feat(toolhive): re-enable the GitHub MCP over streamable-http

kubernetes/apps/ai/toolhive/config/github.yaml

@@ -1,82 +1,101 @@
-# Disabled: ToolHive v0.40.1 virtual-MCP health monitoring repeatedly initializes
-# GitHub's stdio backend, which returns `duplicate "initialize" received` and
-# degrades the resources and unified virtual MCPs. Restore after an upstream fix.
-# ---
-# apiVersion: toolhive.stacklok.dev/v1beta1
-# kind: MCPServer
-# metadata:
-#   name: &name github
-# spec:
-#   image: ghcr.io/github/github-mcp-server:v1.6.0
-#   transport: stdio
-#   groupRef:
-#     name: resources
-#   args:
-#     - stdio
-#   secrets:
-#     - name: toolhive-secrets
-#       key: GITHUB_PERSONAL_ACCESS_TOKEN
-#       targetEnvName: GITHUB_PERSONAL_ACCESS_TOKEN
-#   toolConfigRef:
-#     name: *name
-#   podTemplateSpec:
-#     spec:
-#       containers:
-#         - name: mcp
-#           resources:
-#             requests:
-#               cpu: 10m
-#               memory: 64Mi
-#             limits:
-#               cpu: 500m
-#               memory: 256Mi
-#   resources:
-#     requests:
-#       cpu: 10m
-#       memory: 64Mi
-#     limits:
-#       cpu: 200m
-#       memory: 200Mi
-# ---
-# apiVersion: toolhive.stacklok.dev/v1beta1
-# kind: MCPServer
-# metadata:
-#   name: github-opt
-# spec:
-#   image: ghcr.io/github/github-mcp-server:v1.6.0
-#   transport: stdio
-#   groupRef:
-#     name: all
-#   args:
-#     - stdio
-#   secrets:
-#     - name: toolhive-secrets
-#       key: GITHUB_PERSONAL_ACCESS_TOKEN
-#       targetEnvName: GITHUB_PERSONAL_ACCESS_TOKEN
-#   toolConfigRef:
-#     name: github
-#   podTemplateSpec:
-#     spec:
-#       containers:
-#         - name: mcp
-#           resources:
-#             requests:
-#               cpu: 10m
-#               memory: 64Mi
-#             limits:
-#               cpu: 500m
-#               memory: 256Mi
-#   resources:
-#     requests:
-#       cpu: 10m
-#       memory: 64Mi
-#     limits:
-#       cpu: 200m
-#       memory: 200Mi
 ---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/toolhive.stacklok.dev/mcpexternalauthconfig_v1beta1.json
 apiVersion: toolhive.stacklok.dev/v1beta1
-kind: MCPToolConfig
+kind: MCPExternalAuthConfig
 metadata:
   name: github
 spec:
-  toolsFilter: []
+  # The `http` subcommand takes no server-side token: unlike stdio, its ServerConfig
+  # carries no Token field and it authenticates per request. The proxy injects the
+  # PAT as an Authorization: Bearer header instead.
+  type: bearerToken
+  bearerToken:
+    tokenSecretRef:
+      name: toolhive-secrets
+      key: GITHUB_PERSONAL_ACCESS_TOKEN
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/toolhive.stacklok.dev/mcpserver_v1beta1.json
+apiVersion: toolhive.stacklok.dev/v1beta1
+kind: MCPServer
+metadata:
+  name: &name github
+spec:
+  # streamable-http, not stdio: ToolHive health monitoring re-runs `initialize`,
+  # which the stdio backend rejects with `duplicate "initialize" received` and
+  # which degraded the resources and unified gateways (upstream #5890).
+  image: ghcr.io/github/github-mcp-server:v1.7.0
+  transport: streamable-http
+  mcpPort: 8082 # `http` binds 8082 by default and exposes no env-bound port flag
+  proxyPort: 8080
+  groupRef:
+    name: resources
+  permissionProfile:
+    type: builtin
+    name: network
+  externalAuthConfigRef:
+    name: *name
+  args:
+    - http
+    - --read-only
+    # The full server is ~79 tools; this subset keeps the optimizer's index small.
+    - --toolsets
+    - context,repos,issues,pull_requests
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: mcp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+  resources:
+    requests:
+      cpu: 10m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 200Mi
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/toolhive.stacklok.dev/mcpserver_v1beta1.json
+apiVersion: toolhive.stacklok.dev/v1beta1
+kind: MCPServer
+metadata:
+  name: github-opt
+spec:
+  image: ghcr.io/github/github-mcp-server:v1.7.0
+  transport: streamable-http
+  mcpPort: 8082
+  proxyPort: 8080
+  groupRef:
+    name: all
+  permissionProfile:
+    type: builtin
+    name: network
+  externalAuthConfigRef:
+    name: github
+  args:
+    - http
+    - --read-only
+    - --toolsets
+    - context,repos,issues,pull_requests
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: mcp
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+  resources:
+    requests:
+      cpu: 10m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 200Mi