Add payments-mcp (Layer 3 MCP surface), single-route pattern from the start

list-payments/get-payment (all 5 roles) and create-payment (admin only — matches PaymentPermission's actual write-access logic, not guessed). One KongRoute for GET/POST/DELETE, one ai-mcp-proxy binding — avoids the duplicate-tool-name bug found and fixed on customers-mcp (STATUS.md section 18), built correctly here instead of repeating the two-route mistake. Keycloak (local): mcp-payments-audience client scope + mcp-payments resource client, attached to librechat as an optional scope, no dedicated protocol mappers on the client itself.
2026-08-23 16:27:56 +02:00
parent bf5adadb24
commit 028a0be2a6
12 changed files with 391 additions and 18 deletions
@@ -0,0 +1,94 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-payments-mcp-ai-mcp-proxy
+  namespace: ${NAMESPACE}
+plugin: ai-mcp-proxy
+config:
+  mode: conversion-listener
+  include_consumer_groups: true
+  tools:
+    - name: list-payments
+      description: Retrieves a paginated list of payments in the classic-models CRM.
+      annotations:
+        title: List all payments
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /payments/v1/payments/
+    - name: get-payment
+      description: Retrieves a single payment by customer number and check number.
+      annotations:
+        title: Get a payment
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /payments/v1/payments/{customernumber}/{checknumber}/
+      parameters:
+        - name: customernumber
+          in: path
+          required: true
+          description: The customer's unique number.
+          schema: {}
+        - name: checknumber
+          in: path
+          required: true
+          description: The payment's check number.
+          schema: {}
+    - name: create-payment
+      description: Records a new payment in the CRM.
+      annotations:
+        title: Create a payment
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /payments/v1/payments/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                customernumber:
+                  type: integer
+                checknumber:
+                  type: string
+                paymentdate:
+                  type: string
+                amount:
+                  type: string
+              required:
+                - customernumber
+                - checknumber
+                - paymentdate
+                - amount