apiVersion: v1
kind: ConfigMap
metadata:
  name: librechat-app-config
  namespace: librechat
data:
  librechat.yaml: |
    version: 1.3.13
    mcpSettings:
      allowedDomains:
        - "https://catalog-dev.sttlab.local"
        - "https://customers-dev.sttlab.local"
        - "https://payments-dev.sttlab.local"
        - "https://sales-dev.sttlab.local"
        - "https://workforce-dev.sttlab.local"
        - "https://keycloak.sttlab.local"
        # Cluster-internal and unencrypted, unlike every other entry: the
        # Grafana MCP server is reached directly, not through a gateway.
        - "http://mcp-grafana.observability.svc.cluster.local:8000"
    mcpServers:
      # Grafana's own MCP server: Prometheus, Loki and Tempo as tools, so the
      # telemetry can be questioned instead of browsed.
      #
      # No oauth block, unlike every other server here. The others sit behind a
      # Kong gateway enforcing openid-connect; this one is reached directly on
      # the cluster network and authenticates to Grafana with a service account
      # token of its own. LibreChat passes no user identity along, so there is
      # no per-user scoping either — every LibreChat user gets the same full
      # read of all telemetry. That is the reason to move it behind a gateway
      # like the others.
      grafana:
        type: streamable-http
        url: http://mcp-grafana.observability.svc.cluster.local:8000/mcp
      catalog-mcp:
        type: streamable-http
        url: https://catalog-dev.sttlab.local/catalog-mcp
        oauth:
          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
          client_id: librechat
          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
          redirect_uri: https://librechat.sttlab.local/api/mcp/catalog-mcp/oauth/callback
          scope: 'openid mcp-catalog-audience kong-token-exchange-broker-audience'
          grant_types_supported: ['authorization_code', 'refresh_token']
          token_endpoint_auth_methods_supported: ['client_secret_post']
      customers-mcp:
        type: streamable-http
        url: https://customers-dev.sttlab.local/customers-mcp
        oauth:
          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
          client_id: librechat
          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
          redirect_uri: https://librechat.sttlab.local/api/mcp/customers-mcp/oauth/callback
          scope: 'openid mcp-customers-audience kong-token-exchange-broker-audience'
          grant_types_supported: ['authorization_code', 'refresh_token']
          token_endpoint_auth_methods_supported: ['client_secret_post']
      payments-mcp:
        type: streamable-http
        url: https://payments-dev.sttlab.local/payments-mcp
        oauth:
          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
          client_id: librechat
          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
          redirect_uri: https://librechat.sttlab.local/api/mcp/payments-mcp/oauth/callback
          scope: 'openid mcp-payments-audience kong-token-exchange-broker-audience'
          grant_types_supported: ['authorization_code', 'refresh_token']
          token_endpoint_auth_methods_supported: ['client_secret_post']
      sales-mcp:
        type: streamable-http
        url: https://sales-dev.sttlab.local/sales-mcp
        oauth:
          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
          client_id: librechat
          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
          redirect_uri: https://librechat.sttlab.local/api/mcp/sales-mcp/oauth/callback
          scope: 'openid mcp-sales-audience kong-token-exchange-broker-audience'
          grant_types_supported: ['authorization_code', 'refresh_token']
          token_endpoint_auth_methods_supported: ['client_secret_post']
      workforce-mcp:
        type: streamable-http
        url: https://workforce-dev.sttlab.local/workforce-mcp
        oauth:
          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
          client_id: librechat
          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
          redirect_uri: https://librechat.sttlab.local/api/mcp/workforce-mcp/oauth/callback
          scope: 'openid mcp-workforce-audience kong-token-exchange-broker-audience'
          grant_types_supported: ['authorization_code', 'refresh_token']
          token_endpoint_auth_methods_supported: ['client_secret_post']
    endpoints:
      custom:
        # kong-v2's platform-llm proxy (not the old kube/llms/openrouter lab)
        # — key-auth, same shared-key limitation as before (LibreChat's
        # custom endpoints don't support OAuth/OIDC on this outbound leg).
        # baseURL is `/llm/v1`, not the full path: LibreChat appends
        # `/chat/completions` itself.
        - name: 'OpenRouter'
          apiKey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
          baseURL: 'https://llm-dev.sttlab.local/llm/v1'
          headers:
            apikey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
          models:
            default:
              - 'google/gemini-3.7-flash'
              - 'anthropic/claude-sonnet-5'
              - 'openai/gpt-5.6-luna'
              - 'deepseek/deepseek-v4-flash'
              - 'openai/gpt-oss-120b'
              - 'mistralai/mistral-nemo'
            fetch: false
          titleConvo: true
          titleModel: 'google/gemini-3.7-flash'
          modelDisplayLabel: 'OpenRouter'