2127b41d9f
Delivers the final piece of the mcptoken stack: a containerized,
network-accessible mcplocal that serves Streamable-HTTP MCP to off-host
clients (the vLLM use case), authenticated by project-scoped McpTokens.
New binary (same package, new entry):
- src/mcplocal/src/serve.ts — HTTP-only entry. Reads MCPLOCAL_MCPD_URL,
MCPLOCAL_MCPD_TOKEN, MCPLOCAL_HTTP_HOST/PORT, MCPLOCAL_CACHE_DIR from
env. No StdioProxyServer, no --upstream.
- src/mcplocal/src/http/token-auth.ts — Fastify preHandler that
validates mcpctl_pat_ bearers via mcpd's /api/v1/mcptokens/introspect.
30s positive / 5s negative TTL. Rejects wrong-project with 403.
Shared HTTP MCP client:
- src/shared/src/mcp-http/ — reusable McpHttpSession with initialize,
listTools, callTool, close. Handles http+https, SSE, id correlation,
distinct McpProtocolError / McpTransportError. Plus mcpHealthCheck
and deriveBaseUrl helpers.
New CLI verb `mcpctl test mcp <url>`:
- Flags: --token (also $MCPCTL_TOKEN), --tool, --args (JSON),
--expect-tools, --timeout, -o text|json, --no-health.
- Exit codes: 0 PASS, 1 TRANSPORT/AUTH FAIL, 2 CONTRACT FAIL.
Container + deploy:
- deploy/Dockerfile.mcplocal (Node 20 alpine, multi-stage, pnpm
workspace, CMD node src/mcplocal/dist/serve.js, VOLUME
/var/lib/mcplocal/cache, HEALTHCHECK on :3200/healthz).
- scripts/build-mcplocal.sh mirrors build-mcpd.sh.
- fulldeploy.sh is now a 4-step pipeline that also builds + rolls out
mcplocal (gated on `kubectl get deployment/mcplocal` so the script
stays green before the Pulumi stack lands).
Audit + cache:
- project-mcp-endpoint.ts passes MCPLOCAL_CACHE_DIR into FileCache at
both construction sites and, when request.mcpToken is present, calls
collector.setSessionMcpToken(id, ...) so audit events carry the
tokenName/tokenSha.
Tests:
- 9 unit cases on `mcpctl test mcp` (happy path, health miss,
expect-tools hit/miss, transport throw, tool isError, json report,
$MCPCTL_TOKEN env fallback, invalid --args).
- Smoke test src/mcplocal/tests/smoke/mcptoken.smoke.test.ts —
gated on healthz($MCPGW_URL), skipped cleanly when unreachable.
Covers happy path, wrong-project 403, --expect-tools contract
failure, and revocation 401 within the negative-cache window.
1773/1773 workspace tests pass. Pulumi resources (Deployment, Service,
Ingress, PVC, Secret, NetworkPolicy) still need to land in
../kubernetes-deployment before the smoke gate flips on.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
84 lines
2.3 KiB
Bash
Executable File
84 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build mcplocal (HTTP-only) Docker image and push to Gitea container registry.
|
|
#
|
|
# Usage:
|
|
# ./build-mcplocal.sh [tag] # Build for native arch
|
|
# ./build-mcplocal.sh [tag] --platform linux/amd64
|
|
# ./build-mcplocal.sh [tag] --multi-arch
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
|
|
cd "$PROJECT_ROOT"
|
|
|
|
# Load .env for GITEA_TOKEN
|
|
if [ -f .env ]; then
|
|
set -a; source .env; set +a
|
|
fi
|
|
|
|
# Push directly to internal address (external proxy has body size limit)
|
|
REGISTRY="10.0.0.194:3012"
|
|
IMAGE="mcplocal"
|
|
TAG="${1:-latest}"
|
|
|
|
PLATFORM=""
|
|
MULTI_ARCH=false
|
|
shift 2>/dev/null || true
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--platform)
|
|
PLATFORM="$2"
|
|
shift 2
|
|
;;
|
|
--multi-arch)
|
|
MULTI_ARCH=true
|
|
shift
|
|
;;
|
|
*)
|
|
shift
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [ "$MULTI_ARCH" = true ]; then
|
|
echo "==> Building multi-arch $IMAGE image (linux/amd64 + linux/arm64)..."
|
|
podman build --platform linux/amd64,linux/arm64 \
|
|
--manifest "$IMAGE:$TAG" -f deploy/Dockerfile.mcplocal .
|
|
|
|
echo "==> Tagging manifest as $REGISTRY/michal/$IMAGE:$TAG..."
|
|
podman tag "$IMAGE:$TAG" "$REGISTRY/michal/$IMAGE:$TAG"
|
|
|
|
echo "==> Logging in to $REGISTRY..."
|
|
podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
|
|
|
|
echo "==> Pushing manifest to $REGISTRY/michal/$IMAGE:$TAG..."
|
|
podman manifest push --tls-verify=false --all \
|
|
"$REGISTRY/michal/$IMAGE:$TAG" "docker://$REGISTRY/michal/$IMAGE:$TAG"
|
|
else
|
|
PLATFORM_FLAG=""
|
|
if [ -n "$PLATFORM" ]; then
|
|
PLATFORM_FLAG="--platform $PLATFORM"
|
|
echo "==> Building $IMAGE image for $PLATFORM..."
|
|
else
|
|
echo "==> Building $IMAGE image (native arch)..."
|
|
fi
|
|
|
|
podman build $PLATFORM_FLAG -t "$IMAGE:$TAG" -f deploy/Dockerfile.mcplocal .
|
|
|
|
echo "==> Tagging as $REGISTRY/michal/$IMAGE:$TAG..."
|
|
podman tag "$IMAGE:$TAG" "$REGISTRY/michal/$IMAGE:$TAG"
|
|
|
|
echo "==> Logging in to $REGISTRY..."
|
|
podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
|
|
|
|
echo "==> Pushing to $REGISTRY/michal/$IMAGE:$TAG..."
|
|
podman push --tls-verify=false "$REGISTRY/michal/$IMAGE:$TAG"
|
|
fi
|
|
|
|
# Ensure package is linked to the repository
|
|
source "$SCRIPT_DIR/link-package.sh"
|
|
link_package "container" "$IMAGE"
|
|
|
|
echo "==> Done!"
|
|
echo " Image: $REGISTRY/michal/$IMAGE:$TAG"
|