[codex] Add MCP agent sandbox JWT config

[arnold-retool]

Adds typed MCP configuration for AGENT_SANDBOX_JWT_PRIVATE_KEY, supporting both inline values and Kubernetes Secret references. Documents the new mcp.config keys in both synced values files and adds CI overlays for inline and secret-backed rendering. Bumps the chart patch version to 6.11.2. Validated with Helm render checks, targeted helm lint, a full CI option render sweep, and the values sync diff.

[greptile-apps]

Greptile Summary

This PR adds typed MCP configuration support for AGENT_SANDBOX_JWT_PRIVATE_KEY, following the exact same dual-path pattern already established for OAUTH_INTROSPECTION_AUTH_TOKEN — either a Kubernetes secretKeyRef or an inline literal value. The change bumps the chart version to 6.11.2 and adds two CI overlay files to exercise each code path.

• deployment_mcp.yaml: New if/else if block mirrors lines 139–148 verbatim, placing secret-backed lookup first and the inline literal fallback second; default key name is jwt-private-key consistent with the values.yaml comment.
• CI overlays: test-mcp-agent-sandbox-secret-option.yaml exercises the secretKeyRef path; test-mcp-enabled-option.yaml adds the inline literal to the existing enabled-option sweep.
• values.yaml / charts/retool/values.yaml: Both files updated in sync with the new commented-out config keys and inline-vs-secret guidance.

Confidence Score: 5/5

Safe to merge — the change is additive, fully opt-in, and follows the existing pattern for oauthIntrospectionAuthToken without introducing new failure modes.

The new block in deployment_mcp.yaml is a verbatim structural copy of the already-proven oauthIntrospectionAuthToken block, the two CI overlays each cleanly cover one branch, the values files are kept in sync, and the inline-vs-secret guidance in the comments correctly steers operators toward the secret-backed approach for production.

No files require special attention.

Important Files Changed

Filename	Overview
charts/retool/templates/deployment_mcp.yaml	Adds AGENT_SANDBOX_JWT_PRIVATE_KEY env var injection; new block is structurally identical to the existing oauthIntrospectionAuthToken block at lines 139–148, with a jwt-private-key default key name consistent with the values comments.
charts/retool/ci/test-mcp-agent-sandbox-secret-option.yaml	New CI overlay exercising the secretKeyRef code path with a custom key name (private-key); satisfies the required oauthIntrospectionAuthToken guard via the inline token field.
charts/retool/ci/test-mcp-enabled-option.yaml	Adds agentSandboxJwtPrivateKey inline literal to the existing enabled-option CI overlay, exercising the else-if branch.
charts/retool/values.yaml	Documents the four new config keys in comments; inline literal is clearly marked as dev/testing only; in sync with the root values.yaml.
charts/retool/Chart.yaml	Patch version bump from 6.11.1 to 6.11.2, appropriate for the additive config change.
values.yaml	Root values.yaml kept in sync with charts/retool/values.yaml; identical diff.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[mcp.config] --> B{agentSandboxJwtPrivateKeySecretName set?}
    B -- Yes --> C[secretKeyRef\nname: SecretName\nkey: SecretKey OR 'jwt-private-key']
    C --> D[AGENT_SANDBOX_JWT_PRIVATE_KEY\nenv var via valueFrom]
    B -- No --> E{agentSandboxJwtPrivateKey set?}
    E -- Yes --> F[Inline literal\nvalue: privateKey]
    F --> G[AGENT_SANDBOX_JWT_PRIVATE_KEY\nenv var via value]
    E -- No --> H[Env var omitted\nno AGENT_SANDBOX_JWT_PRIVATE_KEY]

Loading

_{Reviews (1): Last reviewed commit: "Add MCP agent sandbox JWT key config" | Re-trigger Greptile}

[arnold-retool]

Merge activity

• Jun 12, 11:56 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 12, 11:56 PM UTC: @arnold-retool merged this pull request with Graphite.