mrdtech-mcp-gateway
Hardened, read-only MCP gateway on .237, giving Gilfoyle scoped visibility into six core homelab systems without any write/restart/delete capability.
Repository:
Architecture
Hermes (.234) reaches a loopback-only Docker MCP Gateway on .237 via a persistent SSH tunnel.
Six read-only servers sit behind the gateway:
| Server | Tool count | Scope |
|---|---|---|
| Portainer | 3 | Stack, stack status, and container inventory visibility |
| GitHub | 28 | Read-only repo, issue, pull request, action, and context visibility |
| Filesystem | 9 | Read-only approved filesystem paths, initially compose data visibility |
| Proxmox | 153 | Read/list/get/status visibility into Proxmox VE |
| PBS | 7 | Read-only datastore, snapshot, verification, GC, and task-log visibility |
| vault-readonly | 2 | Vault search over the Obsidian knowledge base through the existing RAG pipeline |
| Total | 202 | Gateway hard-allowlisted tools |
Vault RAG server
vault-readonly exposes two tools:
search_vault— embeds a query with the existing Ollama model on Hermes and searches the fixed Qdrant collectionmrdtech_vault.get_document— reconstructs indexed document text from Qdrant chunks bysource_path.
The server has no vault filesystem mount, no secrets, and no arbitrary backend passthrough. Its endpoints are fixed to the existing internal Ollama and Qdrant retrieval path. There is no upsert/delete/collection-management interface.
Security model
- The gateway is never exposed on the LAN; it binds to loopback and is reached through the SSH tunnel only.
- Every credential lives only in gateway-owned secret storage on
.237, never in Hermes config. - Destructive tools are hard-excluded at the gateway level and verified absent by attempting the calls, not just checking a tool list.
- Where the platform supports real RBAC, PBS and Proxmox use dedicated read-only service accounts behind the MCP layer too.
- Filesystem access is additionally verified read-only at the OS layer.
- The vault RAG server uses no secrets and no filesystem mount; Qdrant access is restricted to search/scroll retrieval only.
Origin
This was built in response to the July 2026 Portainer compose-path incident, where a cleanup operation with unchecked destructive access silently deleted config for 30 stacks.
The gateway gives Gilfoyle the visibility it needs without granting the kind of broad access that caused that incident.
Notes
- This project is intentionally visibility-first, not remediation-first.
- If a future server is added, it needs the same gates: credential scoping, hard tool allowlist, negative destructive-tool testing, and platform-level read-only verification where possible.