---
id: w2/m1/t004
title: Manifests + deploy + end-to-end acceptance
worker: worker2
status: done
estimate: 30m
depends_on: [w2/m1/t001, w2/m1/t003]
---

## Objective

Deploy the MCP adapter in-cluster and prove an agent can operate bex through it end-to-end.

## Context

- bex-api deploys via `operator/config/api/` (Deployment/Service/Ingress + cert-manager TLS + least-privilege RBAC), wired from `config/default`; Argo's image override covers the extra binary with no CI change (`docs/ADR006-bex-api.md` "Deploy").
- Mirror that pattern for the MCP HTTP transport under `operator/config/mcp/`.

## Steps

1. Add `operator/config/mcp/` (Deployment overriding `command`, Service, Ingress `mcp.bex.co` + TLS, RBAC) and wire from `config/default`.
2. Reuse the `bex-api-token` Secret.
3. Acceptance: connect an MCP client, list Apps, suspend one, tail its logs; confirm `status.suspended` converges.

## Files

- `operator/config/mcp/` · `operator/config/default/`

## Acceptance criteria

- [ ] An MCP client against the deployed server lists/suspends an App and tails logs; the operator converges the suspend.

## Out of scope

- `deploy` verb + webhook (w2/m2); sandbox verbs (w2/m3).
