Mcp Config
McpConfig
Deployable MCP server definition.
Declares the high-level intent for an MCP (Model Context Protocol) server deployed as a Cloud Run service that exposes tools to AI agents through the Agent Registry. Mirrors the Application manifest pattern; the engine pairs it with an McpDeploymentConfig to provision the Cloud Run service, the per-server service account and its IAM bindings, and the Agent Registry registration used for tool discovery.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an McpConfig so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant McpConfig. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent in the dependency graph. |
| spec | Spec | Desired MCP server configuration. The authoritative, user-authored specification for this MCP server. See Spec. |
Spec
User-authored MCP server specification.
Identifies the server's source build, target Project and hosting platform, and the access-control grants applied to its service account. Mirrors ApplicationDefinition — the same build_definition/project/target model adapted for MCP servers.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of the MCP server. Optional free text describing the server's role and purpose. Not read by the engine when provisioning resources (the per-environment description comes from McpDeploymentConfig); it serves as documentation for the portal UI and as context for AI assistants reasoning about the manifest. |
| target | string | Target compute platform. Selects where the MCP server runs; currently only CLOUD_RUN is accepted and this is enforced by schema validation. Propagated into the computed state so the deployment resolves the correct container definition. |
| project | string | Target Project manifest name. Required. Name of the Project manifest the MCP server deploys into, determining the GCP project where its Cloud Run service, per-server service account, IAM bindings, and Agent Registry entry are provisioned. The server is registered with the target project across every environment of the parent OrganizationalUnit. |
| accessControl | ApplicationAccessControlConfig | MCP server access-control grants. Permissions the server's service account receives over other platform resources — secrets, buckets, databases, Pub/Sub topics, and additional IAM roles. See ApplicationAccessControlConfig. Copied into the McpDeploymentConfig computed state, where the executor turns each grant into the corresponding IAM binding and env-var injection. |
| buildDefinition | string | Source build definition. Required. Name of the BuildDefinition manifest that produces this server's single container image. Creates a dependency so the engine resolves the destination registry and image name from the build's containerize block when computing the source definition. Because a BuildDefinition produces exactly one image, no separate container selector is needed. |
The Model Context Protocol is an open standard for connecting AI models to external tools and data sources. MCP servers expose typed tool definitions that agents can discover and invoke at runtime. Infrastream deploys MCP servers as containerized Cloud Run services with the same isolation, scaling, and monitoring as any other Infrastream application, with McpConfig bringing that deployment path under the same governed, typed manifest model as every other resource.
ApplicationAccessControlConfig
Aggregates all external access rules an application requires.
Computes the comprehensive list of IAM bindings, SQL grants, and secret consumptions that must be provisioned alongside the application's actual deployment.
| Property | Type | Description |
|---|---|---|
| additionalRoles | list of string | Extra IAM roles for the service account. A list of additional IAM roles granted directly to the application's service account, beyond the roles derived from the other access-control blocks. |
| pubsub | ApplicationAccessControlPubsubConfig | Pub/Sub publish and subscribe grants. The application's permission to publish to or subscribe from specific Pub/Sub topics. See ApplicationAccessControlPubsubConfig. |
| buckets | list of ApplicationAccessControlBucketConfig | Cloud Storage bucket access rules. A list of bucket access rules describing which Cloud Storage buckets the application may read from or write to, and how they are mounted or exposed. See ApplicationAccessControlBucketConfig. |
| database | ApplicationAccessControlDatabaseConfig | PostgreSQL database access. The application's access to a specific PostgreSQL database instance and schema, including privileges and credential source. See ApplicationAccessControlDatabaseConfig. |
| secrets | list of SecretsEntry | Secrets consumed by the application. A map from Secret manifest name to the configuration describing how that secret is exposed to the application (as an environment variable or mounted file). See SecretSourceConfig. |
| redis | list of ApplicationAccessControlRedisConfig | Redis cache access. A list of Redis instances the application may use. Each entry injects the connection URL as an environment variable and creates a deployment dependency on the Redis DNS record. See ApplicationAccessControlRedisConfig. |
| jobs | list of ApplicationAccessControlJobConfig | Cloud Run Jobs the application may trigger. A list of Cloud Run Jobs (owned by other applications) that this application's service account may trigger via the RunJob API. Each entry grants roles/run.developer on the referenced job and injects its full resource name as an environment variable. See ApplicationAccessControlJobConfig. |
SecretsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | SecretSourceConfig |
ApplicationAccessControlJobConfig
Grants an application permission to trigger a Cloud Run Job owned by another application.
Resolves the target job via the owning Application's name and job name, then grants roles/run.developer to the calling application's service account on that job. The job's full Cloud Run resource name is injected as an env var (derived from the job name).
| Property | Type | Description |
|---|---|---|
| application | string | Owning application. Required. The Application manifest name that owns the target Cloud Run Job. Used together with job to resolve the concrete job resource to grant access on. |
| job | string | Target job name. Required. The job's name within the owning application, matching an ApplicationJobReference.name on that application. |
| envVar | string | Environment variable for the job resource name. The name of an environment variable injected into the caller with the job's full Cloud Run resource name. When empty, no variable is injected and the caller must derive the job name by convention. |
ApplicationAccessControlDatabaseConfig
Configures PostgreSQL interaction permissions for a workload.
Executes dynamic DDL (CREATE USER, GRANT) against the target SQL instance using an administrative proxy, setting up specific schema rights.
| Property | Type | Description |
|---|---|---|
| name | string | Target Database manifest name. The name of the Database manifest this application requires access to. Resolves to a concrete AlloyDB/PostgreSQL instance during computation. |
| schema | string | Database schema to connect to. The specific database (schema) within the instance the application connects to. Feeds the computed schema and per-deployment access grants used by the Database executor to provision users, roles, and grants. |
| privileges | list of string | SQL privileges to grant on the schema. A list of SQL privileges granted to the application's database role on the target schema. Each entry (one of USAGE, CREATE, ALL) translates into GRANT statements executed against the PostgreSQL instance. |
| readOnly | bool | Connect against a read replica. When true, the application is wired for read-only access, typically to connect to a read replica rather than the primary instance. |
| extensions | list of string | PostgreSQL extensions to enable. A list of PostgreSQL extensions to enable in the target database for this application. Each entry runs CREATE EXTENSION IF NOT EXISTS; extensions are merged across all applications sharing a schema in the computed database schema. |
| secretSource | SecretSourceConfig | Credential source for the database. Required. Defines how the application obtains its database credentials, e.g. from which Secret manifest and how it is exposed (environment variable or file mount). See SecretSourceConfig. |
ApplicationAccessControlRedisConfig
Configures Redis cache access for a workload.
Injects the Redis connection URL as an environment variable and establishes a graph dependency on the Redis manifest's DNS record to ensure the stable FQDN is resolvable before the application deploys.
All Memorystore Redis instances are provisioned with SERVER_AUTHENTICATION transit encryption (TLS). The CA certificate is extracted from the instance state and mounted as a volume in the container so the application can configure its TLS trust pool.
| Property | Type | Description |
|---|---|---|
| name | string | Target Redis manifest name. Required. The name of the Redis manifest this application requires access to. Establishes a graph dependency on that instance's DNS record so its FQDN is resolvable before the application deploys. |
| envVar | string | Environment variable for the connection URL. Required. The name of the environment variable populated with the Redis connection URL of the form redis[s]://memory-<redis-name>.<internal-domain>:<port>. Meshed strategies (SIDECAR/PROXYLESS) use redis:// on port 6380; direct access (DISABLED) uses rediss:// on port 6379. |
| caCertPath | string | In-container path for the server CA certificate. Required. The absolute file path at which the Memorystore server's CA certificate (extracted from instance state) is mounted. The application must load this PEM file into its TLS trust pool to validate the server's identity. |
ApplicationAccessControlPubsubConfig
Configures Pub/Sub interaction permissions for a workload.
Translates to roles/pubsub.publisher and roles/pubsub.subscriber IAM bindings assigned to the application's underlying service account.
| Property | Type | Description |
|---|---|---|
| publishTo | list of string | Topics the workload may publish to. A list of PubSub manifest names this workload is allowed to publish messages to. Each entry grants roles/pubsub.publisher to the workload's service account on the corresponding topic. |
| subscribeTo | list of string | Topics the workload may subscribe to. A list of PubSub manifest names this workload is allowed to create subscriptions for and pull messages from. Each entry grants roles/pubsub.subscriber to the workload's service account on the corresponding topic. |
ApplicationAccessControlBucketConfig
Configures Google Cloud Storage interaction permissions for a workload.
Translates to roles/storage.objectViewer or roles/storage.objectUser IAM bindings assigned to the application's service account, and can map specific paths.
| Property | Type | Description |
|---|---|---|
| name | string | Target Bucket manifest name. Required. The name of the Bucket manifest this application requires access to. The bucket must exist in every environment defined by the parent ReleaseTrack. |
| source | string | Source repository to sync into the bucket. Optional reference to a GithubRepository manifest whose contents seed the bucket. The CI/CD system uses this to set up a gcloud storage rsync job that mirrors the repository data into the bucket. |
| permission | string | Access level granted on the bucket. The permission level for this bucket: READ_ONLY grants roles/storage.objectViewer, and WRITE grants roles/storage.objectUser to the application's service account on the bucket. |
| mountPath | string | In-container mount path for the bucket. The absolute path at which the bucket is mounted (via Cloud Storage FUSE) inside the container. When omitted, permissions are still granted but the bucket is not mounted as a filesystem. |
| subPath | string | Restrict access to a bucket sub-path. A sub-path (prefix) within the bucket that access is scoped to; when omitted, access covers the whole bucket. Commonly used to mount a specific folder of the bucket into the container. |
| promote | bool | Promote bucket contents with the release. When true, the bucket's content is promoted through the ReleaseTrack alongside the application, typically for shipping generic application configuration data with each release. |
| envVar | string | Environment variable to receive the bucket name. The name of an environment variable populated with the resolved bucket name, giving the application the bucket name as plain configuration instead of a filesystem mount. Mutually exclusive with mount_path. |
SecretSourceConfig
Defines how a secret should be retrieved and mounted into a workload.
Triggers IAM bindings for Secret Manager payload access. Values are resolved JIT and passed into the container via environment variables or file mounts.
| Property | Type | Description |
|---|---|---|
| envVar | string | Environment variable name for the secret. The name of the environment variable populated with the secret's value. Mutually exclusive with file_path: set exactly one to choose environment-variable versus file-mount delivery. |
| version | string | Secret Manager version to resolve. The specific version of the secret to retrieve from the backend, either latest or a numeric version like 1. When omitted, latest is assumed. |