DEV Community

Google Developer Experts profile image xbill
xbill for Google Developer Experts

Posted on • Originally published at xbill999.Medium on

Secure MCP Development with Python and Gemini CLI

#python #mcpserver #security #gemini

Leveraging Gemini CLI and the underlying Gemini LLM to build secure Model Context Protocol (MCP) AI applications in the Python programming language with a local development environment.

Aren’t There a Billion Python MCP Demos?

Yes there are.

Python has traditionally been the main coding language for ML and AI tools. The goal of this article is to provide a minimal viable basic working MCP stdio server that can be run locally without any unneeded extra code or extensions.

What Is Python?

Python is an interpreted language that allows for rapid development and testing and has deep libraries for working with ML and AI:

Welcome to Python.org

Python Version Management

One of the downsides of the wide deployment of Python has been managing the language versions across platforms and maintaining a supported version.

The pyenv tool enables deploying consistent versions of Python:

GitHub - pyenv/pyenv: Simple Python version management

As of writing — the mainstream python version is 3.13. To validate your current Python:

xbill@penguin:~$ python --version
Python 3.13.12

xbill@penguin:~$ pyenv version
3.13.12 (set by /home/xbill/.pyenv/version)
Enter fullscreen mode Exit fullscreen mode

Gemini CLI

If not pre-installed you can download the Gemini CLI to interact with the source files and provide real-time assistance:

npm install -g @google/gemini-cli
Enter fullscreen mode Exit fullscreen mode

Testing the Gemini CLI Environment

Once you have all the tools and the correct Node.js version in place- you can test the startup of Gemini CLI. You will need to authenticate with a Key or your Google Account:

gemini
Enter fullscreen mode Exit fullscreen mode

Node Version Management

Gemini CLI needs a consistent, up to date version of Node. The nvm command can be used to get a standard Node environment:

GitHub - nvm-sh/nvm: Node Version Manager - POSIX-compliant bash script to manage multiple active node.js versions

Python MCP Documentation

The official GitHub Repo provides samples and documentation for getting started:

GitHub - modelcontextprotocol/python-sdk: The official Python SDK for Model Context Protocol servers and clients

Where do I start?

The strategy for starting MCP development is a incremental step by step approach.

First, the basic development environment is setup with the required system variables, and a working Gemini CLI configuration.

Then, a minimal Hello World Style Python MCP Server is built with stdio transport. This server is validated with Gemini CLI in the local environment.

This setup validates the connection from Gemini CLI to the local process via MCP. The MCP client (Gemini CLI) and the Python MCP server both run in the same local environment.

Setup the Basic Environment

At this point you should have a working Python environment and a working Gemini CLI installation. The next step is to clone the GitHub samples repository with support scripts:

cd ~
git clone https://github.com/xbill9/iap-https-rust
Enter fullscreen mode Exit fullscreen mode

Then run init.sh from the cloned directory.

The script will attempt to determine your shell environment and set the correct variables:

cd iap-https-rust
source init.sh
Enter fullscreen mode Exit fullscreen mode

If your session times out or you need to re-authenticate- you can run the set_env.sh script to reset your environment variables:

cd iap-https-rust
source set_env.sh
Enter fullscreen mode Exit fullscreen mode

Variables like PROJECT_ID need to be setup for use in the various build scripts- so the set_env script can be used to reset the environment if you time-out.

Python Info Tool with STDIO Transport

One of the key features that the standard MCP libraries provide is abstracting various transport methods.

The high level MCP tool implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

The connection over stdio will look similar to this:

    async with stdio_server() as (read_stream, write_stream):
        await server.run(
            read_stream,
            write_stream,
            InitializationOptions(
                server_name="stdiokey-python",
                server_version="0.4.0",
                capabilities=server.get_capabilities(
                    notification_options=NotificationOptions(),
                    experimental_capabilities={},
                ),
            ),
        )
Enter fullscreen mode Exit fullscreen mode

Running the Python Code

First- switch the directory with the Python version of the MCP sample code:

cd ~/iap-https-rust/stdiokey-python
Enter fullscreen mode Exit fullscreen mode

Run the release version on the local system:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make
Processing ./.
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Enter fullscreen mode Exit fullscreen mode

You can validate the final result by checking the messages:

Successfully built stdiokey-python
Installing collected packages: stdiokey-python
  Attempting uninstall: stdiokey-python
    Found existing installation: stdiokey-python 0.4.0
    Uninstalling stdiokey-python-0.4.0:
      Successfully uninstalled stdiokey-python-0.4.0
Successfully installed stdiokey-python-0.4.0
Enter fullscreen mode Exit fullscreen mode

The project can also be linted:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make lint
Requirement already satisfied: ruff in /home/xbill/.pyenv/versions/3.13.12/lib/python3.13/site-packages (0.15.0)
All checks passed!
xbill@penguin:~/iap-https-rust/stdiokey-python$
Enter fullscreen mode Exit fullscreen mode

And a test run:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make test
Running tests...
.....2026-02-10 12:35:38,616 - stdiokey-python - INFO - Fetching MCP API Key for project: test-project
2026-02-10 12:35:38,616 - stdiokey-python - INFO - Falling back to library-based API key fetch
.2026-02-10 12:35:38,618 - stdiokey-python - INFO - Fetching MCP API Key for project: test-project
2026-02-10 12:35:38,618 - stdiokey-python - INFO - Successfully fetched API key via gcloud
.....
----------------------------------------------------------------------
Ran 11 tests in 0.029s

OK
Enter fullscreen mode Exit fullscreen mode

Running the Tool Locally

Once the release version has been built- the resulting binary can be executed directly in the local environment.

The quick summary of local system info can be run right from the Makefile:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make info
MCP API Key Status
------------------
Provided Key: [NOT FOUND]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:26: info] Error 1
Enter fullscreen mode Exit fullscreen mode

This call failed because no API key was provided on the command line or in the current environment.

The tool will also fail if an invalid key is passed:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make info KEY=1234567890
2026-02-10 13:15:52,054 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 13:15:53,487 - stdiokey-python - INFO - Successfully fetched API key via gcloud
MCP API Key Status
------------------
Provided Key: [FOUND]
Cloud Match: [MISMATCH]

Authentication Failed: Invalid or missing API Key
make: *** [Makefile:26: info] Error 1
xbill@penguin:~/iap-https-rust/stdiokey-python$
Enter fullscreen mode Exit fullscreen mode

Setting an API Key

On project setup the init.sh script configures the Google Cloud environment and creates a sample key to secure the connection. To set this key in the current environment — use the set_key.sh script:

xbill@penguin:~/iap-https-rust/stdiokey-python$ source ../set_key.sh 
--- Setting Google Cloud Project ID ---
Using Google Cloud project: comglitn
Checking for existing MCP API Key...
Using existing MCP API Key: projects/1056842563084/locations/global/keys/cbd6422f-e594-4536-9ad9-6f179f43f11b
Retrieving API Key string...
MCP API Key retrieved and exported.

To use with the 'manual' or 'local' variants, ensure this script was sourced:
source ./set_key.sh
cargo run --bin manual
--- Environment Checks ---
Not running in Google Cloud VM or Shell. Checking ADC...
Running on ChromeOS.
--- Initial Setup complete ---
xbill@penguin:~/iap-https-rust/stdiokey-python$
Enter fullscreen mode Exit fullscreen mode

The tool can now execute:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make info KEY=$MCP_API_KEY
2026-02-10 13:17:55,847 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 13:17:57,277 - stdiokey-python - INFO - Successfully fetched API key via gcloud
System Information Report
=========================

MCP API Key Status
------------------
Provided Key: [FOUND]
Cloud Match: [MATCHED]
Enter fullscreen mode Exit fullscreen mode

System Information with MCP STDIO Transport

One of the key features that the MCP protocol provides is abstracting various transport methods.

The high level tool MCP implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

First- switch the directory with the stdio sample code:

xbill@penguin:~/iap-https-rust/stdiokey-python$ make release KEY=$MCP_API_KEY
Running the MCP Stdio server...
2026-02-10 13:19:46,738 - stdiokey-python - INFO - Fetching MCP API Key for project: comglitn
2026-02-10 13:19:48,154 - stdiokey-python - INFO - Successfully fetched API key via gcloud
2026-02-10 13:19:48,155 - stdiokey-python - INFO - Authentication Successful
2026-02-10 13:19:48,155 - stdiokey-python - INFO - Starting stdiokey-python MCP Stdio server
Enter fullscreen mode Exit fullscreen mode

This step validates that the tool can be started locally and uses the MCP_API_KEY in the local environment.

Gemini CLI settings.json

The default Gemini CLI settings.json has an entry for the Python source:

{
  "mcpServers": {
    "stdiokey-python": {
        "command": "python3",
        "args": ["$HOME/iap-https-rust/stdiokey-python/main.py"],
        "env": {
          "MCP_API_KEY": "$MCP_API_KEY"
        }
      }
    }
  }
Enter fullscreen mode Exit fullscreen mode

Validation with Gemini CLI

Finally- Gemini CLI is restarted and the MCP connection over stdio to the Python Code is validated, The full Gemini CLI Session will start:

 > /mcp list
Configured MCP servers:

🟢 stdiokey-python - Ready (2 tools)
  Tools:
  - disk_usage
  - local_system_info

 > local_system_info

✦ The system information has been retrieved:

  System Information Report
  =========================

  Authentication: [VERIFIED] (Running as MCP Server)

  System Information
  ---
  System Name: posix
  OS Name: linux
  Host Name: penguin

  CPU Information
  ---
  Number of Cores: 12

  Memory Information
  ---
  Total Memory: 6410 MB
  Used Memory: 749 MB
  Total Swap: 0 MB
  Used Swap: 0 MB

  Network Interfaces
  ---
  lo : RX: 133590 bytes, TX: 133590 bytes (MAC: 00:00:00:00:00:00)
  br-413ba64fd5af : RX: 0 bytes, TX: 0 bytes (MAC: 36:10:67:8c:35:b8)
  docker0 : RX: 0 bytes, TX: 0 bytes (MAC: aa:8b:14:57:7f:9b)
  eth0 : RX: 514617147 bytes, TX: 822166162 bytes (MAC: 00:16:3e:52:c3:b9)
Enter fullscreen mode Exit fullscreen mode

Testing the API Key

To validate that the MCP_API_KEY is actually checked at runtime- set the key to an invalid value:

xbill@penguin:~/iap-https-rust/stdiokey-python$ export MCP_API_KEY=twosnakes
xbill@penguin:~/iap-https-rust/stdiokey-python$
Enter fullscreen mode Exit fullscreen mode

Then restart Gemini CLI — you will get an error discovering the MCP tools:

✕ Error during discovery for MCP server 'stdiokey-python': MCP error -32000: Connection closed

 > /mcp list
Configured MCP servers:

🔴 stdiokey-python - Disconnected
Enter fullscreen mode Exit fullscreen mode

Summary

The strategy for using Python for MCP development with Gemini CLI was validated with a incremental step by step approach.

A minimal stdio transport MCP Server was started from Python source code and validated with Gemini CLI running as a MCP client in the same local environment.

This basic Python code was enhanced with an API key generated and stored in the main Google Cloud project.

This API key was used to validate access to the local Python tool and the stdio MCP version directly from Gemini CLI.

This approach can be extended to more complex deployments using other MCP transports and Cloud based options.

Top comments (0)