Add OCI Streaming with Apache Kafka MCP server

[BhaumikAbhishek]

Adds oracle.oci-kafka-mcp-server, a comprehensive MCP server for managing OCI Streaming with Apache Kafka clusters via AI agents.

Features:

• 42 MCP tools spanning Kafka data plane and OCI control plane
• Data plane: topics, consumers, observability, AI diagnostics
• Control plane: cluster lifecycle (create/scale/delete), cluster configurations with versioning, superuser management, work requests
• Security: SASL/SCRAM-512, SASL/PLAIN, mTLS Kafka authentication; OCI API key auth via ~/.oci/config
• Policy guard: three-tier risk model (LOW/MEDIUM/HIGH) with --allow-writes flag for write operations and confirmation required for destructive HIGH-risk operations
• Audit logging: structured JSON log for every tool execution
• Circuit breaker: prevents cascading failures on broker unavailability
• Compartment auto-discovery: falls back to tenancy OCID from OCI config when OCI_COMPARTMENT_ID env var is not set
• Read-only by default; --allow-writes enables write tools

Validation steps:
uvx oracle.oci-kafka-mcp-server # read-only mode
uvx oracle.oci-kafka-mcp-server --allow-writes # write mode
uv run pytest # 92 tests pass

Description

Adds oracle.oci-kafka-mcp-server, a new MCP server that enables AI agents to manage OCI Streaming with Apache Kafka clusters through structured tool execution.

Fixes # 155
This server covers both the Kafka data plane (topics, consumer groups, observability, AI-assisted diagnostics) and the OCI control plane (cluster lifecycle, versioned cluster configurations, superuser management, async work request tracking). It supports secure Kafka connectivity via SASL/SCRAM-512, and mTLS, and authenticates to the OCI control plane via ~/.oci/config.

Dependencies required:

mcp>=1.0.0 — MCP Python SDK (FastMCP)
confluent-kafka>=2.6.0 — Kafka data plane client
oci>=2.130.0 — OCI Python SDK for control plane
pydantic>=2.0.0, pydantic-settings>=2.0.0 — configuration management

Type of change

Please delete options that are not relevant.

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• Test A
• Test B

Test A — Unit tests (92 tests, no broker required):

cd src/oci-kafka-mcp-server
uv run pytest # all 92 tests pass
uv run pytest --cov-fail-under=45

Test B — Server startup validation:

uvx oracle.oci-kafka-mcp-server # starts in read-only mode
uvx oracle.oci-kafka-mcp-server --allow-writes # starts with write tools enabled

Test Configuration:
SDK: OCI Python SDK oci>=2.130.0, MCP SDK mcp>=1.0.0, confluent-kafka >=2.6.0
Toolchain: Python 3.11, 3.12, 3.13 (tested via CI matrix)
OCI Auth: ~/.oci/config with DEFAULT profile

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• PR author: bhaumik.abhishek@gmail.com (@BhaumikAbhishek)

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.