public/dotfiles
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

mcp-config: run MCP servers client-side, not on the gateway

Browse Source 
Every API worth exposing (Gitea, Proxmox) is user-scoped, so hosting MCP
centrally means one shared token per server: everyone acts as the same
identity and attribution is lost. LiteLLM's per-request BYOK cannot cover
all of them either -- it builds its tool->server map from a headerless
background listing, and gitea-mcp hard-exits without a token, so it never
registers. A split brain (some MCPs server-side, some client-side) is worse
than either, so all of them move client-side.

Servers are declared local, spawned via npx with pinned versions, and read
each user's OWN credentials via {env:VAR}. No token is ever written to the
config; the file stays identical for every user.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
noconnor
2026-07-13 13:10:11 -04:00
co-authored by Claude Opus 4.8
parent bd883407ec
commit 70b049625a
4 changed files with 106 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mcp-config/sync.sh
+6 -4
View File
@@ -11,15 +11,17 @@
#
# What it does:
# 1. Fetch the shared opencode.gateway.json from Gitea (the single source of
# truth: the covert-gpt provider + the aggregate MCP endpoint). The file
# is identical for all users — the per-user key is injected via
# {env:LITELLM_KEY}, never baked into the file.
# truth: the covert-gpt provider + the client-side MCP servers). The file
# is identical for all users — EVERY credential (LiteLLM key, Gitea PAT,
# Proxmox token) is injected via {env:VAR} and never baked into the file.
# 2. Auto-discover models: query the gateway's /v1/models with the user's
# key and fill the provider's "models" map. New models exposed on the
# gateway appear on every box at the next sync — no config edit anywhere.
# (opencode cannot list models from a custom provider itself; the map
# must be materialized client-side.) MCP servers need no discovery step:
# the single /mcp/ endpoint aggregates every server the key can access.
# they are declared in the config and run locally under `npx`, each with
# the user's OWN credentials. The gateway hosts no MCP servers at all —
# see mcp-config/README.md for why (user-scoped APIs, no shared tokens).
# 3. Deploy the repo's skills/ tree to ~/.config/mcp-sync/skills. Skills are
# plain files, so there is nothing on the gateway to discover — the repo
# IS the source of truth, and the tree is fetched whole (repo tarball).