Plugin mode had three issues preventing it from working on Astro deployments:

• Multi-replica session errors: FastMCP's streamable HTTP transport stored sessions in-memory, so requests load-balanced across multiple API server replicas got "Session not found" errors. Fixed with stateless_http=True.
• Wrong internal URL: The plugin never called configure(), so the adapter defaulted to localhost:8080. On Astro the API server runs on port 9091. Fixed by reading [api] port from Airflow config.
• No auth on internal API calls: Airflow's API requires JWT auth even on localhost. Fixed by adding ASGI middleware that extracts the Authorization header from incoming MCP requests and forwards it to internal API calls via a per-request ContextVar (safe for concurrent async requests).

Design rationale

Why stateless_http=True? The MCP spec (2025-03-26) says sessions are optional ("a server MAY assign a session ID"). Stateless mode means every POST is independent — no in-memory session store, works with any number of replicas without session affinity.

Why forward the client's token instead of generating one internally? The MCP client already authenticates with a valid Airflow/Astro token. Forwarding it to localhost API calls is equivalent to the user making those calls directly — no privilege escalation, no credential management, no /auth/token round-trips.

Why ContextVar instead of setting _manager._auth_token directly? With concurrent async requests, a shared attribute would race — Alice's token could be overwritten by Bob's before Alice's tool call reads it. ContextVar is scoped per-async-task (per-request in ASGI).

Why pure ASGI middleware instead of BaseHTTPMiddleware? BaseHTTPMiddleware runs call_next in a separate task, which breaks ContextVar propagation. A pure ASGI middleware class runs in the same task as the downstream handler.

Tested on

• Local Astro CLI (Airflow 3.2, single container, no auth required)
• Remote Astro staging deployment (2 API server replicas, JWT auth required)
• Cursor as MCP client with url-based config