Reverts the declaration. The approach does not hold up in practice: an MCP
client resends the whole tool list every turn, so simply having this server
connected cost ~19k prompt tokens per request — and ~5.4k even after
trimming the tool set by 72%. On top of that its metric-name listing
returns 3330 entries, 137 KiB, which the assistant called twice while
exploring. Conversations tripped Kong's 50k-tokens-per-minute AI rate limit
and sat in a 429 retry loop.
The deployment, the Vault-backed secret and the Grafana service account
stay in place; only the LibreChat wiring goes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Prometheus, Loki and Tempo become tools the assistant can call, so the
telemetry can be questioned rather than browsed — which is where the trace
dashboard kept running out of road. Verified: LibreChat initialises the
server in 168ms and loads its tool list.
No oauth block, unlike every other server here. The others sit behind a
Kong gateway enforcing openid-connect; this one is reached directly on the
cluster network and authenticates to Grafana with a service account token
of its own. LibreChat passes no user identity along, so there is no
per-user scoping: every LibreChat user gets the same full read of all
telemetry, including the Kong audit records and the LLM prompts now
captured there.
That is stated in the config rather than left to be discovered, and it is
the reason to move this server behind a gateway like the others.
allowedDomains gains the first http:// and first cluster-internal entry;
without it LibreChat's SSRF protection refuses the address.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Point the OTLP exporter at Tempo instead of Jaeger.
Enable the built-in /metrics endpoint by setting METRICS_SECRET: without
it LibreChat answers 401 and exposes nothing. Prometheus scrapes it with a
Bearer token from a dedicated job, since annotation-based discovery cannot
carry credentials.
A Kubernetes Secret is namespaced, so the same value must also exist as
`librechat-metrics` in the observability namespace — one side verifies the
token, the other presents it. secret.example.yaml documents the pairing;
the real secret.yaml stays gitignored.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland