dataquery-sdk 1.2.3__tar.gz → 1.2.5__tar.gz

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/CHANGELOG.md

@@ -51,5 +51,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Pagination models: `items`, `page-size`, and `info` fields, plus the `next_link` property and `get_self_link()` accessor, moved onto the shared `Paginated` mixin; `FileList` is now paginated; list fields default to empty instead of being required so partial/empty envelopes parse cleanly
 - New `APIResponseError` raised when a 2xx response carries an `errors`/`error` envelope (e.g. `498 Unrecognized Page Token`); an `info` `204` "no content" envelope now yields an empty page so pagination stops cleanly, while any other unrecognized body fails loudly
 - Exports: `Paginated`, `Link`, `APIResponseError` are now part of the public API
-
-
+## [1.2.4] - 2026-08-12
+- MCP: `mcp-connect` accepts `--client-id`, `--client-secret` and `--bearer-token` and exports them into the `DATAQUERY_*` environment of the process, so the MCP bridge and the SDK share one credential set instead of each needing its own setup
+## [1.2.5] - 2026-08-21
+- MCP: `mcp-connect --url` is now optional 
+ 
+ 

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dataquery-sdk
-Version: 1.2.3
+Version: 1.2.5
 Summary: Python SDK for DATAQUERY Data API - Query, download, and check availability of economic data files
 Author-email: DATAQUERY SDK Team <dataquery_support@jpmorgan.com>
 Project-URL: Homepage, https://github.com/jpmorganchase/dataquery-sdk
@@ -25,7 +25,7 @@ Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: aiohttp<4.0.0,>=3.10.11
+Requires-Dist: aiohttp<4.0.0,>=3.14.3
 Requires-Dist: pydantic<3.0.0,>=2.0.0
 Requires-Dist: structlog>=23.0.0
 Requires-Dist: python-dotenv>=1.0.0
@@ -46,7 +46,7 @@ Requires-Dist: mkdocs>=1.5.0; extra == "docs"
 Requires-Dist: mkdocs-material>=9.0.0; extra == "docs"
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == "docs"
 Requires-Dist: mike>=1.1.0; extra == "docs"
-Requires-Dist: pymdown-extensions>=10.21.3; extra == "docs"
+Requires-Dist: pymdown-extensions>=11.0.0; extra == "docs"
 Provides-Extra: pandas
 Requires-Dist: pandas>=2.0.0; extra == "pandas"
 Provides-Extra: mcp
@@ -67,7 +67,7 @@ Requires-Dist: fastmcp>=2.14; extra == "all"
 Requires-Dist: pip-audit>=2.7.0; extra == "all"
 Requires-Dist: build>=1.3.0; extra == "all"
 Requires-Dist: urllib3>=2.7.0; extra == "all"
-Requires-Dist: pymdown-extensions>=10.21.3; extra == "all"
+Requires-Dist: pymdown-extensions>=11.0.0; extra == "all"
 Dynamic: license-file
 
 # DataQuery SDK
@@ -98,6 +98,7 @@ built in for both.
 - [Quick start — JSON Data API](#quick-start--json-data-api)
 - [Auto-download (SSE)](#auto-download-sse)
 - [CLI](#cli)
+- [MCP bridge (`mcp-connect`)](#mcp-bridge-mcp-connect)
 - [Configuration](#configuration)
 - [Logging](#logging)
 - [Error handling](#error-handling)
@@ -140,6 +141,9 @@ through one `DataQuery` client — pick the methods that match what you need.
 - **Retry + circuit breaker** — exponential backoff, configurable failure threshold
 - **Sync and async APIs** — every operation has `_async` and sync variants
 - **CLI** — `dataquery groups | files | availability | download | download-group | auth | config`
+- **MCP bridge** — `dataquery mcp-connect` connects any stdio MCP client
+  (Claude Desktop, Claude Code, …) to the remote DataQuery MCP server, minting
+  OAuth tokens for it
 
 ## New here? Three steps to your first download
 
@@ -172,6 +176,9 @@ pip install dataquery-sdk
 # With pandas DataFrame conversion
 pip install "dataquery-sdk[pandas]"
 
+# With the MCP bridge (dataquery mcp-connect)
+pip install "dataquery-sdk[mcp]"
+
 # With dev tooling (ruff, mypy, pytest)
 pip install "dataquery-sdk[dev]"
 ```
@@ -439,8 +446,134 @@ dataquery config template --output .env
 dataquery auth test
 ```
 
-Every subcommand accepts `--env-file PATH` (to point at a non-default `.env`) and
-most accept `--json` for machine-readable output.
+`--env-file PATH` (to point at a non-default `.env`) is a top-level flag, so it
+goes *before* the subcommand: `dataquery --env-file .env.prod groups`. Most
+subcommands accept `--json` for machine-readable output.
+
+## MCP bridge (`mcp-connect`)
+
+`dataquery mcp-connect` connects a desktop MCP client — Claude Desktop, Claude
+Code, or any stdio MCP host — to the remote DataQuery MCP server. It speaks
+stdio to the client and streamable HTTP to the server, stamping every outbound
+request with a fresh OAuth (AuthE) bearer token minted from your `DATAQUERY_*`
+credentials. Tokens are refreshed for the life of the session, and the MCP host
+itself never handles your client secret.
+
+It needs the `mcp` extra:
+
+```bash
+pip install "dataquery-sdk[mcp]"
+```
+
+### Wire it into an MCP client
+
+Add the server to your client's MCP config (`claude_desktop_config.json`,
+`.mcp.json`, or the equivalent for your host):
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+`--save-credentials` copies the credentials it resolved into
+`~/.dataquery/.env` on the first launch (see [Credentials](#credentials)). From
+then on the bridge — and every other SDK call and CLI run on the machine —
+finds them there, so you can drop the `env` block from the config and keep your
+secret out of a file your MCP client reads on every start:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect"]
+    }
+  }
+}
+```
+
+To skip installing anything, run it straight from PyPI with `uvx`:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "uvx",
+      "args": ["--from", "dataquery-sdk[mcp]", "dataquery", "mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+### Endpoint
+
+`--url` is optional. The endpoint resolves as `--url` → `DATAQUERY_MCP_URL` →
+the production server
+`https://api-dataquery.jpmchase.com/research/dataquery-authe/v2/mcp`:
+
+```bash
+# Production (no arguments needed)
+dataquery mcp-connect
+
+# Another environment
+dataquery mcp-connect --url https://host/research/dataquery-authe/v2/mcp
+DATAQUERY_MCP_URL=https://host/research/dataquery-authe/v2/mcp dataquery mcp-connect
+```
+
+### Credentials
+
+Credentials resolve exactly as they do everywhere else in the SDK — flags win,
+then the process environment (what your MCP client exports), then a `.env`,
+then the saved user-level file:
+
+```bash
+# From the environment (recommended)
+dataquery mcp-connect
+
+# From flags — visible in the process list, so avoid on shared machines
+dataquery mcp-connect --client-id ID --client-secret SECRET
+
+# From a non-default .env (top-level flag: before the subcommand)
+dataquery --env-file .env.prod mcp-connect
+
+# Bearer token instead of OAuth
+dataquery mcp-connect --bearer-token TOKEN
+```
+
+Pass `--save-credentials` once and the resolved credentials are written to
+`~/.dataquery/.env` (owner-only `0600` file in a `0700` directory; override the
+directory with `DATAQUERY_CONFIG_DIR`). Every later SDK call and CLI run reads
+that file as a last-resort fallback, so a plain `DataQuery()` in a script
+authenticates with no environment of its own — while shell variables and a
+local `.env` still take precedence over it.
+
+### Flags
+
+| Flag | Default | Purpose |
+|---|---|---|
+| `--url URL` | `DATAQUERY_MCP_URL`, else the PROD endpoint | Remote MCP endpoint |
+| `--name NAME` | `dataquery-mcp` | Proxy server name reported to the MCP client |
+| `--client-id ID` | _(from env)_ | OAuth client ID; exported as `DATAQUERY_CLIENT_ID` |
+| `--client-secret SECRET` | _(from env)_ | OAuth client secret; exported as `DATAQUERY_CLIENT_SECRET` |
+| `--bearer-token TOKEN` | _(from env)_ | Use a bearer token instead of OAuth |
+| `--save-credentials` | off | Also persist the resolved credentials to `~/.dataquery/.env` |
+
+Because stdout carries the JSON-RPC channel, all logging and diagnostics go to
+stderr — look in your MCP client's server log when something fails.
 
 ## Configuration
 
@@ -457,6 +590,16 @@ All environment variables use the `DATAQUERY_` prefix.
 | `DATAQUERY_BEARER_TOKEN` | _(none)_ | Alternative to OAuth |
 | `DATAQUERY_OAUTH_ENABLED` | `true` | Set `false` to use bearer-token mode |
 
+**Endpoints**
+
+| Variable | Default | Notes |
+|---|---|---|
+| `DATAQUERY_BASE_URL` | `https://api-dataquery.jpmchase.com` | Host for both API surfaces |
+| `DATAQUERY_FILES_BASE_URL` | same as `BASE_URL` | Override only if file endpoints live on another host |
+| `DATAQUERY_OAUTH_TOKEN_URL` | `https://authe.jpmorgan.com/as/token.oauth2` | Token endpoint |
+| `DATAQUERY_OAUTH_AUD` | PROD audience | Set to the value provisioned for your client |
+| `DATAQUERY_MCP_URL` | PROD MCP endpoint | Endpoint used by [`mcp-connect`](#mcp-bridge-mcp-connect); `--url` overrides it |
+
 **HTTP / retry / rate limit**
 
 | Variable | Default |
@@ -621,6 +764,17 @@ async with DataQuery() as dq:
   `manager.clear_event_id()` (or `dataquery download --watch --reset-event-id`)
   only when you intentionally want a clean slate.
 
+**MCP client shows the server as failed**
+
+- `The MCP bridge requires the 'mcp' extra` in the server log means `fastmcp`
+  is missing — `pip install "dataquery-sdk[mcp]"`, or use the `uvx` form.
+- MCP hosts usually launch the command with a minimal environment, so a
+  `.env` in your shell's working directory may not be visible. Put the
+  credentials in the server's `env` block, or run `dataquery mcp-connect
+  --save-credentials` once from a terminal where they do resolve.
+- Auth failures surface as `Could not obtain an OAuth token`; verify the same
+  credentials with `dataquery auth test` before debugging the bridge.
+
 ## Date formats
 
 ```python

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/README.md

@@ -26,6 +26,7 @@ built in for both.
 - [Quick start — JSON Data API](#quick-start--json-data-api)
 - [Auto-download (SSE)](#auto-download-sse)
 - [CLI](#cli)
+- [MCP bridge (`mcp-connect`)](#mcp-bridge-mcp-connect)
 - [Configuration](#configuration)
 - [Logging](#logging)
 - [Error handling](#error-handling)
@@ -68,6 +69,9 @@ through one `DataQuery` client — pick the methods that match what you need.
 - **Retry + circuit breaker** — exponential backoff, configurable failure threshold
 - **Sync and async APIs** — every operation has `_async` and sync variants
 - **CLI** — `dataquery groups | files | availability | download | download-group | auth | config`
+- **MCP bridge** — `dataquery mcp-connect` connects any stdio MCP client
+  (Claude Desktop, Claude Code, …) to the remote DataQuery MCP server, minting
+  OAuth tokens for it
 
 ## New here? Three steps to your first download
 
@@ -100,6 +104,9 @@ pip install dataquery-sdk
 # With pandas DataFrame conversion
 pip install "dataquery-sdk[pandas]"
 
+# With the MCP bridge (dataquery mcp-connect)
+pip install "dataquery-sdk[mcp]"
+
 # With dev tooling (ruff, mypy, pytest)
 pip install "dataquery-sdk[dev]"
 ```
@@ -367,8 +374,134 @@ dataquery config template --output .env
 dataquery auth test
 ```
 
-Every subcommand accepts `--env-file PATH` (to point at a non-default `.env`) and
-most accept `--json` for machine-readable output.
+`--env-file PATH` (to point at a non-default `.env`) is a top-level flag, so it
+goes *before* the subcommand: `dataquery --env-file .env.prod groups`. Most
+subcommands accept `--json` for machine-readable output.
+
+## MCP bridge (`mcp-connect`)
+
+`dataquery mcp-connect` connects a desktop MCP client — Claude Desktop, Claude
+Code, or any stdio MCP host — to the remote DataQuery MCP server. It speaks
+stdio to the client and streamable HTTP to the server, stamping every outbound
+request with a fresh OAuth (AuthE) bearer token minted from your `DATAQUERY_*`
+credentials. Tokens are refreshed for the life of the session, and the MCP host
+itself never handles your client secret.
+
+It needs the `mcp` extra:
+
+```bash
+pip install "dataquery-sdk[mcp]"
+```
+
+### Wire it into an MCP client
+
+Add the server to your client's MCP config (`claude_desktop_config.json`,
+`.mcp.json`, or the equivalent for your host):
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+`--save-credentials` copies the credentials it resolved into
+`~/.dataquery/.env` on the first launch (see [Credentials](#credentials)). From
+then on the bridge — and every other SDK call and CLI run on the machine —
+finds them there, so you can drop the `env` block from the config and keep your
+secret out of a file your MCP client reads on every start:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect"]
+    }
+  }
+}
+```
+
+To skip installing anything, run it straight from PyPI with `uvx`:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "uvx",
+      "args": ["--from", "dataquery-sdk[mcp]", "dataquery", "mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+### Endpoint
+
+`--url` is optional. The endpoint resolves as `--url` → `DATAQUERY_MCP_URL` →
+the production server
+`https://api-dataquery.jpmchase.com/research/dataquery-authe/v2/mcp`:
+
+```bash
+# Production (no arguments needed)
+dataquery mcp-connect
+
+# Another environment
+dataquery mcp-connect --url https://host/research/dataquery-authe/v2/mcp
+DATAQUERY_MCP_URL=https://host/research/dataquery-authe/v2/mcp dataquery mcp-connect
+```
+
+### Credentials
+
+Credentials resolve exactly as they do everywhere else in the SDK — flags win,
+then the process environment (what your MCP client exports), then a `.env`,
+then the saved user-level file:
+
+```bash
+# From the environment (recommended)
+dataquery mcp-connect
+
+# From flags — visible in the process list, so avoid on shared machines
+dataquery mcp-connect --client-id ID --client-secret SECRET
+
+# From a non-default .env (top-level flag: before the subcommand)
+dataquery --env-file .env.prod mcp-connect
+
+# Bearer token instead of OAuth
+dataquery mcp-connect --bearer-token TOKEN
+```
+
+Pass `--save-credentials` once and the resolved credentials are written to
+`~/.dataquery/.env` (owner-only `0600` file in a `0700` directory; override the
+directory with `DATAQUERY_CONFIG_DIR`). Every later SDK call and CLI run reads
+that file as a last-resort fallback, so a plain `DataQuery()` in a script
+authenticates with no environment of its own — while shell variables and a
+local `.env` still take precedence over it.
+
+### Flags
+
+| Flag | Default | Purpose |
+|---|---|---|
+| `--url URL` | `DATAQUERY_MCP_URL`, else the PROD endpoint | Remote MCP endpoint |
+| `--name NAME` | `dataquery-mcp` | Proxy server name reported to the MCP client |
+| `--client-id ID` | _(from env)_ | OAuth client ID; exported as `DATAQUERY_CLIENT_ID` |
+| `--client-secret SECRET` | _(from env)_ | OAuth client secret; exported as `DATAQUERY_CLIENT_SECRET` |
+| `--bearer-token TOKEN` | _(from env)_ | Use a bearer token instead of OAuth |
+| `--save-credentials` | off | Also persist the resolved credentials to `~/.dataquery/.env` |
+
+Because stdout carries the JSON-RPC channel, all logging and diagnostics go to
+stderr — look in your MCP client's server log when something fails.
 
 ## Configuration
 
@@ -385,6 +518,16 @@ All environment variables use the `DATAQUERY_` prefix.
 | `DATAQUERY_BEARER_TOKEN` | _(none)_ | Alternative to OAuth |
 | `DATAQUERY_OAUTH_ENABLED` | `true` | Set `false` to use bearer-token mode |
 
+**Endpoints**
+
+| Variable | Default | Notes |
+|---|---|---|
+| `DATAQUERY_BASE_URL` | `https://api-dataquery.jpmchase.com` | Host for both API surfaces |
+| `DATAQUERY_FILES_BASE_URL` | same as `BASE_URL` | Override only if file endpoints live on another host |
+| `DATAQUERY_OAUTH_TOKEN_URL` | `https://authe.jpmorgan.com/as/token.oauth2` | Token endpoint |
+| `DATAQUERY_OAUTH_AUD` | PROD audience | Set to the value provisioned for your client |
+| `DATAQUERY_MCP_URL` | PROD MCP endpoint | Endpoint used by [`mcp-connect`](#mcp-bridge-mcp-connect); `--url` overrides it |
+
 **HTTP / retry / rate limit**
 
 | Variable | Default |
@@ -549,6 +692,17 @@ async with DataQuery() as dq:
   `manager.clear_event_id()` (or `dataquery download --watch --reset-event-id`)
   only when you intentionally want a clean slate.
 
+**MCP client shows the server as failed**
+
+- `The MCP bridge requires the 'mcp' extra` in the server log means `fastmcp`
+  is missing — `pip install "dataquery-sdk[mcp]"`, or use the `uvx` form.
+- MCP hosts usually launch the command with a minimal environment, so a
+  `.env` in your shell's working directory may not be visible. Put the
+  credentials in the server's `env` block, or run `dataquery mcp-connect
+  --save-credentials` once from a terminal where they do resolve.
+- Auth failures surface as `Could not obtain an OAuth token`; verify the same
+  credentials with `dataquery auth test` before debugging the bridge.
+
 ## Date formats
 
 ```python

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/__init__.py

@@ -1,6 +1,6 @@
 """DATAQUERY SDK - Python SDK for DATAQUERY Data API."""
 
-__version__ = "1.2.3"
+__version__ = "1.2.5"
 __author__ = "DATAQUERY SDK Team"
 __email__ = "dataquery_support@jpmorgan.com"
 __license__ = "MIT"

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/cli.py

@@ -3,6 +3,7 @@
 import argparse
 import asyncio
 import json
+import os
 import sys
 from collections.abc import AsyncGenerator
 from pathlib import Path
@@ -80,6 +81,64 @@ def _print_error(message: str, *, suggestion: Optional[str] = None) -> None:
     print(json.dumps(envelope, indent=2))
 
 
+_MCP_CREDENTIAL_FLAGS = (
+    ("client_id", "CLIENT_ID"),
+    ("client_secret", "CLIENT_SECRET"),
+    ("bearer_token", "BEARER_TOKEN"),
+)
+
+# Endpoint settings saved alongside the credentials, so a later DataQuery()
+# mints tokens against the same environment instead of the PROD defaults.
+_MCP_SAVED_SETTINGS = ("BASE_URL", "OAUTH_TOKEN_URL", "OAUTH_AUD")
+
+
+def _export_mcp_credentials(args: argparse.Namespace) -> List[str]:
+    """Export ``mcp-connect`` credential flags into the ``DATAQUERY_*`` process env.
+
+    Flags win over anything already exported, so the rest of this process —
+    the token manager here, and any SDK use later on — resolves them the usual
+    way with no separate environment setup. Returns the unprefixed keys that
+    are actually set afterwards, in save order.
+    """
+    from dataquery.config import EnvConfig
+
+    for attr, env_key in _MCP_CREDENTIAL_FLAGS:
+        value = getattr(args, attr, None)
+        if value:
+            os.environ[f"{EnvConfig.PREFIX}{env_key}"] = value
+
+    keys = [env_key for _, env_key in _MCP_CREDENTIAL_FLAGS] + list(_MCP_SAVED_SETTINGS)
+    # os.environ rather than get_env_var: model defaults must not be persisted
+    # as if the user had chosen them.
+    return [key for key in keys if os.environ.get(f"{EnvConfig.PREFIX}{key}")]
+
+
+def _save_mcp_credentials(keys: List[str]) -> None:
+    """Persist the resolved credentials to the user-level ``.env``.
+
+    Best effort: a failure here is reported but never takes the MCP connection
+    down with it. Messages go to stderr — stdout is the JSON-RPC channel.
+    """
+    from dataquery.config import EnvConfig
+
+    if not any(key in keys for key in ("CLIENT_ID", "CLIENT_SECRET", "BEARER_TOKEN")):
+        print(
+            "--save-credentials: nothing to save; pass --client-id/--client-secret "
+            "or set DATAQUERY_CLIENT_ID/DATAQUERY_CLIENT_SECRET.",
+            file=sys.stderr,
+        )
+        return
+
+    values = {key: os.environ.get(f"{EnvConfig.PREFIX}{key}") for key in keys}
+    try:
+        env_file = EnvConfig.save_user_env(values)
+    except OSError as exc:
+        print(f"--save-credentials: could not write credentials: {exc}", file=sys.stderr)
+        return
+    saved = ", ".join(f"{EnvConfig.PREFIX}{key}" for key in keys)
+    print(f"Saved {saved} to {env_file} (owner-only)", file=sys.stderr)
+
+
 def create_parser() -> argparse.ArgumentParser:
     """Create the top-level CLI parser with subcommands."""
     parser = argparse.ArgumentParser(description="Command Line Interface for the DataQuery SDK")
@@ -294,12 +353,42 @@ def create_parser() -> argparse.ArgumentParser:
             "Bridge a desktop MCP client (stdio) to a remote streamable-HTTP MCP\n"
             "server, authenticating with an OAuth client-credentials (AuthE) token\n"
             "minted from the DATAQUERY_* environment. Point your MCP client's\n"
-            "`command` at:  dataquery mcp-connect --url <MCP_URL>"
+            "`command` at:  dataquery mcp-connect\n"
+            "\n"
+            "The endpoint defaults to the PROD MCP server; override it with --url\n"
+            "or DATAQUERY_MCP_URL to reach a different environment.\n"
+            "\n"
+            "Credentials passed as flags are exported into the DATAQUERY_*\n"
+            "environment of this process; add --save-credentials to also write\n"
+            "them to ~/.dataquery/.env, which every later SDK call picks up so\n"
+            "no environment has to be set up again."
         ),
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
-    p_connect.add_argument("--url", required=True, help="Remote MCP endpoint URL")
+    p_connect.add_argument(
+        "--url",
+        default=None,
+        help="Remote MCP endpoint URL (default: DATAQUERY_MCP_URL, else the PROD MCP endpoint)",
+    )
     p_connect.add_argument("--name", default="dataquery-mcp", help="Proxy server name (default: dataquery-mcp)")
+    p_connect.add_argument("--client-id", default=None, help="OAuth client ID (exported as DATAQUERY_CLIENT_ID)")
+    p_connect.add_argument(
+        "--client-secret",
+        default=None,
+        help="OAuth client secret (exported as DATAQUERY_CLIENT_SECRET); visible in the process list, "
+        "so prefer DATAQUERY_CLIENT_SECRET or --env-file on shared machines",
+    )
+    p_connect.add_argument(
+        "--bearer-token",
+        default=None,
+        help="Bearer token to use instead of OAuth credentials (exported as DATAQUERY_BEARER_TOKEN)",
+    )
+    p_connect.add_argument(
+        "--save-credentials",
+        action="store_true",
+        help="Also save the resolved credentials to ~/.dataquery/.env (owner-only) so later SDK use "
+        "needs no environment variables",
+    )
 
     return parser
 
@@ -735,7 +824,7 @@ async def cmd_mcp_connect(args: argparse.Namespace) -> int:
             "The MCP bridge requires the 'mcp' extra. Install it with:\n"
             "    pip install 'dataquery-sdk[mcp]'\n"
             "or run it directly with:\n"
-            "    uvx --from 'dataquery-sdk[mcp]' dataquery mcp-connect --url <MCP_URL>",
+            "    uvx --from 'dataquery-sdk[mcp]' dataquery mcp-connect",
             file=sys.stderr,
         )
         return 1
@@ -743,7 +832,26 @@ async def cmd_mcp_connect(args: argparse.Namespace) -> int:
     from dataquery.config import EnvConfig
     from dataquery.transport.auth import TokenManager
 
-    config = EnvConfig.create_client_config(env_file=Path(args.env_file) if getattr(args, "env_file", None) else None)
+    if getattr(args, "env_file", None):
+        EnvConfig.load_env_file(Path(args.env_file))
+    # Load saved credentials before exporting, so they too land in the process
+    # env and a re-launch with --save-credentials rewrites them instead of
+    # reporting nothing to save. Loaded last, so it never wins over the above.
+    EnvConfig.load_user_env_file()
+    savable = _export_mcp_credentials(args)
+    if getattr(args, "save_credentials", False):
+        _save_mcp_credentials(savable)
+
+    config = EnvConfig.create_client_config()
+    # --url wins; otherwise DATAQUERY_MCP_URL, and failing that the model
+    # default (PROD). Only an explicitly emptied env var leaves it unset.
+    url = getattr(args, "url", None) or config.mcp_url
+    if not url:
+        print(
+            "No MCP endpoint configured: pass --url or set DATAQUERY_MCP_URL.",
+            file=sys.stderr,
+        )
+        return 1
     token_manager = TokenManager(config)
 
     class _AutheAuth(httpx.Auth):
@@ -760,7 +868,7 @@ async def cmd_mcp_connect(args: argparse.Namespace) -> int:
             request.headers["Authorization"] = header
             yield request
 
-    transport = StreamableHttpTransport(args.url, auth=_AutheAuth())
+    transport = StreamableHttpTransport(url, auth=_AutheAuth())
     proxy = FastMCP.as_proxy(transport, name=args.name)
     await proxy.run_async(transport="stdio", show_banner=False)
     return 0

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/config/env.py

@@ -3,8 +3,9 @@
 from __future__ import annotations
 
 import os
+import re
 from pathlib import Path
-from typing import Any, Dict, Optional, Union, get_args, get_origin
+from typing import Any, Dict, List, Mapping, Optional, Union, get_args, get_origin
 
 from dotenv import load_dotenv
 from pydantic_core import PydanticUndefined
@@ -30,6 +31,37 @@ _SENSITIVE_FIELDS = frozenset(
     }
 )
 
+# User-level config: credentials saved once (e.g. by `dataquery mcp-connect
+# --save-credentials`) and reused by every later SDK call in any process.
+_USER_CONFIG_DIR_ENV = "DATAQUERY_CONFIG_DIR"
+_USER_CONFIG_DIR_DEFAULT = "~/.dataquery"
+_USER_ENV_FILENAME = ".env"
+
+_USER_ENV_HEADER = [
+    "# DataQuery SDK credentials.",
+    "# Written by `dataquery mcp-connect --save-credentials`; loaded as a",
+    "# fallback only, so shell env vars and a local .env still win.",
+    "# Values are read literally: ${VAR} is not expanded here.",
+    "",
+]
+
+_ENV_LINE_RE = re.compile(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=")
+
+# Characters common in ids, secrets and URLs that need no .env quoting.
+_UNQUOTED_EXTRA_CHARS = "._-:/@+~"
+
+
+def _format_env_value(value: str) -> str:
+    """Render a value for a ``.env`` line, quoting only when it needs it."""
+    if value and all(ch.isalnum() or ch in _UNQUOTED_EXTRA_CHARS for ch in value):
+        return value
+    if "'" not in value and "\n" not in value and "\r" not in value:
+        return f"'{value}'"
+    # Escapes keep the entry on a single physical line, which the line-based
+    # merge in ``save_user_env`` depends on.
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"').replace("\n", "\\n").replace("\r", "\\r")
+    return f'"{escaped}"'
+
 
 def _env_name_for(field_name: str) -> str:
     """Project a Pydantic field name to its env-var key (no PREFIX)."""
@@ -76,6 +108,77 @@ class EnvConfig:
         if env_file.exists():
             load_dotenv(env_file)
 
+    @classmethod
+    def user_config_dir(cls) -> Path:
+        """Directory holding user-level SDK config (``$DATAQUERY_CONFIG_DIR`` or ``~/.dataquery``)."""
+        raw = os.getenv(_USER_CONFIG_DIR_ENV) or _USER_CONFIG_DIR_DEFAULT
+        return Path(raw).expanduser()
+
+    @classmethod
+    def user_env_file(cls) -> Path:
+        """Path of the user-level ``.env`` holding saved credentials."""
+        return cls.user_config_dir() / _USER_ENV_FILENAME
+
+    @classmethod
+    def load_user_env_file(cls) -> bool:
+        """Load the user-level ``.env`` as a fallback; never overrides what is already set."""
+        env_file = cls.user_env_file()
+        if not env_file.exists():
+            return False
+        # interpolate=False: values here are literal secrets, and dotenv's
+        # ${VAR} expansion runs after unquoting, so no quoting style escapes it.
+        load_dotenv(env_file, override=False, interpolate=False)
+        return True
+
+    @classmethod
+    def save_user_env(cls, values: Mapping[str, Optional[str]]) -> Path:
+        """Merge ``DATAQUERY_<key>=<value>`` pairs into the user-level ``.env``.
+
+        Keys are unprefixed (``CLIENT_ID``) and empty values are skipped. Lines
+        for a key being saved are rewritten in place, anything else already in
+        the file is preserved, and the file is (re)written owner-readable only.
+        """
+        updates: Dict[str, str] = {}
+        for key, value in values.items():
+            if value:
+                updates[f"{cls.PREFIX}{key}"] = value
+
+        env_file = cls.user_env_file()
+        env_file.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            env_file.parent.chmod(0o700)
+        except OSError:  # pragma: no cover - non-POSIX filesystem
+            pass
+
+        lines: List[str] = []
+        written: set[str] = set()
+        if env_file.exists():
+            for line in env_file.read_text().splitlines():
+                match = _ENV_LINE_RE.match(line)
+                line_key = match.group(1) if match else None
+                if line_key is None or line_key not in updates:
+                    lines.append(line)
+                elif line_key not in written:
+                    lines.append(f"{line_key}={_format_env_value(updates[line_key])}")
+                    written.add(line_key)
+                # else: drop a stale duplicate of a key just rewritten above
+        else:
+            lines.extend(_USER_ENV_HEADER)
+
+        for key, value in updates.items():
+            if key not in written:
+                lines.append(f"{key}={_format_env_value(value)}")
+
+        # O_CREAT mode only applies to new files, so chmod covers the rest.
+        fd = os.open(env_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "w") as handle:
+            handle.write("\n".join(lines) + "\n")
+        try:
+            env_file.chmod(0o600)
+        except OSError:  # pragma: no cover - non-POSIX filesystem
+            pass
+        return env_file
+
     @classmethod
     def get_env_var(cls, key: str, default: Optional[str] = None) -> Optional[str]:
         """Read ``$DATAQUERY_<key>`` with the model default as the fallback."""
@@ -132,6 +235,11 @@ class EnvConfig:
         if env_file is not None:
             cls.load_env_file(env_file)
 
+        # Lowest precedence, loaded last so it fills only what is still unset:
+        # credentials saved by `mcp-connect --save-credentials`, which let a
+        # later DataQuery() authenticate with no environment of its own.
+        cls.load_user_env_file()
+
         if not cls.get_env_var("BASE_URL"):
             raise ConfigurationError(f"{cls.PREFIX}BASE_URL environment variable is required")
 

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/core/client.py

@@ -290,6 +290,7 @@ class DataQueryClient(
                     "User-Agent": f"DATAQUERY-SDK/{version}",
                     "Connection": "keep-alive",
                     "Accept-Encoding": "gzip, deflate",
+                    **self.config.get_custom_headers(),
                 },
                 "auto_decompress": True,
                 "raise_for_status": False,

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/mcp_proxy.py

@@ -212,10 +212,20 @@ def _emit_stdout(message: Dict[str, Any]) -> None:
     sys.stdout.flush()
 
 
-async def run_mcp_proxy(url: str, env_file: Optional[Path] = None) -> int:
-    """Run the stdio <-> Streamable HTTP proxy until stdin closes."""
+async def run_mcp_proxy(url: Optional[str] = None, env_file: Optional[Path] = None) -> int:
+    """Run the stdio <-> Streamable HTTP proxy until stdin closes.
+
+    ``url`` defaults to ``DATAQUERY_MCP_URL``, and failing that to the PROD MCP
+    endpoint carried by :class:`ClientConfig`.
+    """
     _configure_stderr_logging()
     try:
+        if env_file is not None:
+            EnvConfig.load_env_file(env_file)
+        EnvConfig.load_user_env_file()
+        url = url or EnvConfig.get_env_var("MCP_URL")
+        if not url:
+            raise ConfigurationError("No MCP endpoint configured: pass a url or set DATAQUERY_MCP_URL")
         oauth = _build_oauth_manager(url, env_file)
         await oauth.authenticate()
     except (ConfigurationError, AuthenticationError) as exc:

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/sse/client.py

@@ -157,6 +157,7 @@ class SSEClient:
     async def _get_headers(self) -> dict:
         headers = await self.auth_manager.get_headers()
         headers["Accept"] = "text/event-stream"
+        headers.update(self.config.get_custom_headers())
         if self._last_event_id is not None:
             headers["Last-Event-ID"] = self._last_event_id
         return headers

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/types/models.py

@@ -51,6 +51,10 @@ class ClientConfig(BaseModel):
     )
     context_path: Optional[str] = Field(default="/research/dataquery-authe/api/v2", description="API context path")
     api_version: str = Field(default="2.0.0", description="API version")
+    x_user_agent: Optional[str] = Field(
+        default=None,
+        description="Optional value for the X-User-Agent header sent on each API request",
+    )
     files_base_url: Optional[str] = Field(
         default="https://api-dataquery.jpmchase.com",
         description="Separate base URL for file endpoints",
@@ -59,6 +63,10 @@ class ClientConfig(BaseModel):
         default="/research/dataquery-authe/api/v2",
         description="Context path for the files host",
     )
+    mcp_url: Optional[str] = Field(
+        default="https://api-dataquery.jpmchase.com/research/dataquery-authe/v2/mcp",
+        description="Remote MCP endpoint bridged by `dataquery mcp-connect`",
+    )
 
     oauth_enabled: bool = Field(default=True, description="Enable OAuth authentication")
     oauth_token_url: Optional[str] = Field(
@@ -242,6 +250,13 @@ class ClientConfig(BaseModel):
             kwargs["proxy_headers"] = {"Proxy-Authorization": f"Basic {token}"}
         return kwargs
 
+    def get_custom_headers(self) -> Dict[str, str]:
+        """Return extra headers to attach to every API request (e.g. X-User-Agent)."""
+        headers: Dict[str, str] = {}
+        if self.x_user_agent:
+            headers["X-User-Agent"] = self.x_user_agent
+        return headers
+
     @property
     def api_base_url(self) -> str:
         """Get the complete API base URL including context path."""

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery/utils.py

@@ -52,6 +52,10 @@ DATAQUERY_BASE_URL=https://api-dataquery.jpmchase.com
 # DATAQUERY_FILES_BASE_URL=https://api-dataquery.jpmchase.com
 # DATAQUERY_FILES_CONTEXT_PATH=/research/dataquery-authe/api/v2
 
+# Optional: remote MCP endpoint bridged by `dataquery mcp-connect`
+# Defaults to the PROD endpoint below; override for another environment.
+# DATAQUERY_MCP_URL=https://api-dataquery.jpmchase.com/research/dataquery-authe/v2/mcp
+
 # =============================================================================
 # AUTHENTICATION: OAuth 2.0 Configuration (Recommended)
 # =============================================================================
@@ -171,6 +175,9 @@ DATAQUERY_DEFAULT_DIR=files
 # Default: DATAQUERY-SDK/1.2.1
 DATAQUERY_USER_AGENT=DATAQUERY-SDK/1.2.1
 
+# Optional custom X-User-Agent header sent on every API request
+# DATAQUERY_X_USER_AGENT=MyApp/1.0
+
 # Enable HTTP/2 support (true/false)
 # Default: true
 DATAQUERY_ENABLE_HTTP2=true

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dataquery-sdk
-Version: 1.2.3
+Version: 1.2.5
 Summary: Python SDK for DATAQUERY Data API - Query, download, and check availability of economic data files
 Author-email: DATAQUERY SDK Team <dataquery_support@jpmorgan.com>
 Project-URL: Homepage, https://github.com/jpmorganchase/dataquery-sdk
@@ -25,7 +25,7 @@ Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: aiohttp<4.0.0,>=3.10.11
+Requires-Dist: aiohttp<4.0.0,>=3.14.3
 Requires-Dist: pydantic<3.0.0,>=2.0.0
 Requires-Dist: structlog>=23.0.0
 Requires-Dist: python-dotenv>=1.0.0
@@ -46,7 +46,7 @@ Requires-Dist: mkdocs>=1.5.0; extra == "docs"
 Requires-Dist: mkdocs-material>=9.0.0; extra == "docs"
 Requires-Dist: mkdocstrings[python]>=0.24.0; extra == "docs"
 Requires-Dist: mike>=1.1.0; extra == "docs"
-Requires-Dist: pymdown-extensions>=10.21.3; extra == "docs"
+Requires-Dist: pymdown-extensions>=11.0.0; extra == "docs"
 Provides-Extra: pandas
 Requires-Dist: pandas>=2.0.0; extra == "pandas"
 Provides-Extra: mcp
@@ -67,7 +67,7 @@ Requires-Dist: fastmcp>=2.14; extra == "all"
 Requires-Dist: pip-audit>=2.7.0; extra == "all"
 Requires-Dist: build>=1.3.0; extra == "all"
 Requires-Dist: urllib3>=2.7.0; extra == "all"
-Requires-Dist: pymdown-extensions>=10.21.3; extra == "all"
+Requires-Dist: pymdown-extensions>=11.0.0; extra == "all"
 Dynamic: license-file
 
 # DataQuery SDK
@@ -98,6 +98,7 @@ built in for both.
 - [Quick start — JSON Data API](#quick-start--json-data-api)
 - [Auto-download (SSE)](#auto-download-sse)
 - [CLI](#cli)
+- [MCP bridge (`mcp-connect`)](#mcp-bridge-mcp-connect)
 - [Configuration](#configuration)
 - [Logging](#logging)
 - [Error handling](#error-handling)
@@ -140,6 +141,9 @@ through one `DataQuery` client — pick the methods that match what you need.
 - **Retry + circuit breaker** — exponential backoff, configurable failure threshold
 - **Sync and async APIs** — every operation has `_async` and sync variants
 - **CLI** — `dataquery groups | files | availability | download | download-group | auth | config`
+- **MCP bridge** — `dataquery mcp-connect` connects any stdio MCP client
+  (Claude Desktop, Claude Code, …) to the remote DataQuery MCP server, minting
+  OAuth tokens for it
 
 ## New here? Three steps to your first download
 
@@ -172,6 +176,9 @@ pip install dataquery-sdk
 # With pandas DataFrame conversion
 pip install "dataquery-sdk[pandas]"
 
+# With the MCP bridge (dataquery mcp-connect)
+pip install "dataquery-sdk[mcp]"
+
 # With dev tooling (ruff, mypy, pytest)
 pip install "dataquery-sdk[dev]"
 ```
@@ -439,8 +446,134 @@ dataquery config template --output .env
 dataquery auth test
 ```
 
-Every subcommand accepts `--env-file PATH` (to point at a non-default `.env`) and
-most accept `--json` for machine-readable output.
+`--env-file PATH` (to point at a non-default `.env`) is a top-level flag, so it
+goes *before* the subcommand: `dataquery --env-file .env.prod groups`. Most
+subcommands accept `--json` for machine-readable output.
+
+## MCP bridge (`mcp-connect`)
+
+`dataquery mcp-connect` connects a desktop MCP client — Claude Desktop, Claude
+Code, or any stdio MCP host — to the remote DataQuery MCP server. It speaks
+stdio to the client and streamable HTTP to the server, stamping every outbound
+request with a fresh OAuth (AuthE) bearer token minted from your `DATAQUERY_*`
+credentials. Tokens are refreshed for the life of the session, and the MCP host
+itself never handles your client secret.
+
+It needs the `mcp` extra:
+
+```bash
+pip install "dataquery-sdk[mcp]"
+```
+
+### Wire it into an MCP client
+
+Add the server to your client's MCP config (`claude_desktop_config.json`,
+`.mcp.json`, or the equivalent for your host):
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+`--save-credentials` copies the credentials it resolved into
+`~/.dataquery/.env` on the first launch (see [Credentials](#credentials)). From
+then on the bridge — and every other SDK call and CLI run on the machine —
+finds them there, so you can drop the `env` block from the config and keep your
+secret out of a file your MCP client reads on every start:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "dataquery",
+      "args": ["mcp-connect"]
+    }
+  }
+}
+```
+
+To skip installing anything, run it straight from PyPI with `uvx`:
+
+```json
+{
+  "mcpServers": {
+    "dataquery": {
+      "command": "uvx",
+      "args": ["--from", "dataquery-sdk[mcp]", "dataquery", "mcp-connect", "--save-credentials"],
+      "env": {
+        "DATAQUERY_CLIENT_ID": "your_client_id",
+        "DATAQUERY_CLIENT_SECRET": "your_client_secret"
+      }
+    }
+  }
+}
+```
+
+### Endpoint
+
+`--url` is optional. The endpoint resolves as `--url` → `DATAQUERY_MCP_URL` →
+the production server
+`https://api-dataquery.jpmchase.com/research/dataquery-authe/v2/mcp`:
+
+```bash
+# Production (no arguments needed)
+dataquery mcp-connect
+
+# Another environment
+dataquery mcp-connect --url https://host/research/dataquery-authe/v2/mcp
+DATAQUERY_MCP_URL=https://host/research/dataquery-authe/v2/mcp dataquery mcp-connect
+```
+
+### Credentials
+
+Credentials resolve exactly as they do everywhere else in the SDK — flags win,
+then the process environment (what your MCP client exports), then a `.env`,
+then the saved user-level file:
+
+```bash
+# From the environment (recommended)
+dataquery mcp-connect
+
+# From flags — visible in the process list, so avoid on shared machines
+dataquery mcp-connect --client-id ID --client-secret SECRET
+
+# From a non-default .env (top-level flag: before the subcommand)
+dataquery --env-file .env.prod mcp-connect
+
+# Bearer token instead of OAuth
+dataquery mcp-connect --bearer-token TOKEN
+```
+
+Pass `--save-credentials` once and the resolved credentials are written to
+`~/.dataquery/.env` (owner-only `0600` file in a `0700` directory; override the
+directory with `DATAQUERY_CONFIG_DIR`). Every later SDK call and CLI run reads
+that file as a last-resort fallback, so a plain `DataQuery()` in a script
+authenticates with no environment of its own — while shell variables and a
+local `.env` still take precedence over it.
+
+### Flags
+
+| Flag | Default | Purpose |
+|---|---|---|
+| `--url URL` | `DATAQUERY_MCP_URL`, else the PROD endpoint | Remote MCP endpoint |
+| `--name NAME` | `dataquery-mcp` | Proxy server name reported to the MCP client |
+| `--client-id ID` | _(from env)_ | OAuth client ID; exported as `DATAQUERY_CLIENT_ID` |
+| `--client-secret SECRET` | _(from env)_ | OAuth client secret; exported as `DATAQUERY_CLIENT_SECRET` |
+| `--bearer-token TOKEN` | _(from env)_ | Use a bearer token instead of OAuth |
+| `--save-credentials` | off | Also persist the resolved credentials to `~/.dataquery/.env` |
+
+Because stdout carries the JSON-RPC channel, all logging and diagnostics go to
+stderr — look in your MCP client's server log when something fails.
 
 ## Configuration
 
@@ -457,6 +590,16 @@ All environment variables use the `DATAQUERY_` prefix.
 | `DATAQUERY_BEARER_TOKEN` | _(none)_ | Alternative to OAuth |
 | `DATAQUERY_OAUTH_ENABLED` | `true` | Set `false` to use bearer-token mode |
 
+**Endpoints**
+
+| Variable | Default | Notes |
+|---|---|---|
+| `DATAQUERY_BASE_URL` | `https://api-dataquery.jpmchase.com` | Host for both API surfaces |
+| `DATAQUERY_FILES_BASE_URL` | same as `BASE_URL` | Override only if file endpoints live on another host |
+| `DATAQUERY_OAUTH_TOKEN_URL` | `https://authe.jpmorgan.com/as/token.oauth2` | Token endpoint |
+| `DATAQUERY_OAUTH_AUD` | PROD audience | Set to the value provisioned for your client |
+| `DATAQUERY_MCP_URL` | PROD MCP endpoint | Endpoint used by [`mcp-connect`](#mcp-bridge-mcp-connect); `--url` overrides it |
+
 **HTTP / retry / rate limit**
 
 | Variable | Default |
@@ -621,6 +764,17 @@ async with DataQuery() as dq:
   `manager.clear_event_id()` (or `dataquery download --watch --reset-event-id`)
   only when you intentionally want a clean slate.
 
+**MCP client shows the server as failed**
+
+- `The MCP bridge requires the 'mcp' extra` in the server log means `fastmcp`
+  is missing — `pip install "dataquery-sdk[mcp]"`, or use the `uvx` form.
+- MCP hosts usually launch the command with a minimal environment, so a
+  `.env` in your shell's working directory may not be visible. Put the
+  credentials in the server's `env` block, or run `dataquery mcp-connect
+  --save-credentials` once from a terminal where they do resolve.
+- Auth failures surface as `Could not obtain an OAuth token`; verify the same
+  credentials with `dataquery auth test` before debugging the bridge.
+
 ## Date formats
 
 ```python

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/dataquery_sdk.egg-info/requires.txt

@@ -1,4 +1,4 @@
-aiohttp<4.0.0,>=3.10.11
+aiohttp<4.0.0,>=3.14.3
 pydantic<3.0.0,>=2.0.0
 structlog>=23.0.0
 python-dotenv>=1.0.0
@@ -20,7 +20,7 @@ fastmcp>=2.14
 pip-audit>=2.7.0
 build>=1.3.0
 urllib3>=2.7.0
-pymdown-extensions>=10.21.3
+pymdown-extensions>=11.0.0
 
 [dev]
 pytest>=7.0.0
@@ -39,7 +39,7 @@ mkdocs>=1.5.0
 mkdocs-material>=9.0.0
 mkdocstrings[python]>=0.24.0
 mike>=1.1.0
-pymdown-extensions>=10.21.3
+pymdown-extensions>=11.0.0
 
 [mcp]
 fastmcp>=2.14

{dataquery_sdk-1.2.3 → dataquery_sdk-1.2.5}/pyproject.toml

@@ -27,7 +27,7 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP :: Dynamic Content",
 ]
 dependencies = [
-    "aiohttp>=3.10.11,<4.0.0",
+    "aiohttp>=3.14.3,<4.0.0",
     "pydantic>=2.0.0,<3.0.0",
     "structlog>=23.0.0",
     "python-dotenv>=1.0.0",
@@ -71,7 +71,7 @@ docs = [
     "mkdocs-material>=9.0.0",
     "mkdocstrings[python]>=0.24.0",
     "mike>=1.1.0",
-    "pymdown-extensions>=10.21.3",
+    "pymdown-extensions>=11.0.0",
 ]
 pandas = [
     "pandas>=2.0.0",
@@ -95,7 +95,7 @@ all = [
     "pip-audit>=2.7.0",
     "build>=1.3.0",
     "urllib3>=2.7.0",
-    "pymdown-extensions>=10.21.3",
+    "pymdown-extensions>=11.0.0",
 ]
 
 [project.scripts]
@@ -210,5 +210,5 @@ dev = [
     "mypy>=1.17.1",
     "pytest>=8.4.2",
     "urllib3>=2.7.0",
-    "pymdown-extensions>=10.21.3",
+    "pymdown-extensions>=11.0.0",
 ]