Minimal MCPs for experimenting with OpenWork and OpenShell

Echo MCP

Minimal MCP with 'echo' tool to test custom MCPs with OpenWork

OpenShell MCP

MCP with basic OpenShell commands to translate between OpenWork and OpenShell. Now with demo material (basic service and access policy) to show OpenShell working.

Using the MCP

Prereq: replace placeholders (<YOUR_EMAIL>,<CLUSTER_DOMAIN>) with real values and log into your OpenShift cluster. For a detailed set of instructions see DEPLOYMENT.md

Deploy OpenShell on OpenShift with version 0.0.86.

Then deploy the OpenShell MCP:

kubectl get secret openshell-client-tls -n openshell -o yaml | sed 's/namespace: openshell/namespace: default/' | kubectl apply -f -

# patch registry route to build and push img
oc patch configs.imageregistry.operator.openshift.io/cluster --type merge -p '{"spec":{"defaultRoute":true}}'
oc get route default-route -n openshift-image-registry -o jsonpath='{.spec.host}'

# apply the cert-manager
oc apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

REGISTRY=default-route-openshift-image-registry.apps.<YOUR_IMAGE_REGISTRY_ROUTE>
# ^ use the registry route from oc get route above

podman build -t $REGISTRY/default/openshell-mcp:latest /Users/evhoward/claude/openworkdemo/openshell-mcp/
podman login --tls-verify=false $REGISTRY -u kubeadmin -p $(oc whoami -t)
podman push --tls-verify=false $REGISTRY/default/openshell-mcp:latest

kubectl get secret openshell-server-tls -n openshell -o yaml | sed 's/namespace: openshell/namespace: default/' | kubectl apply -f -

oc apply -f /Users/evhoward/claude/openworkdemo/openshell-mcp/deployment.yaml

# wait for cert-manager to be ready and then apply clusterissuer
oc wait --for=condition=ready pod -l app.kubernetes.io/instance=cert-manager -n cert-manager --timeout=120s

cat <<EOF | oc apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <YOUR_EMAIL>
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            ingressClassName: openshift-default
EOF

oc whoami --show-console # use the output here to set the domain variable
DOMAIN=<YOUR_DOMAIN >.openshift.org

sed "s/<CLUSTER_DOMAIN>/$DOMAIN/g" /path/to/your/certificate/certificate.yaml | oc apply -f -

# the challenges dont resolve themselves so you need to expose the service
oc get challenges -n default
SOLVER_SVC=$(oc get svc -n default -o name | grep acme | head -1 | cut -d/ -f2)
oc expose svc/$SOLVER_SVC \
--hostname=openshell-mcp-default.apps.<YOUR_DOMAIN_HERE>openshift.org \
--path=/.well-known/acme-challenge \
-n default

oc get challenges -n default -w
oc get certificate openshell-mcp-tls -n default -w

# when they're ready patch the route
bash /path/to/patch-route/patch-route.sh # substitute with path to patch-route.sh

Then deploy OpenWork and register the MCP in the desktop app using the MCP route (oc get routes -n default).

Deploying the demo materials

# Build the image for the brand-guidelines service
REGISTRY=$(oc get route default-route -n openshift-image-registry -o jsonpath='{.spec.host}')
podman build --platform linux/amd64 -t $REGISTRY/default/brand-guidelines:latest brand-guidelines/ # from repo root, for me 'openworkdemo' directory
podman push --tls-verify=false $REGISTRY/default/brand-guidelines:latest

oc apply -f brand-guidelines/deployment.yaml
oc get pod -n default -l app=brand-guidelines

Then open a new conversation and prompt the OpenWork agent: “Create a sandbox called demo-sandbox. Try to fetch the Lumina brand guidelines — it should fail. Then apply the brand policy and fetch again from the approved sandbox. Finally, write a LinkedIn post for Lumina 2.0 using the guidelines.”

The agent should try to fetch the guidelines, fail, and then try again, succeeding.

# if you make changes to the mcp, roll it out again:
oc rollout restart deployment/openshell-mcp -n default
oc rollout status deployment/openshell-mcp -n default

# or if you have attempted the demo flow before and want to start again, delete the existing 'demo' sandboxes created by the agent
oc exec -n default deployment/openshell-mcp -- openshell -g openshell-mcp sandbox delete demo-sandbox
oc exec -n default deployment/openshell-mcp -- openshell -g openshell-mcp sandbox delete demo-sandbox-approved