Scalekit provider updates #2413
Conversation
marvin-context-protocol
bot
added
enhancement
WalkthroughThe pull request updates the Scalekit authentication provider across documentation, examples, and source code. Configuration parameters are renamed (mcp_url → base_url, client_id removed), an optional required_scopes parameter is introduced, and the ScalekitProvider constructor signature is updated accordingly. Documentation and examples reflect the new parameter names and environment variables. Metadata endpoint handling was changed to construct and fetch a metadata URL using environment_url and resource_id, with additional logging and explicit 500 error handling on fetch failure. Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
examples/auth/scalekit_oauth/server.py (1)
22-27: Consider using the existingparse_scopesutility function.The manual scope parsing here duplicates the logic in
fastmcp.utilities.auth.parse_scopes, which is already used by the provider internally. Using the utility function would:
- Ensure consistent parsing behavior
- Reduce code duplication
- Automatically benefit from any future parsing improvements
Apply this diff to use the utility function:
+from fastmcp.utilities.auth import parse_scopes + -required_scopes_env = os.getenv("SCALEKIT_REQUIRED_SCOPES") -required_scopes = ( - [scope.strip() for scope in required_scopes_env.split(",") if scope.strip()] - if required_scopes_env - else None -) +required_scopes = parse_scopes(os.getenv("SCALEKIT_REQUIRED_SCOPES"))
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
tests/server/auth/providers/test_scalekit.pyis excluded by none and included by none
📒 Files selected for processing (5)
docs/integrations/scalekit.mdx(6 hunks)docs/python-sdk/fastmcp-server-auth-providers-scalekit.mdx(1 hunks)examples/auth/scalekit_oauth/README.md(2 hunks)examples/auth/scalekit_oauth/server.py(2 hunks)src/fastmcp/server/auth/providers/scalekit.py(6 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
docs/**/*.mdx
📄 CodeRabbit inference engine (docs/.cursor/rules/mintlify.mdc)
docs/**/*.mdx: Use clear, direct language appropriate for technical audiences
Write instructions and procedures in second person ("you")
Use active voice over passive voice
Use present tense for current states and future tense for outcomes
Maintain consistent terminology across the documentation
Keep sentences concise while preserving necessary context
Use parallel structure in lists, headings, and procedures
Lead with the most important information (inverted pyramid)
Use progressive disclosure: basic concepts before advanced ones
Break complex procedures into numbered steps
Include prerequisites and context before instructions
Provide expected outcomes for each major step
End sections with next steps or related information
Use descriptive, keyword-rich headings for navigation and SEO
Focus on user goals and outcomes rather than system features
Anticipate common questions and address them proactively
Include troubleshooting for likely failure points
Offer multiple pathways when appropriate (beginner vs advanced) and provide an opinionated recommended path
Use for supplementary information that supports the main content
Use for expert advice, shortcuts, or best practices
Use for critical cautions, breaking changes, or destructive actions
Use for neutral background or contextual information
Use to confirm success or completion
Provide single code examples using fenced code blocks with language (and filename when relevant)
Use to present the same concept in multiple languages
For API docs, use to show requests
For API docs, use to show responses
Use and to document procedures and sequential instructions
Use and for platform-specific or alternative approaches
Use / for supplementary content that might interrupt flow
In API docs, use for parameters (path, body, query, header) with type and required/default as appropria...
Files:
docs/integrations/scalekit.mdxdocs/python-sdk/fastmcp-server-auth-providers-scalekit.mdx
🧬 Code graph analysis (2)
examples/auth/scalekit_oauth/server.py (1)
src/fastmcp/server/auth/providers/scalekit.py (1)
ScalekitProvider(44-210)
src/fastmcp/server/auth/providers/scalekit.py (3)
src/fastmcp/server/auth/auth.py (2)
RemoteAuthProvider(196-266)TokenVerifier(170-193)src/fastmcp/server/auth/providers/jwt.py (1)
JWTVerifier(165-498)src/fastmcp/utilities/auth.py (1)
parse_scopes(9-34)
🪛 Ruff (0.14.4)
src/fastmcp/server/auth/providers/scalekit.py
175-175: Unused function argument: request
(ARG001)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Run tests: Python 3.10 on windows-latest
- GitHub Check: label-issue-or-pr
🔇 Additional comments (12)
src/fastmcp/server/auth/providers/scalekit.py (4)
28-41: Settings changes look correct and align with objectives.The environment variable prefix change improves clarity, and the addition of
base_urlandrequired_scopesfields with the_parse_scopesvalidator correctly implements the PR objectives. The validator properly handles various scope formats (JSON array, comma-separated, space-separated).
117-117: Consider the default value forrequired_scopes.Line 117 assigns
self.required_scopes = settings.required_scopes or [], which defaults to an empty list. However, at line 140, the code usesrequired_scopes=self.required_scopes or None. This means an empty list will be converted toNonewhen passed toJWTVerifier.This behavior may be intentional (to distinguish "no scopes required" from "scopes required but list is empty"), but it would be clearer to be consistent throughout.
Consider one of these approaches:
- Store
Noneinstead of[]when no scopes are configured (change line 117)- Remove the
or Nonecheck at line 140 if empty list is acceptableWhich behavior do you prefer? Do you want
JWTVerifierto receiveNoneor[]when no scopes are configured?
120-143: Excellent logging additions for debugging authentication flows.The debug logging at initialization and during JWT verifier creation will greatly help troubleshooting authentication issues. The conditional logging for custom verifiers is also a nice touch.
175-199: Robust metadata forwarding with proper error handling.The metadata endpoint correctly:
- Constructs the Scalekit-specific metadata URL
- Logs the fetch operation
- Handles errors gracefully with appropriate HTTP 500 response
- Returns proper JSON responses
The static analysis warning about unused
requestparameter is a false positive—Starlette route handlers require this signature.docs/python-sdk/fastmcp-server-auth-providers-scalekit.mdx (1)
41-42: Documentation accurately reflects the API changes.The updated environment variable guidance correctly shows:
BASE_URLreplacingMCP_URL- Addition of optional
SCALEKIT_REQUIRED_SCOPES- Removal of
SCALEKIT_CLIENT_IDThis aligns perfectly with the code changes in the provider implementation.
examples/auth/scalekit_oauth/README.md (1)
27-29: Clear and accurate environment variable documentation.The README correctly documents:
BASE_URLwith a concrete example- Optional
SCALEKIT_REQUIRED_SCOPESwith helpful guidance on formatThe documentation is clear and helpful for users setting up the example.
examples/auth/scalekit_oauth/server.py (1)
33-34: Correct usage of updated ScalekitProvider API.The provider initialization correctly uses:
base_urlinstead of the oldmcp_urlrequired_scopesparameter with the parsed scopesThis aligns with the PR objectives and updated provider signature.
docs/integrations/scalekit.mdx (5)
19-20: Prerequisites clearly updated to reflect API changes.The updated prerequisites correctly describe:
- What credentials to obtain (Environment URL and Resource ID)
- What to prepare (base URL instead of endpoint)
The language is clear and actionable for developers.
37-39: Environment configuration examples are clear and complete.The
.envexample correctly shows:
- Required variables with descriptive examples
- Optional
SCALEKIT_REQUIRED_SCOPESwith clear formatting guidance- Use of
BASE_URLinstead of the oldMCP_URL
57-58: Code example accurately demonstrates the updated API.The
ScalekitProviderinstantiation correctly shows:
base_urlparameter with descriptive variable namerequired_scopesparameter with example value- Removal of deprecated
client_idparameterThis provides a clear, copy-paste-ready example for users.
76-78: Helpful guidance onrequired_scopesusage.The tip provides practical advice on when to use
required_scopes, helping users understand:
- When to set it (specific permissions needed)
- When to skip it (accept any token for the resource)
This aligns with best practices for OAuth scope enforcement.
105-119: Environment variable reference is comprehensive and accurate.The updated parameter documentation:
- Uses consistent naming (
FASTMCP_SERVER_AUTH_SCALEKIT_*prefix)- Correctly marks required vs optional parameters
- Provides clear descriptions and examples
- Documents the new
REQUIRED_SCOPESparameter with format optionsAll variable names align with the code implementation.
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/fastmcp/server/auth/providers/scalekit.py (1)
203-227: Rename unused handler argument to satisfy lint
ruffis flaggingrequestas unused (ARG001). Renaming it to_requestkeeps the signature Starlette expects while letting the lint pass.- async def oauth_authorization_server_metadata(request): + async def oauth_authorization_server_metadata(_request):
🧹 Nitpick comments (2)
docs/integrations/scalekit.mdx (2)
15-21: Fix heading hierarchy to start sections with H2Guidelines call for main sections to begin at H2. Please bump these headings up one level so the structure starts at H2 and reserves H3 for subsections. As per coding guidelines.
-### Prerequisites +## Prerequisites @@ -### Step 1: Configure MCP server in Scalekit environment +## Step 1: Configure MCP server in Scalekit environment
49-50: Use the<Warning>component for deprecation noticeCritical callouts should use the
<Warning>component rather than a styled blockquote to stay consistent with the docs system. As per coding guidelines.-> **Warning:** The legacy `mcp_url` and `client_id` parameters are deprecated and will be removed in a future release. Use `base_url` instead of `mcp_url` and remove `client_id` from your configuration. +<Warning> +The legacy `mcp_url` and `client_id` parameters are deprecated and will be removed in a future release. Use `base_url` instead of `mcp_url` and remove `client_id` from your configuration. +</Warning>
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
tests/server/auth/providers/test_scalekit.pyis excluded by none and included by none
📒 Files selected for processing (4)
docs/integrations/scalekit.mdx(6 hunks)examples/auth/scalekit_oauth/README.md(2 hunks)examples/auth/scalekit_oauth/server.py(2 hunks)src/fastmcp/server/auth/providers/scalekit.py(6 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- examples/auth/scalekit_oauth/README.md
🧰 Additional context used
📓 Path-based instructions (1)
docs/**/*.mdx
📄 CodeRabbit inference engine (docs/.cursor/rules/mintlify.mdc)
docs/**/*.mdx: Use clear, direct language appropriate for technical audiences
Write instructions and procedures in second person ("you")
Use active voice over passive voice
Use present tense for current states and future tense for outcomes
Maintain consistent terminology across the documentation
Keep sentences concise while preserving necessary context
Use parallel structure in lists, headings, and procedures
Lead with the most important information (inverted pyramid)
Use progressive disclosure: basic concepts before advanced ones
Break complex procedures into numbered steps
Include prerequisites and context before instructions
Provide expected outcomes for each major step
End sections with next steps or related information
Use descriptive, keyword-rich headings for navigation and SEO
Focus on user goals and outcomes rather than system features
Anticipate common questions and address them proactively
Include troubleshooting for likely failure points
Offer multiple pathways when appropriate (beginner vs advanced) and provide an opinionated recommended path
Use for supplementary information that supports the main content
Use for expert advice, shortcuts, or best practices
Use for critical cautions, breaking changes, or destructive actions
Use for neutral background or contextual information
Use to confirm success or completion
Provide single code examples using fenced code blocks with language (and filename when relevant)
Use to present the same concept in multiple languages
For API docs, use to show requests
For API docs, use to show responses
Use and to document procedures and sequential instructions
Use and for platform-specific or alternative approaches
Use / for supplementary content that might interrupt flow
In API docs, use for parameters (path, body, query, header) with type and required/default as appropria...
Files:
docs/integrations/scalekit.mdx
🧬 Code graph analysis (2)
examples/auth/scalekit_oauth/server.py (1)
src/fastmcp/server/auth/providers/scalekit.py (1)
ScalekitProvider(55-238)
src/fastmcp/server/auth/providers/scalekit.py (3)
src/fastmcp/server/auth/auth.py (2)
RemoteAuthProvider(196-266)TokenVerifier(170-193)src/fastmcp/server/auth/providers/jwt.py (1)
JWTVerifier(165-498)src/fastmcp/utilities/auth.py (1)
parse_scopes(9-34)
🪛 Ruff (0.14.4)
src/fastmcp/server/auth/providers/scalekit.py
203-203: Unused function argument: request
(ARG001)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run tests: Python 3.10 on windows-latest
|
Thanks @AkshayParihar33. Two thoughts:
|
|
hi @jlowin, thanks for reviewing the PR: Regarding pt. 1 - As a good number of our customer's first choice is FastMCP, I wanted to keep the backward compatibility for a few versions and hence the deprecation log is in place to notify to stop using the old field and in subsequent release (maybe in a couple of months) will remove that field so that the transition is seamless for the devs. Regarding pt. 2 - Is it okay if we can discuss this offline over slack (if you prefer that) or via email? Could you share your email-id that I can invite over slack? |
2 participants
Description
To provide more capabilities and cleaner integration between FastMCP and Scalekit, we are making the following updates:
Additions & Improvements
required_scopes(optional parameter) to enable fine-grained access control.mcp_url→base_urlfor better alignment with the meaning of the URI being passed in.client_idoptional in the provider configuration. It continues to be handled internally but is planned for deprecation in a future release.aud(audience) validation in the provider layer.The provider no longer enforces the
audclaim during token verification.If your implementation depends on audience checks, you can manually validate the
audvalue from the token within your server logic.Contributors Checklist
Review Checklist