chore(release): plugin.json version 0.5.0

Skip-Release: true
perf(mcp): reach brain and infra over tailnet NodePorts, not the public edge
2026-08-24 16:01:14 +00:00 · 2026-08-24 18:00:17 +02:00 · 2026-08-24 15:31:15 +00:00 · 2026-08-24 17:31:11 +02:00
2 changed files with 4 additions and 10 deletions
@@ -1,7 +1,7 @@
 {
  "name": "skills",
  "description": "Mathias's engineering skills library, plus the hooks and MCP servers that make it enforceable: TDD, clean code, debugging, specs, discovery, CI, and secret hygiene.",
-  "version": "0.4.1",
+  "version": "0.5.0",
  "author": {
    "name": "Mathias",
    "url": "https://git.d-ma.be/mathias"
@@ -1,22 +1,16 @@
 {
+  "_comment": "Tailnet-direct NodePorts, not the public d-ma.be hostnames. The public path goes out through Cloudflare and NPM to reach a k3s service on koala, which imposes rate limits and message-size caps on tool results and adds a full internet round trip - for a service on the same machine most sessions run on. Requires koala to allow these ports on the Tailscale interface; see mathias/skills#24.",
  "mcpServers": {
    "brain": {
      "type": "http",
-      "url": "https://brain-mcp.d-ma.be/mcp",
+      "url": "http://koala:30330/mcp",
      "headers": {
        "Authorization": "Bearer ${BRAIN_MCP_TOKEN}"
      }
    },
-    "gitea": {
-      "type": "http",
-      "url": "https://git-mcp.d-ma.be/mcp",
-      "headers": {
-        "Authorization": "Bearer ${GITEA_MCP_TOKEN}"
-      }
-    },
    "infra": {
      "type": "http",
-      "url": "https://infra-mcp.d-ma.be/mcp"
+      "url": "http://koala:30342/mcp"
    }
  }
 }
Author	SHA1	Message	Date
mathias	0be3506799	chore(release): plugin.json version 0.5.0 Skip-Release: true	2026-08-24 16:01:14 +00:00
mathiasandClaude Opus 5	6151b973bc	perf(mcp): reach brain and infra over tailnet NodePorts, not the public edge release / tag (push) Successful in 1s Details Every MCP call from Claude Code was going out through claude.ai's connector infrastructure, across the public internet, through Cloudflare and NPM on piguard, back into koala's k3s ingress — to reach a service on the same machine the session is running on. For brain that means a two-cloud round trip to read /var/lib/supervisor/brain, a file on koala's local disk. Cloudflare rate-limits and size-caps tool results on that path, which is the actual user-facing symptom. Measured from koala: brain koala:30330 200 in 6.8ms infra koala:30342 200 in 3.6ms brain public edge 200 in 27.7ms infra starts working again as a side effect: its only fault was an SNI/cert gap at the public edge (TLS "unrecognized name"), which the NodePort path does not traverse. No NPM change needed for local use. Note this is not a relocation of existing config. The mcpServers block that lived in ~/.claude/settings.json was inert — Claude Code reads server definitions from ~/.claude.json, project .mcp.json, plugins and connectors, not from settings.json. Verified: a uniquely-named server placed there is invisible to both `claude mcp list` and `claude mcp get`. So before the plugin existed, koala had no direct path at all and every call went via Cloudflare by construction. That also explains how a stale GITEA_MCP_TOKEN went unnoticed for five days: nothing consumed it. Safe to land now because koala is the only host with the plugin installed (#24). The koala firewall must allow 30330/30342 on the Tailscale interface — NOT on the LAN broadly, so tailnet membership stays the perimeter — before the Macs get the plugin. Tracked as a prerequisite in #24. Measured today: those ports are refused from iguana over both LAN and tailnet while :22 answers, so the rule does not exist yet. Bump-Type: minor Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-24 18:00:17 +02:00
mathias	6c1b6ce9db	chore(release): plugin.json version 0.4.2 Skip-Release: true	2026-08-24 15:31:15 +00:00
mathiasandClaude Opus 5	5c8341c797	fix(mcp): drop the gitea server — it was a redundant, silently stale copy release / tag (push) Successful in 2s Details Every gitea__* call from Claude Code on koala already resolves through the claude.ai connector, not through this env-var-authenticated HTTP server. The entry was a second path to the same service that nothing actually used. That redundancy is exactly why it rotted unnoticed. GITEA_MCP_TOKEN on koala resolves ~/.op-env -> op://HomeLab/GITEA_MCP_TOKEN, an item orphaned by the 2026-07-30 consolidation that moved gitea-mcp, agentsquad-serve and crush-runner onto a single shared item in the AgentSecrets vault. The host env-file was never migrated and cannot be: koala's 1Password service account has no access to AgentSecrets, while onepassword-connect in-cluster maps both vaults. So the host copy diverged and stayed diverged for five days. The cluster was never affected — zero 401s from the pod CIDR in 30 days, every rejection came from the gateway. Deleting the divergent copy beats maintaining a second source of truth for a token this host does not need. brain stays: it authenticates, and it is genuinely used from the plugin. infra stays but is currently unreachable for an unrelated reason — infra-mcp.d-ma.be fails TLS with "unrecognized name", an SNI/cert gap at the NPM edge, tracked separately. Bump-Type: patch Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-24 17:31:11 +02:00