Add OCI Language MCP Server

[antimverma]

Description

Adds the OCI Language MCP server under src/oci-language-mcp-server.

This server provides OCI Language shared pretrained capabilities through seven typed MCP tools:

• Dominant language detection
• Text classification
• Named-entity detection
• Key phrase extraction
• Sentiment analysis
• PII detection and transformation
• Text translation

The implementation follows the repository MCP server structure and public packaging expectations:

• Adds pyproject.toml, uv.lock, README.md, CHANGELOG.md, LICENSE.txt, Containerfile, .containerignore, and the oracle/ package source.
• Exposes the package entry point as oracle.oci-language-mcp-server.
• Supports stdio and hardened Streamable HTTP transports.
• Supports outbound OCI session-token, instance-principal, and resource-principal authentication through oracle-mcp-common.
• Supports remote MCP caller authentication through OAuth resource-server validation or a controlled token file.
• Keeps inbound caller authentication separate from outbound OCI identity: OCI Language calls use the server’s configured OCI identity and do not exchange incoming OAuth tokens.
• Adds Host/Origin allowlists, request-body limits, remote request rate limits, bounded concurrent OCI execution, health/readiness endpoints, safe telemetry, and sanitized error responses.
• Adds OCI SDK additional_user_agent telemetry derived from package metadata for every supported outbound authentication mode.
• Adds typed request validation, OCI request mapping, structured result parsing, bounded human-readable output, and PII-safe transformation behavior.
• Documents all runtime settings, local and remote deployment, Docker usage, authentication behavior, IAM requirements, and local validation.
• Configures the container for a non-root, read-only runtime and builds from the repository root so the shared src/common workspace dependency is available.

Fixes: N/A

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Validated locally from src/oci-language-mcp-server:

• pytest --cov=. --cov-branch --cov-report=term-missing
  • 87 passed
  • Coverage: 91.00%
• uv lock --check
• ruff check --no-cache .
• HTTP runtime probe
  • Verified GET /health returns {"status":"ok"}
  • Verified GET /ready returns {"status":"ready"}
• Auth and provider tests cover session-token, instance-principal, and resource-principal OCI client construction paths.
• Remote OAuth and token-file HTTP security behavior are covered by integration tests.
• Workspace dependency resolution was validated with the repository-root container build layout.

Test Configuration:

• OS: macOS
• Python: 3.13.2
• Package manager: uv
• MCP transports: stdio and Streamable HTTP
• OCI authentication modes: session-token, instance principal, and resource principal

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove the feature works
• New and existing unit and integration tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules (N/A)

[antimverma]

Hi @krisrice @dustin-sale Can you please help review/approve this PR for adding OCI Language MCP ?

[dustin-sale]

Review by @dustin-sale via Codex.

Requested changes

• models.py:120 — [P1] Restrict caller-controlled OCI regions.
• provider.py:159 — [P1] Disable OCI SDK request logging.
• Containerfile:28 — [P1] Do not expose unauthenticated local mode on all interfaces.
• http_security.py:64 — [P1] Prevent invalid OAuth tokens from consuming the authenticated quota.
• Containerfile:19 — [P1] Align the container build context with Make and effective ignore rules.

Additional review notes

• Correct timeout classification and response-key reconciliation.
• Preserve REMOVE output formatting and handle empty PII masking maps consistently.
• Make the container healthcheck deployment-aware.
• Permit OCI's documented chars_to_consider=0 behavior.

Validation

make lint passed. make test project=oci-language-mcp-server passed all 87 tests with 91.00% branch coverage. No container image was executed.

See the inline comments in this review for evidence, impact, and suggested remediation.

[antimverma]

@dustin-sale Addressed the latest comments, please check.

[dustin-sale]

Review by @dustin-sale via Codex.

Requested changes

• Containerfile:22 — [P1] Disable development workspace sources when syncing the production image so oracle-mcp-common installs from PyPI.
• README.md:101 — [P2] Follow the repository’s Podman-based container build and run workflow.

Re-review result

Ten previous findings are addressed: caller-controlled region validation, OCI request logging, unauthenticated container defaults, OAuth quota placement, timeout classification, response-key reconciliation, REMOVE formatting, empty masking semantics, healthcheck behavior, and chars_to_consider=0.

The remaining issues are limited to container packaging. The server-only context is appropriate, but the current locked sync still requires the absent development workspace, and the server README diverges from the root project’s supported Podman workflow.

Validation

make lint passed. make test project=oci-language-mcp-server passed all 95 tests with 91.11% branch coverage. Package lock and build checks passed with the repository workspace present. A focused OAuth probe confirmed invalid tokens do not consume the authenticated quota.

In an isolated server-only context, the current uv sync --locked path failed on the unavailable ../common workspace. Disabling development sources allowed the standard oracle-mcp-common>=0.1.2,<0.2.0 dependency to resolve from PyPI while retaining the version already selected by the development lock.

[antimverma]

@dustin-sale Addressed the latest review comments, please check.

[dustin-sale]

Review by @dustin-sale via Codex.

Requested changes

• src/oci-language-mcp-server/README.md:100 — [P1] Make the documented Podman build path self-contained.

Additional review notes

• src/oci-language-mcp-server/README.md:28 — [P2] List Podman, not Docker, as the container prerequisite.

Validation

make lint and make test project=oci-language-mcp-server passed; all 95 tests passed with 91.11% branch coverage. The isolated production sync installed oracle-mcp-common==0.1.2 from PyPI, but the documented make containerize command failed because tomlq is undeclared.

See the inline comments in this review for evidence, impact, and suggested remediation.

[dustin-sale]

Comment from @dustin-sale via Codex.

[P1] Make the documented container target self-contained

• Evidence: In a clean detached checkout bootstrapped from requirements-dev.txt, the exact documented command fails twice with Failed to spawn: tomlq. The shared containerize recipe invokes uv run tomlq, but neither repository requirements file declares that executable. The recipe then continues with empty image name and version values. The passing language-server CI job runs uv build, not this container target.

• Impact: Users following this README cannot produce the advertised image from the repository-supported workflow.

• Requested change: Make the shared containerize target resolve project name and version without an undeclared executable—for example, use Python tomllib as the repository’s other Make targets already do—and make metadata-resolution failures terminate the recipe. Add validation that exercises the exact documented target.

This issue already existed before this PR, but might as well fix it. Adding tomlq to requirements-dev.txt should resolve this issue.

[dustin-sale]

My PR review skill is still not happy with make containerize. See my comment in Makefile.

[antimverma]

@dustin-sale Addressed the latest review comments, please check.

[antimverma]

Hi @dustin-sale , Gentle Reminder to review this ^^

[dustin-sale]

Really close, my PR review skill isn't happy with the containerize make step. I think my suggestion should resolve it.

[dustin-sale]

My PR review skill is still not happy with make containerize. See my comment in Makefile.

[antimverma]

Really close, my PR review skill isn't happy with the containerize make step. I think my suggestion should resolve it.

@dustin-sale Pushed the change.

[gebhardtr]

do you need this file, given that server is the entrypoint (and has this same main check)?

[antimverma]

@gebhardtr Yes good catch, this was a redundant residual code. Addressed.

[gebhardtr]

comment re: 2nd entry point. #406 (review)