glpi-mcp-server 0.1.0__tar.gz

glpi_mcp_server-0.1.0/.dockerignore

@@ -0,0 +1,33 @@
+# Docker ignore file to reduce build context size
+**/__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+*.so
+.git
+.gitignore
+.github
+.vscode
+.idea
+*.md
+!README.md
+.env
+.env.*
+!.env.example
+*.log
+.coverage
+.pytest_cache
+.mypy_cache
+dist/
+build/
+*.egg-info/
+screenshots/
+docker-compose.yml
+Dockerfile*
+*.tar
+*.zip
+.venv/
+venv/
+.ruff_cache/
+.mcpregistry_*

glpi_mcp_server-0.1.0/.env.example

@@ -0,0 +1,123 @@
+# GLPI MCP Server Environment Configuration
+# Needs GLPI 11.0.6+ or 12 with the High-Level API enabled
+# (Setup > General > API) and an OAuth client (Setup > OAuth clients).
+
+# GLPI Connection Details
+# GLPI root URL, without /api.php
+GLPI_URL=https://glpi.example.com
+
+# OAuth client from Setup > OAuth clients (allow the Password grant and the
+# scopes below; also the Authorization Code grant for GLPI_OAUTH_LOGIN)
+GLPI_CLIENT_ID=your-client-id
+GLPI_CLIENT_SECRET=your-client-secret
+
+# GLPI account the tools act as (OAuth password grant)
+GLPI_USERNAME=glpi-mcp
+GLPI_PASSWORD=change-me
+
+# OAuth scopes to request, space- or comma-separated (default: api user)
+# Add graphql to use glpi_graphql_query
+# GLPI_SCOPES=api user
+
+# High-Level API version: auto (default; 3.0 on GLPI 12, 2.3 on GLPI 11), 2.3 or 3.0
+GLPI_API_VERSION=auto
+
+# Optional: entity and profile to work in (GLPI-Entity / GLPI-Profile headers)
+# GLPI_ENTITY=0
+# GLPI_ENTITY_RECURSIVE=true
+# GLPI_PROFILE=4
+
+# SSL Configuration
+GLPI_VERIFY_SSL=true
+# Total seconds allowed for one request, retries included
+GLPI_TIMEOUT=30
+
+# Per-user GLPI access (HTTP transports only; pick at most one)
+# GLPI_TOKEN_PASSTHROUGH: each MCP client sends its own GLPI OAuth access token
+# as 'Authorization: Bearer <token>'; GLPI_USERNAME/GLPI_PASSWORD are not used.
+# GLPI_TOKEN_PASSTHROUGH=false
+# GLPI_OAUTH_LOGIN: MCP clients sign in with their GLPI account through this
+# server (OAuth with Dynamic Client Registration). Register
+# GLPI_OAUTH_BASE_URL + GLPI_OAUTH_REDIRECT_PATH as the OAuth client's
+# redirect URI in GLPI.
+# GLPI_OAUTH_LOGIN=false
+# GLPI_OAUTH_BASE_URL=https://glpi-mcp.example.com
+# GLPI_OAUTH_REDIRECT_PATH=/auth/callback
+# GLPI_OAUTH_ALLOWED_REDIRECT_URIS=
+
+# Read-Only Mode
+# Set READ_ONLY_MODE true to disable all write operations (create, update, delete)
+READ_ONLY_MODE=false
+
+# Dry-Run Mode
+# Set DRY_RUN_MODE true to make write tools return the request they would send
+# instead of changing GLPI
+DRY_RUN_MODE=false
+
+# Disabled Tags
+# Comma-separated list of tags to disable tools for (empty by default)
+# Example: DISABLED_TAGS=assets,knowledgebase,graphql
+DISABLED_TAGS=
+
+# Response Size Limit
+# Maximum size of a tool response in bytes (empty = unlimited)
+# RESPONSE_MAX_SIZE=500000
+
+# Logging Configuration
+LOG_LEVEL=INFO
+
+# Rate Limiting
+# Set RATE_LIMIT_ENABLED true to enable rate limiting
+RATE_LIMIT_ENABLED=false
+RATE_LIMIT_MAX_REQUESTS=60
+RATE_LIMIT_WINDOW_MINUTES=1
+
+# Tool Search Transform (Optional)
+# Set TOOL_SEARCH_ENABLED true to replace full tool listings with search_tools + call_tool
+TOOL_SEARCH_ENABLED=false
+# Search strategy: bm25 (natural language) or regex (pattern match)
+TOOL_SEARCH_STRATEGY=bm25
+# Maximum number of tools returned by search_tools
+TOOL_SEARCH_MAX_RESULTS=5
+
+# Sentry Error Tracking (Optional)
+# Set SENTRY_DSN to enable error tracking and performance monitoring
+# SENTRY_DSN=https://your-key@o12345.ingest.us.sentry.io/6789
+# Optional Sentry configuration
+# SENTRY_TRACES_SAMPLE_RATE=1.0
+# SENTRY_SEND_DEFAULT_PII=false
+# SENTRY_ENVIRONMENT=production
+# SENTRY_RELEASE=1.2.3
+# SENTRY_PROFILE_SESSION_SAMPLE_RATE=1.0
+# SENTRY_PROFILE_LIFECYCLE=trace
+# SENTRY_ENABLE_LOGS=true
+
+# MCP Transport Configuration
+# Transport type: 'stdio' (default), 'sse' (Server-Sent Events), or 'http' (HTTP Streamable)
+# 'streamable-http' is accepted as an alias for 'http'. Any other value stops
+# the server at startup.
+MCP_TRANSPORT=stdio
+
+# HTTP Transport Settings (used when MCP_TRANSPORT=sse or MCP_TRANSPORT=http)
+# Host to bind the HTTP server (default: 127.0.0.1)
+# MCP_HTTP_HOST=127.0.0.1
+# Port to bind the HTTP server (default: 8000)
+# MCP_HTTP_PORT=8000
+# Optional bearer token for authentication (leave empty for no auth)
+# MCP_HTTP_BEARER_TOKEN=
+
+# OIDC / OAuth Authentication (used when MCP_TRANSPORT=sse or MCP_TRANSPORT=http)
+# Lets MCP clients sign in through an external identity provider; tools then
+# act as GLPI_USERNAME. All four are required to enable it; takes precedence
+# over MCP_HTTP_BEARER_TOKEN.
+# OIDC_CONFIG_URL=https://id.example.com/.well-known/openid-configuration
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+# Public URL of this server
+# OIDC_BASE_URL=https://glpi-mcp.example.com
+# Optional OIDC settings
+# OIDC_REDIRECT_PATH=/auth/callback
+# OIDC_REQUIRED_SCOPES=
+# OIDC_ALLOWED_REDIRECT_URIS=
+# OIDC_VERIFY_ID_TOKEN=false
+# OIDC_FORWARD_RESOURCE=false

glpi_mcp_server-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,82 @@
+name: Bug report
+description: Something in glpi-mcp does not work as expected
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Remove tokens, passwords and anything else private from what you paste below.
+        For security issues, use [private vulnerability reporting](https://github.com/mhajder/glpi-mcp/security/advisories/new) instead.
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Include the tool you called and the error or wrong result.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Call tool `...` with arguments `...`
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: glpi-mcp version
+      placeholder: e.g. 0.1.0
+    validations:
+      required: true
+  - type: input
+    id: product-version
+    attributes:
+      label: GLPI version
+      placeholder: "e.g. 11.0.11 (API 2.3) or 12.0.0 (API 3.0)"
+    validations:
+      required: true
+  - type: dropdown
+    id: install
+    attributes:
+      label: Installation method
+      options:
+        - uvx / pip (PyPI)
+        - Docker image (ghcr.io)
+        - From source
+    validations:
+      required: true
+  - type: dropdown
+    id: transport
+    attributes:
+      label: MCP transport
+      options:
+        - stdio
+        - http (Streamable HTTP)
+        - sse
+    validations:
+      required: true
+  - type: input
+    id: client
+    attributes:
+      label: MCP client
+      placeholder: e.g. Claude Desktop, Claude Code, Open WebUI
+  - type: textarea
+    id: config
+    attributes:
+      label: Relevant configuration
+      description: Non-secret settings only, such as READ_ONLY_MODE, DISABLED_TAGS or TOOL_SEARCH_ENABLED. Never paste tokens.
+      render: shell
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Run with LOG_LEVEL=DEBUG if you can, and redact anything private.
+      render: text

glpi_mcp_server-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/mhajder/glpi-mcp/security/advisories/new
+    about: Please report security issues privately, not as a public issue.

glpi_mcp_server-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Suggest a new tool or an improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: What do you want to do with GLPI that the server cannot do today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: For a new tool, describe its name, arguments and what it returns.
+    validations:
+      required: true
+  - type: input
+    id: api
+    attributes:
+      label: GLPI API reference
+      description: Link to the GLPI API endpoint or docs this would use, if you know it.
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

glpi_mcp_server-0.1.0/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      uv-dependencies:
+        dependency-type: "production"
+      uv-dev-dependencies:
+        dependency-type: "development"

glpi_mcp_server-0.1.0/.github/workflows/pre-commit.yml

@@ -0,0 +1,27 @@
+name: Pre-commit Checks
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  prek:
+    name: Run prek
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install the latest version of uv and set the python version
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.15"
+
+      - name: Run prek
+        uses: j178/prek-action@v2

glpi_mcp_server-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,202 @@
+name: Publish
+
+on:
+  push:
+    branches: ["main"]
+    tags:
+      - "v*.*.*"
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  publish-docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # Required to sign the build provenance attestation
+      attestations: write # Required to store the build provenance attestation
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            # Set latest tag for main branch
+            type=raw,value=latest,enable={{is_default_branch}}
+            # Tag with branch name (e.g., main, develop)
+            type=ref,event=branch
+            # Tag with PR number (e.g., pr-2)
+            type=ref,event=pr
+            # Tag with semver - v1.2.3 -> 1.2.3
+            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            # Tag with major.minor - v1.2.3 -> 1.2
+            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            # Tag with major - v1.2.3 -> 1
+            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            # Tag with git sha
+            type=sha,format=short
+
+      - name: Build and push Docker image
+        id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: mode=max
+          sbom: true
+
+      - name: Attest image build provenance
+        if: github.event_name != 'pull_request'
+        uses: actions/attest@v4
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+          # Storage records are only supported for organization-owned repositories
+          create-storage-record: false
+
+  publish-pypi:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/glpi-mcp-server
+    permissions:
+      id-token: write # Mandatory for Trusted Publishing
+      attestations: write # Required to store the build provenance attestation
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Install the latest version of uv and set the python version
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.15"
+
+      - name: Install dependencies
+        run: uv sync --locked --all-extras --no-dev
+
+      - name: Build package
+        run: uv build
+
+      - name: Attest package build provenance
+        id: attest
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/*
+
+      - name: Collect release assets
+        env:
+          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+        run: |
+          mkdir release-assets
+          cp dist/* release-assets/
+          cp "$BUNDLE_PATH" "release-assets/${GITHUB_REPOSITORY#*/}-${GITHUB_REF_NAME#v}.sigstore.json"
+
+      - name: Upload release assets
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-assets
+          path: release-assets/
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  upload-release-assets:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    needs: [publish-pypi]
+    permissions:
+      contents: write # Required to upload assets to the GitHub release
+
+    steps:
+      - name: Download release assets
+        uses: actions/download-artifact@v8
+        with:
+          name: release-assets
+          path: release-assets
+
+      - name: Upload assets to the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # release.yml creates the release in parallel with this workflow
+          for attempt in $(seq 1 10); do
+            if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+              gh release upload "$GITHUB_REF_NAME" release-assets/* --repo "$GITHUB_REPOSITORY" --clobber
+              exit 0
+            fi
+            echo "Release $GITHUB_REF_NAME not found yet, retrying in 15s ($attempt/10)"
+            sleep 15
+          done
+          echo "::error::Release $GITHUB_REF_NAME not found"
+          exit 1
+
+  publish-mcp-registry:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    needs: [publish-pypi, publish-docker]
+    permissions:
+      id-token: write # Required for OIDC authentication
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Install mcp-publisher
+        run: |
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 10 "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+          chmod +x mcp-publisher
+
+      - name: Publish server to MCP Registry
+        run: |
+          max_attempts=5
+          for attempt in $(seq 1 "$max_attempts"); do
+            if ./mcp-publisher login github-oidc; then
+              if output=$(./mcp-publisher publish 2>&1); then
+                echo "$output"
+                exit 0
+              fi
+              echo "$output"
+              # An earlier attempt may have published before its response was lost
+              if grep -q "cannot publish duplicate version" <<< "$output"; then
+                echo "This version is already in the MCP Registry"
+                exit 0
+              fi
+            fi
+            if [ "$attempt" -lt "$max_attempts" ]; then
+              echo "::warning::MCP Registry publish attempt $attempt/$max_attempts failed, retrying in $((attempt * 20))s"
+              sleep $((attempt * 20))
+            fi
+          done
+          echo "::error::MCP Registry publish failed after $max_attempts attempts"
+          exit 1

glpi_mcp_server-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  create-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
+      tag_name: ${{ steps.get_version.outputs.tag_name }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Get version from tag
+        id: get_version
+        run: |
+          echo "tag_name=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
+
+      - name: Build release notes
+        env:
+          TAG: ${{ steps.get_version.outputs.tag_name }}
+          VERSION: ${{ steps.get_version.outputs.version }}
+          IMAGE: ghcr.io/${{ github.repository }}
+        run: |
+          # Same tags as docker/metadata-action in publish.yml: pre-releases only get the full version
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            IMAGE_TAGS="\`$VERSION\`, \`${VERSION%.*}\`, \`${VERSION%%.*}\`"
+          else
+            IMAGE_TAGS="\`$VERSION\`"
+          fi
+          PKG_NAME=$(grep -m1 '^name' pyproject.toml | sed 's/.*= *"\(.*\)"/\1/')
+          CHANGELOG=$(awk -v heading="## $TAG " '
+            index($0, heading) == 1 { flag = 1; next }
+            /^## / { if (flag) exit }
+            flag && (started || NF) { started = 1; print }
+          ' CHANGELOG.md)
+          {
+            echo "## Release $TAG"
+            echo ""
+            echo "### 🐳 Docker Image"
+            echo ""
+            echo "| Image | Tags |"
+            echo "|-------|------|"
+            echo "| \`$IMAGE\` | $IMAGE_TAGS, \`sha-${GITHUB_SHA::7}\` |"
+            echo ""
+            echo "### 🐍 Python Package"
+            echo ""
+            echo "- **Package:** \`$PKG_NAME==$VERSION\`"
+            echo "- **Registry:** [PyPI](https://pypi.org/project/$PKG_NAME/$VERSION/)"
+            echo ""
+            echo "### 📋 Changelog"
+            echo ""
+            echo "${CHANGELOG:-No changelog entry found for this release.}"
+          } > release_notes.md
+          cat release_notes.md
+
+      - name: Create Release
+        id: create_release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ steps.get_version.outputs.tag_name }}
+          name: ${{ steps.get_version.outputs.tag_name }}
+          body_path: release_notes.md
+          prerelease: ${{ contains(steps.get_version.outputs.tag_name, '-') }}