Kyvos Model Context Protocol (MCP) Server

The Kyvos MCP Server is a server-side component that connects the Kyvos platform with the Model Context Protocol (MCP) client-server architecture. The server supports both SSE and STDIO communication modes and allows secure authentication using user-provided Kyvos credentials (basic and OAuth2.0). It accepts natural language (NL) queries, translates them into executable SQL, and retrieves results from the Kyvos engine. This setup allows users to query Kyvos semantic models using natural language, enabling AI-driven insights without the need for advanced technical skills.

Authentication Support

To ensure secure integration and access, the Kyvos MCP Server supports the following authentication mechanisms:

Basic Authentication
Using a valid username and password combination.
OAuth 2.0 Authentication
For token-based secure access, suitable for enterprise-grade deployments.

Supported Deployment Modes

Kyvos MCP Server can be deployed in the following communication modes:

Local Mode
- Server-Sent Events (SSE)
- Standard Input/Output (STDIO)
Remote Mode
- SSE only

This flexibility allows integration in a variety of system architectures, including containerized environments or remote LLM agents.

The MCP Kyvos Server enables agentic applications to interact with the Kyvos platform for querying business data. It supports two transport modes:

SSE (Server-Sent Events): This transport is suited for remote integrations. It uses HTTP requests for communication. It allows servers to handle multiple client connections efficiently. SSE mode supports both Basic and OAuth authorization. OAuth requires users to authenticate using their Kyvos credentials before establishing a connection, providing a secure and standardized login mechanism.
STDIO (Standard I/O): This transport is primarily used for inter-process communication within the same system. It’s particularly suitable for command-line tools and local integrations where the client and server operate within the same process. Only Basic authorization is supported in this mode.

A user poses a natural language (NL) question.
The MCP Client uses an LLM to interpret the question and interacts with the MCP Kyvos Server to retrieve relevant answers.
The server translates the natural language input into an SQL query.
- It communicates with the Kyvos Semantic Model, sending queries and receiving both metadata and data.
- The response is then sent back to the MCP Client, which forwards the final answer to the user.

The Kyvos MCP Server helps you to:

Enable Conversational BI within dashboards and analytical applications.
Provide self-service analytics through natural language without requiring SQL expertise.
Accelerate insight generation for business users using AI-driven query transformation.

MCP Server Tools

The Kyvos MCP Server provides a set of standardized tools accessible to MCP clients:

kyvos_list_semantic_model: Retrieves a list of all available and accessible semantic models for the authenticated user within Kyvos.
kyvos_list_semantic_model_columns: Retrieves column metadata for a specified semantic model as:
- Column name
- Associated tags
- Descriptions
kyvos_sql_generation_prompt: Provides the system prompt template for SQL generation.
kyvos_execute_query: Executes a Spark SQL query on Kyvos and returns a json based result set.

Installation

Install the mcp-kyvos-server package from pip:

pip install mcp-kyvos-server==1.0.0a1

Configuration & Parameters

The server can be configured via environment variables or command-line flags. CLI flags override environment variables.

Parameter	Environment Variable	CLI Flag	Required	Default Value	Description

Parameter	Environment Variable	CLI Flag	Required	Default Value	Description
Kyvos URL	`KYVOS_URL`	`--kyvos-url <url>`	Yes	—	The base URL of the Kyvos server instance.
Kyvos Username	`KYVOS_USERNAME`	`--kyvos-username <username>`	Yes	—	The Kyvos account username used to authenticate and log in to the Kyvos application. It will be overridden if using OAuth or basic-auth flow.
Kyvos Password	`KYVOS_PASSWORD`	`--kyvos-password <password>`	Yes	—	The corresponding password for the provided `KYVOS_USERNAME`, used for authentication with the Kyvos application. It will be overridden if using OAuth or basic-auth flow.
Prompt File Path	`KYVOS_PROMPT_FILE`	`--kyvos-prompt-file <file_path>`	No	—	Path to the `.txt` file containing the prompt for spark sql generation.
Default Folder	`KYVOS_DEFAULT_FOLDER`	`--kyvos-default-folder <folder>`	No	—	Folder containing multiple semantic models used for querying and metadata management in the Kyvos platform.
Transport	—	`--transport <stdio or sse>`	No	`stdio`	The type of communication transport to use: `stdio` for standard input/output or `sse` for Server-Sent Events.
SSL Verification	`VERIFY_SSL`	`--verify-ssl <true or false>`	No	`false`	Flag to enable or disable SSL certificate verification when making HTTP requests to Kyvos. Set to `true` to enforce verification or `false` for self-signed certs.
Max Rows	`MAX_ROWS`	`--max-rows <max rows>`	No	1000	Limit the number of rows in the query response
Environment File	—	`--env-file <file_path>`	No	—	Path to an `.env` file from which to load environment variables, if not provided via arguments.
SSL Key	`SSL_KEY_FILE`	`--ssl-key-file <file_path>`	No	—	Path to the SSL private key file used to enable HTTPS on the server.
SSL Certificate	`SSL_CERTIFICATE_FILE`	`--ssl-certificate-file <file_path>`	No	—	Path to the SSL certificate file used to enable HTTPS on the server.
Auth type	`SERVER_AUTH_TYPE`	`--server-auth-type <basic/oauth>`	No	`oauth`	Type of authorization user want to start the server
Port	—	`--port <port>`	No	8000	Port on which user want to run the server.
Hostname	`MCP_SERVER_HOSTNAME`	`--mcp-server-hostname <machine_ip>`	No	127.0.0.1	The address (hostname or IP) where the user wants the MCP server to run.
MCP Kyvos Server Database Path	`MCP_KYVOS_DB_PATH`	-	No	HOME_PATH/.mcp_kyvos_server	The path where the MCP server database will be created.

Usage

SSE Mode

Start the MCP server with SSE transport.
mcp-kyvos-server --transport sse --env-file /path/to/.env
or provide arguments directly:
mcp-kyvos-server \ --kyvos-url https://your-kyvos-endpoint \ --kyvos-username user123 \ --kyvos-password pass123
Configure your client application to include the SSE server in its MCP server configuration. For example:
{ "mcpServers": { "kyvos-sse": { "url": "http://<machine_ip>:<port>/sse" } } }

STDIO Mode

Configure your client application. For example:

{
  "mcpServers": {
    "kyvos-stdio": {
      "command": "mcp-kyvos-server",
      "args": [
        "--env-file", "/path/to/.env"
      ]
    }
  }
}

OR

  {
    "mcpServers": {
      "kyvos-stdio": {
        "command": "mcp-kyvos-server",
        "args": [
          "--kyvos-url", "https://your-kyvos-endpoint",
          "--kyvos-username", "user123",
          "--kyvos-password", "pass123",
          "--kyvos-prompt-file", "./kyvos_prompt.txt"
        ]
      }
    }
  }

Data Security and Access Control

Kyvos enforces all existing data security policies and access privileges based on the authenticated user's profile. The MCP server ensures that only authorized users can access specific semantic models, metadata, and business data, in alignment with the organization’s governance and role-based access controls.

For a sample client implementation to interact with Kyvos MCP server, refer to Kyvos Sample Client.