feat: add drive to iag-mcp-demo by cowan-macady · Pull Request #78 · indykite/developer-hub

cowan-macady · 2026-07-16T12:19:08Z

add drive to iag-mcp-demo

socket-security · 2026-07-16T12:19:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@google-cloud/local-auth@3.0.1
	npm/googleapis@144.0.0
	npm/@modelcontextprotocol/sdk@1.0.1
	pypi/alembic@1.18.5
	pypi/greenlet@3.5.3
	pypi/charset-normalizer@3.4.9
	pypi/typing-extensions@4.16.0
	pypi/croniter@6.2.4

View full report

deepsource-io · 2026-07-16T12:21:56Z

DeepSource Code Review

We reviewed changes in 6281ae9...d22f597 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Jul 16, 2026 3:54p.m.	Review ↗
Python		Jul 16, 2026 3:54p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

Copilot

Pull request overview

Adds an optional Google Drive MCP proof-of-concept to the a2a/iag-mcp-demo stack (behind a Compose profile), along with corresponding graph/workflow data and demo/Bruno scripts. It also updates the IAG demo identity from alice to millicent, and refreshes a few dependency locks / docs for consistency.

Changes:

Introduce a drive compose profile that proxies a Google Drive MCP server through an IndyKite Agent Gateway configured for MCP proxy mode.
Update IAG demo graph and docs to use millicent as the primary allowed user, and add the wf-drive workflow + indykiteagent-drive agent wiring.
Add Bruno collections + shell scripts to exercise the Drive MCP flow, and refresh lockfiles / minor documentation strings.

Reviewed changes

Copilot reviewed 47 out of 50 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Pipfile.lock	Dependency lock refresh (root).
canbank/.gitignore	Ignore `flask_app.log` due to sensitive runtime content risk.
canbank-iag/README.md	Update demo-user references (`alice` → `millicent`).
canbank-iag/Pipfile.lock	Dependency lock refresh for `canbank-iag`.
canbank-iag/data/relationships/relationships_iag.json	Add `wf-drive` relationships and switch `alice` → `millicent`.
canbank-iag/data/nodes/nodes_iag.json	Add `wf-drive` / `indykiteagent-drive` nodes; update user to `millicent`.
canbank-iag/api/ciq_knowledge_query.py	Align `get-decisions` description/example with the tool name.
canbank-iag/.gitignore	Ignore `flask_app.log` due to sensitive runtime content risk.
a2a/iag-mcp-demo/weather_agent/requirements.txt	Pin `a2a-sdk` version for the demo agents.
a2a/iag-mcp-demo/retriever_agent/requirements.txt	Pin `a2a-sdk` version for the demo agents.
a2a/iag-mcp-demo/orchestrator_agent/requirements.txt	Pin `a2a-sdk` version for the demo agents.
a2a/iag-mcp-demo/analyst_agent/requirements.txt	Pin `a2a-sdk` version for the demo agents.
a2a/iag-mcp-demo/README.md	Document Drive MCP profile and switch demo-user references to `millicent`.
a2a/iag-mcp-demo/makefile	Add `new-drive-mcp` build target.
a2a/iag-mcp-demo/iag-base-docker.yaml	Make IdP base URL configurable via `IDP_BASE_URL`.
a2a/iag-mcp-demo/drive_mcp/README.md	Document Drive MCP PoC auth model + setup/run steps.
a2a/iag-mcp-demo/drive_mcp/Dockerfile	Add container to wrap stdio gdrive MCP server via supergateway.
a2a/iag-mcp-demo/drive_mcp/.gdrive/.gitkeep	Keep `.gdrive/` directory for bind-mounts on fresh clones.
a2a/iag-mcp-demo/docker-compose.yaml	Add `drive-mcp` + `drive-mcp-iag` services under `drive` profile; bump gateway image for MCP proxy mode.
a2a/iag-mcp-demo/test-drive.sh	Add standalone script to exercise Drive MCP via gateway.
a2a/iag-mcp-demo/demo-analyst-drive.sh	Add script demonstrating analyst call + Drive MCP call end-to-end.
a2a/iag-mcp-demo/CANBANK_DEMO_SCRIPT.md	Update demo script to use `millicent` where applicable.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/folder.yml	Update WF4 docs to use `millicent` and rename token vars.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/carol-calls-retriever-gateway.yml	Align request payload with updated A2A message shape.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-calls-retriever-gateway.yml	Rename Alice flow to Millicent + update payload schema.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-calls-analyst-gateway.yml	Rename Alice flow to Millicent + update payload schema.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-retriever-mcp-initialize.yml	Rename Alice flow to Millicent + variable names.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-retriever-mcp-initialized-notification.yml	Rename Alice flow to Millicent + variable names.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-retriever-mcp-list-tools.yml	Rename Alice flow to Millicent + variable names.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-retriever-authzen-evaluate.yml	Rename Alice flow to Millicent + subject IDs.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-retriever-ciq-execute.yml	Rename Alice flow to Millicent + session var usage.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-analyst-mcp-initialize.yml	Rename Alice flow to Millicent + session var usage.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-analyst-mcp-initialized-notification.yml	Rename Alice flow to Millicent + variable names.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-analyst-mcp-list-tools.yml	Rename Alice flow to Millicent + variable names.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-analyst-authzen-evaluate.yml	Rename Alice flow to Millicent + subject IDs.
a2a/iag-mcp-demo/bruno/iag-demo/wf4-parallel-mcp/millicent-analyst-ciq-execute.yml	Rename Alice flow to Millicent + session var usage.
a2a/iag-mcp-demo/bruno/iag-demo/ingest/agent-worfklow/create-nodes.yml	Add `wf-drive` / `indykiteagent-drive` nodes and switch `alice` → `millicent`.
a2a/iag-mcp-demo/bruno/iag-demo/ingest/agent-worfklow/create-relationships.yml	Add Drive workflow edges and switch `alice` → `millicent`.
a2a/iag-mcp-demo/bruno/iag-demo/environments/iag-demo-prd.yml	Rename token var to `user_token_millicent`; add `iag_drive_mcp_url`.
a2a/iag-mcp-demo/bruno/iag-demo/drive-mcp/folder.yml	Add Drive MCP PoC Bruno folder documentation.
a2a/iag-mcp-demo/bruno/iag-demo/drive-mcp/drive-mcp-initialize.yml	Add Drive MCP initialize call + session header capture.
a2a/iag-mcp-demo/bruno/iag-demo/drive-mcp/drive-mcp-initialized-notification.yml	Add Drive MCP initialized notification call.
a2a/iag-mcp-demo/bruno/iag-demo/drive-mcp/drive-mcp-list-tools.yml	Add Drive MCP tools/list call + assertion.
a2a/iag-mcp-demo/bruno/iag-demo/drive-mcp/drive-mcp-tool-search.yml	Add Drive MCP search tool call + assertion.
a2a/iag-mcp-demo/bruno/iag-demo/ciq-context/get-decisions/create-get-decision-query.yml	Rename CIQ query `get-decision` → `get-decisions` for this demo.
a2a/iag-mcp-demo/bruno/iag-demo/ciq-context/get-decisions/update-get-decision-query.yml	Rename CIQ query `get-decision` → `get-decisions` for this demo.
a2a/iag-mcp-demo/bruno/iag-demo/ciq-context/get-decisions/execute-get-decision-query.yml	Update execute payload to use `id: get-decisions`.
a2a/iag-mcp-demo/analyst_agent/README.md	Update graph model/docs to use `millicent`.
a2a/iag-mcp-demo/.gitignore	Ignore Google OAuth material under `drive_mcp/.gdrive` (keep `.gitkeep`).
a2a/iag-mcp-demo/.example.env	Add `IDP_BASE_URL` and Drive MCP profile variables.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cowan-macady · 2026-07-16T15:49:07Z

@@ -293,8 +293,8 @@ class Unauthorized(BaseModel):
            "Returns: An object containing the decision, the document, a relationship that "


cowan-macady · 2026-07-16T15:49:02Z

+RUN npm install -g supergateway @modelcontextprotocol/server-gdrive \
+ && npm cache clean --force


socket-security · 2026-07-16T15:35:11Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `googleapis` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: a2a/iag-mcp-demo/drive_mcp/vendor/package.json → `npm/googleapis@144.0.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/googleapis@144.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `googleapis` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: a2a/iag-mcp-demo/drive_mcp/vendor/package.json → `npm/googleapis@144.0.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/googleapis@144.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copilot

Pull request overview

Copilot reviewed 47 out of 52 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 47 out of 52 changed files in this pull request and generated 2 comments.

cowan-macady · 2026-07-16T15:57:23Z

+import glob, pickle, base64, json, time
+cands = []
+for f in glob.glob('/tmp/flask_session/*'):
+    raw = open(f, 'rb').read()
+    for off in (4, 8, 0):
+        try:
+            d = pickle.loads(raw[off:])
+            if isinstance(d, dict) and d.get('access_token'):


cowan-macady · 2026-07-16T15:57:14Z

+import glob, pickle, base64, json, time
+cands = []
+for f in glob.glob('/tmp/flask_session/*'):
+    raw = open(f, 'rb').read()
+    for off in (4, 8, 0):
+        try:
+            d = pickle.loads(raw[off:])
+            if isinstance(d, dict) and d.get('access_token'):


implement [ENG-8488]

Copilot

Pull request overview

Copilot reviewed 47 out of 52 changed files in this pull request and generated no new comments.

cowan-macady requested a review from a team as a code owner July 16, 2026 12:19

Copilot AI review requested due to automatic review settings July 16, 2026 12:19

Copilot started reviewing on behalf of cowan-macady July 16, 2026 12:19 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 15:34

cowan-macady force-pushed the updates-iag branch from 0a6887c to 1bb7f05 Compare July 16, 2026 15:34

Copilot started reviewing on behalf of cowan-macady July 16, 2026 15:34 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread canbank-iag/api/ciq_knowledge_query.py Outdated

Comment thread a2a/iag-mcp-demo/bruno/iag-demo/ciq-context/get-decisions/create-get-decision-query.yml Outdated

Comment thread a2a/iag-mcp-demo/bruno/iag-demo/ciq-context/get-decisions/update-get-decision-query.yml Outdated

Copilot AI review requested due to automatic review settings July 16, 2026 15:44

cowan-macady force-pushed the updates-iag branch from 1bb7f05 to a05f49b Compare July 16, 2026 15:44

Copilot started reviewing on behalf of cowan-macady July 16, 2026 15:45 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

feat: add drive to iag-mcp-demo

d22f597

implement [ENG-8488]

Copilot AI review requested due to automatic review settings July 16, 2026 15:54

cowan-macady force-pushed the updates-iag branch from a05f49b to d22f597 Compare July 16, 2026 15:54

Copilot started reviewing on behalf of cowan-macady July 16, 2026 15:55 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

cowan-macady requested a review from chahalarora July 16, 2026 16:03

chahalarora approved these changes Jul 16, 2026

View reviewed changes

cowan-macady merged commit ff54bba into master Jul 16, 2026
10 of 11 checks passed

cowan-macady deleted the updates-iag branch July 16, 2026 17:51

		@@ -293,8 +293,8 @@ class Unauthorized(BaseModel):
		"Returns: An object containing the decision, the document, a relationship that "

		RUN npm install -g supergateway @modelcontextprotocol/server-gdrive \
		&& npm cache clean --force

Uh oh!

Conversation

cowan-macady commented Jul 16, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

cowan-macady Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

cowan-macady Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

cowan-macady Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

cowan-macady Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cowan-macady commented Jul 16, 2026 •

edited by atlassian Bot

Loading

socket-security Bot commented Jul 16, 2026 •

edited

Loading

deepsource-io Bot commented Jul 16, 2026 •

edited

Loading

socket-security Bot commented Jul 16, 2026 •

edited

Loading