Boomi API集成服务器

claude mcp add --transport http boomi https://boomi.renera.ai/mcp

Show me my Boomi account information from the production profile

┌──────────────┐
│    User      │
│  (Browser)   │
└──────┬───────┘
       │ 1. Visit https://boomi.renera.ai
       │ 2. Google OAuth Login
       ▼
┌──────────────────────────────────────┐
│      Boomi MCP Server (Cloud Run)    │
│  ┌────────────┐    ┌──────────────┐ │
│  │  Web UI    │    │  MCP Server  │ │
│  │ (FastAPI)  │    │  (FastMCP)   │ │
│  └────────────┘    └──────────────┘ │
└───────┬──────────────────┬───────────┘
        │                  │
        │ Store            │ Retrieve
        │ Credentials      │ Credentials
        ▼                  ▼
┌──────────────────────────────────────┐
│      GCP Secret Manager              │
│  boomi-mcp-{user-id}-{profile-name}  │
└──────────────────────────────────────┘
                    │
                    │ API Calls
                    ▼
             ┌──────────────┐
             │  Boomi API   │
             └──────────────┘

GitHub Push → Cloud Build (cloudbuild.yaml) → Docker Build (KB pin) → Artifact Registry → Cloud Run

gcloud builds triggers update github 8623a6fa-3295-430a-b018-7c728ba941e8 \
  --project=boomimcp \
  --region=global \
  --build-config=cloudbuild.yaml

# Authenticate with GCP
gcloud auth login
gcloud config set project boomimcp

# Submit the same pipeline that the trigger runs.
# REPO_NAME and COMMIT_SHA are populated by Cloud Build only for
# trigger-driven runs, so pass them explicitly via --substitutions
# when submitting from the CLI.
gcloud builds submit \
  --config=cloudbuild.yaml \
  --substitutions="REPO_NAME=boomi-mcp-server,COMMIT_SHA=$(git rev-parse HEAD)"

# Or use the trigger by pushing
git push origin main

OIDC_CLIENT_ID          # Google OAuth client ID
OIDC_CLIENT_SECRET      # Google OAuth client secret
OIDC_BASE_URL           # https://boomi.renera.ai
SESSION_SECRET          # Session signing key for web UI
MONGODB_URI             # MongoDB Atlas connection string for OAuth state
JWT_SIGNING_KEY         # Stable key for signing MCP JWT tokens
STORAGE_ENCRYPTION_KEY  # Fernet key(s) for encrypting OAuth tokens at rest.
                        # Single value or comma-separated list (newest first)
                        # to enable zero-downtime key rotation via MultiFernet.

BOOMI_RT_GRACE_SECONDS          # default 60. Window during which a just-
                                # rotated refresh token still returns the
                                # same new tokens (defeats one-time-use
                                # replay race). Set 0 to disable.
BOOMI_RT_GRACE_MAX_SIZE         # default 512. LRU capacity for the grace cache.
BOOMI_OAUTH_DIAGNOSTICS_DISABLE # default off (diagnostics ON). Set true to
                                # silence the three OAuth diagnostic log
                                # patches. BOOMI_OAUTH_DIAGNOSTICS=false
                                # also works as a back-compat opt-out.
BOOMI_AUTH_HEAL_CORRUPT_CLIENTS # default true. When get_client raises
                                # InvalidToken/ValidationError, delete the
                                # corrupted MongoDB doc so the client can
                                # re-register cleanly.

BOOMI_TOKEN_CACHE_DISABLE           # default off (cache ON). Set true to
                                    # restore the per-tool-call Google
                                    # tokeninfo/userinfo round trip.
BOOMI_TOKEN_CACHE_TTL_SECONDS       # default 300. Upper bound on per-entry
                                    # TTL; caps Google-revocation latency.
BOOMI_TOKEN_CACHE_MAX_SIZE          # default 256. LRU capacity.
BOOMI_TOKEN_CACHE_SWR               # default false. Opt-in stale-while-
                                    # revalidate against short Google outages.
BOOMI_TOKEN_CACHE_SWR_WINDOW        # default 30. Seconds before expiry at
                                    # which SWR serves stale + refreshes.
BOOMI_TOKEN_CACHE_STALE_IF_ERROR_SECONDS  # default 0 (off); Cloud Run pins =0
                                    # (off). Opt in by raising it. When the
                                    # Google verifier returns None after a cache
                                    # entry expired, serve the last positive
                                    # token for this many seconds past expiry --
                                    # only while the token's own expiry is still
                                    # future. Note: the verifier returns None for
                                    # BOTH transient failures and explicit Google
                                    # rejections, so enabling this extends the
                                    # cache's revocation-latency window (see
                                    # BOOMI_TOKEN_CACHE_TTL_SECONDS) by up to this
                                    # many seconds. Negatives are never cached.

BOOMI_RT_GRACE_SHARED               # default true. Backs the refresh-token
                                    # grace cache with a MongoDB collection
                                    # (mcp-rt-grace, Fernet-encrypted) so
                                    # multi-replica deployments coalesce
                                    # rotations across instances.
BOOMI_RT_GRACE_SHARED_COLLECTION    # default mcp-rt-grace.
BOOMI_RT_GRACE_DISTRIBUTED_LOCK     # default false. Opt-in cross-instance
                                    # singleflight via mcp-rt-inflight-locks.
                                    # Enable only if logs show duplicate
                                    # orig_exchange calls within ms.
BOOMI_RT_GRACE_LOCK_TTL_SECONDS     # default 30. Auto-release safety bound.
BOOMI_RT_GRACE_LOCK_POLL_MS         # default 100. Follower poll interval.

BOOMI_RT_RECOVERY_ENABLED           # default true. Durable recovery of stale
                                    # refresh JWTs that still verify but whose
                                    # storage rows were deleted (hours/days
                                    # later). Uses an encrypted alias ledger
                                    # (mcp-rt-recovery) to mint fresh tokens.
BOOMI_RT_RECOVERY_MAX_AGE_SECONDS   # default 2592000 (30d, matches the sliding
                                    # refresh lifetime). Max durable alias
                                    # lifetime; older stale tokens must re-auth.
BOOMI_RT_RECOVERY_COLLECTION        # default mcp-rt-recovery.
BOOMI_RT_RECOVERY_MAX_HOPS          # default 64 (scaled with the 30d window).
                                    # Max alias-chain depth walked when resolving
                                    # a stale token to its latest live successor.
BOOMI_RT_REFRESH_JWT_LEEWAY_SECONDS # default 60. Clock-skew tolerance on the
                                    # refresh JWT exp, durable-recovery path only.
BOOMI_RT_SLIDING_REFRESH_EXPIRY     # default true. When upstream omits
                                    # refresh_expires_in, stamp the new FastMCP
                                    # refresh token with a fresh sliding window
                                    # (fixes the frozen 30-day expiry).
BOOMI_RT_SLIDING_REFRESH_TTL_SECONDS # default 2592000 (30d). Sliding lifetime.

BOOMI_AUTH_PROTECTION_STRICT        # default true in production / false in
                                    # local. Fail startup if an ENABLED shared-
                                    # grace or durable-recovery backend cannot
                                    # initialize, instead of silently degrading.
BOOMI_RT_PATCH_STRICT               # default true in production / false in
                                    # local. A FastMCP-contract incompatibility
                                    # raises instead of silently leaving
                                    # recovery/sliding unpatched.

SECRETS_BACKEND         # gcp
GCP_PROJECT_ID          # boomimcp

BOOMI_DOCS_ENABLED       # true to register KB tools and resource
BOOMI_DOCS_DB_PATH       # /app/kb/boomi_knowledge_db (in-image corpus path)
BOOMI_DOCS_RELEASE_TAG   # operational marker, mirrors deploy/kb-release.env

BOOMI_MCP_STATELESS_HTTP   # PINNED true in cloudbuild.yaml. Builds the MCP app
                           # with stateless_http=true and skips the stream guard,
                           # session-manager binding, JWT-issuer binding, and
                           # session reaper (none apply without per-instance
                           # sessions). Set false to revert to stateful.
BOOMI_MCP_JSON_RESPONSE    # PINNED true in cloudbuild.yaml (since 2026-06-07).
                           # Honored ONLY in stateless mode; passes
                           # json_response=true so each POST tool result is a
                           # single buffered JSON response instead of SSE-on-POST.
                           # Required: SSE-on-POST large results stalled in the
                           # Cloud Run managed-domain-mapping proxy and hung the
                           # client indefinitely. Set false only to debug.

# Clone repository
git clone https://github.com/RenEra-ai/boomi-mcp-server.git
cd boomi-mcp-server

# Create virtual environment
python3 -m venv .venv
source .venv/bin/activate

# Install dependencies
pip install -r requirements.txt -r requirements-cloud.txt

# Configure environment
cp .env.example .env
# Edit .env with your OAuth credentials

# Set environment variables
export OIDC_CLIENT_ID="your-google-oauth-client-id"
export OIDC_CLIENT_SECRET="your-google-oauth-client-secret"
export OIDC_BASE_URL="http://localhost:8080"
export SESSION_SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
export SECRETS_BACKEND=gcp
export GCP_PROJECT_ID=boomimcp

# Run server
python server_http.py

boomi-mcp-server/
├── server.py                  # Core MCP server (FastMCP, all tool definitions)
├── server_http.py             # HTTP wrapper with OAuth middleware
├── src/boomi_mcp/
│   ├── cloud_secrets.py       # Secret Manager backends (GCP/AWS/Azure)
│   ├── local_secrets.py       # Local filesystem secret backend
│   ├── sanitize.py            # Response sanitization helpers
│   ├── categories/            # Tool category groupings
│   ├── models/                # Pydantic models for SDK payloads
│   ├── utils/                 # Misc utilities
│   └── kb/                    # Boomi Docs knowledge-base (gated by BOOMI_DOCS_ENABLED)
│       ├── service.py         # Search + page retrieval over Chroma corpus
│       ├── manifest.py        # kb://boomi-docs/corpus resource
│       └── errors.py          # KB-specific exception types
├── templates/                 # Jinja2 web UI templates (credentials, login, ...)
├── static/                    # Web UI static assets
├── tests/                     # Unit + integration tests (incl. tests/kb)
├── docs/                      # Specs, plans, runbooks
├── agents/                    # Subagent configs (boomi-qa-tester, ...)
├── examples/                  # Usage examples
├── scripts/                   # Operational scripts
├── local_atom/                # Helpers for the local-atom dev profile
├── requirements.txt           # Core dependencies (FastMCP, ...)
├── requirements-cloud.txt     # Cloud provider SDKs
├── requirements-kb.txt        # KB dependencies (chromadb, sentence-transformers)
├── Dockerfile                 # Multi-stage Docker build (KB pin via ARG)
├── cloudbuild.yaml            # Cloud Build pipeline (pinned KB release)
├── deploy/
│   └── kb-release.env         # Pinned knowledge-base release tag
└── README.md                  # This file

# Recent logs
gcloud run services logs read boomi-mcp-server \
  --region us-central1 --limit 50 --project boomimcp

# Follow logs in real-time
gcloud run services logs tail boomi-mcp-server \
  --region us-central1 --project boomimcp

# Check service status
gcloud run services describe boomi-mcp-server \
  --region us-central1 --project boomimcp

curl https://boomi.renera.ai/

claude mcp list

curl -u "BOOMI_TOKEN.email@example.com:your-token" \
  "https://api.boomi.com/api/rest/v1/YOUR_ACCOUNT_ID/Account/YOUR_ACCOUNT_ID"