aviary-mcp

# AviaryMCP AviaryMCP is a release-candidate, opinionated FastMCP runtime for publishing one tool definition through MCP and a generated REST/OpenAPI interface. It extends FastMCP through public APIs rather than maintaining a source fork, so MCP and HTTP share the same registry, validation, middleware, handler, and authorization decision. Install the public release candidate from PyPI: ```console python -m pip install 'aviary-mcp==0.1.0rc6' ``` ```python from aviary_mcp import AviaryMCP app = AviaryMCP("calculator") @app.tool def add(a: int, b: int) -> int: """Add two integers.""" return a + b app.run(transport="http", host="127.0.0.1", port=8000) ``` `access="local"` is the safe default: HTTP may bind only to loopback, and in-process/stdio calls receive a local principal. An unauthenticated network service requires explicit `access="public"`. Supplying `auth=` (or a FastMCP 3.4 token verifier through `mcp_auth=`) selects private mode. An authenticated REST face uses normalized principals and operation-centric scopes: ```python from aviary_mcp import AviaryMCP, Principal, StaticKeyAuth app = AviaryMCP( "calculator", auth=StaticKeyAuth({ # Use a generated, high-entropy secret in production. The provider # immediately retains only its SHA-256 digest. "development-secret": Principal( subject="example-client", scopes={"tool:call:add"}, ), }), ) ``` `LocalAuth`, `StaticKeyAuth`, `FinchAssertionAuth`, `AnyOf`, and `AllOf` normalize callers into a `Principal`. One outer ASGI authentication boundary protects `/mcp`, generated REST routes, and application custom routes together. The generated REST operation calls `invoke_tool`, which checks `tool:call:<tool-name>` (plus any scopes registered with `require_scopes`) before entering FastMCP's normal validation, middleware, and handler path. When application auth is configured, the generated catalog and OpenAPI routes also require authentica…