From 6151b973bc770dae1103425b48eab2ae557627f0 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 24 Aug 2026 18:00:11 +0200 Subject: [PATCH] perf(mcp): reach brain and infra over tailnet NodePorts, not the public edge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every MCP call from Claude Code was going out through claude.ai's connector infrastructure, across the public internet, through Cloudflare and NPM on piguard, back into koala's k3s ingress — to reach a service on the same machine the session is running on. For brain that means a two-cloud round trip to read /var/lib/supervisor/brain, a file on koala's local disk. Cloudflare rate-limits and size-caps tool results on that path, which is the actual user-facing symptom. Measured from koala: brain koala:30330 200 in 6.8ms infra koala:30342 200 in 3.6ms brain public edge 200 in 27.7ms infra starts working again as a side effect: its only fault was an SNI/cert gap at the public edge (TLS "unrecognized name"), which the NodePort path does not traverse. No NPM change needed for local use. Note this is not a relocation of existing config. The mcpServers block that lived in ~/.claude/settings.json was inert — Claude Code reads server definitions from ~/.claude.json, project .mcp.json, plugins and connectors, not from settings.json. Verified: a uniquely-named server placed there is invisible to both `claude mcp list` and `claude mcp get`. So before the plugin existed, koala had no direct path at all and every call went via Cloudflare by construction. That also explains how a stale GITEA_MCP_TOKEN went unnoticed for five days: nothing consumed it. Safe to land now because koala is the only host with the plugin installed (#24). The koala firewall must allow 30330/30342 on the Tailscale interface — NOT on the LAN broadly, so tailnet membership stays the perimeter — before the Macs get the plugin. Tracked as a prerequisite in #24. Measured today: those ports are refused from iguana over both LAN and tailnet while :22 answers, so the rule does not exist yet. Bump-Type: minor Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m --- .mcp.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.mcp.json b/.mcp.json index 2151502..c43beea 100644 --- a/.mcp.json +++ b/.mcp.json @@ -1,15 +1,16 @@ { + "_comment": "Tailnet-direct NodePorts, not the public d-ma.be hostnames. The public path goes out through Cloudflare and NPM to reach a k3s service on koala, which imposes rate limits and message-size caps on tool results and adds a full internet round trip - for a service on the same machine most sessions run on. Requires koala to allow these ports on the Tailscale interface; see mathias/skills#24.", "mcpServers": { "brain": { "type": "http", - "url": "https://brain-mcp.d-ma.be/mcp", + "url": "http://koala:30330/mcp", "headers": { "Authorization": "Bearer ${BRAIN_MCP_TOKEN}" } }, "infra": { "type": "http", - "url": "https://infra-mcp.d-ma.be/mcp" + "url": "http://koala:30342/mcp" } } }