fix mcp (#146)

* fix mcp

* Internal url

Author: mjudeikis

pkg/hub/server.go

@@ -222,7 +222,7 @@ func (s *Server) Run(ctx context.Context) error {
 	}
 
 	// Tunnel handlers (kcpConfig is used for SA token verification; nil if kcp not configured)
-	vws, err := builder.NewVirtualWorkspaces(connManager, kcpConfig, s.opts.StaticAuthTokens, s.opts.HubExternalURL, logger)
+	vws, err := builder.NewVirtualWorkspaces(connManager, kcpConfig, s.opts.StaticAuthTokens, s.opts.HubExternalURL, s.opts.HubInternalURL, logger)
 	if err != nil {
 		return fmt.Errorf("creating virtual workspaces handlers: %w", err)
 	}

pkg/virtual/builder/mcp_builder.go

@@ -69,8 +69,14 @@ func (p *virtualWorkspaces) buildMCPHandler(cluster, edgeName string) http.Handl
 		}
 
 		// 2. Build per-request single-edge MCP provider.
-		//    edgeProxyBase is derived from the hub's external URL.
-		edgeProxyBase := strings.TrimRight(p.hubExternalURL, "/") + "/services/edges-proxy"
+		//    edgeProxyBase uses the internal URL to avoid CDN/proxy loops
+		//    (e.g. Cloudflare loop detection when the MCP handler calls back
+		//    to the edges-proxy on the same hub).
+		baseURL := p.hubInternalURL
+		if baseURL == "" {
+			baseURL = p.hubExternalURL
+		}
+		edgeProxyBase := strings.TrimRight(baseURL, "/") + "/services/edges-proxy"
 
 		provider := &KedgeEdgeProvider{
 			cluster:         cluster,
@@ -220,7 +226,12 @@ func (p *virtualWorkspaces) buildKubernetesMCPHandler() http.Handler {
 		}
 
 		// 7. Build multi-edge provider.
-		edgeProxyBase := strings.TrimRight(p.hubExternalURL, "/") + "/services/edges-proxy"
+		//    Use internal URL to avoid CDN/proxy loops (same as single-edge handler).
+		baseURL := p.hubInternalURL
+		if baseURL == "" {
+			baseURL = p.hubExternalURL
+		}
+		edgeProxyBase := strings.TrimRight(baseURL, "/") + "/services/edges-proxy"
 		provider := &MultiEdgeKedgeEdgeProvider{
 			cluster:         cluster,
 			edgeNames:       resolvedEdges,

pkg/virtual/builder/mcp_provider.go

@@ -100,8 +100,9 @@ func (p *KedgeEdgeProvider) GetDerivedKubernetes(_ context.Context, edgeName str
 	return k8s, nil
 }
 
-// GetDefaultTarget returns an empty string — there is no single default edge.
-func (p *KedgeEdgeProvider) GetDefaultTarget() string { return "" }
+// GetDefaultTarget returns the fixed edge name so that MCP tool calls that
+// omit the "cluster" parameter automatically route to the only available edge.
+func (p *KedgeEdgeProvider) GetDefaultTarget() string { return p.edgeName }
 
 // GetTargetParameterName returns "cluster" as the MCP target query parameter.
 // "cluster" is used rather than "edge" because users think in terms of clusters,

pkg/virtual/builder/mcp_provider_test.go

@@ -148,11 +148,11 @@ func TestGetDerivedKubernetes_correctURL(t *testing.T) {
 	}
 }
 
-// TestGetDefaultTarget asserts that GetDefaultTarget returns an empty string.
+// TestGetDefaultTarget asserts that GetDefaultTarget returns the fixed edge name.
 func TestGetDefaultTarget(t *testing.T) {
-	provider := &KedgeEdgeProvider{}
-	if got := provider.GetDefaultTarget(); got != "" {
-		t.Errorf("GetDefaultTarget() = %q; want empty string", got)
+	provider := &KedgeEdgeProvider{edgeName: "my-edge"}
+	if got := provider.GetDefaultTarget(); got != "my-edge" {
+		t.Errorf("GetDefaultTarget() = %q; want %q", got, "my-edge")
 	}
 }
 

pkg/virtual/builder/proxy.go

@@ -43,6 +43,7 @@ type virtualWorkspaces struct {
 	kedgeClient     *kedgeclient.Client  // kedge client for fetching Edge resources
 	staticTokens    map[string]struct{}  // static tokens that bypass JWT SA requirement
 	hubExternalURL  string               // external URL of the hub (used for kubeconfig generation)
+	hubInternalURL  string               // internal URL of the hub (used for MCP→edges-proxy calls to avoid CDN loops)
 	// authorizeFn performs delegated authentication and authorization against kcp.
 	// Defaults to the package-level authorize function; injectable for testing.
 	authorizeFn authorizeFnType
@@ -57,7 +58,9 @@ type VirtualWorkspaceHandlers struct {
 // NewVirtualWorkspaces creates a new VirtualWorkspaceHandlers.
 // kcpConfig is required for SA token authorization against kcp and for fetching Edge resources/secrets.
 // hubExternalURL is the externally reachable URL of the hub, used when building kubeconfigs for agents.
-func NewVirtualWorkspaces(cm *connman.ConnectionManager, kcpConfig *rest.Config, staticTokens []string, hubExternalURL string, logger klog.Logger) (*VirtualWorkspaceHandlers, error) {
+// hubInternalURL is the internal URL for MCP→edges-proxy calls to avoid CDN/proxy loops.
+// If empty, hubExternalURL is used as fallback.
+func NewVirtualWorkspaces(cm *connman.ConnectionManager, kcpConfig *rest.Config, staticTokens []string, hubExternalURL, hubInternalURL string, logger klog.Logger) (*VirtualWorkspaceHandlers, error) {
 	staticTokenSet := make(map[string]struct{}, len(staticTokens))
 	for _, t := range staticTokens {
 		staticTokenSet[t] = struct{}{}
@@ -89,6 +92,7 @@ func NewVirtualWorkspaces(cm *connman.ConnectionManager, kcpConfig *rest.Config,
 			kedgeClient:     kedgeClient,
 			staticTokens:    staticTokenSet,
 			hubExternalURL:  hubExternalURL,
+			hubInternalURL:  hubInternalURL,
 			authorizeFn:     authorize,
 			logger:          logger.WithName("virtual-workspaces"),
 		},