Oracle OAC Governance Reporting and OAC MCP server on my Codex

 There are 2 very different Generative AI based solutions for OAC (not for OAS, currently): 

• OAC Governance Reporting 
• OAC MCP server

The OAC Governance Skill generates inventory and governance reports for an OAC instance. 

OAC MCP server connects to OAC server and can run various tasks or run queries on OAC. 

Capability	Main purpose	Changes OAC?	Status
Governance Skill	Inventory and governance reporting	Read-only by default	Community/demo
OAC MCP tools	Search, query, export and catalog administration	Some tools can modify content	Oracle Preview

OAC Governance Reporting

The major goal of the OAC Governance Reporting is to let you create Governance reports about the OAC server with AI tools (Codex/Claude/Cursor...).

Here you can find some explanations about OAC Governance Reporting, as well as the code itself (zip file) and a Guide: https://community.oracle.com/products/oracleanalytics/discussion/29242/oracle-analytics-governance-skill

Please note: "This content is intended for community knowledge sharing and demonstration purposes. It is not official Oracle documentation and should not be considered formal Oracle guidance or support documentation."

The main formats are Codex, Claude and General (for other options)

For connection with your OAC you will need the OAC server URL and the tokens.json file. The file is available from your OAC profile / Access Tokens menu. 

The tokens are valid for an hour. After that the AI tool will request access to updated tokens.

Now I can work with my OAC server. Here I request to see all dataflows I have access to and sources/targets of specific dataflow:

For larger output, you will get an excel file.

Please note, this is not the OAC Analytics plugin workbook extension described In this Blog and This Video that creates files from Analytics workbook GUI (see images below). What I described above is Codex/Claude/Cursor UI for you to interact directly with OAC instance. 

OAC MCP server

The OAC MCP server does what any MCP tools should. It lets you interact directly from the AI tool (Codex/Claude/Cursor...) with the OAC server. It can run queries you want or do Administration of Catalog etc... 

Always remember the MCP connection has its overhead. This very simple count distinct takes less than 1 second in OAC:

See here the full list of available tools. The MCP server has an impressive list of capabilities:

Administration:

• Create a catalog folder
• Copy a catalog item
• Move a catalog item
• Delete a catalog item
• Update catalog permissions
• Create or replace workbook or connection catalog content

Search:

• Search catalog objects

Content:

• Match a natural-language question to relevant OAC data sources
• Retrieve table and column metadata for subject areas or datasets
• Execute Oracle Analytics Logical SQL and return query results
• Export a workbook to PNG or PDF

MCP Tool Name	Purpose
oracle_analytics-search_catalog	Search catalog objects such as workbooks, folders, datasets, connections, subject areas, analyses, reports, dashboards, and scripts.
oracle_analytics-find_matching_datasources	Match a natural-language question to relevant OAC data sources.
oracle_analytics-describe_data	Retrieve table and column metadata for subject areas or datasets.
oracle_analytics-execute_logical_sql	Execute Oracle Analytics Logical SQL and return query results.
oracle_analytics-save_catalog_content	Create or replace workbook or connection catalog content
oracle_analytics-export_workbook	Export a workbook to PNG or PDF.
oracle_analytics-create_catalog_folder	Create a catalog folder.
oracle_analytics-copy_catalog_item	Copy a catalog item.
oracle_analytics-move_catalog_item	Move a catalog item.
oracle_analytics-delete_catalog_item	Delete a catalog item.
oracle_analytics-update_catalog_acl	Update catalog permissions.

to create the connection, we need the MCP Connect option from the Profile:

The OAC MCP Server documentation is here in the Developers Guide 

There are Blogs and Videos about it as well. 

Mike Durran provides a 55-minute presentation about OAC MCP here as well.

When I did the setups, I didn't bother with both setups and just asked my Codex to do the setup for both (MCP and Governance). I provided Codex with the relevant documentation links and required files, and it configured both capabilities within a few minutes.

For anyone who prefers a manual installation, I asked Codex to summarize the steps it performed:

# OAC governance reporting and OAC MCP server in Codex

This guide installs two complementary capabilities:

1. **OAC governance reporting** — read-only inventory and governance reports in Excel.

2. **OAC MCP server** — lets Codex discover and query OAC through MCP in any Codex project.

The two use different authentication methods on purpose:

| Capability | Authentication | Why |

| --- | --- | --- |

| Governance reporting | OAC `tokens.json` access-token file | The reporting scripts use the OAC REST APIs. |

| OAC MCP | Browser sign-in with a local cached session | Oracle's recommended interactive method; it avoids passing token files to Codex. |

Never put token values, bearer headers, cookies, or the contents of `tokens.json` into prompts, source control, reports, or logs.

## 1. Prerequisites

- Codex Desktop on Windows.

- An OAC account that can view the workbooks and datasets you want to report on.

- Node.js 18 or later. Check it in PowerShell:

```powershell

node --version

```

- A downloaded OAC token file for governance reporting. In OAC, go to **User Profile** > **Access Tokens**, create one, and save the downloaded JSON file somewhere private, for example `C:\Users\<you>\Downloads\tokens.json`.

OAC token files normally expire after about one hour. Generate a fresh one if the governance scripts report an authentication failure.

## 2. Install the OAC governance skill

Install the Oracle governance skill into your global Codex skills directory. A globally installed skill is available from all Codex projects.

```powershell

# Run from a clone of Oracle's skills repository.

Copy-Item .\oac-governance "$env:USERPROFILE\.codex\skills\oac-governance" -Recurse

```

If the `oac-governance` skill is already visible in Codex, skip this step. Restart Codex after installing a new skill.

## 3. Configure governance reporting

Open this file:

```text

C:\Users\<you>\.codex\skills\oac-governance\config\oac-config.json

```

Set the OAC URL and the path to the token file. Use forward slashes in JSON paths, or escape Windows backslashes.

```json

{

"oac_url": "https://your-instance.analytics.ocp.oraclecloud.com",

"tokens_path": "C:/Users/<you>/Downloads/tokens.json",

"default_language": "en"

}

```

For Boris's current OAC instance, the URL is:

```text

https://temp1-XXXXXXXXX-XX.analytics.ocp.oraclecloud.com

```

Keep `tokens.json` outside the skill folder and outside Git repositories.

## 4. Verify the governance configuration

Use the Python runtime bundled with Codex, or another Python 3 installation:

```powershell

$python = "$env:USERPROFILE\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe"

$skill = "$env:USERPROFILE\.codex\skills\oac-governance"

& $python "$skill\scripts\oac_api.py" `

--config "$skill\config\oac-config.json" `

config-status

```

Then run a minimal read-only request:

```powershell

& $python "$skill\scripts\oac_api.py" `

--config "$skill\config\oac-config.json" `

search-items --type catalog --search "*" --limit 1

```

This confirms only that the current token can reach OAC; it does not prove catalog-wide administrator visibility. Report results always cover the content visible to the authenticated account.

## 5. Create an Excel governance report

Create an output folder in the current project, then build the report JSON and Excel workbook:

```powershell

$python = "$env:USERPROFILE\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe"