_file_stem()
 
     def _register_fn(
         app: FastMCP,
@@ -271,14 +334,17 @@ def register_mcp_tools(
 
 def register_mcp_prompts(
     app: FastMCP,
-    domain: ToolDomain | str,
+    domain: ToolDomain | str | None = None,
 ) -> None:
     """Register prompt callables with the FastMCP app, filtered by domain.
 
     Args:
         app: The FastMCP app instance
-        domain: The domain to register for (e.g., ToolDomain.PROMPTS, "prompts")
+        domain: The domain to register for. If not provided, automatically
+            derived from the caller's file stem.
     """
+    if domain is None:
+        domain = _get_caller_file_stem()
 
     def _register_fn(
         app: FastMCP,
@@ -300,14 +366,17 @@ def register_mcp_prompts(
 
 def register_mcp_resources(
     app: FastMCP,
-    domain: ToolDomain | str,
+    domain: ToolDomain | str | None = None,
 ) -> None:
     """Register resource callables with the FastMCP app, filtered by domain.
 
     Args:
         app: The FastMCP app instance
-        domain: The domain to register for (e.g., ToolDomain.SERVER_INFO, "server_info")
+        domain: The domain to register for. If not provided, automatically
+            derived from the caller's file stem.
     """
+    if domain is None:
+        domain = _get_caller_file_stem()
 
     def _register_fn(
         app: FastMCP,

airbyte_ops_mcp/mcp/cloud_connector_versions.py

@@ -33,7 +33,7 @@ from airbyte_ops_mcp.cloud_admin.models import (
     ConnectorVersionInfo,
     VersionOverrideOperationResult,
 )
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 
 
 def _get_workspace(workspace_id: str) -> CloudWorkspace:
@@ -63,7 +63,6 @@ def _get_workspace(workspace_id: str) -> CloudWorkspace:
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
     open_world=True,
@@ -117,7 +116,6 @@ def get_cloud_connector_version(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     destructive=True,
     idempotent=False,
     open_world=True,
@@ -297,4 +295,4 @@ def register_cloud_connector_version_tools(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_tools(app, domain=ToolDomain.CLOUD_ADMIN)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/github.py

@@ -15,7 +15,7 @@ import requests
 from fastmcp import FastMCP
 from pydantic import BaseModel, Field
 
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 
 GITHUB_API_BASE = "https://api.github.com"
 DOCKERHUB_API_BASE = "https://hub.docker.com/v2"
@@ -115,7 +115,6 @@ def _get_workflow_run(
 
 
 @mcp_tool(
-    ToolDomain.REPO,
     read_only=True,
     idempotent=True,
     open_world=True,
@@ -222,7 +221,6 @@ def _check_dockerhub_image(
 
 
 @mcp_tool(
-    ToolDomain.REPO,
     read_only=True,
     idempotent=True,
     open_world=True,
@@ -276,4 +274,4 @@ def register_github_tools(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_tools(app, domain=ToolDomain.REPO)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/github_repo_ops.py

@@ -15,7 +15,7 @@ from pydantic import BaseModel
 from airbyte_ops_mcp.airbyte_repo.bump_version import bump_connector_version
 from airbyte_ops_mcp.airbyte_repo.list_connectors import list_connectors
 from airbyte_ops_mcp.airbyte_repo.utils import resolve_diff_range
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 
 
 class ConnectorListResponse(BaseModel):
@@ -36,7 +36,6 @@ class BumpVersionResponse(BaseModel):
 
 
 @mcp_tool(
-    ToolDomain.REPO,
     read_only=True,
     idempotent=True,
     open_world=False,
@@ -102,7 +101,6 @@ def list_connectors_in_repo(
 
 
 @mcp_tool(
-    ToolDomain.REPO,
     read_only=False,
     idempotent=False,
     open_world=False,
@@ -164,4 +162,4 @@ def register_github_repo_ops_tools(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_tools(app, domain=ToolDomain.REPO)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/live_tests.py

@@ -21,7 +21,7 @@ from airbyte.cloud.auth import resolve_cloud_client_id, resolve_cloud_client_sec
 from fastmcp import FastMCP
 from pydantic import BaseModel, Field
 
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 
 logger = logging.getLogger(__name__)
 
@@ -308,7 +308,6 @@ class RunLiveConnectionTestsResponse(BaseModel):
 
 
 @mcp_tool(
-    ToolDomain.LIVE_TESTS,
     read_only=False,
     idempotent=False,
     open_world=True,
@@ -512,4 +511,4 @@ def register_live_tests_tools(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_tools(app, domain=ToolDomain.LIVE_TESTS)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/prerelease.py

@@ -16,7 +16,7 @@ import yaml
 from fastmcp import FastMCP
 from pydantic import BaseModel, Field
 
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 
 GITHUB_API_BASE = "https://api.github.com"
 DEFAULT_REPO_OWNER = "airbytehq"
@@ -205,7 +205,6 @@ def _trigger_workflow_dispatch(
 
 
 @mcp_tool(
-    ToolDomain.REPO,
     read_only=False,
     destructive=False,
     idempotent=False,
@@ -310,4 +309,4 @@ def register_prerelease_tools(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_tools(app, domain=ToolDomain.REPO)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/prod_db_queries.py

@@ -14,7 +14,7 @@ from airbyte.exceptions import PyAirbyteInputError
 from fastmcp import FastMCP
 from pydantic import Field
 
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_tool, register_mcp_tools
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_tool, register_mcp_tools
 from airbyte_ops_mcp.prod_db_access.queries import (
     query_actors_pinned_to_version,
     query_connections_by_connector,
@@ -86,7 +86,6 @@ def _resolve_canonical_name_to_definition_id(canonical_name: str) -> str:
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -104,7 +103,6 @@ def query_prod_dataplanes() -> list[dict[str, Any]]:
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -128,7 +126,6 @@ def query_prod_workspace_info(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -151,7 +148,6 @@ def query_prod_connector_versions(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -179,7 +175,6 @@ def query_prod_new_connector_releases(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -205,7 +200,6 @@ def query_prod_actors_by_connector_version(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
 )
@@ -252,7 +246,6 @@ def query_prod_connector_version_sync_results(
 
 
 @mcp_tool(
-    ToolDomain.CLOUD_ADMIN,
     read_only=True,
     idempotent=True,
     open_world=True,
@@ -354,4 +347,4 @@ def query_prod_connections_by_connector(
 
 def register_prod_db_query_tools(app: FastMCP) -> None:
     """Register prod DB query tools with the FastMCP app."""
-    register_mcp_tools(app, ToolDomain.CLOUD_ADMIN)
+    register_mcp_tools(app, domain=__name__)

airbyte_ops_mcp/mcp/prompts.py

@@ -13,13 +13,12 @@ from fastmcp import FastMCP
 from pydantic import Field
 
 from airbyte_ops_mcp.mcp._guidance import TEST_MY_TOOLS_GUIDANCE
-from airbyte_ops_mcp.mcp._mcp_utils import ToolDomain, mcp_prompt, register_mcp_prompts
+from airbyte_ops_mcp.mcp._mcp_utils import mcp_prompt, register_mcp_prompts
 
 
 @mcp_prompt(
     name="test-my-tools",
     description="Test all available MCP tools to confirm they are working properly",
-    domain=ToolDomain.PROMPTS,
 )
 def test_my_tools_prompt(
     scope: Annotated[
@@ -57,4 +56,4 @@ def register_prompts(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_prompts(app, ToolDomain.PROMPTS)
+    register_mcp_prompts(app, domain=__name__)

airbyte_ops_mcp/mcp/server_info.py

@@ -12,7 +12,6 @@ from fastmcp import FastMCP
 
 from airbyte_ops_mcp.constants import MCP_SERVER_NAME
 from airbyte_ops_mcp.mcp._mcp_utils import (
-    ToolDomain,
     mcp_resource,
     register_mcp_resources,
 )
@@ -64,7 +63,6 @@ def _get_version_info() -> dict[str, str | list[str] | None]:
     uri=f"{MCP_SERVER_NAME}://server/info",
     description="Server information for the Airbyte Admin MCP server",
     mime_type="application/json",
-    domain=ToolDomain.SERVER_INFO,
 )
 def mcp_server_info() -> dict[str, str | list[str] | None]:
     """Resource that returns information for the MCP server.
@@ -83,4 +81,4 @@ def register_server_info_resources(app: FastMCP) -> None:
     Args:
         app: FastMCP application instance
     """
-    register_mcp_resources(app, domain=ToolDomain.SERVER_INFO)
+    register_mcp_resources(app, domain=__name__)

airbyte_ops_mcp/prod_db_access/queries.py

@@ -16,6 +16,7 @@ from typing import Any
 import sqlalchemy
 from google.cloud import secretmanager
 
+from airbyte_ops_mcp.gcp_auth import get_secret_manager_client
 from airbyte_ops_mcp.prod_db_access.db_engine import get_pool
 from airbyte_ops_mcp.prod_db_access.sql import (
     SELECT_ACTORS_PINNED_TO_VERSION,
@@ -52,7 +53,7 @@ def _run_sql_query(
         List of row dicts from the query result
     """
     if gsm_client is None:
-        gsm_client = secretmanager.SecretManagerServiceClient()
+        gsm_client = get_secret_manager_client()
     pool = get_pool(gsm_client)
     start = perf_counter()
     with pool.connect() as conn: