feat(mcp): serve the control plane to MCP clients at mcp.sean.farm #2021

Merged

sean merged 3 commits from feat/mcp-server into trunk 2026-08-10 11:05:23 +00:00

Conversation 0 Commits 3 Files changed 38 +2549 -541

sean commented 2026-08-10 10:51:56 +00:00

Owner

Copy link

The MCP server is the third client surface of the one control plane: reads call the query service, mutations call the release API with the shared caller token plus the caller OAuth identity as X-User-Email. A new --mode=mcp runs it from the same released binary.

• OAuth 2.1 access tokens are verified in-process against the Hydra JWKS. RFC 9728 protected-resource metadata points MCP clients at the issuer. The pod holds no Kubernetes credential.
• Six tools: list_projects, status, trace, get_workflow, release, approve. Three embedded model documents. Two guided prompts. Tool results carry next-step hints.
• The Deployment starts at 0 replicas: manifests sync at the release before the image adapter pins the first binary that knows this mode. A follow-up change raises replicas to 2 and adds the PDB.
• The runtime Target, deploy RBAC, Argo image ownership, and the contract guards all name the new Deployment.
• Second commit: regenerate stale CRD bases (description-only churn; the doc-comment rewrite outran the checked-in YAML).

Evidence: make test green (envtest suite, mcpserver at 78.6% coverage), 129/129 guards pass, dashboard and workflows-infra-bare render.

Companion changes (separate repos): the mcp.sean.farm gateway listener + certificate in seanfarm, and the Hydra dynamic-client-registration flip in sean/ory.

The MCP server is the third client surface of the one control plane: reads call the query service, mutations call the release API with the shared caller token plus the caller OAuth identity as X-User-Email. A new --mode=mcp runs it from the same released binary. - OAuth 2.1 access tokens are verified in-process against the Hydra JWKS. RFC 9728 protected-resource metadata points MCP clients at the issuer. The pod holds no Kubernetes credential. - Six tools: list_projects, status, trace, get_workflow, release, approve. Three embedded model documents. Two guided prompts. Tool results carry next-step hints. - The Deployment starts at 0 replicas: manifests sync at the release before the image adapter pins the first binary that knows this mode. A follow-up change raises replicas to 2 and adds the PDB. - The runtime Target, deploy RBAC, Argo image ownership, and the contract guards all name the new Deployment. - Second commit: regenerate stale CRD bases (description-only churn; the doc-comment rewrite outran the checked-in YAML). Evidence: make test green (envtest suite, mcpserver at 78.6% coverage), 129/129 guards pass, dashboard and workflows-infra-bare render. Companion changes (separate repos): the mcp.sean.farm gateway listener + certificate in seanfarm, and the Hydra dynamic-client-registration flip in sean/ory.

sean added 2 commits 2026-08-10 10:51:56 +00:00

feat(mcp): serve the control plane to MCP clients at mcp.sean.farm ... 4f165b2d06

The MCP server is the third client surface of the one control plane:
reads call the query service, mutations call the release API with the
shared caller token plus the caller's OAuth identity as X-User-Email.
A new --mode=mcp runs it from the same released binary. OAuth 2.1
access tokens are verified in-process against the Hydra JWKS; RFC 9728
protected-resource metadata points clients at the issuer; the pod
holds no Kubernetes credential at all.

The Deployment starts at 0 replicas: manifests sync at the release
before the image adapter pins the first binary that knows this mode.
A follow-up change raises replicas once the pin exists. The runtime
Target, the deploy RBAC, the Argo image ownership, and the contract
guards all name the new Deployment.

chore(crd): regenerate bases so the checked-in YAML matches the Go sources ... 9cf9971d84

The doc-comment rewrite changed api/v1alpha1 descriptions without a
regeneration, so the committed CRD YAML drifted from what the pinned
controller-gen (v0.20.1) renders. CI never sees this: the render-diff
half of crd-generated-in-sync runs only where controller-gen is
present. A laptop with the pinned tool could not push at all.
Description-only churn; no schema change.

sean added 1 commit 2026-08-10 10:58:57 +00:00

docs(mcp): how a person connects, what it exposes, how it refuses ... 5d302999a4

The user-facing twin of the embedded resources: connect steps for
Claude Code and claude.ai, the tool/resource/prompt table, the
identity and authorization model, operations notes, and the four
refusals a new user meets first.

sean merged commit 5d302999a4 into trunk 2026-08-10 11:05:23 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2021

No description provided.