refactor(mcp): route Make IT Work Cloud through direct endpoints - #22
Merged
Merged
Conversation
Replace the aggregate makeitwork server with fourteen direct remote entries, makeitwork-<integration> at https://mcp-<integration>.makeitwork.cloud/mcp, per the kustomize-cluster mcp-gateway TunnelBinding at bea0c54. CF Access headers still reference CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET; no secret values are introduced. Permission grants move from makeitwork_makeitwork-<integration>_* onto the per-server namespaces makeitwork-<integration>_*. The intended read-only Grafana ability is preserved by mirroring the existing Hatch grafana allowlist onto makeitwork-grafana_* tool-for-tool; no mutating grant is added or widened, and a bare makeitwork-grafana_* wildcard is deliberately not used because it would allow grafana mutating tools. AGENTS.md routing now states the direct endpoints, the CF-Access header environment references, direct tool naming, per-server enable/disable via mcp.makeitwork-<integration>.enabled, and the external-only list: github, hero-ssh, and codebase-memory have no external endpoint. Client-local context-mode, Hatch servers, linear, notion, opentofu-docs, tmux, and codebase-memory are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the retired aggregate
makeitworkMCP entry with the 14 direct Cloudflare Access-protected ToolHive endpoints configured bymakeitworkcloud/kustomize-cluster@bea0c54. Updates routing guidance and preserves existing non-Make-IT-Work client servers. Migrates existing permission namespaces; the direct Grafana grants remain read-only and intentionally excludegenerate_deeplink.Fixes #
Type of change
Validation
Static review confirmed the 14 configured endpoint names, URL pattern, and environment-only CF Access header references against the canonical workload README and TunnelBinding. Adversarial review found and the follow-up commit removed the mutating Grafana shortened-deeplink auto-grant. CI has not run yet; runtime endpoint authentication/reachability was not probed.
Impact and rollout
Producer unchanged:
makeitworkcloud/kustomize-clusterowns the direct endpoints. Consumer changed: this repository's OpenCode config. After merge, workstation rendering/installation remains a separate manual dotfiles stage; no service restart, deployment, or live verification was performed. Rollback is a revert of this PR.Safety and secrets
AI-assisted change; final endpoint inventory and permissions were independently reviewed.