DEV Community

Google Developer Experts profile image xbill
xbill for Google Developer Experts

Posted on • Originally published at xbill999.Medium on

Building a Secure HTTP Transport MCP Server with Python and Gemini CLI

#mcpserver #python #gemini #googlecloud

Leveraging Gemini CLI and the underlying Gemini LLM to build secure Model Context Protocol (MCP) AI applications in the Python programming language with a local development environment.

Aren’t There a Billion Python MCP Demos?

Yes there are.

Python has traditionally been the main coding language for ML and AI tools. The goal of this article is to provide a minimal viable basic working MCP stdio server that can be run locally without any unneeded extra code or extensions.

What Is Python?

Python is an interpreted language that allows for rapid development and testing and has deep libraries for working with ML and AI:

Welcome to Python.org

Python Version Management

One of the downsides of the wide deployment of Python has been managing the language versions across platforms and maintaining a supported version.

The pyenv tool enables deploying consistent versions of Python:

GitHub - pyenv/pyenv: Simple Python version management

As of writing — the mainstream python version is 3.13. To validate your current Python:

xbill@penguin:~$ python --version
Python 3.13.12

xbill@penguin:~$ pyenv version
3.13.12 (set by /home/xbill/.pyenv/version)
Enter fullscreen mode Exit fullscreen mode

Gemini CLI

If not pre-installed you can download the Gemini CLI to interact with the source files and provide real-time assistance:

npm install -g @google/gemini-cli
Enter fullscreen mode Exit fullscreen mode

Testing the Gemini CLI Environment

Once you have all the tools and the correct Node.js version in place- you can test the startup of Gemini CLI. You will need to authenticate with a Key or your Google Account:

gemini
Enter fullscreen mode Exit fullscreen mode

Node Version Management

Gemini CLI needs a consistent, up to date version of Node. The nvm command can be used to get a standard Node environment:

GitHub - nvm-sh/nvm: Node Version Manager - POSIX-compliant bash script to manage multiple active node.js versions

Python MCP Documentation

The official GitHub Repo provides samples and documentation for getting started:

GitHub - modelcontextprotocol/python-sdk: The official Python SDK for Model Context Protocol servers and clients

Where do I start?

The strategy for starting MCP development is a incremental step by step approach.

First, the basic development environment is setup with the required system variables, and a working Gemini CLI configuration.

Then, a minimal Hello World Style Python MCP Server is built with HTTP transport. This server is validated with Gemini CLI in the local environment.

This setup validates the connection from Gemini CLI to the local server via MCP. The MCP client (Gemini CLI) and the Python MCP server both run in the same local environment.

Setup the Basic Environment

At this point you should have a working Python environment and a working Gemini CLI installation. The next step is to clone the GitHub samples repository with support scripts:

cd ~
git clone https://github.com/xbill9/iap-https-rust
Enter fullscreen mode Exit fullscreen mode

Then run init.sh from the cloned directory.

The script will attempt to determine your shell environment and set the correct variables:

cd iap-https-rust
source init.sh
Enter fullscreen mode Exit fullscreen mode

If your session times out or you need to re-authenticate- you can run the set_env.sh script to reset your environment variables:

cd iap-https-rust
source set_env.sh
Enter fullscreen mode Exit fullscreen mode

Variables like PROJECT_ID need to be setup for use in the various build scripts- so the set_env script can be used to reset the environment if you time-out.

Python Info Tool with HTTP Transport

One of the key features that the standard MCP libraries provide is abstracting various transport methods.

The high level MCP tool implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

The HTTP transport allows the MCP client and server to run on the same system or be distributed over the Internet.

The connection over HTTP will look similar to this:

    transport = os.environ.get("MCP_TRANSPORT", "sse")

    logger.info(f"Starting httpkey-python MCP server (Transport: {transport})")

    if transport == "sse":
        mcp.run(transport="sse")
Enter fullscreen mode Exit fullscreen mode

Running the Python Code

First- switch the directory with the Python version of the MCP sample code:

cd ~/iap-https-rust/local-python
Enter fullscreen mode Exit fullscreen mode

Run the release version on the local system:

xbill@penguin:~/iap-https-rust/local-python$ make
Processing ./.
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Enter fullscreen mode Exit fullscreen mode

You can validate the final result by checking the messages:

Successfully built httpkey-python
Installing collected packages: httpkey-python
  Attempting uninstall: httpkey-python
    Found existing installation: httpkey-python 0.5.0
    Uninstalling httpkey-python-0.5.0:
      Successfully uninstalled httpkey-python-0.5.0
Successfully installed httpkey-python-0.5.0
Enter fullscreen mode Exit fullscreen mode

The project can also be linted:

xbill@penguin:~/iap-https-rust/local-python$ make lint
Requirement already satisfied: ruff in /home/xbill/.pyenv/versions/3.13.12/lib/python3.13/site-packages (0.15.0)
All checks passed!
xbill@penguin:~/iap-https-rust/local-python$
Enter fullscreen mode Exit fullscreen mode

And a test run:

xbill@penguin:~/iap-https-rust/local-python$ make test
Running tests...
.....2026-02-10 15:08:42,652 - stdiokey-python - INFO - Fetching MCP API Key for project: test-project
2026-02-10 15:08:42,652 - stdiokey-python - INFO - Falling back to library-based API key fetch
.2026-02-10 15:08:42,654 - stdiokey-python - INFO - Fetching MCP API Key for project: test-project
2026-02-10 15:08:42,654 - stdiokey-python - INFO - Successfully fetched API key via gcloud
...
----------------------------------------------------------------------
Ran 9 tests in 0.017s

OK
Enter fullscreen mode Exit fullscreen mode

Running the Tool Locally

Once the release version has been built- the resulting binary can be executed directly in the local environment.

The quick summary of local system info can be run right from the Makefile:

xbill@penguin:~/iap-https-rust/local-python$ make info
MCP API Key Status
------------------
Provided Key: [NOT FOUND]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:30: info] Error 1
xbill@penguin:~/iap-https-rust/local-python$
Enter fullscreen mode Exit fullscreen mode

This call failed because no API key was provided on the command line or in the current environment.

The tool will also fail if an invalid key is passed:

xbill@penguin:~/iap-https-rust/local-python$ make info KEY=2snakes
2026-02-10 15:09:29,162 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 15:09:30,660 - stdiokey-python - INFO - Successfully fetched API key via gcloud
MCP API Key Status
------------------
Provided Key: [FOUND]
Cloud Match: [MISMATCH]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:30: info] Error 1
Enter fullscreen mode Exit fullscreen mode

Setting an API Key

On project setup the init.sh script configures the Google Cloud environment and creates a sample key to secure the connection. To set this key in the current environment — use the set_key.sh script:

xbill@penguin:~/iap-https-rust/local-python$ source ../set_key.sh 
--- Setting Google Cloud Project ID ---
Using Google Cloud project: comglitn
Checking for existing MCP API Key...
Using existing MCP API Key: projects/1056842563084/locations/global/keys/cbd6422f-e594-4536-9ad9-6f179f43f11b
Retrieving API Key string...
MCP API Key retrieved and exported.

To use with the 'manual' or 'local' variants, ensure this script was sourced:
source ./set_key.sh
cargo run --bin manual
--- Environment Checks ---
Not running in Google Cloud VM or Shell. Checking ADC...
Running on ChromeOS.
--- Initial Setup complete ---
Enter fullscreen mode Exit fullscreen mode

The tool can now execute:

xbill@penguin:~/iap-https-rust/local-python$ make info KEY=$MCP_API_KEY
2026-02-10 15:10:59,431 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 15:11:00,869 - stdiokey-python - INFO - Successfully fetched API key via gcloud
System Information Report
=========================

MCP API Key Status
------------------
Provided Key: [FOUND]
Cloud Match: [MATCHED]

System Information
Enter fullscreen mode Exit fullscreen mode

System Information with MCP HTTP Transport

One of the key features that the MCP protocol provides is abstracting various transport methods.

The high level tool MCP implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

The HTTP transport allows the MCP client and server to run in the same environment or be distributed over the Internet.

First- switch the directory with the HTTP sample code:

xbill@penguin:~/iap-https-rust/local-python$ make run
Running the MCP HTTP (SSE) server...
2026-02-10 15:12:25,808 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 15:12:27,295 - stdiokey-python - INFO - Successfully fetched API key via gcloud
2026-02-10 15:12:27,296 - stdiokey-python - INFO - Successfully fetched MCP API Key from Google Cloud settings
2026-02-10 15:12:27,296 - stdiokey-python - INFO - Starting httpkey-python MCP server (Transport: sse)
INFO: Started server process [11812]
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8080 (Press CTRL+C to quit)
Enter fullscreen mode Exit fullscreen mode

This step validates that the tool can be started locally and uses the MCP_API_KEY in the local environment.

Gemini CLI settings.json

The default Gemini CLI settings.json has an entry for the Python source:

{
  "mcpServers": {
    "httpkey-python": {
      "url": "http://127.0.0.1:8080/sse",
       "headers": {
         "X-Goog-Api-Key": "$MCP_API_KEY"
       }
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Validation with Gemini CLI

Finally- leave the MCP server running. Open a new terminal and start Gemini CLI. Gemini CLI is used as a MCP client to check the MCP connection over the HTTP transport to the Python Code:

 > /mcp list

 > /mcp list
Configured MCP servers:

🟢 httpkey-python - Ready (2 tools)
  Tools:
  - disk_usage
  - local_system_info

 > local_system_info

╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✓ local_system_info (httpkey-python MCP Server) {} │
│ │
│ System Information Report │
│ ========================= │
│ │
│ Authentication: [VERIFIED] (Running as MCP Server) │
│ │
│ System Information │
│ --- │
│ System Name: posix │
│ OS Name: linux │
│ Host Name: penguin │
│ │
│ CPU Information │
│ --- │
│ Number of Cores: 12 │
│ │
│ Memory Information │
│ --- │
│ Total Memory: 6410 MB │
│ Used Memory: 1366 MB │
│ Total Swap: 0 MB │
│ Used Swap: 0 MB │
│ │
│ Network Interfaces │
│ --- │
│ lo : RX: 299774 bytes, TX: 299774 bytes (MAC: 00:00:00:00:00:00) │
│ br-413ba64fd5af : RX: 0 bytes, TX: 0 bytes (MAC: 36:10:67:8c:35:b8) │
│ docker0 : RX: 0 bytes, TX: 0 bytes (MAC: aa:8b:14:57:7f:9b) │
│ eth0 : RX: 537927659 bytes, TX: 853766537 bytes (MAC: 00:16:3e:52:c3:b9) │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✦ The system information has been retrieved and displayed. Please let me know if you have any other requests.
Enter fullscreen mode Exit fullscreen mode

Testing the API Key

To validate that the MCP_API_KEY is actually checked at runtime- set the key to an invalid value:

xbill@penguin:~/iap-https-rust/local-python$ export MCP_API_KEY=2snakes
Enter fullscreen mode Exit fullscreen mode

Then restart Gemini CLI — you will get an error discovering the MCP tools:

ℹ MCP server 'httpkey-python' requires authentication using: /mcp auth httpkey-python
 > /mcp list
Configured MCP servers:

🔴 httpkey-python - Disconnected (OAuth not authenticated)
Enter fullscreen mode Exit fullscreen mode

Summary

The strategy for using Python for MCP development with Gemini CLI was validated with a incremental step by step approach.

A minimal HTTP transport MCP Server was started from Python source code and validated with Gemini CLI running as a MCP client in the same local environment.

This basic Python code was enhanced with an API key generated and stored in the main Google Cloud project.

This API key was used to validate access to the local Python tool and the HTTP MCP version directly from Gemini CLI.

This approach can be extended to more complex deployments using other MCP transports and Cloud based options.

Top comments (0)