tempura-client 0.1.0__tar.gz

tempura_client-0.1.0/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: tempura-client
+Version: 0.1.0
+Summary: MCP client that vends short-term AWS credentials via stdio transport
+License: MIT
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: mcp[cli]
+Requires-Dist: httpx
+
+# tempura-client
+
+A lightweight MCP (Model Context Protocol) client that vends short-term AWS
+credentials via stdio transport.
+
+## Installation
+
+```bash
+pip install tempura-client
+```
+
+## Usage
+
+The package provides a `tempura-client` command that communicates over
+stdin/stdout using the MCP JSON-RPC protocol. It is designed to be launched
+by an MCP-aware agent or host application.
+
+```bash
+tempura-client
+```
+
+## Dependencies
+
+- `mcp[cli]` - Model Context Protocol SDK
+- `httpx` - HTTP client for forwarding requests to the remote server

tempura_client-0.1.0/README.md

@@ -0,0 +1,25 @@
+# tempura-client
+
+A lightweight MCP (Model Context Protocol) client that vends short-term AWS
+credentials via stdio transport.
+
+## Installation
+
+```bash
+pip install tempura-client
+```
+
+## Usage
+
+The package provides a `tempura-client` command that communicates over
+stdin/stdout using the MCP JSON-RPC protocol. It is designed to be launched
+by an MCP-aware agent or host application.
+
+```bash
+tempura-client
+```
+
+## Dependencies
+
+- `mcp[cli]` - Model Context Protocol SDK
+- `httpx` - HTTP client for forwarding requests to the remote server

tempura_client-0.1.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tempura-client"
+version = "0.1.0"
+description = "MCP client that vends short-term AWS credentials via stdio transport"
+readme = "README.md"
+requires-python = ">=3.12"
+license = {text = "MIT"}
+dependencies = [
+    "mcp[cli]",
+    "httpx",
+]
+
+[project.scripts]
+tempura-client = "tempura_client.app:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["tempura_client*", "tempura_shared*"]

tempura_client-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tempura_client-0.1.0/src/tempura_client/__init__.py

@@ -0,0 +1,6 @@
+"""Tempura MCP Client.
+
+A local MCP proxy that forwards get_credentials requests to
+the deployed Tempura Server over HTTPS and persists temporary
+credentials to the host AWS credentials file.
+"""

tempura_client-0.1.0/src/tempura_client/__main__.py

@@ -0,0 +1,8 @@
+"""Entry point for running the MCP Client proxy.
+
+Usage: python -m tempura_client
+"""
+
+from tempura_client.app import main
+
+main()

tempura_client-0.1.0/src/tempura_client/app.py

@@ -0,0 +1,12 @@
+"""Application entry point for the Tempura MCP Client.
+
+Provides main() as the console-script target so that the client
+can be launched via ``tempura-client`` or ``python -m tempura_client``.
+"""
+
+
+def main() -> None:
+    """Start the Tempura MCP Client stdio server."""
+    from tempura_client.server import mcp
+
+    mcp.run()

tempura_client-0.1.0/src/tempura_client/config.py

@@ -0,0 +1,61 @@
+"""Client configuration loader.
+
+Reads required environment variables and returns a typed config object.
+Raises ConfigError if any required variable is missing or empty.
+
+Requirements: 4.1, 4.2, 4.4, 4.5
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+
+
+class ConfigError(Exception):
+    """Raised when required client configuration is missing or invalid."""
+
+
+@dataclass(frozen=True)
+class ClientConfig:
+    """Immutable container for client configuration.
+
+    Fields:
+        api_key: The API Gateway API key value (from TEMPURA_API_KEY).
+        endpoint: The Server endpoint URL (from TEMPURA_ENDPOINT).
+    """
+
+    api_key: str
+    endpoint: str
+
+
+def load_config() -> ClientConfig:
+    """Load client configuration from environment variables.
+
+    Reads TEMPURA_API_KEY and TEMPURA_ENDPOINT from the process
+    environment. Raises ConfigError with a clear message identifying
+    the missing variable if either is unset or empty.
+
+    Returns:
+        ClientConfig with the validated values.
+
+    Raises:
+        ConfigError: If TEMPURA_API_KEY or TEMPURA_ENDPOINT is
+            missing or empty.
+    """
+    api_key = os.environ.get("TEMPURA_API_KEY", "")
+    if not api_key:
+        raise ConfigError(
+            "TEMPURA_API_KEY environment variable is required but "
+            "not set or empty. Set it to your API Gateway API key."
+        )
+
+    endpoint = os.environ.get("TEMPURA_ENDPOINT", "")
+    if not endpoint:
+        raise ConfigError(
+            "TEMPURA_ENDPOINT environment variable is required but "
+            "not set or empty. Set it to the Tempura Server URL "
+            "(e.g. https://<api-id>.execute-api.<region>.amazonaws.com/prod/mcp)."
+        )
+
+    return ClientConfig(api_key=api_key, endpoint=endpoint)

tempura_client-0.1.0/src/tempura_client/remote.py

@@ -0,0 +1,120 @@
+"""Remote HTTP forwarder for the Tempura Client.
+
+POSTs a plain JSON request to the deployed Tempura Server REST API
+with the x-api-key header, parses the JSON response, and returns
+credential fields. Never logs or surfaces the API key.
+
+Requirements: 3.1, 3.2, 3.3, 3.4, 4.3, 4.6, 6.1, 6.2, 6.3, 6.4, 6.6
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import httpx
+
+
+class RemoteError(Exception):
+    """Raised when the Server returns an error or is unreachable."""
+
+
+@dataclass(frozen=True)
+class VendResult:
+    """Immutable container for credentials returned by the Server.
+
+    Fields:
+        access_key_id: AWS access key ID.
+        secret_access_key: AWS secret access key.
+        session_token: AWS session token.
+        expiration: ISO-8601 expiration timestamp.
+    """
+
+    access_key_id: str
+    secret_access_key: str
+    session_token: str
+    expiration: str
+
+
+def vend(account_id: str, api_key: str, endpoint: str) -> VendResult:
+    """Forward a get_credentials request to the Tempura Server.
+
+    Sends a plain JSON POST to the Server endpoint with x-api-key
+    authentication. Maps HTTP status codes and Server error responses
+    to RemoteError. Never includes the API key in any exception.
+
+    Args:
+        account_id: Validated 12-digit AWS account ID.
+        api_key: API Gateway key value (never logged/returned).
+        endpoint: Server HTTPS URL.
+
+    Returns:
+        VendResult with temporary credential fields.
+
+    Raises:
+        RemoteError: On authentication failure, rate limiting,
+            connectivity issues, or Server-reported errors.
+    """
+    headers = {
+        "x-api-key": api_key,
+        "Content-Type": "application/json",
+    }
+    body = {"account_id": account_id}
+
+    try:
+        response = httpx.post(
+            endpoint,
+            headers=headers,
+            json=body,
+            timeout=30.0,
+        )
+    except httpx.TimeoutException:
+        raise RemoteError(
+            "Connection timed out reaching the Tempura Server. "
+            "Check that TEMPURA_ENDPOINT is correct and the "
+            "Server is reachable."
+        )
+    except httpx.ConnectError:
+        raise RemoteError(
+            "Unable to connect to the Tempura Server. "
+            "Check that TEMPURA_ENDPOINT is correct and the "
+            "Server is reachable."
+        )
+    except httpx.HTTPError:
+        raise RemoteError(
+            "Connectivity error reaching the Tempura Server. "
+            "Check that TEMPURA_ENDPOINT is correct and the "
+            "Server is reachable."
+        )
+
+    if response.status_code == 400:
+        data = response.json()
+        raise RemoteError(data.get("error", "Bad request"))
+
+    if response.status_code == 403:
+        raise RemoteError(
+            "Authentication failed. Verify that your "
+            "TEMPURA_API_KEY is valid and active."
+        )
+
+    if response.status_code == 429:
+        raise RemoteError(
+            "Rate limited by the Tempura Server. " "Please wait and try again."
+        )
+
+    if response.status_code == 500:
+        data = response.json()
+        raise RemoteError(data.get("error", "Server error"))
+
+    if response.status_code != 200:
+        raise RemoteError(
+            f"Unexpected response from the Tempura Server "
+            f"(HTTP {response.status_code})."
+        )
+
+    creds = response.json()
+    return VendResult(
+        access_key_id=creds["access_key_id"],
+        secret_access_key=creds["secret_access_key"],
+        session_token=creds["session_token"],
+        expiration=creds["expiration"],
+    )

tempura_client-0.1.0/src/tempura_client/server.py

@@ -0,0 +1,81 @@
+"""MCP Client proxy server.
+
+Registers the get_credentials proxy tool over stdio transport.
+Validates account_id locally, loads config, forwards to the remote
+Server, and persists credentials to the host credentials file.
+
+Requirements: 2.1, 2.2, 2.3, 2.5, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 6.5
+"""
+
+from __future__ import annotations
+
+import os
+
+from mcp.server.fastmcp import FastMCP
+
+from tempura_shared.credentials_file import write_profile
+from tempura_shared.validators import validate_account_id
+from tempura_client.config import ConfigError, load_config
+from tempura_client.remote import RemoteError, vend
+
+mcp = FastMCP("tempura-client")
+
+_TARGET_PROFILE: str = "TargetReadOnly"
+_CREDENTIALS_PATH: str = os.path.join(os.path.expanduser("~"), ".aws", "credentials")
+
+
+@mcp.tool()
+def get_credentials(account_id: str) -> dict:
+    """Get short-term AWS credentials for a target account.
+
+    Validates the account_id locally, forwards the request to the
+    deployed Tempura Server over HTTPS, and writes the returned
+    temporary credentials to the [TargetReadOnly] profile in
+    ~/.aws/credentials.
+
+    Args:
+        account_id: 12-digit AWS account identifier.
+
+    Returns:
+        Dictionary with status, profile, and expiration on success,
+        or {"error": "..."} on failure. Never echoes the secret
+        access key.
+    """
+    # Step 1: Validate account_id before any remote call
+    try:
+        validated_id = validate_account_id(account_id)
+    except ValueError as exc:
+        return {"error": str(exc)}
+
+    # Step 2: Load config; fail fast if missing
+    try:
+        config = load_config()
+    except ConfigError as exc:
+        return {"error": str(exc)}
+
+    # Step 3: Forward to the remote Server
+    try:
+        creds = vend(validated_id, config.api_key, config.endpoint)
+    except RemoteError as exc:
+        return {"error": str(exc)}
+
+    # Step 4: Write credentials to the host file
+    try:
+        write_profile(
+            profile_name=_TARGET_PROFILE,
+            access_key_id=creds.access_key_id,
+            secret_access_key=creds.secret_access_key,
+            session_token=creds.session_token,
+            credentials_path=_CREDENTIALS_PATH,
+        )
+    except PermissionError as exc:
+        return {"error": str(exc)}
+    except OSError as exc:
+        return {"error": f"Failed to write credentials: {exc}"}
+
+    # Step 5: Return success without echoing the secret
+    return {
+        "status": "written",
+        "profile": _TARGET_PROFILE,
+        "expiration": creds.expiration,
+    }

tempura_client-0.1.0/src/tempura_client.egg-info/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: tempura-client
+Version: 0.1.0
+Summary: MCP client that vends short-term AWS credentials via stdio transport
+License: MIT
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: mcp[cli]
+Requires-Dist: httpx
+
+# tempura-client
+
+A lightweight MCP (Model Context Protocol) client that vends short-term AWS
+credentials via stdio transport.
+
+## Installation
+
+```bash
+pip install tempura-client
+```
+
+## Usage
+
+The package provides a `tempura-client` command that communicates over
+stdin/stdout using the MCP JSON-RPC protocol. It is designed to be launched
+by an MCP-aware agent or host application.
+
+```bash
+tempura-client
+```
+
+## Dependencies
+
+- `mcp[cli]` - Model Context Protocol SDK
+- `httpx` - HTTP client for forwarding requests to the remote server

tempura_client-0.1.0/src/tempura_client.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+README.md
+pyproject.toml
+src/tempura_client/__init__.py
+src/tempura_client/__main__.py
+src/tempura_client/app.py
+src/tempura_client/config.py
+src/tempura_client/remote.py
+src/tempura_client/server.py
+src/tempura_client.egg-info/PKG-INFO
+src/tempura_client.egg-info/SOURCES.txt
+src/tempura_client.egg-info/dependency_links.txt
+src/tempura_client.egg-info/entry_points.txt
+src/tempura_client.egg-info/requires.txt
+src/tempura_client.egg-info/top_level.txt
+src/tempura_shared/__init__.py
+src/tempura_shared/credentials_file.py
+src/tempura_shared/validators.py

tempura_client-0.1.0/src/tempura_client.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

tempura_client-0.1.0/src/tempura_client.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tempura-client = tempura_client.app:main

tempura_client-0.1.0/src/tempura_client.egg-info/requires.txt

@@ -0,0 +1,2 @@
+mcp[cli]
+httpx

tempura_client-0.1.0/src/tempura_client.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+tempura_client
+tempura_shared

tempura_client-0.1.0/src/tempura_shared/__init__.py

@@ -0,0 +1,5 @@
+"""Tempura shared modules.
+
+Stdlib-only utilities shared between the tempura server and
+tempura_client packages: credential file I/O and input validators.
+"""

tempura_client-0.1.0/src/tempura_shared/credentials_file.py

@@ -0,0 +1,128 @@
+"""Credentials file manager.
+
+Read and write AWS credentials file profiles in INI format.
+Requirements: 4.1, 4.2, 4.3, 4.4, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 8.3
+"""
+
+import configparser
+import os
+import stat
+
+_DEFAULT_CREDENTIALS_PATH = os.path.join(os.path.expanduser("~"), ".aws", "credentials")
+
+_SECURE_MODE = stat.S_IRUSR | stat.S_IWUSR  # 0o600
+
+
+def read_profile(
+    profile_name: str = "MyAwesomeReadOnly",
+    credentials_path: str | None = None,
+) -> dict[str, str]:
+    """Read credentials for a named profile from the AWS credentials file.
+
+    Args:
+        profile_name: The profile section name to read.
+        credentials_path: Path to the credentials file.
+            Defaults to ``~/.aws/credentials``.
+
+    Returns:
+        Dictionary of key-value pairs from the profile section.
+
+    Raises:
+        FileNotFoundError: If the credentials file does not exist.
+        KeyError: If the named profile is not found in the file.
+    """
+    path = credentials_path or _DEFAULT_CREDENTIALS_PATH
+
+    if not os.path.isfile(path):
+        raise FileNotFoundError(
+            f"AWS credentials file not found at {path}. "
+            "Please configure your credentials by running "
+            "'aws configure' or creating the file manually."
+        )
+
+    config = configparser.RawConfigParser()
+    config.read(path)
+
+    if not config.has_section(profile_name):
+        raise KeyError(profile_name)
+
+    return dict(config.items(profile_name))
+
+
+def _check_permissions(path: str) -> None:
+    """Verify the file has secure permissions (mode 600).
+
+    Raises:
+        PermissionError: If the file is group/other readable
+            or not writable by the owner.
+    """
+    file_stat = os.stat(path)
+    mode = stat.S_IMODE(file_stat.st_mode)
+
+    if mode & (stat.S_IRGRP | stat.S_IROTH):
+        raise PermissionError(
+            f"Credentials file {path} has insecure permissions "
+            f"(mode {oct(mode)}). Expected mode 0o600."
+        )
+
+    if not os.access(path, os.W_OK):
+        raise PermissionError(f"Credentials file {path} is not writable.")
+
+
+def write_profile(
+    profile_name: str,
+    access_key_id: str,
+    secret_access_key: str,
+    session_token: str | None = None,
+    credentials_path: str | None = None,
+) -> None:
+    """Write or update a profile in the AWS credentials file.
+
+    Args:
+        profile_name: The profile section name to write.
+        access_key_id: The AWS access key ID.
+        secret_access_key: The AWS secret access key.
+        session_token: Optional session token.
+        credentials_path: Path to the credentials file.
+            Defaults to ``~/.aws/credentials``.
+
+    Raises:
+        PermissionError: If the file is not writable or has
+            insecure permissions.
+    """
+    path = credentials_path or _DEFAULT_CREDENTIALS_PATH
+    config = configparser.RawConfigParser()
+    file_exists = os.path.exists(path)
+
+    if file_exists:
+        _check_permissions(path)
+        config.read(path)
+    else:
+        parent = os.path.dirname(path)
+        if parent:
+            os.makedirs(parent, exist_ok=True)
+
+    if not config.has_section(profile_name):
+        config.add_section(profile_name)
+
+    config.set(profile_name, "aws_access_key_id", access_key_id)
+    config.set(
+        profile_name,
+        "aws_secret_access_key",
+        secret_access_key,
+    )
+
+    if session_token is not None:
+        config.set(
+            profile_name,
+            "aws_session_token",
+            session_token,
+        )
+    elif config.has_option(profile_name, "aws_session_token"):
+        config.remove_option(profile_name, "aws_session_token")
+
+    with open(path, "w") as f:
+        config.write(f)
+
+    if not file_exists:
+        os.chmod(path, _SECURE_MODE)

tempura_client-0.1.0/src/tempura_shared/validators.py

@@ -0,0 +1,22 @@
+"""Input validation functions for tempura.
+
+Requirements: 2.1, 2.2, 2.3, 2.4
+"""
+
+import re
+
+_ACCOUNT_ID_PATTERN = re.compile(r"^\d{12}$")
+
+
+def validate_account_id(account_id: str) -> str:
+    """Validate and return a 12-digit AWS account ID string.
+
+    Raises ValueError if invalid.
+    """
+    if not isinstance(account_id, str):
+        raise ValueError(
+            "account_id must be a string, " f"got {type(account_id).__name__}"
+        )
+    if not _ACCOUNT_ID_PATTERN.match(account_id):
+        raise ValueError("account_id must be exactly 12 digits, " f"got '{account_id}'")
+    return account_id