nvidia-nat 1.4.0a20251120__py3-none-any.whl → 1.4.0a20260113__py3-none-any.whl

nat/front_ends/mcp/introspection_token_verifier.py

@@ -1,73 +0,0 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-"""OAuth 2.0 Token Introspection verifier implementation for MCP servers."""
-
-import logging
-
-from mcp.server.auth.provider import AccessToken
-from mcp.server.auth.provider import TokenVerifier
-
-from nat.authentication.credential_validator.bearer_token_validator import BearerTokenValidator
-from nat.authentication.oauth2.oauth2_resource_server_config import OAuth2ResourceServerConfig
-
-logger = logging.getLogger(__name__)
-
-
-class IntrospectionTokenVerifier(TokenVerifier):
-    """Token verifier that delegates token verification to BearerTokenValidator."""
-
-    def __init__(self, config: OAuth2ResourceServerConfig):
-        """Create IntrospectionTokenVerifier from OAuth2ResourceServerConfig.
-
-        Args:
-            config: OAuth2ResourceServerConfig
-        """
-        issuer = config.issuer_url
-        scopes = config.scopes or []
-        audience = config.audience
-        jwks_uri = config.jwks_uri
-        introspection_endpoint = config.introspection_endpoint
-        discovery_url = config.discovery_url
-        client_id = config.client_id
-        client_secret = config.client_secret
-
-        self._bearer_token_validator = BearerTokenValidator(
-            issuer=issuer,
-            audience=audience,
-            scopes=scopes,
-            jwks_uri=jwks_uri,
-            introspection_endpoint=introspection_endpoint,
-            discovery_url=discovery_url,
-            client_id=client_id,
-            client_secret=client_secret,
-        )
-
-    async def verify_token(self, token: str) -> AccessToken | None:
-        """Verify token by delegating to BearerTokenValidator.
-
-        Args:
-            token: The Bearer token to verify
-
-        Returns:
-            AccessToken | None: AccessToken if valid, None if invalid
-        """
-        validation_result = await self._bearer_token_validator.verify(token)
-
-        if validation_result.active:
-            return AccessToken(token=token,
-                               expires_at=validation_result.expires_at,
-                               scopes=validation_result.scopes or [],
-                               client_id=validation_result.client_id or "")
-        return None

nat/front_ends/mcp/mcp_front_end_config.py

@@ -1,109 +0,0 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-import logging
-from typing import Literal
-
-from pydantic import Field
-from pydantic import field_validator
-from pydantic import model_validator
-
-from nat.authentication.oauth2.oauth2_resource_server_config import OAuth2ResourceServerConfig
-from nat.data_models.front_end import FrontEndBaseConfig
-
-logger = logging.getLogger(__name__)
-
-
-class MCPFrontEndConfig(FrontEndBaseConfig, name="mcp"):
-    """MCP front end configuration.
-
-    A simple MCP (Model Context Protocol) front end for NeMo Agent toolkit.
-    """
-
-    name: str = Field(default="NeMo Agent Toolkit MCP",
-                      description="Name of the MCP server (default: NeMo Agent Toolkit MCP)")
-    host: str = Field(default="localhost", description="Host to bind the server to (default: localhost)")
-    port: int = Field(default=9901, description="Port to bind the server to (default: 9901)", ge=0, le=65535)
-    debug: bool = Field(default=False, description="Enable debug mode (default: False)")
-    log_level: str = Field(default="INFO", description="Log level for the MCP server (default: INFO)")
-    tool_names: list[str] = Field(
-        default_factory=list,
-        description="The list of tools MCP server will expose (default: all tools)."
-        "Tool names can be functions or function groups",
-    )
-    transport: Literal["sse", "streamable-http"] = Field(
-        default="streamable-http",
-        description="Transport type for the MCP server (default: streamable-http, backwards compatible with sse)")
-    runner_class: str | None = Field(
-        default=None, description="Custom worker class for handling MCP routes (default: built-in worker)")
-    base_path: str | None = Field(default=None,
-                                  description="Base path to mount the MCP server at (e.g., '/api/v1'). "
-                                  "If specified, the server will be accessible at http://host:port{base_path}/mcp. "
-                                  "If None, server runs at root path /mcp.")
-
-    server_auth: OAuth2ResourceServerConfig | None = Field(
-        default=None, description=("OAuth 2.0 Resource Server configuration for token verification."))
-
-    @field_validator('base_path')
-    @classmethod
-    def validate_base_path(cls, v: str | None) -> str | None:
-        """Validate that base_path starts with '/' and doesn't end with '/'."""
-        if v is not None:
-            if not v.startswith('/'):
-                raise ValueError("base_path must start with '/'")
-            if v.endswith('/'):
-                raise ValueError("base_path must not end with '/'")
-        return v
-
-    # Memory profiling configuration
-    enable_memory_profiling: bool = Field(default=False,
-                                          description="Enable memory profiling and diagnostics (default: False)")
-    memory_profile_interval: int = Field(default=50,
-                                         description="Log memory stats every N requests (default: 50)",
-                                         ge=1)
-    memory_profile_top_n: int = Field(default=10,
-                                      description="Number of top memory allocations to log (default: 10)",
-                                      ge=1,
-                                      le=50)
-    memory_profile_log_level: str = Field(default="DEBUG",
-                                          description="Log level for memory profiling output (default: DEBUG)")
-
-    @model_validator(mode="after")
-    def validate_security_configuration(self):
-        """Validate security configuration to prevent accidental misconfigurations."""
-        # Check if server is bound to a non-localhost interface without authentication
-        localhost_hosts = {"localhost", "127.0.0.1", "::1"}
-        if self.host not in localhost_hosts and self.server_auth is None:
-            logger.warning(
-                "MCP server is configured to bind to '%s' without authentication. "
-                "This may expose your server to unauthorized access. "
-                "Consider either: (1) binding to localhost for local-only access, "
-                "or (2) configuring server_auth for production deployments on public interfaces.",
-                self.host)
-
-        # Check if SSE transport is used (which doesn't support authentication)
-        if self.transport == "sse":
-            if self.server_auth is not None:
-                logger.warning("SSE transport does not support authentication. "
-                               "The configured server_auth will be ignored. "
-                               "For production use with authentication, use 'streamable-http' transport instead.")
-            elif self.host not in localhost_hosts:
-                logger.warning(
-                    "SSE transport does not support authentication and is bound to '%s'. "
-                    "This configuration is not recommended for production use. "
-                    "For production deployments, use 'streamable-http' transport with server_auth configured.",
-                    self.host)
-
-        return self

nat/front_ends/mcp/mcp_front_end_plugin.py

@@ -1,155 +0,0 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-import logging
-import typing
-
-from nat.builder.front_end import FrontEndBase
-from nat.builder.workflow_builder import WorkflowBuilder
-from nat.front_ends.mcp.mcp_front_end_config import MCPFrontEndConfig
-from nat.front_ends.mcp.mcp_front_end_plugin_worker import MCPFrontEndPluginWorkerBase
-
-if typing.TYPE_CHECKING:
-    from mcp.server.fastmcp import FastMCP
-
-logger = logging.getLogger(__name__)
-
-
-class MCPFrontEndPlugin(FrontEndBase[MCPFrontEndConfig]):
-    """MCP front end plugin implementation."""
-
-    def get_worker_class(self) -> type[MCPFrontEndPluginWorkerBase]:
-        """Get the worker class for handling MCP routes."""
-        from nat.front_ends.mcp.mcp_front_end_plugin_worker import MCPFrontEndPluginWorker
-
-        return MCPFrontEndPluginWorker
-
-    @typing.final
-    def get_worker_class_name(self) -> str:
-        """Get the worker class name from configuration or default."""
-        if self.front_end_config.runner_class:
-            return self.front_end_config.runner_class
-
-        worker_class = self.get_worker_class()
-        return f"{worker_class.__module__}.{worker_class.__qualname__}"
-
-    def _get_worker_instance(self):
-        """Get an instance of the worker class."""
-        # Import the worker class dynamically if specified in config
-        if self.front_end_config.runner_class:
-            module_name, class_name = self.front_end_config.runner_class.rsplit(".", 1)
-            import importlib
-            module = importlib.import_module(module_name)
-            worker_class = getattr(module, class_name)
-        else:
-            worker_class = self.get_worker_class()
-
-        return worker_class(self.full_config)
-
-    async def run(self) -> None:
-        """Run the MCP server."""
-        # Build the workflow and add routes using the worker
-        async with WorkflowBuilder.from_config(config=self.full_config) as builder:
-
-            # Get the worker instance
-            worker = self._get_worker_instance()
-
-            # Let the worker create the MCP server (allows plugins to customize)
-            mcp = await worker.create_mcp_server()
-
-            # Add routes through the worker (includes health endpoint and function registration)
-            await worker.add_routes(mcp, builder)
-
-            # Start the MCP server with configurable transport
-            # streamable-http is the default, but users can choose sse if preferred
-            try:
-                # If base_path is configured, mount server at sub-path using FastAPI wrapper
-                if self.front_end_config.base_path:
-                    if self.front_end_config.transport == "sse":
-                        logger.warning(
-                            "base_path is configured but SSE transport does not support mounting at sub-paths. "
-                            "Use streamable-http transport for base_path support.")
-                        logger.info("Starting MCP server with SSE endpoint at /sse")
-                        await mcp.run_sse_async()
-                    else:
-                        full_url = f"http://{self.front_end_config.host}:{self.front_end_config.port}{self.front_end_config.base_path}/mcp"
-                        logger.info(
-                            "Mounting MCP server at %s/mcp on %s:%s",
-                            self.front_end_config.base_path,
-                            self.front_end_config.host,
-                            self.front_end_config.port,
-                        )
-                        logger.info("MCP server URL: %s", full_url)
-                        await self._run_with_mount(mcp)
-                # Standard behavior - run at root path
-                elif self.front_end_config.transport == "sse":
-                    logger.info("Starting MCP server with SSE endpoint at /sse")
-                    await mcp.run_sse_async()
-                else:  # streamable-http
-                    full_url = f"http://{self.front_end_config.host}:{self.front_end_config.port}/mcp"
-                    logger.info("MCP server URL: %s", full_url)
-                    await mcp.run_streamable_http_async()
-            except KeyboardInterrupt:
-                logger.info("MCP server shutdown requested (Ctrl+C). Shutting down gracefully.")
-
-    async def _run_with_mount(self, mcp: "FastMCP") -> None:
-        """Run MCP server mounted at configured base_path using FastAPI wrapper.
-
-        Args:
-            mcp: The FastMCP server instance to mount
-        """
-        import contextlib
-
-        import uvicorn
-        from fastapi import FastAPI
-
-        @contextlib.asynccontextmanager
-        async def lifespan(_app: FastAPI):
-            """Manage MCP server session lifecycle."""
-            logger.info("Starting MCP server session manager...")
-            async with contextlib.AsyncExitStack() as stack:
-                try:
-                    # Initialize the MCP server's session manager
-                    await stack.enter_async_context(mcp.session_manager.run())
-                    logger.info("MCP server session manager started successfully")
-                    yield
-                except Exception as e:
-                    logger.error("Failed to start MCP server session manager: %s", e)
-                    raise
-            logger.info("MCP server session manager stopped")
-
-        # Create a FastAPI wrapper app with lifespan management
-        app = FastAPI(
-            title=self.front_end_config.name,
-            description="MCP server mounted at custom base path",
-            lifespan=lifespan,
-        )
-
-        # Mount the MCP server's ASGI app at the configured base_path
-        app.mount(self.front_end_config.base_path, mcp.streamable_http_app())
-
-        # Allow plugins to add routes to the wrapper app (e.g., OAuth discovery endpoints)
-        worker = self._get_worker_instance()
-        await worker.add_root_level_routes(app, mcp)
-
-        # Configure and start uvicorn server
-        config = uvicorn.Config(
-            app,
-            host=self.front_end_config.host,
-            port=self.front_end_config.port,
-            log_level=self.front_end_config.log_level.lower(),
-        )
-        server = uvicorn.Server(config)
-        await server.serve()