Migrate OCI Monitoring MCP server authentication to oracle-mcp-common

Summary

Migrate oci-monitoring-mcp-server from its locally implemented OCI authentication logic to the shared oracle-mcp-common authentication APIs.

Use oci-cloud-mcp-server as the reference implementation:

• oci-cloud-mcp-server/server.py
• oci-cloud-mcp-server authentication tests

Related work:

• Issue #366: shared OCI MCP authentication library
• PR #367: oracle-mcp-common implementation and initial adoption
• PR #417: Logging and Monitoring region selection

Problem

oci-monitoring-mcp-server currently implements authentication directly by:

• reading OCI config profiles;
• loading security-token files and private keys;
• constructing SecurityTokenSigner;
• constructing HTTP TokenExchangeSigner;
• configuring FastMCP's OCIProvider.

This duplicates behavior now owned by oracle-mcp-common and supports fewer credential modes. It can also mishandle valid API-key profiles when the selected profile has no security_token_file, or when that value is inherited from [DEFAULT].

Every Monitoring SDK client path must use consistent authentication and the exact derived additional_user_agent, including:

• oci.monitoring.MonitoringClient;
• oci.identity.IdentityClient used for subscribed-region discovery after PR Support for subscribed region selection in monitoring and logging mcp servers #417.

Proposed changes

• Declare the same bounded dependency used by oci-cloud-mcp-server:

  "oracle-mcp-common>=0.1.2,<0.2.0"

• Add the workspace dependency mapping used by the reference server:

  [tool.uv.sources]
  oracle-mcp-common = { workspace = true }

• Derive one canonical _ADDITIONAL_UA from __project__ and __version__.

• Use build_auth_context() for stdio and configured credential modes.

• When a Monitoring tool supplies an explicit region, use AuthOptions(region=region) or otherwise preserve the common library's documented region precedence.

• Merge AuthContext.config with _ADDITIONAL_UA and pass AuthContext.signer to every OCI client.

• Use AuthContext.tenancy_id when resolving the tenancy for subscribed-region discovery.

• At HTTP startup, call build_idcs_http_auth(required_scopes) once and assign its provider to mcp.auth.

• For every authenticated HTTP request:

  • obtain the FastMCP access token in the server;
  • call IDCSHttpAuth.context_for(access_token.token, region=region) when an explicit region is supplied;
  • merge the returned config with _ADDITIONAL_UA;
  • construct caller-specific Monitoring or Identity clients.

• Do not cache an HTTP-derived signer or OCI client across callers.

• Preserve the server's existing retry, circuit-breaker, client lifecycle, MCP tool contracts, and region-selection behavior.

• Remove duplicated profile parsing and direct signer/provider construction from the server.

• Update README.md, CHANGELOG.md, pyproject.toml, and uv.lock.

Shared-library ownership

oracle-mcp-common remains the source of truth for reusable OCI authentication behavior.

If this migration identifies a missing authentication mode, configuration input, signer behavior, validation rule, error contract, or other reusable requirement:

• implement and test the capability in src/common rather than adding a server-local workaround;
• document the behavior in src/common/README.md;
• maintain secret-safe errors and backward compatibility;
• publish an appropriate oracle-mcp-common version before depending on it from this server;
• update the server's bounded dependency and lockfile afterward.

The Monitoring server should retain only service-specific client construction, region handling, retry and circuit-breaker policy, user-agent assignment, and client lifecycle.

Supported authentication modes

The migrated server should support the modes provided by oracle-mcp-common:

• auto
• api_key
• security_token
• identity_domain_upst
• instance_principal
• resource_principal
• instance_principal_delegation
• resource_principal_delegation
• oke_workload_identity

Acceptance criteria

• oci-monitoring-mcp-server declares oracle-mcp-common>=0.1.2,<0.2.0.