[arnold-retool]

Summary

BFA-130: Use env.BASE_DOMAIN as the MCP public origin fallback in a single-host Retool installation. The chart passes it to the MCP process, derives OAUTH_MAIN_DOMAIN when it can resolve the value, and passes trusted-proxy CIDRs when configured. An explicit mcp.config.mcpServiceExternalUrl (or mcp.environmentVariables entry) is copied to the backend unless the backend has its own explicit value, keeping OAuth discovery, Bearer challenges, resource metadata, and upload links aligned. Existing explicit values are preserved.

Render-time validation rejects malformed public origin values and clear mismatches with chart-managed Ingress hosts and HTTPRoute hostnames. Multiple managed hosts, externally managed ingress, and secret-backed values that cannot be resolved during templating remain supported. Tests cover both backendRelay and direct routing modes. The chart version moves to 6.12.4 and both values files remain synchronized.

Companion server PR: https://github.com/tryretool/retool_development/pull/86710

This PR is stacked on routing PR #391 (itself stacked on #390) and targets arnold/mcp-routing-mode so the diff contains only the public-origin change.

Migration

For one public host, set env.BASE_DOMAIN: https://retool.example.com and serve that host via the configured Ingress or HTTPRoute. Remove mcp.config.mcpServiceExternalUrl when custom Space domains should be advertised per request; the existing explicit override continues to pin every MCP response to one origin. If a proxy rewrites Host or terminates TLS, set env.MCP_TRUSTED_PROXY_CIDRS to the immediate proxy peer CIDRs. The server PR consumes this contract. With external ingress, disable chart-managed routing and provide the public path mappings documented in the README.

Validation

• python3 .github/test_mcp_routing.py: 16 render tests passed, including defaults, overrides, mismatches, secret-backed values, custom hosts, and both routing modes.
• python3 .github/test_mcp_helm_test.py: 14 render and localhost HTTP smoke tests passed.
• helm lint charts/retool --values charts/retool/ci/test-install-values.yaml --values charts/retool/ci/test-mcp-enabled-option.yaml: passed.
• helm template ... | kubeconform -strict -ignore-missing-schemas -summary: 18 valid resources, zero invalid, one skipped.
• git diff --check: passed.

No deployment was performed.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with all three previous findings addressed and no new blocking issues found.

_{Reviews (2) · Last reviewed commit: "[BFA-130] Default MCP public origin from..." · Reviewed by Greptile}

[arnold-retool]

• [BFA-130] Default MCP public origin from BASE_DOMAIN #392 👈 (View in Graphite)
• [feat][MCP] Make public routing mode explicit #391
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.