From 7ba01abdbe7ea0fdb16e599b06f1122d0ec42a10 Mon Sep 17 00:00:00 2001 From: Mathias Date: Sat, 29 Aug 2026 14:18:38 +0200 Subject: [PATCH] chore(mcp): park cad and gitea-mcp entries, blocked on vault visibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both services are now proxied from koala and reachable: tailscale serve 8445 -> 127.0.0.1:31877 (cad) and 8446 -> 127.0.0.1:30340 (gitea-mcp). Both answer 401 unauthenticated, so the path is right and auth is enforced. They stay out of mcpServers because neither token resolves on this host. The static tokens live in the 1Password AgentSecrets vault; koala's op identity sees HomeLab only: op vault list -> HomeLab, and nothing else op://HomeLab/CAD_STATIC_TOKEN -> could not find item op://HomeLab/gitea-mcp-shared-token -> could not find item That is infra#224, not the OAuth-discovery bug #32 and #33 both flagged as the likely blocker. A live entry that cannot authenticate would fail on every session start, so the wiring is recorded rather than enabled. The item names come from the ExternalSecrets, read by reference only — no secret value was retrieved, printed, or transformed at any point. Refs #32, #33 Bump-Type: patch --- .mcp.json | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.mcp.json b/.mcp.json index acd884f..66ae279 100644 --- a/.mcp.json +++ b/.mcp.json @@ -12,5 +12,22 @@ "type": "http", "url": "https://koala.tail30472e.ts.net:8444/mcp" } + }, + "_parked": { + "_reason": "cad and gitea-mcp are proxied and reachable (tailscale serve 8445 -> 127.0.0.1:31877, 8446 -> 127.0.0.1:30340; both answer 401 unauthenticated, so auth is enforced and the path is right). They stay parked because their static tokens live in the 1Password AgentSecrets vault, and this host's op identity sees only HomeLab -- 'op vault list' returns HomeLab alone, and resolving op://HomeLab/gitea-mcp-shared-token/password or op://HomeLab/CAD_STATIC_TOKEN/password fails with 'could not find item'. That is infra#224 (AgentSecrets not visible to koala's service account), NOT the OAuth-discovery bug both issues warned about. Enabling is: make the vault visible, add the two op:// references to ~/.op-env, move these entries into mcpServers. See mathias/skills#32 and #33.", + "cad": { + "type": "http", + "url": "https://koala.tail30472e.ts.net:8445/mcp", + "headers": { + "Authorization": "Bearer ${CAD_MCP_TOKEN}" + } + }, + "gitea": { + "type": "http", + "url": "https://koala.tail30472e.ts.net:8446/mcp", + "headers": { + "Authorization": "Bearer ${GITEA_MCP_STATIC_TOKEN}" + } + } } -} \ No newline at end of file +}