deploy: add MCP gateway for Agent Zero

apps/agent-zero/agent-zero.yaml

@@ -153,6 +153,17 @@ metadata:
 spec:
   itemPath: "vaults/IAmWorkin/items/FlowerCore DMS MCP Keys"
 
+---
+# FlowerCore MCP Gateway key. Agent Zero advertises only fc_gateway so product
+# tool schemas are discovered on demand instead of dumped into the prompt.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: gateway-mcp-keys
+  namespace: agent-zero
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Gateway MCP Keys"
+
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -266,31 +277,11 @@ spec:
               MODELCFG
               # Strip heredoc indentation
               sed -i 's/^              //' /a0/usr/plugins/_model_config/config.json
-              # Phase 0 Chat MCP pilot: Agent Zero does not interpolate env vars
-              # inside A0_SET_mcp_servers JSON, so build the final JSON here from
-              # the secret-backed env vars before initialize.sh. Keep the local
-              # corpus_search.py tool mounted either way so outage fallback
-              # remains available even when fc_knowledge is not advertised.
-              export KNOWLEDGE_MCP_ENABLED=false
-              if [ -n "${KNOWLEDGE_MCP_BEARER_TOKEN:-}" ]; then
-                if curl -sf --connect-timeout 3 "${KNOWLEDGE_MCP_HEALTH_URL}" > /dev/null && \
-                   curl -sf --connect-timeout 5 \
-                     -H "Authorization: Bearer ${KNOWLEDGE_MCP_BEARER_TOKEN}" \
-                     -H "Accept: application/json, text/event-stream" \
-                     -H "Content-Type: application/json" \
-                     -d '{"jsonrpc":"2.0","id":"fc-knowledge-bootstrap","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"agent-zero-bootstrap","version":"1.0"}}}' \
-                     "${KNOWLEDGE_MCP_URL}" > /dev/null; then
-                  export KNOWLEDGE_MCP_ENABLED=true
-                  echo "fc_knowledge enabled from ${KNOWLEDGE_MCP_URL}."
-                else
-                  echo "fc_knowledge unavailable or unauthorized; keeping local corpus_search.py as the fallback path."
-                fi
-              else
-                echo "fc_knowledge token missing; keeping local corpus_search.py as the fallback path."
-              fi
-
+              # Agent Zero does not interpolate env vars inside
+              # A0_SET_mcp_servers JSON, so build the final JSON here from the
+              # secret-backed gateway key before initialize.sh.
               export A0_SET_mcp_servers="$(
-                python3 -c 'import json, os; servers = {}; chat_key = os.getenv("CHAT_MCP_API_KEY"); knowledge_enabled = os.getenv("KNOWLEDGE_MCP_ENABLED", "false").lower() == "true"; token = os.getenv("KNOWLEDGE_MCP_BEARER_TOKEN", "") if knowledge_enabled else ""; chat_key and servers.setdefault("fc_chat", {"type": "streamable-http", "url": "http://chat-web.fc-chat.svc/mcp", "headers": {"X-Api-Key": chat_key}}); token and servers.setdefault("fc_knowledge", {"type": "streamable-http", "url": os.getenv("KNOWLEDGE_MCP_URL", "http://knowledge-web.knowledge.svc/mcp"), "headers": {"Authorization": f"Bearer {token}"}}); dms_key = os.getenv("DMS_MCP_API_KEY"); dms_key and servers.setdefault("fc_dms", {"type": "streamable-http", "url": os.getenv("DMS_MCP_URL", "http://dms-web.fc-dms.svc/mcp"), "headers": {"X-Api-Key": dms_key}}); print(json.dumps({"mcpServers": servers}, separators=(",", ":")))'
+                python3 -c 'import json, os; key=os.getenv("GATEWAY_MCP_API_KEY"); url=os.getenv("GATEWAY_MCP_URL", "http://fc-gateway.fc-gateway.svc/mcp"); servers={"fc_gateway":{"type":"streamable-http","url":url,"headers":{"X-Api-Key":key}}} if key else {}; print(json.dumps({"mcpServers": servers}, separators=(",", ":")))'
               )"
               # Run the original entrypoint
               exec /exe/initialize.sh $BRANCH
@@ -372,6 +363,14 @@ spec:
               value: "http://fc-llm-bridge.fc-llm-bridge.svc:8080"
             - name: FLOWERCORE_AGENTZERO_OLLAMA_URL
               value: "http://fc-llm-bridge.fc-llm-bridge.svc:8080"
+            # FlowerCore.Mcp.Gateway — single MCP fan-in for product tools.
+            - name: GATEWAY_MCP_URL
+              value: "http://fc-gateway.fc-gateway.svc/mcp"
+            - name: GATEWAY_MCP_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: gateway-mcp-keys
+                  key: agent-zero
             # Agent profile — Blue Jay personality, tools, and system prompt
             - name: A0_SET_agent_profile
               value: "bluejay"
@@ -678,6 +677,17 @@ spec:
           protocol: TCP
         - port: 8080
           protocol: TCP
+    # FlowerCore.Mcp.Gateway — Agent Zero advertises this single MCP server;
+    # the gateway performs backend search and invokes product MCP tools.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-gateway
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP
     # Allow internet (for kubectl image pull, etc)
     - to:
         - ipBlock: