Airflow MCP configuration properties

Use these properties to turn on Airflow MCP and to control how it connects to Airflow, how it authenticates, how it checks user identity, and how it handles DAG uploads.

Configuration file

Airflow MCP properties go in the Data Fabric MCP server configuration file on the Data Access Gateway node:
/opt/mapr/data-access-gateway/conf/mcp-server.conf

The file uses HOCON format. You can put Airflow properties inside an airflow {} block, as shown in the examples below.

Property summary

Property Type Default Description
airflow.enabled Boolean false Turns on the Airflow MCP endpoint (/airflow).
mcp.airflow.rest-service-url String (URL) Found automatically Airflow REST API URL. Set this only if the automatic lookup doesn't work in your environment.
airflow.auth.use-internal-jwt Boolean false Signs in to Airflow with Airflow's own credentials instead of passing through the user's JWT. For development and testing only.
airflow.auth.username String None Airflow username. Used only when use-internal-jwt is true.
airflow.auth.password String None Airflow password. Used only when use-internal-jwt is true.
mcp.airflow.skip-run-as-user-check Boolean false Turns off the run_as_user impersonation check. For development and testing only.
mcp.airflow.dag-upload-max-size-bytes Integer (bytes) 10 MB Largest DAG file size allowed for upload.
mcp.airflow.dag-stage-file-permissions String (POSIX permissions) rw------- Permissions on staged DAG files while they wait for review.
mcp.airflow.dag-review-temp-dir String (path) <java.io.tmpdir>/airflow-dag-review Folder where DAG files are staged between review and upload.
mcp.http.auth.introspection.enabled Boolean true Enables live token introspection (RFC 7662https://datatracker.ietf.org/doc/html/rfc7662) against the identity provider (Keycloak) to verify that an access token has not been revoked or that the user has not logged out. When disabled (false), the MCP server performs only offline JWT validation (signature and expiration check).
mcp.http.auth.introspection.cache-ttl-ms Long (milliseconds) 60000 (60 seconds) Controls how long (in milliseconds) a per-token introspection result (active / inactive) is cached before the gateway re-queries the identity provider. Setting this value to 0 disables caching and checks Keycloak on every request.

Enabling the endpoint

airflow.enabled
Turns on the Airflow MCP interface for DEP Airflow. If this is not set, the /airflow endpoint is not available.
airflow {
  enabled = true
}

Airflow connection

mcp.airflow.rest-service-url
By default, Airflow MCP finds the Airflow service on the Data Fabric cluster and connects to it. Set this property to use a specific Airflow REST API URL instead. For example, you might do this if the automatic lookup fails, or if Airflow is behind a load balancer.
airflow {
  enabled = true
  rest-service-url = "https://<airflow_rest_api_hostname>:<port>"
}

Authentication

By default, Airflow MCP passes the user's JWT to Airflow as a Bearer token. Each action then runs as that user, with that user's Airflow permissions. No properties are needed for this default behavior.
airflow.auth.use-internal-jwt, airflow.auth.username, airflow.auth.password
When use-internal-jwt is true, Airflow MCP signs in to Airflow with the Airflow username and password you give here, instead of the user's JWT. Use this only in development or test setups where Keycloak isn't available.
airflow {
  enabled = true
  auth = {
    use-internal-jwt = true
    username = <airflow_username>
    password = <airflow_password>
  }
}
WARNING
Do not use internal credentials in production environments. When this option is on, requests reach Airflow with the Airflow account you set here, not the user who made the MCP request.

Impersonation check

mcp.airflow.skip-run-as-user-check

Before starting a DAG, Airflow MCP checks that the run_as_user set on the DAG and its tasks matches the user making the MCP request. If they don't match, the request is rejected. Setting this property to true turns off the whole check.

mcp.airflow.skip-run-as-user-check = true
WARNING
Do not turn off this check in production environments. Without it, MCP users could start DAGs that run as a different user.

Airflow DAG upload

These properties control the two-step DAG creation process. First, reviewDagForUpload stages the proposed DAG code in a temporary file and returns a short-lived review token. Then, after the user approves the code, uploadDag publishes the DAG to Airflow.
mcp.airflow.dag-upload-max-size-bytes
The largest DAG file, in bytes, that can be staged and uploaded. The default is 10 MB.
mcp.airflow.dag-stage-file-permissions
POSIX permissions on staged DAG files. The default, rw-------, lets only the Data Access Gateway service user read and write them.
mcp.airflow.dag-review-temp-dir

The folder where staged DAG files are kept until they're uploaded. The default is the airflow-dag-review subfolder of the JVM temp folder (java.io.tmpdir).