Deploying the MCP Server

Quick Deploy

Staging (from main)

bash
1gh workflow run "Deploy MCP Server" -f branch=main -f deploy_staging=true

Production (from main)

bash
1gh workflow run "Deploy MCP Server" -f branch=main -f deploy_production=true

Both environments

bash
1gh workflow run "Deploy MCP Server" -f branch=main -f deploy_staging=true -f deploy_production=true

From a feature branch

bash
1gh workflow run "Deploy MCP Server" -f branch=feat/my-branch -f deploy_staging=true

Monitoring a Deploy

bash
1# Watch the workflow run
2gh run list --workflow="Deploy MCP Server" --limit 3
3gh run watch <run-id>
4
5# Check pod rollout
6kubectl rollout status deploy/futuresearch-mcp-staging -n futuresearch-mcp-staging --timeout=5m
7
8# Verify pods are running
9kubectl get pods -n futuresearch-mcp-staging -o wide

How It Works

The GitHub Actions workflow (.github/workflows/deploy-mcp.yaml) does:

1. Checks — ruff lint + pytest on the target branch
2. Build & push — Docker image to GAR, tagged with short SHA (+ latest on main)
3. Deploy — Helm upgrade with layered values:
   • values.yaml — base config
   • values.staging.yaml — staging overrides (MCP_SERVER_URL, REDIS_DB, replicaCount, host)
   • values.secrets.staging.yaml — SOPS-decrypted secrets (Supabase, API keys)

The deploy uses --atomic so it auto-rolls back on failure.

Scaling Replicas

Via Helm values (persistent)

Edit futuresearch-mcp/deploy/chart/values.staging.yaml:

yaml
1replicaCount: 2  # Change this

Commit, push, and redeploy.

Via kubectl (temporary, resets on next deploy)

bash
1# Staging
2kubectl scale deploy futuresearch-mcp-staging -n futuresearch-mcp-staging --replicas=3
3
4# Take offline
5kubectl scale deploy futuresearch-mcp-staging -n futuresearch-mcp-staging --replicas=0

Environments

Both environments hit the same production FutureSearch API — there is no staging API.

Updating Secrets

bash
1# View current secrets
2sops -d futuresearch-mcp/deploy/chart/secrets.staging.enc.yaml
3
4# Update a value
5sops --set '["secrets"]["data"]["KEY_NAME"] "new-value"' futuresearch-mcp/deploy/chart/secrets.staging.enc.yaml

Commit the encrypted file and redeploy.

Key Files

Gotchas

• Branch protection on main: Can't push directly — create a PR and merge first, then deploy from main.
• SOPS decryption requires GCP IAM: Run gcloud auth application-default login if decryption fails.
• Concurrent deploys: Workflow uses cancel-in-progress: false — if a deploy is running, the next one queues.
• Atomic rollback: --atomic means a failed deploy auto-reverts to the previous release. Check helm history if this happens.