Metadata-Version: 2.5
Name: orionbelt-semantic-layer-mcp
Version: 2.26.1
Summary: Thin MCP server for OrionBelt Semantic Layer — delegates to REST API
Project-URL: Homepage, https://github.com/ralforion/orionbelt-semantic-layer-mcp
Project-URL: Repository, https://github.com/ralforion/orionbelt-semantic-layer-mcp
Project-URL: Issues, https://github.com/ralforion/orionbelt-semantic-layer-mcp/issues
Author-email: "Ralf Becher, RALFORION d.o.o." <info@ralforion.com>
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: llm,mcp,orionbelt,semantic-layer
Classifier: Development Status :: 5 - Production/Stable
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.12
Requires-Dist: fastmcp<4,>=3.4
Requires-Dist: httpx<1,>=0.28
Requires-Dist: pydantic-settings<3,>=2.12
Description-Content-Type: text/markdown

<!-- mcp-name: io.github.ralforion/orionbelt-semantic-layer-mcp -->
<p align="center">
  <img src="https://raw.githubusercontent.com/ralforion/orionbelt-semantic-layer-mcp/main/docs/assets/ORIONBELT_Logo.png" alt="OrionBelt® Logo" width="400">
</p>

<h1 align="center">OrionBelt® Semantic Layer MCP</h1>

<p align="center"><strong>Thin MCP server that delegates to the OrionBelt® Semantic Layer REST API</strong></p>

[![Version 2.26.1](https://img.shields.io/badge/version-2.26.1-purple.svg)](https://github.com/ralforion/orionbelt-semantic-layer-mcp/releases)
[![OrionBelt® Semantic Layer 2.26](https://img.shields.io/badge/OrionBelt_Semantic_Layer-2.26-0054A6.svg)](https://github.com/ralforion/orionbelt-semantic-layer)
[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/ralforion/orionbelt-semantic-layer-mcp/blob/main/LICENSE)
[![FastMCP](https://img.shields.io/badge/FastMCP-3.4+-8A2BE2)](https://gofastmcp.com)
[![Pydantic v2](https://img.shields.io/badge/Pydantic-v2-E92063.svg?logo=pydantic&logoColor=white)](https://docs.pydantic.dev)
[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://docs.astral.sh/ruff/)

[![BigQuery](https://img.shields.io/badge/BigQuery-669DF6.svg?logo=googlebigquery&logoColor=white)](https://cloud.google.com/bigquery)
[![PostgreSQL](https://img.shields.io/badge/PostgreSQL-4169E1.svg?logo=postgresql&logoColor=white)](https://www.postgresql.org)
[![Snowflake](https://img.shields.io/badge/Snowflake-29B5E8.svg?logo=snowflake&logoColor=white)](https://www.snowflake.com)
[![ClickHouse](https://img.shields.io/badge/ClickHouse-FFCC01.svg?logo=clickhouse&logoColor=black)](https://clickhouse.com)
[![Dremio](https://img.shields.io/badge/Dremio-31B48D.svg)](https://www.dremio.com)
[![Databricks](https://img.shields.io/badge/Databricks-FF3621.svg?logo=databricks&logoColor=white)](https://www.databricks.com)
[![DuckDB](https://img.shields.io/badge/DuckDB-FFF000.svg?logo=duckdb&logoColor=black)](https://duckdb.org)
[![MySQL](https://img.shields.io/badge/MySQL-4479A1.svg?logo=mysql&logoColor=white)](https://www.mysql.com)

[![Docker Hub](https://img.shields.io/docker/v/ralforion/orionbelt-semantic-layer-mcp?logo=docker&logoColor=white&label=Docker%20Hub&color=2496ED&sort=semver)](https://hub.docker.com/r/ralforion/orionbelt-semantic-layer-mcp/tags)
[![Docker pulls](https://img.shields.io/docker/pulls/ralforion/orionbelt-semantic-layer-mcp?logo=docker&logoColor=white&color=2496ED)](https://hub.docker.com/r/ralforion/orionbelt-semantic-layer-mcp)
[![Image size](https://img.shields.io/docker/image-size/ralforion/orionbelt-semantic-layer-mcp/latest?logo=docker&logoColor=white&color=2496ED)](https://hub.docker.com/r/ralforion/orionbelt-semantic-layer-mcp/tags)

A thin MCP server that delegates all business logic to the [OrionBelt® Semantic Layer](https://github.com/ralforion/orionbelt-semantic-layer) REST API via HTTP. No embedded engine — pure API pass-through.

## Architecture

The OrionBelt® Semantic Layer platform has two deployment modes. This MCP server supports both:

- **Standalone** — Deploy the [OrionBelt® Semantic Layer API](https://github.com/ralforion/orionbelt-semantic-layer) anywhere (Cloud Run, Docker, localhost) and point this MCP server at it via `API_BASE_URL`.
- **Hosted** — Connect to the public Cloud Run deployment with zero local setup (see [Hosted MCP Server](#hosted-mcp-server) below).

```
┌────────────┐       ┌──────────────────────────────────────────────────────┐
│ LLM Client │       │                OrionBelt® Platform                   │
│            │       │                                                      │
│  Claude,   │──MCP──│──> server.py  ──HTTP /v1──>  Semantic Layer REST API │
│  Cursor,   │       │    (FastMCP                   (FastAPI: parse OBML,  │
│  any MCP   │       │     + httpx)                   validate, compile     │
│  client    │       │                                to SQL)               │
└────────────┘       └──────────────────────────────────────────────────────┘
```

- **No business logic** — all tool calls delegate to the REST API (v1 endpoints)
- **Dual-mode** — auto-detects single-model or multi-model API mode at startup
- **Auto-session management** — creates an API session on first tool call, caches the ID (multi-model mode)
- **16 tools** (single-model mode) or **20 tools** (multi-model mode) for querying (QueryObject), execution, batch, discovery, composability (ACR), examples, diagrams, RDF/SPARQL, OSI export, and OBML reference + function catalog + JSON schemas. (21 distinct tools exist in total; the API mode selects which subset is active — they overlap in 15 — and no client ever sees all 21 at once.) The visible surface is narrowed further in the design-time phase and when query execution is disabled (see [Design-time vs run-time tool switching](#design-time-vs-run-time-tool-switching))
- **4 prompts + 2 resources** for OBML / OBSQL reference and usage guidance

<p align="center">
  <img src="https://raw.githubusercontent.com/ralforion/orionbelt-semantic-layer-mcp/main/docs/assets/architecture.png" alt="OrionBelt® Analytics Architecture" width="900">
</p>

## Live Demo

A public demo of the OrionBelt® Semantic Layer API is available at:

> **API endpoint:** `https://orionbelt.ralforion.com` — [Swagger UI](https://orionbelt.ralforion.com/docs) | [ReDoc](https://orionbelt.ralforion.com/redoc) | [Gradio UI](https://orionbelt.ralforion.com/ui/?__theme=dark)

Set `API_BASE_URL=https://orionbelt.ralforion.com` in your `.env` file to use it (see `.env.example`).

## Installation

```bash
uv sync
```

For development (includes pytest, respx, ruff):

```bash
uv sync --all-groups
```

## Usage

### stdio (default)

```bash
uv run server.py
```

### HTTP transport

```bash
MCP_TRANSPORT=http uv run python server.py
```

The HTTP transport runs **stateless** by default (`MCP_STATELESS_HTTP=true`):
every request is self-contained, with no `Mcp-Session-Id`, no stream
resumability, and no server-initiated messages. Nothing here needs that state —
the tool phase is derived from explicit loaded-model state rather than from the
connection, and no tool sends progress, sampling, or elicitation requests — so
instances can sit behind a load balancer without session affinity. Set
`MCP_STATELESS_HTTP=false` to restore per-connection sessions; `sse` always runs
stateful, since it is a long-lived per-connection stream.

Note this is the *transport* session only. The upstream API session and the set
of loaded models remain process-global and shared by every client of an
instance, unchanged by this flag.

### MCP client configuration

Add to your MCP client config (e.g. `claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "orionbelt": {
      "command": "uv",
      "args": ["run", "python", "server.py"],
      "cwd": "/path/to/orionbelt-semantic-layer-mcp"
    }
  }
}
```

## Configuration

Environment variables or `.env` file (pydantic-settings). See `.env.example` for defaults.

| Variable          | Default      | Description                           |
| ----------------- | ------------ | ------------------------------------- |
| `API_BASE_URL`    | — (required) | OrionBelt® Semantic Layer REST API URL |
| `API_KEY`         | — (unset)    | API credential; required only when the API runs with `AUTH_MODE=api_key` |
| `API_KEY_HEADER`  | `X-API-Key`  | Header the credential is sent in; must match the API's `API_KEY_HEADER` |
| `MCP_TRANSPORT`   | `stdio`      | `stdio`, `http`, or `sse`             |
| `MCP_SERVER_HOST` | `localhost`  | Bind host for HTTP/SSE                |
| `MCP_SERVER_PORT` | `9000`       | Bind port for HTTP/SSE                |
| `MCP_STATELESS_HTTP` | `true`    | Run the HTTP transport without a per-connection MCP session (no `Mcp-Session-Id`, no stream resumability) so instances scale without session affinity. Ignored for stdio; forced off for `sse` |
| `LOG_LEVEL`       | `INFO`       | Logging level                         |
| `API_TIMEOUT`     | `30`         | HTTP timeout in seconds               |

## Tools

### Model lifecycle

| MCP Tool                        | Description                                                      |
| ------------------------------- | ---------------------------------------------------------------- |
| `get_obml_reference()`          | Returns the full OBML format specification                       |
| `load_model(model? \| osi_yaml?, dedup=True)` | Parse, validate, and store a model (returns health + model_load). Pass `model` (OBML JSON) **or** `osi_yaml` (OSI YAML, converted to OBML server-side) |
| `describe_model(model_id)`      | Inspect data objects, dimensions, measures, metrics              |
| `remove_model(model_id)`        | Remove a model from the current session                          |
| `list_models()`                 | List all models loaded in the current session                    |
| `export_model_to_osi(model_id, ...)` | Export a loaded model as OSI YAML                                |

### Model discovery

| MCP Tool                                 | Description                                                                                      |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------ |
| `find_artefacts(model_id, query?, kind?, name?)` | Look up artefacts. With `query` → **fuzzy, ranked search** (resolve a vague term: exact / synonym / fuzzy). Without `query` → **exact, deterministic lookup** (all artefacts, one kind, or one named artefact, full records) |
| `explain_artefact(model_id, name)`       | Explain lineage of a dimension, measure, or metric                                               |
| `list_examples(model_id, intent?)`       | List authored example queries (filterable by intent tag)                                         |
| `get_example(model_id, name)`            | Get one example with query + compiled SQL preview                                                |
| `get_join_graph(model_id)`               | Return the join graph as an adjacency list                                                       |
| `find_composables(query_json?, anchors?, anchor_type?, model_id?)` | **ACR** — given an in-progress query or named anchor(s), return the dimensions/measures/metrics that still compose into a valid, fanout-free result (plus CFL candidates). Guaranteed to compile |

### Query, execution & diagrams

| MCP Tool                      | Description                                             |
| ----------------------------- | ------------------------------------------------------- |
| `execute_query(...)`          | Compile and execute a QueryObject, returning SQL + rows |
| `run_batch(queries, ...)`     | One-shot: load a model + run N queries in parallel      |
| `get_model_diagram(model_id)` | Generate a Mermaid ER diagram for a loaded model        |

### Semantic graph (RDF / SPARQL)

| MCP Tool                                      | Description                                 |
| --------------------------------------------- | ------------------------------------------- |
| `get_model_graph(model_id)`                   | Return the model as OBSL-Core RDF (Turtle)  |
| `query_model_graph_by_sparql(query, ...)`     | Run a read-only SPARQL query (SELECT / ASK) |

### References

| MCP Tool                  | Description                                             |
| ------------------------- | ------------------------------------------------------- |
| `get_obml_reference()`    | OBML (model authoring) grammar reference                |
| `get_function_catalog()`  | Portable scalar functions usable in OBML expressions, with their pinned cross-dialect semantics |
| `get_json_schema(name)`   | JSON Schema for `obml` (model) or `query` (QueryObject) |

### Utilities

| MCP Tool          | Description                                  |
| ----------------- | -------------------------------------------- |
| `list_dialects()` | List available SQL dialects and capabilities |

## Design-time vs run-time tool switching

The server presents a **phase-scoped tool surface**: instead of listing all
all tools at once, it shows only the tools that make sense for where you are in
the model lifecycle. About half the tools are meaningless until a model is
loaded (`execute_query`, `describe_model`, `find_artefacts`, …) and the rest are
about authoring or reference (`get_obml_reference`, `get_function_catalog`,
`get_json_schema`, `list_dialects`). Splitting them keeps the surface small and prevents a
whole class of error — calling a query tool with no model loaded.

### Three buckets, swapped by phase

Tools fall into three buckets. The visible surface is a **swap** at the
load/unload transition, not additive — the run phase does **not** show the
design/reference tools:

| Bucket          | Listed when                 | Tools                                                                                                                                                                                                                                                                                             |
| --------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Always**      | always (both phases)        | `load_model`, `remove_model` (transition verbs — stay available in the run phase so a second model can be loaded mid-session, up to `max_models_per_session`); `run_batch` (self-contained one-shot — loads/references a model inline, so it needs no prior session state); `get_json_schema` (QueryObject/OBML schemas — needed in both phases) |
| **Design-only** | only when no model loaded   | `get_obml_reference`, `get_function_catalog`, `list_dialects`                                                                                                          |
| **Run-only**    | only when a model is loaded | `describe_model`, `get_model_diagram`, `find_artefacts`, `explain_artefact`, `execute_query`, `list_examples`, `get_example`, `get_model_graph`, `get_join_graph`, `find_composables`, `query_model_graph_by_sparql`, `list_models`, `export_model_to_osi` |

```
                       load_model  (returns "re-list" signal)
   ┌─────────────────┐ ────────────────────────────────▶ ┌───────────────┐
   │ design phase    │                                   │ run phase     │
   │ always + design │ ◀───────────────────────────────  │ always + run  │
   └─────────────────┘  remove_model (last model) / TTL  └───────────────┘
                        expiry — back to design phase
```

So **design phase → always + design-only**, **run phase → always + run-only**.
Design/reference tools are hidden once a model is loaded, keeping the run
surface focused on querying.

### Re-listing

The MCP `tools/list` response is filtered to the active phase. Because the
stateless MCP spec makes push notifications (`notifications/tools/list_changed`)
unreliable, transitions are **pull-based**: `load_model` (design → run) and
`remove_model` (run → design, once no models remain) return a short signal
telling the client to **re-list its tools** and pick up the swapped surface.

### Guard against premature calls

If a client calls a run-only verb while still in the design phase (e.g. a stale
host that hasn't re-listed yet), the server returns a **structured error**
rather than an opaque failure:

> No model loaded — '`execute_query`' is a run-time tool and is not available
> yet. Call `load_model` first, then re-list tools.

### Capability gating (orthogonal to phase)

Separately from lifecycle phase, a tool can be hidden because the server is
_configured_ not to support it. The execution tool `execute_query` is gated on
the API's `query_execute` capability: when the server runs **compile-only** it is
dropped from `tools/list` and calling it returns a structured error. This
composes with phase — a verb is listed only if its **phase is active _and_ its
capability is enabled**. The mechanism is a general capability registry, so
future "the server can't do X here" flags hide their tools the same way.

### Single-model mode

When the API runs in **single-model mode** a model is pre-loaded at startup, so
the server is permanently in the run-time phase — every applicable tool is
listed from the first request and there is no `load_model` step.

> **Note on caching hints.** The `2026-07-28` MCP spec adds `ttlMs` / `cacheScope`
> hints on `tools/list` (SEP-2549). These are intentionally **not** set yet — the
> fields are a release candidate, and FastMCP's list-tools hook exposes only the
> tool list, not the result envelope. The explicit re-list signal above is the
> primary (and spec-recommended) transition mechanism in the meantime.

## Supported SQL Dialects

`postgres`, `snowflake`, `clickhouse`, `databricks`, `dremio`, `bigquery`, `duckdb`

## Workflow

1. **Get reference** — call `get_obml_reference()` to learn OBML syntax
2. **Load model** — call `load_model(model_yaml)` to get a `model_id`
3. **Explore** — call `describe_model(model_id)` or use discovery tools (`find_artefacts`, `explain_artefact`)
4. **Execute** — call `execute_query(model_id, query_json='{"select": {"dimensions": [...], "measures": [...]}}')` to compile and run SQL, returning rows (requires `QUERY_EXECUTE=true` on the API; see `get_json_schema("query")` for the QueryObject shape)

## Integration Guides

Use the OrionBelt® Semantic Layer MCP server with popular AI agent frameworks and automation platforms:

| Framework             | Transport        | Guide                                                                            |
| --------------------- | ---------------- | -------------------------------------------------------------------------------- |
| **OpenAI Agents SDK** | stdio, HTTP, SSE | [docs/integrations/openai-agents-sdk.md](docs/integrations/openai-agents-sdk.md) |
| **LangChain**         | stdio, HTTP      | [docs/integrations/langchain.md](docs/integrations/langchain.md)                 |
| **Google ADK**        | stdio, HTTP, SSE | [docs/integrations/google-adk.md](docs/integrations/google-adk.md)               |
| **n8n**               | HTTP, SSE        | [docs/integrations/n8n.md](docs/integrations/n8n.md)                             |
| **CrewAI**            | stdio, HTTP      | [docs/integrations/crewai.md](docs/integrations/crewai.md)                       |

Each guide includes quick-start examples, multi-agent patterns, and connection options for both the hosted demo and self-hosted deployments.

## Development

```bash
# Run tests
uv run pytest

# Lint and format
uv run ruff check server.py
uv run ruff format server.py tests/

# Set up pre-commit hooks (recommended)
./scripts/setup-hooks.sh
```

### GitHub Actions pinning

Every `uses:` in `.github/workflows` is pinned to a 40-character commit SHA with
a comment naming the exact patch release it was cut from:

```yaml
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
```

A tag such as `v7` is a movable label — the action's owner can repoint it at any
time, so `@v7` runs whatever commit it happens to name when the job starts. A
SHA cannot move. Every workflow also starts read-only (`permissions: contents:
read`), with write scopes granted on the single job that needs them (only
`id-token: write`, on the PyPI publish job).

Pinning makes each reference unreadable, though, and nothing inherently keeps a
SHA and the comment beside it in agreement: a pull request could swap the hash
for one taken from a fork, leave `# v7.0.1` untouched, and the diff would look
like a routine dependency bump. `scripts/check-action-pins.sh` closes that gap.
It requires a real SHA, an owner on its `ALLOWED_OWNERS` allowlist, and a
version comment naming an exact patch release, then resolves that tag upstream
with `git ls-remote` and fails if the commit it names is not the one pinned.

```bash
./scripts/check-action-pins.sh            # every check, including upstream lookups
./scripts/check-action-pins.sh --offline  # skip the network; SHA and comment format only
```

It runs as the `pins` job in CI, and again as the first step after checkout in
both tag-triggered publish workflows, so no release ships artifacts built by
steps whose pins were never verified. Bumping an action means updating the SHA
and its comment together; add a new action's owner to `ALLOWED_OWNERS`
deliberately, since a pin verifies against its own tag no matter who published
it.

### Release Process

The release script (`scripts/release.sh`) includes comprehensive pre-flight checks to prevent issues like the v2.8.2 formatting problem:

- **Code formatting check** - Ensures `ruff format` passes
- **Linting check** - Ensures `ruff check` passes
- **CI status check** - Warns if CI is not green
- **Test suite** - Runs all tests
- **Version consistency** - Verifies version across files
- **Changelog** - Ensures changelog entry exists

Pre-commit hooks are available to catch issues early. Run `./scripts/setup-hooks.sh` to install them.

## Hosted MCP Server

A public hosted instance of this MCP server runs on Google Cloud Run, connected
to the live OrionBelt® Semantic Layer demo API. No local install, no API key.

### Endpoint

```
https://orionbelt.ralforion.com/mcp
```

Streamable HTTP (MCP spec 2025-03-26). Stateful — clients should send the
`initialize` handshake and reuse the returned `Mcp-Session-Id` header.

### Quick start with Claude Desktop

Claude Desktop's config schema accepts only stdio launchers — for a remote
MCP server, use the [`mcp-remote`](https://www.npmjs.com/package/mcp-remote)
stdio↔HTTP bridge (auto-fetched by `npx`, no manual install).

Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
or `%APPDATA%\Claude\claude_desktop_config.json` (Windows) and add:

```json
{
  "mcpServers": {
    "orionbelt": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://orionbelt.ralforion.com/mcp",
        "--transport",
        "http"
      ]
    }
  }
}
```

Fully quit Claude Desktop (⌘Q on macOS — closing the window isn't enough) and
reopen. The OrionBelt® tools then appear in the tools menu.

Alternatively, in newer Claude Desktop builds: **Settings → Connectors → Add
custom connector**, paste the URL above. No file editing or `npx` required.

> **Why `mcp-remote`?** Claude Desktop's `claude_desktop_config.json` schema
> currently only validates stdio entries (`command` + `args`). A bare
> `{"url": "…"}` entry is rejected with _"not valid MCP server configurations
> and were skipped"_. `mcp-remote` runs a local stdio bridge that forwards to
> the HTTPS endpoint, so Claude Desktop sees a normal stdio server. **Claude
> Code** does support `{"type": "url", "url": "…"}` natively — see below.

### Quick start with Claude Code

Add to `.mcp.json` in any repo (or `~/.config/claude-code/.mcp.json` globally):

```json
{
  "mcpServers": {
    "orionbelt": {
      "type": "url",
      "url": "https://orionbelt.ralforion.com/mcp"
    }
  }
}
```

### Other MCP clients

Any client that supports Streamable HTTP transport (MCP spec 2025-03-26) can
point at the URL above. The endpoint accepts `POST /mcp` with
`Accept: application/json, text/event-stream`. See
[`tests/cloudrun/test_mcp_cloudrun.sh`](tests/cloudrun/test_mcp_cloudrun.sh)
for a stdlib-only Python smoke test that walks the full handshake.

### Notes

- The hosted instance scales to zero when idle, so the first request after a
  cold period takes ~1–2 seconds longer.
- It connects to the public demo API at `https://orionbelt.ralforion.com` — same data,
  same dialects, no authentication. Don't load production data through it.
- For self-hosting, see the [Installation](#installation) section above and
  the [`Dockerfile`](Dockerfile).

## License

Copyright 2026 [RALFORION d.o.o.](https://ralforion.com)

Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.

### Third-party licenses

The PyPI package ships only `server.py` — its dependencies are declared, not
bundled, so it redistributes no third-party code.

The Docker image does bundle them, and carries their licenses in three places:

| In the image | Covers |
|---|---|
| `/app/.venv/lib/*/site-packages/*.dist-info/licenses/` | each Python package, as its author shipped it |
| `/app/LICENSES-THIRD-PARTY.txt` | the same texts aggregated into one file |
| `/usr/share/doc/*/copyright` | the Debian base packages inherited from `python:3.14-slim` |

The aggregate is generated at build time from the synced virtualenv, so it is
derived from `uv.lock` and cannot drift. To read the one an image actually
carries — the ground truth for any given tag:

```bash
docker run --rm --entrypoint cat ralforion/orionbelt-semantic-layer-mcp:latest \
    /app/LICENSES-THIRD-PARTY.txt
```

To review the set before a release without building the image, run
`./scripts/gen-third-party-licenses.sh`. It resolves for the image's target
(Linux / CPython 3.14) rather than for your host, so the package set matches
what ships — a host-resolved run on macOS would silently omit `jeepney` and
`SecretStorage`.

**The Python dependencies are all permissive** — MIT, BSD, Apache-2.0, ISC,
Unlicense, PSF-2.0, and MPL-2.0 for `certifi`. None is copyleft, and none
reaches the server's own code.

**The Debian base is a separate matter.** `python:3.14-slim` brings ~87 system
packages, many of them GPL/LGPL (`coreutils`, `libc6`, `bash`, …), exactly as
every Debian-based image does. They are unmodified upstream packages invoked as
ordinary OS components, not linked into or derived from this server, and their
licenses and written-offer text ship in the image under `/usr/share/doc/` and
`/usr/share/common-licenses/`. If your distribution policy needs to avoid them
entirely, rebuild `FROM` a distroless or Alpine base.

---

<p align="center">
  <a href="https://ralforion.com">
    <img src="https://raw.githubusercontent.com/ralforion/orionbelt-semantic-layer-mcp/main/docs/assets/RALFORION_doo_Logo.png" alt="RALFORION d.o.o." width="200">
  </a>
</p>

<p align="center">
  Copyright © 2026 RALFORION d.o.o.
  <br>
  OrionBelt® is a registered trademark of RALFORION d.o.o.
</p>
