simplify Athena runtime and centralize MCP management

platform/mcp/sync-clients.py

@@ -13,6 +13,7 @@ import time
 
 BEGIN = "# BEGIN MANAGED MCP SERVERS"
 END = "# END MANAGED MCP SERVERS"
+CLIENT_TOKEN = ""
 
 
 def env_file(path: str) -> dict[str, str]:
@@ -37,7 +38,10 @@ def enabled(item: dict) -> bool:
     if source:
         values = env_file(source)
         url_ready = bool(item.get("url")) or bool(values.get(item.get("url_env", "")))
-        key_ready = not item.get("key_env") or bool(values.get(item["key_env"]))
+        key_ready = (not item.get("key_env")
+                     or bool(values.get(item["key_env"]))
+                     or (item.get("key_env") == "MCPHUB_BEARER_TOKEN"
+                         and bool(CLIENT_TOKEN)))
         return url_ready and key_ready
     return True
 
@@ -47,6 +51,8 @@ def resolved(item: dict) -> tuple[str, str]:
         values = env_file(item["env_file"])
         url = item.get("url") or values[item["url_env"]]
         key = values.get(item.get("key_env", ""), "")
+        if not key and item.get("key_env") == "MCPHUB_BEARER_TOKEN":
+            key = CLIENT_TOKEN
         return url, key
     return item["url"], ""
 
@@ -72,6 +78,16 @@ def hermes_block(items: list[dict]) -> str:
         ])
         if key:
             lines.extend(["    headers:", f"      Authorization: {yaml_quote('Bearer ' + key)}"])
+        if "tool_include" in item:
+            lines.append("    tools:")
+            lines.append("      include:")
+            for tool in item["tool_include"]:
+                lines.append(f"        - {yaml_quote(str(tool))}")
+        elif "tool_exclude" in item:
+            lines.append("    tools:")
+            lines.append("      exclude:")
+            for tool in item["tool_exclude"]:
+                lines.append(f"        - {yaml_quote(str(tool))}")
         lines.extend([
             f"    timeout: {int(item.get('timeout', 300))}",
             "    connect_timeout: 30",
@@ -103,6 +119,8 @@ def openwebui_connection(item: dict) -> dict:
     config = {"enable": True, "access_grants": []}
     if item.get("functions"):
         config["function_name_filter_list"] = item["functions"]
+    elif item.get("tool_include"):
+        config["function_name_filter_list"] = ",".join(item["tool_include"])
     return {
         "url": url, "path": "", "type": "mcp",
         "auth_type": item.get("auth_type", "none"), "headers": None,
@@ -135,11 +153,17 @@ def update_openwebui(db: pathlib.Path, items: list[dict]) -> None:
 
 
 def main() -> None:
+    global CLIENT_TOKEN
     parser = argparse.ArgumentParser()
     parser.add_argument("--registry", type=pathlib.Path, required=True)
     parser.add_argument("--hermes", type=pathlib.Path, action="append", default=[])
     parser.add_argument("--openwebui-db", type=pathlib.Path)
+    parser.add_argument("--mcphub-token-file", type=pathlib.Path)
     args = parser.parse_args()
+    if args.mcphub_token_file:
+        CLIENT_TOKEN = args.mcphub_token_file.read_text(encoding="utf-8").strip()
+        if not CLIENT_TOKEN:
+            raise SystemExit("MCPHub token file is empty")
     if args.hermes:
         block = hermes_block(active(args.registry, "hermes"))
         for path in args.hermes: