Internal agent-runner MCP setup

Internal runner sessions should use the in-cluster workflow MCP endpoint and a scoped per-agent bearer token.

Config

Set LTINTEG_MCP_SERVERS to include the workflow MCP server:

[
  {
    "name": "ltinteg-workflow",
    "server_url": "http://ltinteg-workflow-mcp.ltinteg-product:8000/mcp",
    "transport": "streamable_http",
    "headers": {
      "Authorization": "Bearer AGENT_TOKEN"
    }
  }
]

Inject AGENT_TOKEN from a Secret or token broker. Do not commit it in workflow config.

Why internal URL

Use the service URL to avoid public ingress, public DNS, and hosted-user OAuth for in-cluster traffic. This also makes token ownership explicit per agent.

Smoke test

1. Launch a runner session with the MCP config.
2. Confirm the runner opens a Streamable HTTP session.
3. Confirm whoami returns the agent identity.
4. Confirm list_workflow_types and a harmless workflow run work.

Related workflows

• agents.session-launch
• agents._session-launch.load-mcp
• agents.mcp-server-call-tool
• agents.mcp-server-refresh