refactor(mcp-gateway): consolidate external aggregate and clean member names - #242
Merged
Merged
Conversation
…are/Playwright/Twilio docs, single tunnel route Rename every MCPGroup member metadata name from makeitwork-* to clean integration keys (kubernetes, argocd, grafana, aws, aws-docs, gcp, terraform-docs, context7, parallel-search, apify, slidespeak): the vmcp aggregate exposes member tools name-prefixed with these keys. Rename the aggregate-member manifests makeitwork-aws-mcpserver.yaml and makeitwork-gcp-mcpserver.yaml to aws-mcpserver.yaml and gcp-mcpserver.yaml to match. Add Cloudflare (cloudflare-read, read-only token boundary preserved via renamed cloudflare-read-auth) and Playwright (playwright) to the gateway group, and add a public-docs-only twilio-docs MCPRemoteProxy (no auth config, no header forward, no secret references). Retire the obsolete per-integration TunnelBinding subjects, retaining only the aggregate root route (mcp.makeitwork.cloud -> vmcp-gateway); update kustomization resource list, comments, and the directory README. Non- aggregate makeitwork-github, hero-ssh, and codebase-memory backends are unchanged.
…ght exposure approval Restore the original argocd-mcpserver.yaml comment text (--allowed-host-header) so the only intended change on that file remains the member rename to `argocd`. Record the 2026-09-11 owner approval for external aggregate exposure of the browser-capable playwright member in its manifest comment and the directory README ownership boundary (Cloudflare Access service token remains the edge authentication boundary). No other changes; no secrets involved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Renames ToolHive aggregate members from
makeitwork-*to clean integration keys, makes the existing Cloudflare read proxy and Playwright browser server available through the Access-protected aggregate, and adds a credential-freetwilio-docspublic-documentation proxy. Retires all per-integration public TunnelBinding subjects;mcp.makeitwork.cloudremains the single external gateway route.Fixes #
N/A — owner-approved MCP aggregate consolidation.
Type of change
Validation
Impact and rollout
Producer:
kustomize-cluster/workloads/mcp-gateway; consumer: the existing external aggregatemcp.makeitwork.cloudand the subsequently updatedopencode-serverchart.This deletes/recreates renamed ToolHive members and their generated proxy Services, removes the nine dedicated external routes, and retains only the existing aggregate Cloudflare Access route. Cloudflare API authentication remains proxy-owned and read-only. The new Twilio proxy has no authentication/header/Secret reference and serves public documentation only.
Owner-approved external exposure: Playwright is intentionally made available through the existing Cloudflare-Access aggregate on 2026-09-11. Its pinned image and current runtime security configuration are unchanged.
Owner-accepted cutover: OpenCode 0.1.74 currently uses the old direct generated Services, so its affected MCP integrations will be temporarily unavailable after this reconciles and before the separately reviewed
opencode-server0.1.75 pin rolls out. Merge and reconcile this PR first, then merge the charts PR promptly. Rollback is paired: revert this GitOps change and reselect/publish a chart compatible with the restored Service names; do not revert only one side.After merge, verify GitOps root and
mcp-gatewayApplication reconciliation, renamed MCP resource readiness, aggregate tool discovery including Cloudflare/Playwright/Twilio docs, and DNS retirement. No sync, rollout, or live verification is authorized by this PR.Safety and secrets
AI-assisted change; reviewer scrutiny requested for ToolHive aggregation and aggregate-only cutover.