feat(mcp): serve OpenAI Apps SDK domain-verification token from env by calebevans-ab · Pull Request #1471 · airbytehq/PyAirbyte

Caleb Evans (calebevans-ab) · 2026-11-13T00:02:59Z

Summary

OpenAI's Apps SDK verifies ownership of an MCP server's host by fetching a token, as plain text, from /.well-known/openai-apps-challenge. The hosted Airbyte MCP (mcp.airbyte.com) currently 404s there, blocking the Apps directory submission (Slack thread, AGENTIC-2419).

This adds an env-driven route to the HTTP MCP server, next to /health:

OPENAI_APPS_CHALLENGE_TOKEN_ENV = "AIRBYTE_MCP_OPENAI_APPS_CHALLENGE_TOKEN"
OPENAI_APPS_CHALLENGE_PATH = "/.well-known/openai-apps-challenge"

@app.custom_route(OPENAI_APPS_CHALLENGE_PATH, methods=["GET"])
async def openai_apps_challenge(request) -> PlainTextResponse:
    token = os.getenv(OPENAI_APPS_CHALLENGE_TOKEN_ENV, "").strip()
    if not token:
        return PlainTextResponse("Not Found", status_code=404)
    return PlainTextResponse(token)

The route is always registered but reads the env var per request; when unset the path stays a 404, so stdio, local and self-hosted deployments see no change. Registering unconditionally (rather than only when the var is set at import time) keeps the behavior testable with monkeypatch and avoids import-order coupling.
The token is public by design (OpenAI reads it over the internet), so it is a plain deployment env var, not a secret. The value for mcp.airbyte.com is set in the Cloud MCP deploy workflow in airbyte-platform-internal (companion PR).
Env var documented in airbyte.mcp and airbyte.mcp.http_main module docstrings.

Tests

tests/unit_tests/test_mcp_http.py: configured token is returned verbatim (stripped) as text/plain with 200; unset var yields 404.

uv run pytest tests/unit_tests/test_mcp_http.py tests/unit_tests/test_mcp_http_main.py -q
35 passed, 13 warnings in 40.03s
uv run ruff check / ruff format --check  → All checks passed! / already formatted
uv run pyrefly check → 0 errors

Requested by Caleb Evans (@calebevans-ab).

Link to Devin session: https://app.devin.ai/sessions/9215bf131c41438ba2c01d6b3277117a
Open in Devin Desktop: https://app.devin.ai/desktop/session/9215bf131c41438ba2c01d6b3277117a?variant=devin

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration · 2026-11-13T00:03:03Z

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

Disable automatic comment, CI, and merge conflict monitoring

linear-code · 2026-11-13T00:03:13Z

AGENTIC-2419

github-actions · 2026-11-13T00:03:19Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1794527890-openai-apps-challenge' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1794527890-openai-apps-challenge'

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

/fix-pr - Fixes most formatting and linting issues
/uv-lock - Updates uv.lock file
/test-pr - Runs tests with the updated PyAirbyte
/prerelease - Builds and publishes a prerelease version to PyPI
/evals - Runs the Cloud MCP evals that use the MCP tools this PR changed (/evals full=true runs the full suite)

📚 Show Repo Guidance

Helpful Resources

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

chatgpt-codex-connector · 2026-11-13T00:03:41Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T00:23:14.646801Z	`e70cca2`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

devin-ai-integration · 2026-11-13T00:04:12Z

Devin Review

🟢 Devin Review found nothing to fix · View findings

github-code-quality · 2026-11-13T00:08:38Z

Code coverage overview

Languages: Python

Python / code-coverage/pytest-no-creds

release-candidate/v1 d9f652f	devin/1794527890-ope... e70cca2	+/-
65%	81%	+16%

View coverage of the 10 most impacted files.

File	release-candidate/v1 d9f652f	devin/1794527890-ope... e70cca2	+/-
`airbyte/_util/api_util.py`	36%	68%	+32%
`airbyte/mcp/cloud.py`	52%	87%	+35%
`airbyte/cloud/connectors.py`	34%	81%	+47%
`airbyte/cloud/connections.py`	26%	76%	+50%
`airbyte/mcp/_datadog.py`	0%	50%	+50%
`airbyte/mcp/_telemetry.py`	0%	94%	+94%
`airbyte/cloud/c...lder/project.py`	0%	94%	+94%
`airbyte/_direct...ctors/models.py`	0%	95%	+95%
`airbyte/mcp/_sso_auth.py`	0%	96%	+96%
`airbyte/cloud/models.py`	0%	96%	+96%

Python / code-coverage/pytest

release-candidate/v1 d9f652f	devin/1794527890-ope... e70cca2	+/-
71%	83%	+12%

View coverage of the 10 most impacted files.

File	release-candidate/v1 d9f652f	devin/1794527890-ope... e70cca2	+/-
`airbyte/cloud/connectors.py`	51%	84%	+33%
`airbyte/mcp/cloud.py`	52%	87%	+35%
`airbyte/cloud/connections.py`	34%	78%	+44%
`airbyte/mcp/_datadog.py`	0%	50%	+50%
`airbyte/mcp/_telemetry.py`	0%	94%	+94%
`airbyte/cloud/c...lder/project.py`	0%	94%	+94%
`airbyte/_direct...ctors/models.py`	0%	95%	+95%
`airbyte/mcp/_sso_auth.py`	0%	96%	+96%
`airbyte/cloud/models.py`	0%	96%	+96%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%

Python / code-coverage/pytest-unit

release-candidate/v1	devin/1794527890-ope... e70cca2	+/-
—	78%	—

Line coverage data for the release-candidate/v1 branch is not yet available.

View coverage of the 10 most covered files.

File	release-candidate/v1	devin/1794527890-ope... e70cca2	+/-
`airbyte/mcp/_sso_auth.py`	—	96%	—
`airbyte/cloud/models.py`	—	96%	—
`airbyte/_direct...ctors/models.py`	—	95%	—
`airbyte/cloud/client.py`	—	91%	—
`airbyte/mcp/cloud.py`	—	87%	—
`airbyte/cloud/connectors.py`	—	81%	—
`airbyte/progress.py`	—	80%	—
`airbyte/cloud/connections.py`	—	76%	—
`airbyte/_util/api_util.py`	—	68%	—
`airbyte/shared/...ql_processor.py`	—	68%	—

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated November 13, 2026 00:13 UTC}

Caleb Evans (calebevans-ab) · 2026-11-13T00:21:42Z

Codex (@codex) review

chatgpt-codex-connector · 2026-11-13T00:23:13Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: e70cca23cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

feat(mcp): serve OpenAI Apps SDK domain-verification token from env

e70cca2

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration Bot assigned Caleb Evans (calebevans-ab) Nov 13, 2026

Caleb Evans (calebevans-ab) marked this pull request as ready for review November 13, 2026 00:03

devin-ai-integration Bot reviewed Nov 13, 2026

View reviewed changes

Caleb Evans (calebevans-ab) merged commit 1a4ad47 into release-candidate/v1 Nov 13, 2026
33 checks passed

Caleb Evans (calebevans-ab) deleted the devin/1794527890-openai-apps-challenge branch November 13, 2026 00:23

Navigation Menu

Repository navigation

feat(mcp): serve OpenAI Apps SDK domain-verification token from env - #1471

feat(mcp): serve OpenAI Apps SDK domain-verification token from env#1471
Caleb Evans (calebevans-ab) merged 1 commit into
release-candidate/v1from
devin/1794527890-openai-apps-challenge

Caleb Evans (calebevans-ab) commented Nov 13, 2026

Uh oh!

devin-ai-integration Bot commented Nov 13, 2026

Uh oh!

linear-code Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026

Testing This PyAirbyte Version

PR Slash Commands

Helpful Resources

Community Support

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot commented Nov 13, 2026

Uh oh!

github-code-quality Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

Caleb Evans (calebevans-ab) commented Nov 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Caleb Evans (calebevans-ab) commented Nov 13, 2026

Summary

Tests

Uh oh!

devin-ai-integration Bot commented Nov 13, 2026

Uh oh!

linear-code Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026

👋 Greetings, Airbyte Team Member!

Testing This PyAirbyte Version

PR Slash Commands

Helpful Resources

Community Support

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

devin-ai-integration Bot commented Nov 13, 2026

Devin Review

Uh oh!

github-code-quality Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

Python / code-coverage/pytest-no-creds

Python / code-coverage/pytest

Python / code-coverage/pytest-unit

Uh oh!

Caleb Evans (calebevans-ab) commented Nov 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Nov 13, 2026 •

edited

Loading

github-code-quality Bot commented Nov 13, 2026 •

edited

Loading