[devin-ai-integration]

Summary

The hosted MCP SSO login rejected valid Keycloak realm names that contain a dot (e.g. a realm named example.com, whose /auth/realms/example.com/.well-known/openid-configuration exists while the undotted variant 404s). The Cloud webapp's SSO pages have no such restriction, so these orgs could sign in to Cloud via SSO but not to the hosted MCP.

REALM_IDENTIFIER_PATTERN is used by both validate_realm_identifier (login form) and SsoRealmRegistry.realm_from_issuer (token iss → realm), so both rejected dotted realms. Before this change, validation raised InvalidRealmIdentifierError and realm_from_issuer(".../realms/example.com") returned None.

- ^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$
+ ^(?=.{1,63}\Z)[A-Za-z0-9][A-Za-z0-9_-]*(?:\.[A-Za-z0-9_-]+)*\Z

Dots are allowed only between non-empty labels: no leading, trailing, or consecutive dots, so ./.. can never form the path segment. /, %, @, a leading _, and >63 chars are still rejected, so the identifier still stays inside the template's single path segment. The user-facing error text and docstring were updated to match. The login page has no client-side pattern to update.

Reviewer note: please sanity-check the relaxed regex from a security angle (the traversal/segment cases are covered in tests).

Resolves https://github.com/airbytehq/oncall/issues/13820:

• https://github.com/airbytehq/oncall/issues/13820

Close on merge: no — customer-filed; support confirms the fix with the customer before closing.

Test Coverage

tests/unit_tests/test_mcp_sso_auth.py:

• accepts: example.com, acme.example, a.b-c_d.e, 63-char dotted value
• rejects: .acme, acme., acme..example, ., .., ../master, 64-char dotted value (existing traversal/percent/at cases kept)
• realm_from_issuer: dotted round-trip, plus /.., acme..example, acme. → None
• test_registry_discovers_dotted_realm: discovery for a dotted realm end to end through SsoRealmRegistry

The new cases failed against unfixed code (5 failed) and pass with the fix (115 passed in the file). Ruff and pyrefly are clean.

Declarative-First Evaluation

N/A — not a declarative connector; this is PyAirbyte MCP server code.

Requested by the /ai-fix workflow on the linked oncall issue.

Link to Devin session: https://app.devin.ai/sessions/cdc6e6dde6b04b0daa0105707ef65ab9
Open in Devin Desktop: https://app.devin.ai/desktop/session/cdc6e6dde6b04b0daa0105707ef65ab9?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1792655670-mcp-sso-dotted-realms' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1792655670-mcp-sso-dotted-realms'

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /fix-pr - Fixes most formatting and linting issues
• /uv-lock - Updates uv.lock file
• /test-pr - Runs tests with the updated PyAirbyte
• /prerelease - Builds and publishes a prerelease version to PyPI
• /evals - Runs the Cloud MCP evals that use the MCP tools this PR changed (/evals full=true runs the full suite)

📚 Show Repo Guidance

Helpful Resources

• PyAirbyte Documentation
• API Reference

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/pytest-no-creds

main d9f652f	devin/1792655670-mcp... a379ba2	+/-
65%	77%	+12%

View coverage of the 10 most impacted files.

File	main d9f652f	devin/1792655670-mcp... a379ba2	+/-
airbyte/mcp/cloud.py	52%	71%	+19%
airbyte/_util/api_util.py	36%	56%	+20%
airbyte/mcp/_otel.py	0%	89%	+89%
airbyte/mcp/int..._registry_ui.py	0%	92%	+92%
airbyte/cloud/models.py	0%	95%	+95%
airbyte/mcp/_sso_auth.py	0%	96%	+96%
airbyte/mcp/int...nc_status_ui.py	0%	97%	+97%
airbyte/_direct...nnector_docs.py	0%	97%	+97%
airbyte/mcp/agents.py	0%	98%	+98%
airbyte/_direct...ctors/models.py	0%	99%	+99%

Python / code-coverage/pytest

main d9f652f	devin/1792655670-mcp... a379ba2	+/-
71%	80%	+9%

View coverage of the 10 most impacted files.

File	main d9f652f	devin/1792655670-mcp... a379ba2	+/-
airbyte/mcp/cloud.py	52%	71%	+19%
airbyte/mcp/_otel.py	0%	89%	+89%
airbyte/mcp/int..._registry_ui.py	0%	92%	+92%
airbyte/_direct...ors/api_util.py	0%	92%	+92%
airbyte/mcp/_sso_auth.py	0%	96%	+96%
airbyte/cloud/models.py	0%	96%	+96%
airbyte/mcp/int...nc_status_ui.py	0%	97%	+97%
airbyte/_direct...nnector_docs.py	0%	97%	+97%
airbyte/mcp/agents.py	0%	98%	+98%
airbyte/_direct...ctors/models.py	0%	99%	+99%

Python / code-coverage/pytest-unit

main	devin/1792655670-mcp... a379ba2	+/-
—	73%	—

Line coverage data for the main branch is not yet available.

View coverage of the 10 most covered files.

File	main	devin/1792655670-mcp... a379ba2	+/-
airbyte/mcp/agents.py	—	98%	—
airbyte/mcp/_sso_auth.py	—	96%	—
airbyte/cloud/models.py	—	95%	—
airbyte/cloud/client.py	—	91%	—
airbyte/mcp/_otel.py	—	89%	—
airbyte/exceptions.py	—	84%	—
airbyte/progress.py	—	80%	—
airbyte/mcp/cloud.py	—	71%	—
airbyte/shared/...ql_processor.py	—	68%	—
airbyte/_util/api_util.py	—	56%	—

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 22, 2026 08:09 UTC}