pandamcp/client_utils/panda_mcp_wrapper.sh

0001 #!/bin/bash
0002 # panda_mcp_wrapper.sh
0003 # Launches mcp-remote with a cached PanDA id_token.
0004 # Requires a valid token in TOKEN_FILE (run: source get_panda_token.sh first).
0005 # The MCP configuration could look like this:
0006 #   "mcpServers": {
0007 #     "aipanda120-mcp": {
0008 #       "command": "/Users/fbarreir/panda_mcp_wrapper.sh",
0009 #       "args": [],
0010 #       "env": {
0011 #         "NODE_EXTRA_CA_CERTS": "/Users/fbarreir/all-certs.pem"
0012 #       }
0013 #     }
0014 #   },
0015
0016 PANDA_SERVER=${PANDA_SERVER:-"https://pandaserver.cern.ch:25443"}
0017 VO=${VO:-"atlas"}
0018 TOKEN_FILE=${TOKEN_FILE:-"${HOME}/.panda_id_token"}
0019 MCP_URL=${MCP_URL:-"https://aipanda120.cern.ch:8443/mcp/"}
0020
0021 # Check if we have a cached valid token
0022 if [ -f "$TOKEN_FILE" ]; then
0023     ID_TOKEN=$(python3 -c "
0024 import json, base64, time
0025 with open('$TOKEN_FILE') as f:
0026     data = json.load(f)
0027 id_token = data.get('id_token', '')
0028 if id_token:
0029     payload = id_token.split('.')[1]
0030     payload += '=' * (-len(payload) % 4)
0031     claims = json.loads(base64.urlsafe_b64decode(payload))
0032     # check if token expires in more than 5 minutes. The user not even see the error message.
0033     if claims.get('exp', 0) - time.time() > 300:
0034         print(id_token)
0035 " 2>/dev/null)
0036 fi
0037
0038 # If no valid id_token, try refreshing silently using the refresh_token
0039 if [ -z "$ID_TOKEN" ] && [ -f "$TOKEN_FILE" ]; then
0040     REFRESH_TOKEN=$(python3 -c "
0041 import json
0042 with open('$TOKEN_FILE') as f:
0043     data = json.load(f)
0044 print(data.get('refresh_token', ''))
0045 " 2>/dev/null)
0046
0047     if [ -n "$REFRESH_TOKEN" ]; then
0048         echo "==> id_token expired, attempting silent refresh..." >&2
0049
0050         AUTH_CONFIG=$(curl -sk "${PANDA_SERVER}/auth/${VO}_auth_config.json")
0051         read -r CLIENT_ID CLIENT_SECRET OIDC_CONFIG_URL < <(
0052             python3 -c "
0053 import sys, json
0054 d = json.load(sys.stdin)
0055 print(d['client_id'], d.get('client_secret') or '', d['oidc_config_url'])
0056 " <<< "$AUTH_CONFIG")
0057
0058         TOKEN_ENDPOINT=$(curl -sk "$OIDC_CONFIG_URL" | python3 -c "
0059 import sys, json
0060 print(json.load(sys.stdin)['token_endpoint'])
0061 ")
0062
0063         TOKEN_RESPONSE=$(curl -sk -X POST "$TOKEN_ENDPOINT" \
0064             -H "Content-Type: application/x-www-form-urlencoded" \
0065             -d "grant_type=refresh_token&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&refresh_token=${REFRESH_TOKEN}")
0066
0067         ID_TOKEN=$(python3 -c "
0068 import sys, json
0069 d = json.load(sys.stdin)
0070 if 'id_token' in d:
0071     print(d['id_token'])
0072 " <<< "$TOKEN_RESPONSE" 2>/dev/null)
0073
0074         if [ -n "$ID_TOKEN" ]; then
0075             echo "$TOKEN_RESPONSE" > "$TOKEN_FILE"
0076             echo "==> Token refreshed and cached to $TOKEN_FILE" >&2
0077         else
0078             echo "==> Silent refresh failed (refresh_token may be expired)" >&2
0079         fi
0080     fi
0081 fi
0082
0083 if [ -z "$ID_TOKEN" ]; then
0084     echo "ERROR: No valid token found. Authenticate first by running: source get_panda_token.sh" >&2
0085     exit 1
0086 fi
0087
0088 # Launch mcp-remote with the token
0089 exec npx mcp-remote "$MCP_URL" \
0090     --header "Authorization: Bearer ${ID_TOKEN}" \
0091     --header "Origin: atlas" \
0092     --header "X-Auth-Token: Bearer ${ID_TOKEN}"