ROX-33010: Add MCP Gateway integraton to Helm chart

charts/stackrox-mcp/README.md

@@ -142,6 +142,18 @@ The following table lists the configurable parameters of the StackRox MCP chart
 | `openshift.route.tls.insecureEdgeTerminationPolicy` | Policy for insecure edge traffic | `Redirect` |
 | `openshift.route.tls.destinationCACertificate` | CA certificate for pod verification | `""` |
 
+### MCP Gateway Integration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `mcpGateway.enabled` | Enable MCP Gateway integration | `false` |
+| `mcpGateway.gateway.name` | Name of the MCP Gateway resource | `stackrox-mcp-gateway` |
+| `mcpGateway.gateway.namespace` | Namespace of the MCP Gateway resource | `gateway-system` |
+| `mcpGateway.hostname` | Hostname for the HTTPRoute | `""` |
+| `mcpGateway.toolPrefix` | Prefix for tools exposed via the gateway | `stackrox_` |
+
+**Note:** Requires [MCP Gateway](https://github.com/Kuadrant/mcp-gateway) to be installed on the cluster. The chart validates that the required CRDs (`gateway.networking.k8s.io/v1` and `mcp.kagenti.com/v1alpha1`) are available and fails with a descriptive error if they are not. See [MCP Gateway Integration](../../docs/mcp-gateway-integration.md) for details.
+
 ### Scheduling
 
 | Parameter | Description | Default |

charts/stackrox-mcp/templates/http-route.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.mcpGateway.enabled }}
+{{- if not (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1") }}
+{{- fail "MCP Gateway integration requires the Gateway API (gateway.networking.k8s.io/v1). Install Gateway API CRDs before enabling mcpGateway." }}
+{{- end }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "stackrox-mcp.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stackrox-mcp.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+  - name: {{ .Values.mcpGateway.gateway.name }}
+    namespace: {{ .Values.mcpGateway.gateway.namespace }}
+  {{- with .Values.mcpGateway.hostname }}
+  hostnames:
+  - {{ . | quote }}
+  {{- end }}
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /mcp
+    backendRefs:
+    - name: {{ include "stackrox-mcp.fullname" . }}
+      port: {{ .Values.service.port }}
+{{- end }}

charts/stackrox-mcp/templates/mcp-server-registration.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.mcpGateway.enabled }}
+{{- if not (.Capabilities.APIVersions.Has "mcp.kagenti.com/v1alpha1") }}
+{{- fail "MCP Gateway integration requires the MCPServerRegistration CRD (mcp.kagenti.com/v1alpha1). Install MCP Gateway (https://github.com/Kuadrant/mcp-gateway) before enabling mcpGateway." }}
+{{- end }}
+apiVersion: mcp.kagenti.com/v1alpha1
+kind: MCPServerRegistration
+metadata:
+  name: {{ include "stackrox-mcp.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stackrox-mcp.labels" . | nindent 4 }}
+spec:
+  toolPrefix: {{ .Values.mcpGateway.toolPrefix }}
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: {{ include "stackrox-mcp.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

charts/stackrox-mcp/values.yaml

@@ -184,6 +184,22 @@ config:
     configManager:
       enabled: true
 
+# MCP Gateway integration (opt-in)
+# Requires MCP Gateway (https://github.com/Kuadrant/mcp-gateway) to be installed on the cluster
+mcpGateway:
+  enabled: false
+
+  # Gateway resource reference
+  gateway:
+    name: stackrox-mcp-gateway
+    namespace: gateway-system
+
+  # Hostname for the HTTPRoute
+  hostname: ""
+
+  # Tool prefix to avoid naming conflicts when aggregating tools through the gateway
+  toolPrefix: stackrox_
+
 # Additional environment variables (advanced use)
 # These will be added directly to the container
 extraEnv: []

docs/mcp-gateway-integration.md

@@ -0,0 +1,59 @@
+# MCP Gateway Integration
+
+This guide describes how to integrate the StackRox MCP server with [MCP Gateway](https://github.com/Kuadrant/mcp-gateway), enabling tool aggregation behind a centralized gateway endpoint.
+
+## Overview
+
+MCP Gateway is an Envoy-based system that aggregates multiple MCP servers behind a single endpoint. It uses Gateway API resources and a custom `MCPServerRegistration` CRD to discover and route requests to backend MCP servers.
+
+When enabled, the Helm chart creates:
+- **HTTPRoute** — routes `/mcp` traffic from the gateway to the StackRox MCP service
+- **MCPServerRegistration** — registers the server with the gateway using a tool prefix to avoid naming conflicts
+
+## Prerequisites
+
+- [MCP Gateway](https://github.com/Kuadrant/mcp-gateway) installed on the cluster ([OpenShift installation guide](https://github.com/Kuadrant/mcp-gateway/tree/main/config/openshift))
+
+The Helm chart validates that the required CRDs are available and fails with a descriptive error if they are not.
+
+## Installation
+
+```bash
+helm install stackrox-mcp charts/stackrox-mcp \
+  --namespace stackrox-mcp \
+  --create-namespace \
+  --set mcpGateway.enabled=true \
+  --set mcpGateway.hostname=stackrox-mcp.mcp.local \
+  --set config.central.url=<your-central-url>
+```
+
+## Configuration Reference
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `mcpGateway.enabled` | Enable MCP Gateway integration | `false` |
+| `mcpGateway.gateway.name` | Name of the MCP Gateway resource | `stackrox-mcp-gateway` |
+| `mcpGateway.gateway.namespace` | Namespace of the MCP Gateway resource | `gateway-system` |
+| `mcpGateway.hostname` | Hostname for the HTTPRoute | `""` |
+| `mcpGateway.toolPrefix` | Prefix for tools exposed via the gateway | `stackrox_` |
+
+## Verification
+
+```bash
+curl -X POST https://$(oc get routes -n gateway-system -o jsonpath='{ .items[0].spec.host }')/mcp \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"initialize","id":1,"params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'
+```
+
+## Architecture
+
+```
+MCP Client
+  → MCP Gateway (gateway-system namespace)
+    → HTTPRoute (/mcp)
+      → StackRox MCP Service (stackrox-mcp namespace)
+        → StackRox MCP Pod(s)
+          → StackRox Central API
+```
+
+The gateway aggregates tools from all registered MCP servers. StackRox MCP tools are exposed with the configured prefix (e.g., `stackrox_get_deployments_for_cve`).