Stéphane Tailland
7892f0f8f5
Reverts the declaration. The approach does not hold up in practice: an MCP client resends the whole tool list every turn, so simply having this server connected cost ~19k prompt tokens per request — and ~5.4k even after trimming the tool set by 72%. On top of that its metric-name listing returns 3330 entries, 137 KiB, which the assistant called twice while exploring. Conversations tripped Kong's 50k-tokens-per-minute AI rate limit and sat in a 429 retry loop. The deployment, the Vault-backed secret and the Grafana service account stay in place; only the LibreChat wiring goes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
5.1 KiB
YAML
102 lines
5.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: librechat-app-config
|
|
namespace: librechat
|
|
data:
|
|
librechat.yaml: |
|
|
version: 1.3.13
|
|
mcpSettings:
|
|
allowedDomains:
|
|
- "https://catalog-dev.sttlab.local"
|
|
- "https://customers-dev.sttlab.local"
|
|
- "https://payments-dev.sttlab.local"
|
|
- "https://sales-dev.sttlab.local"
|
|
- "https://workforce-dev.sttlab.local"
|
|
- "https://keycloak.sttlab.local"
|
|
mcpServers:
|
|
catalog-mcp:
|
|
type: streamable-http
|
|
url: https://catalog-dev.sttlab.local/catalog-mcp
|
|
oauth:
|
|
authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
|
|
token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
|
|
client_id: librechat
|
|
client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
|
|
redirect_uri: https://librechat.sttlab.local/api/mcp/catalog-mcp/oauth/callback
|
|
scope: 'openid mcp-catalog-audience kong-token-exchange-broker-audience'
|
|
grant_types_supported: ['authorization_code', 'refresh_token']
|
|
token_endpoint_auth_methods_supported: ['client_secret_post']
|
|
customers-mcp:
|
|
type: streamable-http
|
|
url: https://customers-dev.sttlab.local/customers-mcp
|
|
oauth:
|
|
authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
|
|
token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
|
|
client_id: librechat
|
|
client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
|
|
redirect_uri: https://librechat.sttlab.local/api/mcp/customers-mcp/oauth/callback
|
|
scope: 'openid mcp-customers-audience kong-token-exchange-broker-audience'
|
|
grant_types_supported: ['authorization_code', 'refresh_token']
|
|
token_endpoint_auth_methods_supported: ['client_secret_post']
|
|
payments-mcp:
|
|
type: streamable-http
|
|
url: https://payments-dev.sttlab.local/payments-mcp
|
|
oauth:
|
|
authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
|
|
token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
|
|
client_id: librechat
|
|
client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
|
|
redirect_uri: https://librechat.sttlab.local/api/mcp/payments-mcp/oauth/callback
|
|
scope: 'openid mcp-payments-audience kong-token-exchange-broker-audience'
|
|
grant_types_supported: ['authorization_code', 'refresh_token']
|
|
token_endpoint_auth_methods_supported: ['client_secret_post']
|
|
sales-mcp:
|
|
type: streamable-http
|
|
url: https://sales-dev.sttlab.local/sales-mcp
|
|
oauth:
|
|
authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
|
|
token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
|
|
client_id: librechat
|
|
client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
|
|
redirect_uri: https://librechat.sttlab.local/api/mcp/sales-mcp/oauth/callback
|
|
scope: 'openid mcp-sales-audience kong-token-exchange-broker-audience'
|
|
grant_types_supported: ['authorization_code', 'refresh_token']
|
|
token_endpoint_auth_methods_supported: ['client_secret_post']
|
|
workforce-mcp:
|
|
type: streamable-http
|
|
url: https://workforce-dev.sttlab.local/workforce-mcp
|
|
oauth:
|
|
authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
|
|
token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
|
|
client_id: librechat
|
|
client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
|
|
redirect_uri: https://librechat.sttlab.local/api/mcp/workforce-mcp/oauth/callback
|
|
scope: 'openid mcp-workforce-audience kong-token-exchange-broker-audience'
|
|
grant_types_supported: ['authorization_code', 'refresh_token']
|
|
token_endpoint_auth_methods_supported: ['client_secret_post']
|
|
endpoints:
|
|
custom:
|
|
# kong-v2's platform-llm proxy (not the old kube/llms/openrouter lab)
|
|
# — key-auth, same shared-key limitation as before (LibreChat's
|
|
# custom endpoints don't support OAuth/OIDC on this outbound leg).
|
|
# baseURL is `/llm/v1`, not the full path: LibreChat appends
|
|
# `/chat/completions` itself.
|
|
- name: 'OpenRouter'
|
|
apiKey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
|
|
baseURL: 'https://llm-dev.sttlab.local/llm/v1'
|
|
headers:
|
|
apikey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
|
|
models:
|
|
default:
|
|
- 'google/gemini-3.7-flash'
|
|
- 'anthropic/claude-sonnet-5'
|
|
- 'openai/gpt-5.6-luna'
|
|
- 'deepseek/deepseek-v4-flash'
|
|
- 'openai/gpt-oss-120b'
|
|
- 'mistralai/mistral-nemo'
|
|
fetch: false
|
|
titleConvo: true
|
|
titleModel: 'google/gemini-3.7-flash'
|
|
modelDisplayLabel: 'OpenRouter'
|