EislM0203andClaude Opus 5
631bdbb13f
find_account/find_category were added and get_openapi_spec dropped after this comment was written, so the counts are 15 read / 39 total, not 14 / 38. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L3qYLuu9jgXsCRXmJ18YGY
111 lines
3.2 KiB
YAML
111 lines
3.2 KiB
YAML
# fin-mcp — MCP server for the fin API.
|
|
#
|
|
# This file is NOT applied from this repo. The cluster is reconciled by Flux
|
|
# from the GitOps repo (Kustomization `fin-app`, namespace flux-system); copy
|
|
# this alongside the existing fin-api / fin-web manifests there.
|
|
#
|
|
# Deliberately ClusterIP-only, with no HTTPRoute. Writes are enabled, and the
|
|
# fin API has no authentication (FIN_API_TOKEN is unset on fin-api), so the
|
|
# only thing keeping this safe is that nothing outside the cluster can reach
|
|
# it. Do not add an HTTPRoute for this Service without turning on auth first.
|
|
# This matches how karakeep-mcp, paperless-mcp and searxng-mcp are deployed.
|
|
#
|
|
# In-cluster endpoint: http://fin-mcp.apps.svc.cluster.local:8000/mcp
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: fin-mcp
|
|
namespace: apps
|
|
labels:
|
|
app: fin
|
|
component: mcp
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: fin
|
|
component: mcp
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: fin
|
|
component: mcp
|
|
spec:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
containers:
|
|
- name: mcp
|
|
image: harbor.cloud.traunseenet.com/library/fin-mcp:latest
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- name: http
|
|
containerPort: 8000
|
|
protocol: TCP
|
|
env:
|
|
# Talks to the API over the cluster Service, not the public route.
|
|
- name: FIN_API_URL
|
|
value: http://fin-api.apps.svc.cluster.local:8000
|
|
- name: FIN_MCP_TRANSPORT
|
|
value: streamable-http
|
|
- name: FIN_MCP_HOST
|
|
value: 0.0.0.0
|
|
- name: FIN_MCP_PORT
|
|
value: "8000"
|
|
- name: FIN_MCP_PATH
|
|
value: /mcp
|
|
# 39 tools instead of 15. Safe only while this stays unreachable
|
|
# from outside the cluster — see the header note.
|
|
- name: FIN_MCP_ALLOW_WRITES
|
|
value: "1"
|
|
# Uncomment together with FIN_API_TOKEN on fin-api.
|
|
# - name: FIN_API_TOKEN
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: fin-api-token
|
|
# key: token
|
|
# MCP has no unauthenticated health route, so probe the TCP socket
|
|
# rather than an HTTP path — GET /mcp answers 406 without the MCP
|
|
# Accept headers, which would read as a failure.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: fin-mcp
|
|
namespace: apps
|
|
labels:
|
|
app: fin
|
|
component: mcp
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: fin
|
|
component: mcp
|
|
ports:
|
|
- name: http
|
|
port: 8000
|
|
targetPort: http
|
|
protocol: TCP
|