feat: add tlsConfig (insecureSkipVerify, caCertPem) for HTTP/SSE MCP client connections in Bifrost Helm chart

[BearTS]

Summary

Adds TLS configuration support (tlsConfig) for HTTP and SSE MCP client connections in the Bifrost Helm chart, allowing operators to connect to MCP servers that use self-signed or private CA certificates, or to disable TLS verification in development/testing environments.

Changes

• Added tls_config object to the MCP client config JSON schema (config.schema.json) with insecure_skip_verify and ca_cert_pem fields.
• Updated _helpers.tpl to map tlsConfig.insecureSkipVerify → tls_config.insecure_skip_verify and tlsConfig.caCertPem → tls_config.ca_cert_pem in the generated config JSON.
• Added a commented example tlsConfig block in values.yaml for the clientConfigs[] array.
• Documented the new fields in README.md under an "Upcoming" changelog entry and the values reference table.
• caCertPem supports both a literal PEM string and an env.VAR_NAME reference for reading the certificate from an environment variable.
• insecureSkipVerify takes priority over caCertPem when both are set; it is intended for development/testing only and is not recommended for production.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Deploy the Helm chart with an MCP client config that uses a self-signed CA certificate:

bifrost:
  mcp:
    clientConfigs:
      - name: "example-https-mcp"
        connectionType: "http"
        connectionString: "https://my-internal-mcp.corp/mcp"
        tlsConfig:
          insecureSkipVerify: false
          caCertPem: "env.MY_MCP_CA_CERT"

Verify the generated ConfigMap contains the expected tls_config JSON:

helm template . -f values.yaml | grep -A5 tls_config

Expected output should include:

"tls_config": {
  "insecure_skip_verify": false,
  "ca_cert_pem": "env.MY_MCP_CA_CERT"
}

New config fields:

Field	Description	Default
bifrost.mcp.clientConfigs[].tlsConfig.insecureSkipVerify	Disable TLS certificate verification (dev/test only)	false
bifrost.mcp.clientConfigs[].tlsConfig.caCertPem	PEM-encoded CA cert or env.VAR_NAME reference	""

Screenshots/Recordings

N/A

Breaking changes

• No

Related issues

N/A

Security considerations

• insecureSkipVerify: true disables TLS certificate verification entirely and should never be used in production environments. This is documented explicitly in the schema, README, and values comments.
• caCertPem supports env.VAR_NAME references to avoid embedding sensitive certificate material directly in Helm values.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (5)

• helm-charts/bifrost/README.md is excluded by none and included by none
• helm-charts/bifrost/templates/_helpers.tpl is excluded by none and included by none
• helm-charts/bifrost/values.schema.json is excluded by none and included by none
• helm-charts/bifrost/values.yaml is excluded by none and included by none
• transports/config.schema.json is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 99778788-b7f3-4983-93a6-5cbbc5275e33

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds TLS configuration support for MCP HTTP/SSE clients: JSON and Helm values schemas, Helm template mapping from tlsConfig to generated tls_config, example values, and README documentation updates.

Changes

MCP TLS Configuration

Layer / File(s)	Summary
TLS Schema Definitions transports/config.schema.json, helm-charts/bifrost/values.schema.json	Adds tls_config / tlsConfig objects with insecure_skip_verify/insecureSkipVerify and ca_cert_pem/caCertPem, disallowing additional TLS properties.
Helm Template Mapping helm-charts/bifrost/templates/_helpers.tpl	Helm helper constructs a tls_config object when .tlsConfig is present and maps insecureSkipVerify and caCertPem into the rendered MCP client config.
Values Example & Documentation helm-charts/bifrost/values.yaml, helm-charts/bifrost/README.md	Adds a commented example-https-mcp TLS example in values.yaml; README changelog and MCP parameter table document the new Helm fields and their mapping to generated JSON.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• danpiths

Poem

🐰 A rabbit hops with cert in paw,

tls flags set, no need to gnaw,
Insecure skip or CA to paste,
MCP TLS now with tasteful haste,
Hop, deploy, and connections thaw.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main feature addition: TLS configuration support (insecureSkipVerify and caCertPem) for HTTP/SSE MCP client connections in the Bifrost Helm chart.
Description check	✅ Passed	The description provides a comprehensive explanation of the changes, including affected files, implementation details, testing instructions with examples, security considerations, and checklist completion status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-27-chore_add_support_to_config_json_and_helm_chart

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• feat: add tlsConfig (insecureSkipVerify, caCertPem) for HTTP/SSE MCP client connections in Bifrost Helm chart #3783 👈 (View in Graphite)
• feat: add TLS configuration support for MCP HTTP/SSE client connections #3779
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge; the Go backend already handles tls_config fully and the Helm layer correctly guards against emitting empty or inappropriate TLS objects.

All changed files are Helm chart wiring and schema documentation. The underlying Go implementation for MCPTLSConfig already exists and is well-tested. The template logic correctly uses hasKey for boolean handling and an empty-dict guard. The only findings are minor description inconsistencies (websocket omitted from schema descriptions) that do not affect runtime behavior.

Both schema description strings in transports/config.schema.json and helm-charts/bifrost/values.schema.json omit websocket despite the template handling it.

Important Files Changed

Filename	Overview
helm-charts/bifrost/templates/_helpers.tpl	Adds tlsConfig → tls_config mapping for http/sse/websocket connection types. Uses hasKey for the boolean insecureSkipVerify to handle explicit false, guards with if $tls to avoid emitting an empty object, and the connectionType check correctly excludes stdio/inprocess.
transports/config.schema.json	Adds tls_config to the MCP client config schema, backed by existing Go structs (MCPTLSConfig). Description says "HTTP and SSE" but the template also handles websocket — description should be updated.
helm-charts/bifrost/values.schema.json	Adds tlsConfig to the clientConfig object schema. Description says "HTTP and SSE" but websocket is a valid connectionType in the same enum and the template handles it — minor description inconsistency.
helm-charts/bifrost/values.yaml	Adds a commented example for tlsConfig under clientConfigs. Comments are clear and include the env.VAR_NAME reference pattern.
helm-charts/bifrost/README.md	Adds changelog entry and values reference table rows for the new tlsConfig fields. Documentation is accurate and includes the env.VAR_NAME reference pattern and production warnings.

_{Reviews (6): Last reviewed commit: "chore: add support to config json and he..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/templates/_helpers.tpl`:
- Around line 956-966: The current mapping always sets tls_config when
$client.tlsConfig exists; update the block in _helpers.tpl to only build and set
the "tls_config" key ($cc "tls_config") when the client's connection type is one
of http, sse, or websocket (if you still accept that alias) by checking the
client's connection type (e.g. $client.connection.type or $client.type) before
creating $tls and calling set; keep the existing field mappings for
$client.tlsConfig.insecureSkipVerify and $client.tlsConfig.caCertPem but wrap
the whole mapping in a guard that tests the connection type against
"http","sse","websocket".

In `@helm-charts/bifrost/values.yaml`:
- Line 381: The YAML comment line containing "#   # [Upcoming] TLS configuration
for HTTP and SSE connection types." is stale; remove the "[Upcoming]" marker so
the comment reads "#   # TLS configuration for HTTP and SSE connection types."
to avoid misleading users—update the comment text in the same block (the TLS
example comment) accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: bbae8f94-b2fe-42fd-b182-57345630fead

📥 Commits

Reviewing files that changed from the base of the PR and between 6ae7faf and 5f5e06c.

📒 Files selected for processing (4)

• helm-charts/bifrost/README.md
• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

[Pratham-Mishra04]

Merge activity

• May 28, 9:31 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 28, 9:35 AM UTC: Graphite rebased this pull request as part of a merge.
• May 28, 9:36 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.