cmdbox 0.6.0.3__py3-none-any.whl → 0.6.1__py3-none-any.whl

cmdbox/app/mcp.py

@@ -0,0 +1,375 @@
+from cmdbox.app import common, options
+from cmdbox.app.options import Options
+from cmdbox.app.auth import signin
+from pathlib import Path
+from typing import Callable, List, Dict, Any, Tuple
+import argparse
+import logging
+import locale
+import json
+import time
+import re
+import os
+
+
+class Mcp:
+    default_host:str = os.environ.get('REDIS_HOST', 'localhost')
+    default_port:int = int(os.environ.get('REDIS_PORT', '6379'))
+    default_pass:str = os.environ.get('REDIS_PASSWORD', 'password')
+    default_svname:str = os.environ.get('SVNAME', 'server')
+
+    def __init__(self, logger:logging.Logger, data:Path, sign:signin.Signin, appcls=None, ver=None,):
+        """
+        MCP (Multi-Channel Protocol) クラスの初期化
+
+        Args:
+            logger (logging.Logger): ロガー
+            data (Path): データのパス
+            sign (signin.Signin): サインインオブジェクト
+            appcls (type, optional): アプリケーションクラス. Defaults to None.
+            ver (module, optional): バージョンモジュール. Defaults to None.
+        """
+        self.logger = logger
+        self.data = data
+        self.appcls = appcls
+        self.ver = ver
+        self.signin = sign
+
+    def create_mcpserver(self, args:argparse.Namespace) -> Any:
+        """
+        mcpserverを作成します
+
+        Args:
+            args (argparse.Namespace): 引数
+
+        Returns:
+            Any: FastMCP
+        """
+        from fastmcp import FastMCP
+        from fastmcp.server.auth import BearerAuthProvider
+        cls = self.signin.__class__
+        publickey_str = cls.verify_jwt_publickey_str if hasattr(cls, 'verify_jwt_publickey_str') else None
+        issuer = cls.verify_jwt_issuer if hasattr(cls, 'verify_jwt_issuer') else None
+        audience = cls.verify_jwt_audience if hasattr(cls, 'verify_jwt_audience') else None
+        if publickey_str is not None and issuer is not None and audience is not None:
+            self.logger.info(f"Using BearerAuthProvider with public key, issuer: {issuer}, audience: {audience}")
+            auth = BearerAuthProvider(
+                public_key=publickey_str,
+                issuer=issuer,
+                audience=audience
+            )
+            mcp = FastMCP(name=self.ver.__appid__, auth=auth)
+        else:
+            self.logger.info(f"Using BearerAuthProvider without public key, issuer, or audience.")
+            mcp = FastMCP(name=self.ver.__appid__)
+        return mcp
+
+    def create_session_service(self, args:argparse.Namespace) -> Any:
+        """
+        セッションサービスを作成します
+
+        Args:
+            args (argparse.Namespace): 引数
+
+        Returns:
+            BaseSessionService: セッションサービス
+        """
+        from google.adk.events import Event
+        from google.adk.sessions import DatabaseSessionService, InMemorySessionService, session
+        from typing_extensions import override
+        if hasattr(args, 'agent_session_dburl') and args.agent_session_dburl is not None:
+            class _DatabaseSessionService(DatabaseSessionService):
+                @override
+                async def append_event(self, session: session.Session, event: Event) -> Event:
+                    # 永続化されるセッションには <important> タグを含めない
+                    bk_parts = event.content.parts.copy()
+                    for part in event.content.parts:
+                        if not part.text: continue
+                        part.text = re.sub(r"<important>.*</important>", "", part.text)
+                    for part in bk_parts:
+                        if not part.text: continue
+                        part.text = part.text.replace("<important>", "").replace("</important>", "")
+                    ret = await super().append_event(session, event)
+                    ret.content.parts = bk_parts
+                    return ret
+            dss = _DatabaseSessionService(db_url=args.agent_session_dburl)
+            #dss.db_engine.echo = True
+            return dss
+        else:
+            return InMemorySessionService()
+
+    def create_agent(self, logger:logging.Logger, args:argparse.Namespace, tools:List[Callable]) -> Any:
+        """
+        エージェントを作成します
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+            tools (List[Callable]): 関数
+
+        Returns:
+            Agent: エージェント
+        """
+        if logger.level == logging.DEBUG:
+            logger.debug(f"create_agent processing..")
+        language, _ = locale.getlocale()
+        is_japan = language.find('Japan') >= 0 or language.find('ja_JP') >= 0
+        description = f"{self.ver.__appid__}に登録されているコマンド提供"
+        instruction = f"あなたはコマンドの意味を熟知しているエキスパートです。" + \
+                      f"ユーザーがコマンドを実行したいとき、あなたは以下の手順に従ってコマンドを確実に実行してください。\n" + \
+                      f"1. ユーザーのクエリからが実行したいコマンドを特定します。\n" + \
+                      f"2. コマンド実行に必要なパラメータのなかで、ユーザーのクエリから取得できないものは、コマンド定義にあるデフォルト値を指定して実行してください。\n" + \
+                      f"3. もしエラーが発生した場合は、ユーザーにコマンド名とパラメータとエラー内容を提示してください。\n"
+
+        description = description if is_japan else \
+                      f"Command offer registered in {self.ver.__appid__}."
+        instruction = instruction if is_japan else \
+                      f"You are the expert who knows what the commands mean." + \
+                      f"When a user wants to execute a command, you follow these steps to ensure that the command is executed.\n" + \
+                      f"1. Identify the command you want to execute from the user's query.\n" + \
+                      f"2. Any parameters required to execute the command that cannot be obtained from the user's query should be executed with the default values provided in the command definition.\n" + \
+                      f"3. If an error occurs, provide the user with the command name, parameters, and error description.\n"
+
+        description = args.agent_description if args.agent_description else description
+        instruction = args.agent_instruction if args.agent_instruction else instruction
+        if logger.level == logging.DEBUG:
+            logger.debug(f"google-adk loading..")
+        from google.adk.agents import Agent
+        if logger.level == logging.DEBUG:
+            logger.debug(f"litellm loading..")
+        from google.adk.models.lite_llm import LiteLlm
+        # loggerの初期化
+        common.reset_logger("LiteLLM Proxy")
+        common.reset_logger("LiteLLM Router")
+        common.reset_logger("LiteLLM")
+        if args.llmprov == 'openai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmapikey is None: raise ValueError("llmapikey is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    api_key=args.llmapikey,
+                    endpoint=args.llmendpoint,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'azureopenai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmendpoint is None: raise ValueError("llmendpoint is required.")
+            if args.llmapikey is None: raise ValueError("llmapikey is required.")
+            if args.llmapiversion is None: raise ValueError("llmapiversion is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    api_key=args.llmapikey,
+                    endpoint=args.llmendpoint,
+                    api_version=args.llmapiversion,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'vertexai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmlocation is None: raise ValueError("llmlocation is required.")
+            if args.llmsvaccountfile is not None: 
+                with open(args.llmsvaccountfile, "r", encoding="utf-8") as f:
+                    vertex_credentials = json.load(f)
+            elif args.llmprojectid is None: raise ValueError("llmprojectid is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    #vertex_project=args.llmprojectid,
+                    vertex_credentials=vertex_credentials,
+                    vertex_location=args.llmlocation,
+                    #seed=args.llmseed,
+                    #temperature=args.llmtemperature,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'ollama':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmendpoint is None: raise ValueError("llmendpoint is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=f"ollama/{args.llmmodel}",
+                    api_base=args.llmendpoint,
+                    temperature=args.llmtemperature,
+                    stream=True
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        else:
+            raise ValueError("llmprov is required.")
+        if logger.level == logging.DEBUG:
+            logger.debug(f"create_agent complate.")
+        return agent
+
+    def create_runner(self, logger:logging.Logger, args:argparse.Namespace, session_service, agent) -> Any:
+        """
+        ランナーを作成します
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+            session_service (BaseSessionService): セッションサービス
+            agent (Agent): エージェント
+
+        Returns:
+            Runner: ランナー
+        """
+        from google.adk.runners import Runner
+        return Runner(
+            app_name=self.ver.__appid__,
+            agent=agent,
+            session_service=session_service,
+        )
+
+    def init_agent_runner(self, logger:logging.Logger, args:argparse.Namespace) -> Tuple[Any, Any]:
+        """
+        エージェントの初期化を行います
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+
+        Returns:
+            Tuple[Any, Any]: ランナーとFastMCP
+        """
+        if logger.level == logging.DEBUG:
+            logger.debug(f"init_agent_runner processing..")
+        # loggerの初期化
+        common.reset_logger("httpx")
+        common.reset_logger("google_adk.google.adk.sessions.database_session_service")
+        common.reset_logger("mcp.server.streamable_http_manager")
+        # モジュールインポート
+        from fastmcp import FastMCP
+        from google.adk.sessions import BaseSessionService
+        mcp:FastMCP = self.create_mcpserver(args)
+        session_service:BaseSessionService = self.create_session_service(args)
+        options = Options.getInstance()
+        tools:Callable[[logging.Logger, argparse.Namespace, float, Dict], Tuple[int, Dict[str, Any], Any]] = []
+
+        def _ds(d:str) -> str:
+            return f'"{d}"' if d is not None else 'None'
+        def _t2s(o:Dict[str, Any], req=True) -> str:
+            t, m, d, r = o["type"], o["multi"], o["default"], o["required"]
+            if t == Options.T_BOOL: return ("List[bool]=[]" if m else f"bool={d}") if req else ("List[bool]" if m else f"bool")
+            if t == Options.T_DATE: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_DATETIME: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_DICT: return ("List[dict]=[]" if m else f"dict={d}") if req else ("List[dict]" if m else f"dict")
+            if t == Options.T_DIR or t == Options.T_FILE:
+                if d is not None: d = str(d).replace('\\', '/')
+                return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_FLOAT: return ("List[float]=[]" if m else f"float={d}") if req else ("List[float]" if m else f"float")
+            if t == Options.T_INT: return ("List[int]=[]" if m else f"int={d}") if req else ("List[int]" if m else f"int")
+            if t == Options.T_STR: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_TEXT: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            raise ValueError(f"Unknown type: {t} for option {o['opt']}")
+        def _arg(o:Dict[str, Any], is_japan) -> str:
+            t, d = o["type"], o["default"]
+            s = f'        {o["opt"]}:'
+            if t == Options.T_DIR or t == Options.T_FILE:
+                d = str(d).replace("\\", "/")
+            s += f'{_t2s(o, False)}={d}:'
+            #s += f'Optional[{_t2s(o, False)}]={d}:'
+            s += f'{o["discription_ja"] if is_japan else o["discription_en"]}'
+            return s
+        def _coercion(a:argparse.Namespace, key:str, dval) -> str:
+            dval = f'opt["{key}"] if "{key}" in opt else ' + f'"{dval}"' if isinstance(dval, str) else dval
+            aval = args.__dict__[key] if hasattr(args, key) and args.__dict__[key] else None
+            aval = f'"{aval}"' if isinstance(aval, str) else aval
+            ret = f'opt["{key}"] = {aval}' if aval is not None else f'opt["{key}"] = {dval}'
+            return ret
+        language, _ = locale.getlocale()
+        is_japan = language.find('Japan') >= 0 or language.find('ja_JP') >= 0
+        for mode in options.get_mode_keys():
+            for cmd in options.get_cmd_keys(mode):
+                if not options.get_cmd_attr(mode, cmd, 'use_agent'):
+                    continue
+                discription = options.get_cmd_attr(mode, cmd, 'discription_ja' if is_japan else 'discription_en')
+                choices = options.get_cmd_choices(mode, cmd, False)
+                if len([opt for opt in choices if 'opt' in opt and opt['opt'] == 'signin_file']) <= 0:
+                    choices.append(dict(opt="signin_file", type=Options.T_FILE, default=f'.{self.ver.__appid__}/user_list.yml', required=True, multi=False, hide=True, choice=None,
+                        discription_ja="サインイン可能なユーザーとパスワードを記載したファイルを指定します。省略した時は認証を要求しません。",
+                        discription_en="Specify a file containing users and passwords with which they can signin. If omitted, no authentication is required."),)
+                fn = f"{mode}_{cmd}"
+                func_txt  = f'def {fn}(' + ", ".join([f'{o["opt"]}:{_t2s(o, False)}' for o in choices]) + '):\n'
+                func_txt += f'    """\n'
+                func_txt += f'    {discription}\n'
+                func_txt += f'    Args:\n'
+                func_txt += "\n".join([_arg(o, is_japan) for o in choices])
+                func_txt += f'\n'
+                func_txt += f'    Returns:\n'
+                func_txt += f'        Dict[str, Any]:{"処理結果" if is_japan else "Processing Result"}\n'
+                func_txt += f'    """\n'
+                func_txt += f'    scope = signin.get_request_scope()\n'
+                func_txt += f'    logger = common.default_logger()\n'
+                func_txt += f'    opt = dict()\n'
+                func_txt += f'    opt["mode"] = "{mode}"\n'
+                func_txt += f'    opt["cmd"] = "{cmd}"\n'
+                func_txt += f'    opt["data"] = opt["data"] if hasattr(opt, "data") else common.HOME_DIR / ".{self.ver.__appid__}"\n'
+                func_txt += f'    opt["format"] = False\n'
+                func_txt += f'    opt["output_json"] = None\n'
+                func_txt += f'    opt["output_json_append"] = False\n'
+                func_txt += f'    opt["debug"] = logger.level == logging.DEBUG\n'
+                func_txt += '\n'.join([f'    opt["{o["opt"]}"] = {o["opt"]}' for o in choices])+'\n'
+                func_txt += f'    {_coercion(args, "host", self.default_host)}\n'
+                func_txt += f'    {_coercion(args, "port", self.default_port)}\n'
+                func_txt += f'    {_coercion(args, "password", self.default_pass)}\n'
+                func_txt += f'    {_coercion(args, "svname", self.default_svname)}\n'
+                func_txt += f'    {_coercion(args, "retry_count", 3)}\n'
+                func_txt += f'    {_coercion(args, "retry_interval", 3)}\n'
+                func_txt += f'    {_coercion(args, "timeout", 15)}\n'
+                func_txt += f'    {_coercion(args, "output_json", None)}\n'
+                func_txt += f'    {_coercion(args, "output_json_append", False)}\n'
+                func_txt += f'    {_coercion(args, "stdout_log", False)}\n'
+                func_txt += f'    {_coercion(args, "capture_stdout", False)}\n'
+                func_txt += f'    {_coercion(args, "capture_maxsize", 1024*1024)}\n'
+                func_txt += f'    {_coercion(args, "tag", None)}\n'
+                func_txt += f'    {_coercion(args, "clmsg_id", None)}\n'
+                func_txt += f'    opt["signin_file"] = signin_file if signin_file else ".{self.ver.__appid__}/user_list.yml"\n'
+                func_txt += f'    args = argparse.Namespace(**opt)\n'
+                func_txt += f'    signin_data = signin.Signin.load_signin_file(args.signin_file)\n'
+                func_txt += f'    req = scope["req"] if scope["req"] is not None else scope["websocket"]\n'
+                func_txt += f'    sign = signin.Signin._check_signin(req, scope["res"], signin_data, logger)\n'
+                func_txt += f'    if sign is not None:\n'
+                func_txt += f'        logger.warning("Unable to execute command because authentication information cannot be obtained")\n'
+                func_txt += f'        return dict(warn="Unable to execute command because authentication information cannot be obtained")\n'
+                func_txt += f'    groups = req.session["signin"]["groups"]\n'
+                func_txt += f'    logger.info("Call agent tool `{mode}_{cmd}`:user="+str(req.session["signin"]["name"])+" groups="+str(groups)+" args="+str(args))\n'
+                func_txt += f'    if not signin.Signin._check_cmd(signin_data, groups, "{mode}", "{cmd}", logger):\n'
+                func_txt += f'        logger.warning("You do not have permission to execute this command.")\n'
+                func_txt += f'        return dict(warn="You do not have permission to execute this command.")\n'
+                func_txt += f'    feat = Options.getInstance().get_cmd_attr("{mode}", "{cmd}", "feature")\n'
+                func_txt += f'    try:\n'
+                func_txt += f'        st, ret, _ = feat.apprun(logger, args, time.perf_counter(), [])\n'
+                func_txt += f'        return ret\n'
+                func_txt += f'    except Exception as e:\n'
+                func_txt += f'        logger.error("Error occurs when tool is executed:", exc_info=True)\n'
+                func_txt += f'        raise e\n'
+                func_txt += f'tools.append({fn})\n'
+                if logger.level == logging.DEBUG:
+                    logger.debug(f"generating agent tool: {fn}")
+
+                exec(func_txt,
+                     dict(time=time,List=List, argparse=argparse, common=common, Options=Options, logging=logging, signin=signin,),
+                     dict(tools=tools, mcp=mcp))
+                exec(f"@mcp.tool\n{func_txt}",
+                     dict(time=time,List=List, argparse=argparse, common=common, Options=Options, logging=logging, signin=signin,),
+                     dict(tools=[], mcp=mcp))
+        root_agent = self.create_agent(logger, args, tools)
+        runner = self.create_runner(logger, args, session_service, root_agent)
+        if logger.level == logging.DEBUG:
+            logger.debug(f"init_agent_runner complate.")
+        return runner, mcp

cmdbox/app/options.py

@@ -295,12 +295,18 @@ class Options:
             discription_ja="クライアントのメッセージIDを指定します。省略した場合はuuid4で生成されます。",
             discription_en="Specifies the message ID of the client. If omitted, uuid4 will be generated.",
             choice=None)
+        self._options["description"] = dict(
+            type=Options.T_TEXT, default=None, required=False, multi=False, hide=True,
+            discription_ja="このコマンド登録の説明文を指定します。Agentがこのコマンドの用途を理解するのに使用します。",
+            discription_en="Specifies a description of this command registration, used to help the Agent understand the use of this command.",
+            choice=None)
 
     def init_debugoption(self):
         # デバックオプションを追加
         self._options["debug"]["opt"] = "debug"
         self._options["tag"]["opt"] = "tag"
         self._options["clmsg_id"]["opt"] = "clmsg_id"
+        self._options["description"]["opt"] = "description"
         for key, mode in self._options["cmd"].items():
             if type(mode) is not dict:
                 continue
@@ -315,6 +321,8 @@ class Options:
                     c["choice"].append(self._options["tag"])
                 if "clmsg_id" not in [_o['opt'] for _o in c["choice"]]:
                     c["choice"].append(self._options["clmsg_id"])
+                if "description" not in [_o['opt'] for _o in c["choice"]]:
+                    c["choice"].append(self._options["description"])
                 if c["opt"] not in [_o['opt'] for _o in self._options["cmd"]["choice"]]:
                     self._options["cmd"]["choice"] += [c]
             self._options["mode"][key] = mode
@@ -824,11 +832,13 @@ class Options:
                 if hasattr(arg, 'redis_password'): opt['password'] = arg.redis_password
                 if hasattr(arg, 'svname'): opt['svname'] = arg.svname
                 if hasattr(arg, 'clmsg_id'): opt['clmsg_id'] = arg.clmsg_id
+                if hasattr(arg, 'client_only'): opt['client_only'] = arg.client_only
             elif isinstance(arg, web.Web):
                 opt['host'] = arg.redis_host
                 opt['port'] = arg.redis_port
                 opt['password'] = arg.redis_password
                 opt['svname'] = arg.svname
+                opt['client_only'] = arg.client_only
             elif isinstance(arg, feature.Feature):
                 func_feature = arg
                 opt['clmsg_src'] = func_feature.__class__.__name__

cmdbox/app/web.py

@@ -1,11 +1,9 @@
 from cmdbox.app import common, options
-from cmdbox.app.auth import signin, signin_saml
 from cmdbox.app.commons import module
 from fastapi import FastAPI, Request, Response
 from pathlib import Path
 from starlette.applications import Starlette
 from starlette.middleware.sessions import SessionMiddleware
-from starlette.routing import Mount
 from typing import Any, Dict, List
 from uvicorn.config import Config
 import asyncio
@@ -13,6 +11,7 @@ import copy
 import ctypes
 import datetime
 import gevent
+import jwt
 import logging
 import multiprocessing
 import os
@@ -20,7 +19,6 @@ import platform
 import requests
 import queue
 import signal
-import string
 import time
 import threading
 import traceback
@@ -30,10 +28,10 @@ import webbrowser
 
 class Web:
     def __init__(self, logger:logging.Logger, data:Path, appcls=None, ver=None,
-                 redis_host:str = "localhost", redis_port:int = 6379, redis_password:str = None, svname:str = 'server',
+                 redis_host:str="localhost", redis_port:int=6379, redis_password:str=None, svname:str='server',
                  client_only:bool=False, doc_root:Path=None, gui_html:str=None, filer_html:str=None, result_html:str=None, users_html:str=None,
                  audit_html:str=None, agent_html:str=None, assets:List[str]=None, signin_html:str=None, signin_file:str=None, gui_mode:bool=False,
-                 web_features_packages:List[str]=None, web_features_prefix:List[str]=None):
+                 web_features_packages:List[str]=None, web_features_prefix:List[str]=[]):
         """
         cmdboxクライアント側のwebapiサービス
 
@@ -122,7 +120,8 @@ class Web:
         self.cb_queue = queue.Queue(1000)
         self.options = options.Options.getInstance()
         self.webcap_client = requests.Session()
-        signin_file_data = signin.Signin.load_signin_file(self.signin_file)
+        from cmdbox.app.auth import signin, signin_saml
+        signin_file_data = signin.Signin.load_signin_file(self.signin_file, self=self)
         self.signin = signin.Signin(self.logger, self.signin_file, signin_file_data, self.appcls, self.ver)
         self.signin_saml = signin_saml.SigninSAML(self.logger, self.signin_file, signin_file_data, self.appcls, self.ver)
 
@@ -249,7 +248,25 @@ class Web:
         for u in copy.deepcopy(signin_data['users']):
             u['password'] = '********'
             if 'apikeys' in u:
-                u['apikeys'] = dict([(ak, '********') for ak in u['apikeys']])
+                for an, ak in u['apikeys'].items():
+                    exp = '-'
+                    try:
+                        cls = self.signin.__class__
+                        publickey = None
+                        if cls.verify_jwt_certificate is not None:
+                            publickey = cls.verify_jwt_certificate.public_key()
+                        if publickey is None and cls.verify_jwt_publickey is not None:
+                            publickey = cls.verify_jwt_publickey
+                        t = jwt.decode(ak, publickey, algorithms=[cls.verify_jwt_algorithm],
+                                       issuer=cls.verify_jwt_issuer, audience=cls.verify_jwt_audience,
+                                       options={'verify_iss': cls.verify_jwt_issuer is not None,
+                                                'verify_aud': cls.verify_jwt_audience is not None})
+                        exp = datetime.datetime.fromtimestamp(t['exp']).strftime('%Y-%m-%d %H:%M:%S')
+                        u['apikeys'][an] = (ak, exp, '-')
+                    except jwt.exceptions.InvalidTokenError as e:
+                        u['apikeys'][an] = (ak, '-', str(e))
+                    except Exception as e:
+                        u['apikeys'][an] = (ak, '-', '-')
             if u['name'] == name:
                 return [u]
             signin_last = self.user_data(None, u['uid'], u['name'], 'signin', 'last_update')
@@ -291,10 +308,19 @@ class Web:
                 if user['apikey_name'] in u['apikeys']:
                     raise ValueError(f"ApiKey name is already exists. ({user})")
                 apikey = common.random_string(64)
-                u['apikeys'][user['apikey_name']] = common.hash_password(apikey, 'sha1')
+                u['apikeys'][user['apikey_name']] = apikey
+                if signin_data['apikey']['gen_jwt']['enabled']:
+                    cls = self.signin.__class__
+                    claims = cls.gen_jwt_claims.copy() if cls.gen_jwt_claims is not None else dict()
+                    claims['exp'] = int(time.time()) + int(claims.get('exp', 3600))
+                    claims['uid'] = u['uid']
+                    claims['name'] = u['name']
+                    claims['groups'] = u['groups']
+                    claims['email'] = u['email']
+                    claims['apikey_name'] = user['apikey_name']
+                    apikey = jwt.encode(claims, cls.gen_jwt_privatekey, algorithm=cls.gen_jwt_algorithm)
+                    u['apikeys'][user['apikey_name']] = apikey
 
-        if self.signin_file is None:
-            raise ValueError(f"signin_file is None.")
         if self.logger.level == logging.DEBUG:
             self.logger.debug(f"apikey_add: {user} -> {self.signin_file}")
         common.save_yml(self.signin_file, signin_data)
@@ -679,7 +705,7 @@ class Web:
               ssl_cert:Path=None, ssl_key:Path=None, ssl_keypass:str=None, ssl_ca_certs:Path=None,
               session_domain:str=None, session_path:str='/', session_secure:bool=False, session_timeout:int=900, outputs_key:List[str]=[],
               guvicorn_workers:int=-1, guvicorn_timeout:int=30,
-              agent_runner=None, mcp=None, mcp_listen_port=9081, mcp_ssl_listen_port=9443):
+              agent_runner=None, mcp=None,):
         """
         Webサーバを起動する
 
@@ -700,8 +726,6 @@ class Web:
             guvicorn_timeout (int, optional): Gunicornタイムアウト. Defaults to 30.
             agent_runner (Runner, optional): エージェントランナー. Defaults to None.
             mcp (MCP, optional): MCP. Defaults to None.
-            mcp_listen_port (int, optional): MCPリスンポート. Defaults to 9081.
-            mcp_ssl_listen_port (int, optional): MCP SSLリスンポート. Defaults to 9443.
         """
         self.allow_host = allow_host
         self.listen_port = listen_port
@@ -719,8 +743,6 @@ class Web:
         self.guvicorn_timeout = guvicorn_timeout
         self.agent_runner = agent_runner
         self.mcp = mcp
-        self.mcp_listen_port = mcp_listen_port
-        self.mcp_ssl_listen_port = mcp_ssl_listen_port
         if self.logger.level == logging.DEBUG:
             self.logger.debug(f"web start parameter: allow_host={self.allow_host}")
             self.logger.debug(f"web start parameter: listen_port={self.listen_port}")
@@ -738,8 +760,6 @@ class Web:
             self.logger.debug(f"web start parameter: guvicorn_timeout={self.guvicorn_timeout}")
             self.logger.debug(f"web start parameter: agent_runner={self.agent_runner}")
             self.logger.debug(f"web start parameter: mcp={self.mcp}")
-            self.logger.debug(f"web start parameter: mcp_listen_port={self.mcp_listen_port}")
-            self.logger.debug(f"web start parameter: mcp_ssl_listen_port={self.mcp_ssl_listen_port}")
 
         if self.agent_runner is not None:
             # google.adkが大きいので必要な時にだけ読込む
@@ -778,7 +798,10 @@ class Web:
                     sessions = await session_service.list_sessions(app_name=self.ver.__appid__, user_id=user_id)
                     ret = []
                     for s in sessions.sessions:
-                        ret.append(await session_service.get_session(app_name=self.ver.__appid__, user_id=user_id, session_id=s.id))
+                        session = await session_service.get_session(app_name=self.ver.__appid__, user_id=user_id, session_id=s.id)
+                        if session is None:
+                            continue
+                        ret.append(session)
                     return ret
                 else:
                     session = await session_service.get_session(app_name=self.ver.__appid__, user_id=user_id, session_id=session_id)
@@ -801,17 +824,15 @@ class Web:
                 return await session_service.delete_session(app_name=self.ver.__appid__, user_id=user_id, session_id=session_id)
             self.delete_agent_session = delete_agent_session
 
-        """
+        mcp_app:Starlette = None
         if self.mcp is not None:
-            # MCPをFastAPIにマウント
             mcp_app:Starlette = self.mcp.streamable_http_app()
-            app = FastAPI(lifespan=self.mcp.settings.lifespan)
-            app.mount("/mcp", mcp_app)
-            #app.include_router(mcp_app.router)
+            #mcp_app:Starlette = self.mcp.http_app()
+        if mcp_app is not None:
+            app = FastAPI(lifespan=mcp_app.lifespan)
         else:
             app = FastAPI()
-        """
-        app = FastAPI()
+
         @app.middleware("http")
         async def set_context_cookie(req:Request, call_next):
             res:Response = await call_next(req)
@@ -824,20 +845,13 @@ class Web:
         if self.session_secure:
             mwparam['https_only'] = True # セッションハイジャック対策
         app.add_middleware(SessionMiddleware, **mwparam)
+        if mcp_app is not None:
+            app.mount("/mcpsv", mcp_app, name="mcp")
+            self.logger.info(f"mcp server mount: mount_path=/mcpsv app={mcp_app} routes={mcp_app.routes}")
         self.init_webfeatures(app)
 
         self.is_running = True
-        #uvicorn.run(app, host=self.allow_host, port=self.listen_port, workers=2)
-        http_config = Config(app=app, host=self.allow_host, port=self.listen_port)
-        th = ThreadedUvicorn(self.logger, config=http_config,
-                             guvicorn_config=dict(workers=self.guvicorn_workers, timeout=self.guvicorn_timeout))
-        th.start()
-        if self.mcp is not None and self.ssl_cert is None and self.ssl_key is None:
-            mcp_app:Starlette = self.mcp.streamable_http_app()
-            http_config = Config(app=mcp_app, host=self.allow_host, port=self.mcp_listen_port)
-            mcp_th = ThreadedUvicorn(self.logger, config=http_config, force_uvicorn=True)
-            mcp_th.start()
-        browser_port = self.listen_port
+        th = None
         th_ssl = None
         if self.ssl_cert is not None and self.ssl_key is not None:
             https_config = Config(app=app, host=self.allow_host, port=self.ssl_listen_port,
@@ -847,13 +861,12 @@ class Web:
                                      guvicorn_config=dict(workers=self.guvicorn_workers, timeout=self.guvicorn_timeout))
             th_ssl.start()
             browser_port = self.ssl_listen_port
-            if self.mcp is not None:
-                mcp_app:Starlette = self.mcp.streamable_http_app()
-                https_config = Config(app=mcp_app, host=self.allow_host, port=self.mcp_ssl_listen_port,
-                                      ssl_certfile=self.ssl_cert, ssl_keyfile=self.ssl_key,
-                                      ssl_keyfile_password=self.ssl_keypass, ssl_ca_certs=self.ssl_ca_certs)
-                mcp_th_ssl = ThreadedUvicorn(self.logger, config=https_config, force_uvicorn=True)
-                mcp_th_ssl.start()
+        else:
+            http_config = Config(app=app, host=self.allow_host, port=self.listen_port)
+            th = ThreadedUvicorn(self.logger, config=http_config,
+                                guvicorn_config=dict(workers=self.guvicorn_workers, timeout=self.guvicorn_timeout))
+            th.start()
+            browser_port = self.listen_port
         try:
             if self.gui_mode:
                 webbrowser.open(f'http://localhost:{browser_port}/gui')
@@ -861,21 +874,15 @@ class Web:
                 f.write(str(os.getpid()))
             while self.is_running:
                 gevent.sleep(1)
-            th.stop()
-            if self.mcp is not None:
-                mcp_th.stop()
+            if th is not None:
+                th.stop()
             if th_ssl is not None:
                 th_ssl.stop()
-                if self.mcp is not None:
-                    mcp_th_ssl.stop()
         except KeyboardInterrupt:
-            th.stop()
-            if self.mcp is not None:
-                mcp_th.stop()
+            if th is not None:
+                th.stop()
             if th_ssl is not None:
                 th_ssl.stop()
-                if self.mcp is not None:
-                    mcp_th_ssl.stop()
 
     def stop(self):
         """