stacklok / toolhive / 18493738710

Build # 18493738710

Build Type

push

github

Committed by web-flow

Commit Message

Add proposal for Remote MCP Server Proxy Support (#2151)

* Add proposal for Remote MCP Server Proxy Support

This proposal extends the ToolHive Kubernetes operator to support
proxying remote Model Context Protocol (MCP) servers with OAuth
authentication, bringing feature parity with the existing
`thv run <remote-url>` CLI capability.

Key features:
- New MCPRemoteProxy CRD for deploying remote MCP proxies
- JWT validation and identity extraction for policy enforcement
- Optional token exchange support via MCPExternalAuthConfig CRD
- Integration with existing authz, audit, and tool filtering
- Stateless, horizontally scalable architecture

This enables enterprises to gain centralized observability and policy
enforcement over external MCP usage without requiring changes to
remote services or storing user credentials.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

* Address PR feedback on remote MCP proxy proposal

Add status field enhancements:
- Add ObservedGeneration field
- Document recommended condition types (Ready, RemoteAvailable)

Add implementation clarifications:
- Explain authentication model differences between CLI and K8s proxy
- Document two proxy modes: direct (token forwarding) vs token exchange
- Clarify OIDC configuration validates different issuers in different modes
- Document cross-namespace reference policy
- Specify middleware ordering
- Note that token exchange may use oauth2.ReuseTokenSource for caching

Fix numbering in best practices list.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>
Co-authored-by: Claude <noreply@anthropic.com>

Run Details

17570 of 37630 relevant lines covered (46.69%)

16.03 hits per line

Source File

Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available