OAuth-protected MCP challenge responses are enabled by default for tool calls.
Local Development
make install-dev
cp .env.example .env
make run
Docker
Use docker/Dockerfile:
Multi-stage image build.
Non-root runtime user.
Production env flags (NODE_ENV=production, ENVIRONMENT=production).
Only required app files copied.
Healthcheck on /health.
Run examples:
docker compose --profile prod up -d
docker compose --profile dev up -d
CI/CD (Gitea Workflows)
Workflows live in .gitea/workflows/:
lint.yml: ruff + format checks + mypy.
test.yml: lint + tests + coverage fail-under 80.
docker.yml: lint + test + docker smoke-test gating; image publish on push to main/dev and on approved PR review targeting main/dev; tags include commit SHA plus latest (main) or dev (dev).
Docker publish settings:
vars.PUSH_IMAGE=true enables registry push.
vars.REGISTRY_IMAGE sets the target image name (for example registry.example.com/org/aegis-gitea-mcp).
vars.REGISTRY_HOST is optional and overrides the login host detection.
secrets.REGISTRY_USER and secrets.REGISTRY_TOKEN are required when push is enabled.
Production Recommendations
Place MCP behind TLS reverse proxy.
Set PUBLIC_BASE_URL=https://<your-mcp-domain> so OAuth metadata advertises HTTPS endpoints.