Deployment¶
Shipped artifacts follow ADR-0009 and FND-003: CGO-free binary tarballs on GitHub Releases plus a multi-arch container on GHCR. No Helm chart or Kustomize in v0.
Full release mechanics: RELEASE.md.
Binary (GitHub Releases)¶
After the first tagged release (vX.Y.Z), download the tarball for your
platform from the GitHub Releases
page. Assets are cosign-signed with SBOM and provenance attestations — see
RELEASE.md.
Local equivalent:
bash
task build
./bin/ibm-mq-mcp
Container (GHCR)¶
Published image (once tagged):
text
ghcr.io/platformrelay/ibm-mq-mcp:<version>
Local smoke build:
bash
task docker:build
docker inspect --format '{{.Config.User}}' ibm-mq-mcp:dev # expect 65532:65532
The image uses gcr.io/distroless/static:nonroot, runs as UID 65532, and
builds with CGO_ENABLED=0.
Run container (stdio MCP)¶
MCP stdio is the default transport. Example (host networking varies by platform):
bash
docker run --rm -i ghcr.io/platformrelay/ibm-mq-mcp:0.1.0
Connect your MCP host to the container stdin/stdout. MQ profiles and secrets are not loaded in the bootstrap skeleton — mount configuration and secret files when CON-001 defines the contract.
Ops HTTP in containers¶
Enable probes and metrics on a dedicated port (not the MCP transport):
bash
docker run --rm -p 9090:9090 \
-e IBM_MQ_MCP_OPS_ADDR=:9090 \
ghcr.io/platformrelay/ibm-mq-mcp:0.1.0
Kubernetes livenessProbe / readinessProbe and securityContext.readOnlyRootFilesystem
guidance are deferred to deployment hardening after remote transport decisions
(ADR-0006) — the v0 image does not define a
Docker HEALTHCHECK.
Remote MCP transport (opt-in — ADR-0006)¶
Streamable HTTP MCP is disabled by default. Enable on a dedicated listener separate from ops HTTP:
bash
ibm-mq-mcp \
--config /etc/ibm-mq-mcp/profiles.yaml \
--remote-addr :8080 \
--remote-auth-token-ref file:/run/secrets/mcp/gate-token \
--stdio=false
| Input | Purpose |
|---|---|
--remote-addr |
Streamable HTTP MCP listen address |
IBM_MQ_MCP_REMOTE_ADDR |
Same when flag omitted |
--remote-auth-token-ref |
Required with remote addr — env: or file: bearer gate token |
IBM_MQ_MCP_REMOTE_AUTH_TOKEN_REF |
Same when flag omitted |
--stdio=false |
Remote-only mode (no stdin MCP) |
Clients must send Authorization: Bearer <token>. The gate token is not
mqweb credentials and is never forwarded to IBM MQ.
Abuse limits (body size, rate, concurrency, HTTP timeouts) apply on the remote listener only. See Authentication.
What we deliberately omit in v0¶
| Artifact | Status |
|---|---|
| Helm chart | Out of scope (RELEASE.md) |
| Kustomize manifests | Out of scope |
| Kubernetes Operator | Non-goal (feature scope) |