Feature/am mcp gateway

.github/workflows/am-mcp-gateway.yml

@@ -0,0 +1,40 @@
+name: AM MCP Gateway Publish
+
+on:
+  push:
+    branches: ["main", "develop", "test/**", "feature/**", "hotfix/**", "fix/**"]
+    paths:
+      - "am-mcp-gateway/**"
+      - "libraries/**"
+      - "requirements.txt"
+      - "requirements-dev.txt"
+      - ".dockerignore"
+      - "docker/**"
+  pull_request:
+    branches: ["main", "develop", "test/**", "feature/**", "hotfix/**", "fix/**"]
+    paths:
+      - "am-mcp-gateway/**"
+      - "libraries/**"
+      - "requirements.txt"
+      - "requirements-dev.txt"
+      - ".dockerignore"
+      - "docker/**"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Publish AM MCP Gateway
+    permissions:
+      contents: read
+      packages: write
+    uses: AM-Portfolio/am-pipelines/.github/workflows/central-build-publish.yml@main
+    with:
+      language: "python"
+      working_directory: "am-mcp-gateway"
+      image_name: "am-mcp-gateway"
+      build_context: ".."
+      preprod_namespace: "am-apps-preprod"
+      prod_namespace: "am-apps-prod"
+      deploy_dev: true
+      deploy_prod: true
+    secrets: inherit

.github/workflows/deploy-am-mcp-gateway.yml

@@ -0,0 +1,38 @@
+name: Manual Deploy (AM MCP Gateway)
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "Select Image Tag"
+        required: true
+        default: "latest"
+        type: choice
+        options:
+          - latest
+          - custom
+      custom_tag:
+        description: "If 'custom' selected, enter tag here"
+        required: false
+        type: string
+      environment:
+        description: "Target Environment"
+        required: true
+        default: "preprod"
+        type: choice
+        options:
+          - preprod
+          - prod
+
+jobs:
+  deploy:
+    name: Deploy AM MCP Gateway to ${{ github.event.inputs.environment }}
+    uses: AM-Portfolio/am-pipelines/.github/workflows/central-deploy.yml@main
+    with:
+      service_name: "am-mcp-gateway"
+      working_directory: "am-mcp-gateway"
+      language: "python"
+      environment: ${{ github.event.inputs.environment }}
+      image_tag: ${{ github.event.inputs.image_tag == 'custom' && github.event.inputs.custom_tag || github.event.inputs.image_tag }}
+      namespace: ${{ github.event.inputs.environment == 'prod' && 'am-apps-prod' || 'am-apps-preprod' }}
+    secrets: inherit

am-identity/am_identity/api/user_router.py

@@ -13,7 +13,7 @@
 def _profile_from_claims(claims: dict[str, Any]) -> dict[str, Any]:
     """Build profile from validated JWT when Keycloak userinfo is unavailable."""
     return {
-        "sub": claims.get("sub", ""),
+        "sub": claims.get("userId") or claims.get("sub", ""),
         "email": claims.get("email"),
         "preferred_username": claims.get("preferred_username"),
         "given_name": claims.get("given_name"),

am-mcp-gateway/.env.preprod

@@ -0,0 +1,31 @@
+# ── App Environment ────────────────────────────────────────────────────────
+APP_ENV=preprod
+LOG_LEVEL=DEBUG
+LOG_FORMAT=text
+
+# ── OIDC / Keycloak (am-preprod-realm) ────────────────────────────────────
+OIDC_JWKS_URL=http://auth.munish.org/auth/realms/am-preprod-realm/protocol/openid-connect/certs
+OIDC_ISSUER=http://auth.munish.org/auth/realms/am-preprod-realm
+
+# ── MCP Service Client Credentials ────────────────────────────────────────
+AM_MCP_CLIENT_ID=am-mcp-service
+AM_MCP_CLIENT_SECRET=hkk4698D7xZ8m2VpPL3zNfepAoTwRN8r
+
+# ── LiteLLM (local port-forward to cluster) ───────────────────────────────
+LITELLM_BASE_URL=http://localhost:4000
+LITELLM_MASTER_KEY=sk-27ad0c81915a946bfcf010e9b28a777c1ddc1a42f6640a6d
+LLM_MODEL=together_ai/meta-llama/Meta-Llama-3-8B-Instruct-Lite
+LLM_FALLBACK_CHAIN=litellm
+LLM_CB_ENABLED=false
+
+# ── Langfuse Observability ────────────────────────────────────────────────
+LANGFUSE_ENABLED=true
+LANGFUSE_HOST=https://langfuse.munish.org
+LANGFUSE_PUBLIC_KEY=pk-lf-cc35cb35-f20e-463d-90df-b41caec0a962
+LANGFUSE_SECRET_KEY=sk-lf-f64795da-863f-4a83-8f47-5b43a1bd0472
+
+# ── UI test agent (MCP tool proxy) ────────────────────────────
+UI_TEST_AGENT_BASE_URL=http://localhost:8130
+UI_TEST_MANIFEST_PATH=../../am-modern-ui/testing/manifest.json
+MCP_GATEWAY_PUBLIC_URL=http://localhost:8120
+LITELLM_MCP_SERVER_ALIAS=am_mcp_gateway

am-mcp-gateway/.gitignore

@@ -0,0 +1,7 @@
+.env
+.env.*
+!.env.example
+.pytest_cache/
+__pycache__/
+*.pyc
+.venv/

am-mcp-gateway/Dockerfile

@@ -0,0 +1,44 @@
+# AM MCP Gateway — build context: am-platform root (build_context: ..)
+FROM python:3.12-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Copy root requirements first to cache base platform dependencies
+COPY requirements.txt ./requirements-platform.txt
+RUN pip install --no-cache-dir -r requirements-platform.txt
+
+# Copy gateway-specific requirements and install them
+COPY am-mcp-gateway/requirements.txt ./am-mcp-gateway/requirements.txt
+RUN pip install --no-cache-dir -r am-mcp-gateway/requirements.txt
+
+# Copy shared libraries
+COPY libraries/am-platform-common/ libraries/am-platform-common/
+COPY libraries/am-platform-security/ libraries/am-platform-security/
+RUN pip install --no-cache-dir ./libraries/am-platform-common ./libraries/am-platform-security
+
+# Copy service code
+COPY am-mcp-gateway/ am-mcp-gateway/
+
+# Set environment
+ENV PYTHONPATH=/app/libraries/am-platform-common:/app/libraries/am-platform-security:/app/am-mcp-gateway
+ENV APP_ENV=production
+ENV TZ=Asia/Kolkata
+ENV APP_PORT=8120
+
+EXPOSE 8120
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=45s --retries=3 \
+  CMD curl -f http://localhost:8120/health || exit 1
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8120"]
+

am-mcp-gateway/Makefile

@@ -0,0 +1,19 @@
+.PHONY: run test lint format clean
+
+run:
+	uvicorn app.main:app --host 0.0.0.0 --port 8120 --reload
+
+test:
+	pytest tests/
+
+lint:
+	black --check app/ tests/
+	isort --check-only app/ tests/
+
+format:
+	black app/ tests/
+	isort app/ tests/
+
+clean:
+	find . -type d -name "__pycache__" -exec rm -rf {} +
+	find . -type d -name ".pytest_cache" -exec rm -rf {} +

am-mcp-gateway/README.md

@@ -0,0 +1,31 @@
+# AM MCP Gateway
+
+The Gateway routes MCP and LLM queries through local and remote models, ensuring secure, fast, and structured execution.
+
+## 🔒 Secret Management & Security Guidelines
+
+To prevent sensitive credentials and API keys from leaking, the gateway strictly decouples credentials from code and configuration:
+
+### 1. In-Cluster (Preprod / Production)
+In cluster environments, secrets are injected dynamically using **HashiCorp Vault Agent Sidecars**.
+- Secrets are mapped via [vault-mappings.yaml](file:///a:/InfraCode/AM-Portfolio-grp/am-platform/am-mcp-gateway/helm/vault-mappings.yaml).
+- The Vault agent writes secrets to memory-mounted files under `/vault/secrets/`.
+- Sourced files automatically set environment variables (such as `TOGETHER_API_KEY`, `LITELLM_MASTER_KEY`, etc.) inside the shell before running the Gateway process:
+  ```bash
+  . /vault/secrets/identity-oidc 2>/dev/null || true
+  . /vault/secrets/llm-api-keys 2>/dev/null || true
+  . /vault/secrets/observability 2>/dev/null || true
+  . /vault/secrets/redis 2>/dev/null || true
+  exec uvicorn app.main:app
+  ```
+
+### 2. Local Development
+For local testing:
+- Create a `.env` file in the root of `am-mcp-gateway` (or use the global `am-platform/.secrets.env`).
+- Secrets will be parsed automatically at startup by Pydantic settings.
+- **Never commit `.env` or `.secrets.env` files.** The global and local `.gitignore` rules are configured to prevent these files from being tracked by Git.
+
+### 3. Golden Rule
+> [!IMPORTANT]
+> **Never hardcode or place real API keys/credentials inside values files (like `values.yaml` or `values.preprod.yaml`).**
+> All credential integrations must be mapped via Vault paths and key bindings.

am-mcp-gateway/app/api/agent_llm.py

@@ -0,0 +1,122 @@
+"""Service-to-service LLM endpoint for internal agents (e.g. ui-test-agent).
+
+Routes through LiteLLM so all agent LLM/vision calls appear in LiteLLM logs + Langfuse.
+"""
+from __future__ import annotations
+
+import logging
+import time
+import uuid
+from typing import Any, Optional
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel, Field
+
+from am_platform_security.dependencies import require_auth_context
+from am_platform_security.models import AuthContext
+
+from app.api.chat import _litellm_metadata, _log_chat_trace
+from app.llm.router import llm_router
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(include_in_schema=False)
+
+
+class AgentLLMRequest(BaseModel):
+    messages: list[dict[str, Any]] = Field(..., description="OpenAI-style messages (text or multimodal)")
+    model: str = Field(..., description="LiteLLM model name")
+    temperature: float = Field(default=0.2, ge=0.0, le=2.0)
+    max_tokens: int = Field(default=4096, ge=1, le=8192)
+    sessionId: Optional[str] = None
+    testId: Optional[str] = Field(default=None, description="UI test run id for trace correlation")
+    source: str = Field(default="ui-test-agent", description="Caller service name")
+
+
+class AgentLLMResponse(BaseModel):
+    content: str
+    model: str
+    sessionId: str
+    traceId: str
+    usage: dict[str, int] | None = None
+
+
+def _prompt_summary(messages: list[dict[str, Any]]) -> str:
+    parts: list[str] = []
+    for msg in messages:
+        content = msg.get("content")
+        if isinstance(content, str):
+            parts.append(content[:500])
+        elif isinstance(content, list):
+            for block in content:
+                if isinstance(block, dict) and block.get("type") == "text":
+                    parts.append(str(block.get("text", ""))[:500])
+    return "\n".join(parts)[:2000] or "(multimodal request)"
+
+
+@router.post("/agent/llm/completions", response_model=AgentLLMResponse)
+async def agent_llm_completions(
+    request: AgentLLMRequest,
+    auth_context: AuthContext = Depends(require_auth_context()),
+):
+    """Proxy agent LLM/vision calls to LiteLLM with gateway + Langfuse tracing."""
+    user_id = auth_context.subject
+    session_id = request.sessionId or request.testId or str(uuid.uuid4())
+    trace_id = str(uuid.uuid4())
+    start_time = time.time()
+
+    metadata = _litellm_metadata(user_id=user_id, session_id=session_id, trace_id=trace_id)
+    metadata["source"] = request.source
+    if request.testId:
+        metadata["test_id"] = request.testId
+
+    response_text, provider, usage = await llm_router.generate_chat_messages(
+        request.messages,
+        model=request.model,
+        temperature=request.temperature,
+        metadata=metadata,
+        max_tokens=request.max_tokens,
+    )
+    latency = time.time() - start_time
+
+    await _log_chat_trace(
+        user_id=user_id,
+        session_id=session_id,
+        trace_id=trace_id,
+        response=response_text,
+        model=request.model,
+        latency=latency,
+        provider=provider,
+        usage=usage,
+        request=_AgentTraceRequest(
+            message=_prompt_summary(request.messages),
+            model=request.model,
+            temperature=request.temperature,
+            stream=False,
+        ),
+    )
+
+    logger.info(
+        "Agent LLM completion source=%s test_id=%s model=%s latency=%.2fs",
+        request.source,
+        request.testId,
+        request.model,
+        latency,
+    )
+    return AgentLLMResponse(
+        content=response_text,
+        model=request.model,
+        sessionId=session_id,
+        traceId=trace_id,
+        usage=usage,
+    )
+
+
+class _AgentTraceRequest:
+    """Minimal adapter so agent calls reuse chat trace logging."""
+
+    def __init__(self, *, message: str, model: str, temperature: float, stream: bool):
+        self.message = message
+        self.model = model
+        self.temperature = temperature
+        self.stream = stream