# OPAX-MCP — Vauco sin CI/CD-kanal mot GCP

**CI1a** | **Service:** `opax-mcp` | **Region:** `us-central1`

Vauco sin egen MCP-server som erstatter GitHub Actions som CI/CD-trigger.
Jason og Emma kaller denne direkte for å deploye, pushe statiske filer og hente status.

## Arkitektur

```
Chris / Jason (Cloud Run) / Emma (Gemma GPU-VM) / Perplexity (stand-in)
        ↓
   POST /mcp/call  {tool: "push_static", params: {...}}
        ↓
   OPAX-MCP  (Cloud Run opax-mcp, IAP-beskyttet)
        ↓
   GCP APIs: GCS · Cloud Build · Cloud Run · Cloud Logging
        ↓
   Resultat returneres til kalleren
```

## Tilgjengelige verktøy

| Tool | Endepunkt | Beskrivelse |
|------|-----------|-------------|
| `push_static` | `POST /tools/push_static` | Last opp HTML/CSS/JS til GCS |
| `get_build_status` | `GET /tools/get_build_status` | Hent siste Cloud Build-status |
| `deploy_service` | `POST /tools/deploy_service` | Trigger Cloud Build → Cloud Run deploy |
| `get_logs` | `GET /tools/get_logs` | Hent Cloud Run-logger |

Alle verktøy er også tilgjengelig via det unifiserte endepunktet:
```
POST /mcp/call
{"tool": "push_static", "params": {"file_path": "static/jason.html", "content": "..."}}
```

## Auth

- **Utvikling:** `X-MCP-Key` header (Secret Manager: `mcp-server-key`)
- **Produksjon:** Cloud Run er `--no-allow-unauthenticated` + IAP
- **Jason/Emma:** Kaller via ADK tool med service-account `jason.vauger@vauco.no`

## Deploy

```bash
# Første gang: opprett secret
echo -n "$(openssl rand -hex 32)" | \
  gcloud secrets create mcp-server-key \
  --data-file=- \
  --project=propane-will-491900-m5

# Deploy opax-mcp
gcloud builds submit \
  --config agents/mcp_server/cloudbuild.yaml \
  --project=propane-will-491900-m5 \
  .
```

### Observed Staged Rollout Behavior (2026-09-23)

During the 2026-09-23 rollout, the `opax-mcp` service traffic configuration was
explicitly pinned to a single production revision. Observations from that rollout
include:

- Candidate revisions created outside the tagged staged flow were observed to
  retire before a later promotion decision.
- A candidate deployed with both `--no-traffic` and a unique `--tag` remained
  active and addressable for a health check.
- Promotion required a separate, explicit `gcloud run services update-traffic`
  command.

These are observations from a specific rollout, not general Cloud Run
guarantees. The staged workflow observed to succeed is documented in
`docs/runbooks/opax-live-deploy.md`.

## CI1e — ADK-integrasjon (neste steg)

Når `opax-mcp` er live, legges det til som ADK-tool i `agents/core-logic/agent.py`:

```python
# agents/core-logic/tools/mcp_tools.py
from google.adk.tools import FunctionTool
import httpx

MCP_BASE = "https://opax-mcp-<hash>.run.app"

async def push_static(file_path: str, content: str) -> dict:
    """Last opp statisk fil til GCS via OPAX-MCP."""
    async with httpx.AsyncClient() as client:
        r = await client.post(f"{MCP_BASE}/mcp/call",
            json={"tool": "push_static", "params": {"file_path": file_path, "content": content}},
            headers={"X-MCP-Key": os.environ["MCP_SECRET"]},
            timeout=30,
        )
        return r.json()

push_static_tool = FunctionTool(func=push_static)
```

Deretter registreres `push_static_tool` i `root_agent` → Jason kan deploye direkte fra chat.

## Planlagte verktøy (CI1b–d)

| Tool | Status |
|------|--------|
| `run_query` | 🔮 CI1b |
| `write_secret` | 🔮 CI1c |
| `update_dns` | 🔮 CI1d |
| `create_service` | 🔮 Fase C |

---
*OPAX-MCP · CI1a · 2026-06-10 · propane-will-491900-m5*