feat: add ClickHouse logs store, MCP OAuth2 server config, `bedrock_mantle` provider, virtual key `expires_at`, and per-client `toolExecutionTimeout` to Helm chart by BearTS · Pull Request #4960 · maximhq/bifrost

BearTS · 2026-07-06T14:04:25Z

Summary

Extends the Bifrost Helm chart with several new configuration capabilities: OAuth2/MCP server authentication modes, ClickHouse as a logs store backend, AWS Bedrock Mantle provider support, virtual key expiry, and per-client tool execution timeout overrides.

Changes

MCP server auth modes: Added mcpServerAuthMode (headers, both, oauth) to control how /mcp authenticates inbound clients. Added oauth2ServerConfig block supporting issuerUrl, authCodeTtl, accessTokenTtl, and disableVkIdentity for Bifrost-issued JWT flows.
ClickHouse logs store: Added clickhouse as a valid storage.logsStore.type. Supports full connection configuration including host, port, database, credentials, protocol (native/http), TLS, dial timeout, and optional cluster name for replicated DDL.
Bedrock Mantle provider: Added bedrock_mantle_key_config schema and example configuration supporting SigV4 credentials, AssumeRole via role_arn, external_id, and session_name. Added mutual-exclusivity constraints alongside existing provider key configs.
Virtual key expiry: Added expires_at (RFC3339) field to virtual key definitions. Requests using a key past its expiry timestamp are rejected.
Per-client tool execution timeout: Added toolExecutionTimeout to MCP client configuration, allowing per-server overrides of the global toolManagerConfig.toolExecutionTimeout. Accepts a Go duration string or bare integer (seconds); 0 falls back to the global default.

Type of change

Affected areas

How to test

# Render the chart and verify new fields appear in the generated config
helm template bifrost ./helm-charts/bifrost \
  --set bifrost.client.mcpServerAuthMode=both \
  --set bifrost.client.oauth2ServerConfig.issuerUrl=https://example.com \
  --set bifrost.client.oauth2ServerConfig.authCodeTtl=300 \
  --set bifrost.client.oauth2ServerConfig.accessTokenTtl=600 \
  --set storage.logsStore.type=clickhouse \
  --set storage.logsStore.clickhouse.host=clickhouse.default.svc.cluster.local

# Validate schema
helm lint ./helm-charts/bifrost

# Verify ClickHouse logs store block is rendered correctly
helm template bifrost ./helm-charts/bifrost \
  --set storage.logsStore.type=clickhouse \
  --set storage.logsStore.clickhouse.host=ch-host \
  --set storage.logsStore.clickhouse.protocol=native \
  --set storage.logsStore.clickhouse.secure=true

# Verify virtual key expiry field is included
helm template bifrost ./helm-charts/bifrost \
  --set 'bifrost.virtualKeys[0].name=test' \
  --set 'bifrost.virtualKeys[0].expires_at=2026-12-31T23:59:59Z'

New configuration fields:

Field	Description
`bifrost.client.mcpServerAuthMode`	`headers` (default), `both`, or `oauth`
`bifrost.client.oauth2ServerConfig.*`	OAuth2 AS settings for `/mcp`
`storage.logsStore.type=clickhouse`	ClickHouse backend for logs
`storage.logsStore.clickhouse.*`	ClickHouse connection parameters
`virtualKeys[].expires_at`	RFC3339 expiry for virtual keys
`mcpClients[].toolExecutionTimeout`	Per-server tool execution timeout override
`providers.bedrock_mantle.*`	AWS Bedrock Mantle provider key config

Breaking changes

Yes
No

Security considerations

oauth2ServerConfig introduces Bifrost as an OAuth2 authorization server issuing JWTs for MCP clients. The issuerUrl must be a stable, publicly reachable URL in multi-host deployments to ensure JWT iss claims and discovery documents are consistent.
disableVkIdentity removes virtual-key identity from the OAuth consent flow; only valid in oauth mode.
bedrock_mantle_key_config credentials support the env. prefix to avoid embedding secrets directly in values files.
Virtual key expires_at enforcement happens server-side; expired keys are rejected at request time.

Checklist

I read docs/contributing/README.md and followed the guidelines
I added/updated tests where appropriate
I updated documentation where needed
I verified builds succeed (Go and UI)
I verified the CI pipeline passes locally if applicable

coderabbitai · 2026-07-06T14:04:35Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 48b9f295-32f1-48bd-ae4b-a94e1714071c

📥 Commits

Reviewing files that changed from the base of the PR and between b97bc2b and 936ac46.

📒 Files selected for processing (8)

docs/changelogs/helm-v2.1.26.mdx
docs/docs.json
helm-charts/bifrost/Chart.yaml
helm-charts/bifrost/README.md
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
helm-charts/index.yaml

✅ Files skipped from review due to trivial changes (4)

helm-charts/bifrost/Chart.yaml
docs/changelogs/helm-v2.1.26.mdx
docs/docs.json
helm-charts/bifrost/values.yaml

🚧 Files skipped from review as they are similar to previous changes (3)

helm-charts/index.yaml
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json

📝 Walkthrough

Summary by CodeRabbit

New Features
- Added inbound MCP authentication controls, including OAuth2 server configuration with capped token TTLs.
- Added ClickHouse as a logs store backend with configurable connection details.
- Added the Bedrock Mantle provider and enabled DeepSeek via provider passthrough.
- Added per-MCP client tool execution timeout overrides and optional governance virtual key expiration (expires_at).
Documentation
- Published the Helm v2.1.26 changelog and updated Helm chart docs/navigation.
Chores
- Bumped the Helm chart version to 2.1.26 and refreshed the chart index metadata/schema guidance.

Walkthrough

This PR bumps the Bifrost Helm chart to v2.1.26 and adds MCP auth, virtual key expiry, ClickHouse log storage, Bedrock Mantle, and per-server tool timeout configuration, with matching schema, values, docs, and index updates.

Changes

Helm v2.1.26 configuration additions

Layer / File(s)	Summary
Version bump and changelog documentation `helm-charts/bifrost/Chart.yaml`, `helm-charts/bifrost/README.md`, `docs/changelogs/helm-v2.1.26.mdx`, `docs/docs.json`, `helm-charts/index.yaml`	Chart version was bumped to 2.1.26, the release is documented in README and a new changelog page, docs navigation includes the page, and the Helm index adds the new chart entry.
MCP inbound authentication and OAuth2 server config `helm-charts/bifrost/templates/_helpers.tpl`, `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`	Adds `mcpServerAuthMode` and `oauth2ServerConfig` rendering, schema validation, and documented example values.
Virtual key expiration `helm-charts/bifrost/templates/_helpers.tpl`, `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`	Adds optional `expires_at` to virtual keys in template output, schema, and example values.
ClickHouse log storage backend `helm-charts/bifrost/templates/_helpers.tpl`, `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`	Adds a ClickHouse branch to logs store config generation, schema for `logsStore.clickhouse`, and documented example configuration.
Bedrock Mantle provider support `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`	Adds `bedrock_mantle_key_config`, updates provider-key validation branches, and documents an example configuration.
Per-server MCP tool execution timeout `helm-charts/bifrost/templates/_helpers.tpl`, `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`	Adds `toolExecutionTimeout` mapping, schema support, and documented guidance.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

maximhq/bifrost#4522: Also adds the MCP /mcp auth settings that render into mcp_server_auth_mode and oauth2_server_config.
maximhq/bifrost#3783: Modifies the Helm MCP client config generation and schema plumbing in the same template path.
maximhq/bifrost#3827: Also updates Helm changelog page wiring through docs/changelogs and docs/docs.json.

Suggested reviewers: akshaydeo, danpiths, roroghost17

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main Helm chart additions, including ClickHouse logs, MCP OAuth2, Bedrock Mantle, virtual-key expiry, and timeout overrides.
Description check	✅ Passed	The PR description covers the required template sections and includes summary, changes, testing, type, areas, security, breaking changes, and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 07-06-feat_helm_update

_{Comment @coderabbitai help to get the list of available commands.}

BearTS · 2026-07-06T14:04:39Z

feat: add ClickHouse logs store, MCP OAuth2 server config, bedrock_mantle provider, virtual key expires_at, and per-client toolExecutionTimeout to Helm chart #4960 👈 (View in Graphite)
dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

coderabbitai

🧹 Nitpick comments (1)

helm-charts/bifrost/values.schema.json (1)
550-581: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider adding an explicit default for mcpServerAuthMode.

The description states 'headers' (default) but the property itself has no "default": "headers" key, unlike several sibling enums in this file (e.g. logStyle, sourceOfTruth). Purely cosmetic/documentation consistency; runtime behavior is unaffected since the Go binary applies its own default when the field is omitted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm-charts/bifrost/values.schema.json` around lines 550 - 581, Add an
explicit default for mcpServerAuthMode in the schema so it matches the
description and sibling enum fields like logStyle and sourceOfTruth. Update the
mcpServerAuthMode schema entry to include a default of headers, keeping the
existing enum and description intact, and verify any generated docs or schema
consumers reflect the new default consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@helm-charts/bifrost/values.schema.json`:
- Around line 550-581: Add an explicit default for mcpServerAuthMode in the
schema so it matches the description and sibling enum fields like logStyle and
sourceOfTruth. Update the mcpServerAuthMode schema entry to include a default of
headers, keeping the existing enum and description intact, and verify any
generated docs or schema consumers reflect the new default consistently.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ae9b4679-e73c-4e24-af84-593bb965a56f

📥 Commits

Reviewing files that changed from the base of the PR and between 7022fa1 and 78ff2b7.

📒 Files selected for processing (8)

docs/changelogs/helm-v2.1.26.mdx
docs/docs.json
helm-charts/bifrost/Chart.yaml
helm-charts/bifrost/README.md
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
helm-charts/index.yaml

greptile-apps · 2026-07-06T14:21:44Z

Confidence Score: 5/5

This is a Helm chart-only release adding five independent configuration features; all template changes are additive and use established guard patterns from the existing codebase.

All new template paths use the correct guard idiom for their value types — with for optional strings/integers that legitimately skip zero, and hasKey for booleans and fields where zero is a meaningful value. The ClickHouse path has explicit fail guards that surface missing required config at render time. The bedrock_mantle_key_config mutual-exclusion constraints are complete and symmetric with the existing key configs. No Go source changes are included.

No files require special attention.

Important Files Changed

Filename	Overview
helm-charts/bifrost/templates/_helpers.tpl	Adds MCP auth mode, OAuth2 server config, ClickHouse logs store, virtual key `expires_at`, and per-client `toolExecutionTimeout` template rendering. All field guards use appropriate `with`/`hasKey` patterns; fail-guards were added for the mandatory ClickHouse block and host.
helm-charts/bifrost/values.schema.json	Extends JSON Schema with `mcpServerAuthMode`, `oauth2ServerConfig`, `clickhouse` logs store, `bedrock_mantle_key_config`, `expires_at`, and `toolExecutionTimeout`. The `oneOf` mutual-exclusion constraints for `bedrock_mantle_key_config` are complete and consistent with other provider key configs.
helm-charts/bifrost/values.yaml	Adds commented-out example blocks for all new features. The `port: "9000"` example deliberately uses a quoted string, confirming the ClickHouse Go config uses a string port field.
docs/changelogs/helm-v2.1.26.mdx	New changelog entry accurately describes all additions; the authCodeTtl 900-second cap is documented and matches the schema maximum constraint.
helm-charts/bifrost/Chart.yaml	Version bumped from 2.1.25 to 2.1.26 consistently across Chart.yaml, README, index.yaml, and the changelog.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Helm values.yaml] --> B[_helpers.tpl]
    B --> C{logs_store type?}
    C -->|postgres| D[Postgres config block]
    C -->|clickhouse| E{clickhouse block present?}
    C -->|empty/default| F[SQLite config block]
    E -->|No| G[fail - template error at render time]
    E -->|Yes - host required| H[ClickHouse config block]
    B --> I[client block]
    I --> J{mcpServerAuthMode set?}
    J -->|Yes| K[mcp_server_auth_mode]
    I --> L{oauth2ServerConfig set?}
    L -->|Yes| M[oauth2_server_config]
    B --> N[providers block - deepCopy]
    N --> O[bedrock_mantle_key_config passthrough]
    B --> P[governance.virtual_keys]
    P --> Q{expires_at truthy?}
    Q -->|Yes| R[expires_at rendered]
    B --> S[mcp.client_configs]
    S --> T{hasKey toolExecutionTimeout?}
    T -->|Yes incl. 0| U[tool_execution_timeout rendered]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Helm values.yaml] --> B[_helpers.tpl]
    B --> C{logs_store type?}
    C -->|postgres| D[Postgres config block]
    C -->|clickhouse| E{clickhouse block present?}
    C -->|empty/default| F[SQLite config block]
    E -->|No| G[fail - template error at render time]
    E -->|Yes - host required| H[ClickHouse config block]
    B --> I[client block]
    I --> J{mcpServerAuthMode set?}
    J -->|Yes| K[mcp_server_auth_mode]
    I --> L{oauth2ServerConfig set?}
    L -->|Yes| M[oauth2_server_config]
    B --> N[providers block - deepCopy]
    N --> O[bedrock_mantle_key_config passthrough]
    B --> P[governance.virtual_keys]
    P --> Q{expires_at truthy?}
    Q -->|Yes| R[expires_at rendered]
    B --> S[mcp.client_configs]
    S --> T{hasKey toolExecutionTimeout?}
    T -->|Yes incl. 0| U[tool_execution_timeout rendered]

_{Reviews (3): Last reviewed commit: "feat: helm update" | Re-trigger Greptile}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/README.md`:
- Line 18: The README changelog contains an unrelated deepseek provider note
that does not belong in this Helm chart update. Remove the deepseek bullet from
the release notes section in helm-charts/bifrost/README.md, and keep the entry
scoped to the chart changes only; if needed, move the provider-routing note to
the separate provider PR release notes instead.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 648f7d35-9410-453e-80b2-6d7de5b6d005

📥 Commits

Reviewing files that changed from the base of the PR and between 78ff2b7 and b97bc2b.

📒 Files selected for processing (8)

docs/changelogs/helm-v2.1.26.mdx
docs/docs.json
helm-charts/bifrost/Chart.yaml
helm-charts/bifrost/README.md
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
helm-charts/index.yaml

✅ Files skipped from review due to trivial changes (5)

docs/changelogs/helm-v2.1.26.mdx
helm-charts/bifrost/Chart.yaml
helm-charts/index.yaml
docs/docs.json
helm-charts/bifrost/values.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json

akshaydeo · 2026-07-06T18:30:01Z

Merge activity

Jul 6, 6:30 PM UTC: A user started a stack merge that includes this pull request via Graphite.
Jul 6, 6:30 PM UTC: @akshaydeo merged this pull request with Graphite.

BearTS changed the title ~~feat: helm update~~ feat: add ClickHouse logs store, MCP OAuth2 server config, bedrock_mantle provider, virtual key expires_at, and per-client toolExecutionTimeout to Helm chart Jul 6, 2026

BearTS force-pushed the 07-06-feat_helm_update branch from 21352da to 78ff2b7 Compare July 6, 2026 14:08

BearTS marked this pull request as ready for review July 6, 2026 14:10

BearTS requested a review from a team as a code owner July 6, 2026 14:10

coderabbitai Bot requested review from TejasGhatte, akshaydeo, danpiths and roroghost17 July 6, 2026 14:15

coderabbitai Bot reviewed Jul 6, 2026

View reviewed changes

coderabbitai Bot previously approved these changes Jul 6, 2026

View reviewed changes

greptile-apps Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread helm-charts/bifrost/templates/_helpers.tpl

BearTS dismissed coderabbitai[bot]’s stale review via b97bc2b July 6, 2026 18:21

BearTS force-pushed the 07-06-feat_helm_update branch from 78ff2b7 to b97bc2b Compare July 6, 2026 18:21

coderabbitai Bot requested changes Jul 6, 2026

View reviewed changes

Comment thread helm-charts/bifrost/README.md Outdated

feat: helm update

936ac46

BearTS force-pushed the 07-06-feat_helm_update branch from b97bc2b to 936ac46 Compare July 6, 2026 18:27

akshaydeo approved these changes Jul 6, 2026

View reviewed changes

coderabbitai Bot approved these changes Jul 6, 2026

View reviewed changes

akshaydeo merged commit 4278bc7 into dev Jul 6, 2026
15 checks passed

akshaydeo deleted the 07-06-feat_helm_update branch July 6, 2026 18:30

Navigation Menu

Uh oh!

feat: add ClickHouse logs store, MCP OAuth2 server config, `bedrock_mantle` provider, virtual key `expires_at`, and per-client `toolExecutionTimeout` to Helm chart - #4960

feat: add ClickHouse logs store, MCP OAuth2 server config, `bedrock_mantle` provider, virtual key `expires_at`, and per-client `toolExecutionTimeout` to Helm chart#4960
akshaydeo merged 1 commit into
devfrom
07-06-feat_helm_update

BearTS commented Jul 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

BearTS commented Jul 6, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

greptile-apps Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

akshaydeo commented Jul 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

BearTS commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of change

Affected areas

How to test

Breaking changes

Security considerations

Checklist

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

BearTS commented Jul 6, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

akshaydeo commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BearTS commented Jul 6, 2026 •

edited

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

greptile-apps Bot commented Jul 6, 2026 •

edited

Loading

akshaydeo commented Jul 6, 2026 •

edited

Loading