MCP Medical Agent Platform

MCP_HACK//26 Submission — A local-first AI agent platform that federates kagent + a medical data MCP server through agentgateway, deployed via ArgoCD GitOps on Kind.

The Demo

 Ask from VS Code: "What is the race distribution in ICU admissions?"

 ┌─────────────┐     ┌──────────────────┐     ┌────────────────────┐
 │  VS Code /  │────▶│  agentgateway    │────▶│  kagent (/mcp)     │
 │  Cursor /   │     │  :4000           │     │  :8083             │
 │  Claude     │     │  MCP federation  │     │  list_agents       │
 └─────────────┘     │  + security      │     │  invoke_agent      │
                     │  + observability │     └────────────────────┘
                     │                  │
                     │                  │     ┌────────────────────┐
                     │                  │────▶│  m3 MCP (/mcp)     │
                     └──────────────────┘     │  :3000             │
                                              │  MIMIC-IV clinical │
                                              │  database tools    │
                                              └────────────────────┘

 Response: "Based on the MIMIC-IV admissions data, the race distribution
           shows WHITE: 41,266 (54.8%), BLACK/AFRICAN AMERICAN: 13,197..."

One MCP endpoint. Two servers. Six medical data tools. All from your IDE.

Why This Project

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    MCP Clients (any)                         │
│  VS Code + Copilot  │  Cursor  │  Claude Code  │  curl     │
└──────────┬──────────┴──────────┴───────────────┴───────────┘
           │ MCP Streamable HTTP
           ▼
┌──────────────────────┐
│   agentgateway       │  MCP federation proxy (Rust)
│   localhost:4000     │  ├─ Virtual MCP multiplexing
│   UI: :15000         │  ├─ CORS / session management
│                      │  └─ Observability + routing
└───┬──────────┬───────┘
    │          │
    ▼          ▼
┌────────┐ ┌────────────┐
│ kagent │ │ m3         │    ← Both inside Kind cluster
│ :8083  │ │ :3000      │    ← Both deployed via ArgoCD
│ /mcp   │ │ /mcp       │    ← Both speak MCP Streamable HTTP
└───┬────┘ └────────────┘
    │
    ▼
┌──────────────────────┐
│ medical-data-agent   │  kagent Agent CRD
│ Uses m3 tools via    │  ├─ get_database_schema
│ K8s Service          │  ├─ execute_mimic_query
│ discovery            │  ├─ get_race_distribution
│ (appProtocol: mcp)   │  ├─ get_icu_stays
│                      │  ├─ get_lab_results
│                      │  └─ get_table_info
└──────────────────────┘

Two ways to deploy

This repo contains two independent deployment systems. Pick one:

Everything below documents deploy/. For the original flow, see Original setup.

Prerequisites

You need a container runtime, plus kind, kubectl, helm, and an OpenAI API key.

macOS

brew install kind kubectl helm jq
# plus Docker Desktop, Podman Desktop, or colima

Linux / WSL2 — install from your distro, not Homebrew. Brew's podman on Linux
ships without the rootless plumbing (uidmap, /etc/subuid entries), which makes
kind fail with mkdir /var/lib/containers/storage/libpod: permission denied.

sudo apt-get update && sudo apt-get install -y podman uidmap slirp4netns jq
sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 "$USER"

# WSL2 only: systemd is required for the cgroup v2 delegation kind needs
printf '[boot]\nsystemd=true\n' | sudo tee /etc/wsl.conf
# then run `wsl --shutdown` from Windows PowerShell and reopen the terminal

podman info --format '{{.Host.Security.Rootless}} {{.Store.GraphRoot}}'
# expect: true  /home/<you>/.local/share/containers/storage

Both Makefiles auto-detect the runtime in kind's own order (docker → podman →
nerdctl). Force one with make create CONTAINER_RUNTIME=podman.

Quick Start (5 minutes)

# 1. Set API key
export OPENAI_API_KEY=sk-your-key

# 2. Deploy everything via GitOps
cd deploy
make create

# 3. Start port-forwards
make ports

# 4. Start agentgateway (separate terminal)
make gateway

# 5. Test it!
make demo

The deploy/ targets resolve paths against the Makefile's own location, so
cd deploy && make create and make -f deploy/Makefile create are equivalent.

What Gets Deployed

Demo Walkthrough

1. Federated MCP — list all tools from both servers

curl -s http://localhost:4000/ \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | python3 -m json.tool

You'll see tools prefixed by target name: kagent_list_agents, kagent_invoke_agent, m3_get_database_schema, m3_execute_mimic_query, etc.

2. Query clinical data via agentgateway

# Race distribution in hospital admissions
curl -s http://localhost:4000/ \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"m3_get_race_distribution","arguments":{}},"id":2}' \
  | python3 -m json.tool

3. List kagent agents via agentgateway

curl -s http://localhost:4000/ \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"kagent_list_agents","arguments":{}},"id":3}' \
  | python3 -m json.tool

4. VS Code Integration

Copy the MCP config to your project:

cp deploy/vscode/mcp.json .vscode/mcp.json

Then ask GitHub Copilot:

"What is the race distribution in ICU admissions?"

Copilot will discover and call m3_get_race_distribution through agentgateway automatically.

5. Explore the UIs

Hackathon Categories

This project spans multiple categories:

Building Cool Agents (Primary)

• medical-data-agent: A kagent Agent CRD that queries MIMIC-IV clinical data via MCP tools
• Uses Go runtime for fast startup (~2s)
• Demonstrates kagent's K8s Service discovery for MCP servers

MCP & AI Agents Starter Track

• Complete tutorial: from zero to federated MCP servers
• Step-by-step Makefile — each target is idempotent and documented
• VS Code integration shows practical developer workflow

Secure & Govern MCP

• agentgateway provides the governance layer: CORS, session management, routing
• All agent traffic flows through a single auditable proxy
• Ready for JWT auth and RBAC policies (documented in README)

Key Technical Decisions

File Structure

argo-kagent/
├── README.md                            ← You are here
├── Makefile                             ← Root convenience targets
├── setup-kagent.sh                      ← Original setup script
├── argocd/                              ← ArgoCD app definitions (original)
├── deploy/                              ← Hackathon deployment system
│   ├── Makefile                         ← Main orchestration (make create/ports/gateway/demo)
│   ├── .env.template                    ← Environment configuration
│   ├── README.md                        ← Technical deployment guide
│   ├── kind/
│   │   └── cluster-config.yaml          ← Kind cluster config
│   ├── argocd/
│   │   ├── kagent-app.yaml              ← kagent ArgoCD Application (v0.8.3)
│   │   └── m3-app.yaml                  ← m3 ArgoCD Application
│   ├── kagent-resources/
│   │   ├── modelconfig.yaml             ← OpenAI LLM provider config
│   │   └── medical-data-agent.yaml      ← Agent CRD with m3 MCP tools
│   ├── agentgateway/
│   │   └── config.yaml                  ← MCP federation config
│   └── vscode/
│       └── mcp.json                     ← VS Code MCP client config
├── helm-charts/
│   └── m3/                              ← m3 Helm chart (deployed via ArgoCD)
│       ├── Chart.yaml
│       ├── values.yaml
│       └── templates/
│           ├── deployment.yaml
│           ├── service.yaml             ← appProtocol: mcp for kagent discovery
│           ├── configmap.yaml
│           └── ...
└── galileotest/                         ← Example kagent agent definitions

Technologies Used

Extending

Add another MCP server

1. Deploy to cluster (Helm chart + ArgoCD Application)
2. Add as target in deploy/agentgateway/config.yaml
3. Restart agentgateway

Add RBAC to agentgateway

# deploy/agentgateway/config.yaml
policies:
  auth:
    - type: jwt
      jwt:
        issuer: https://your-idp.com

Create new kagent agent

kubectl apply -f - <<EOF
apiVersion: kagent.dev/v1alpha2
kind: Agent
metadata:
  name: my-agent
  namespace: kagent
spec:
  type: Declarative
  declarative:
    modelConfig: default-model-config
    systemMessage: "You are a helpful agent."
    tools:
      - type: McpServer
        mcpServer:
          name: m3
          kind: Service
          toolNames:
            - get_database_schema
EOF

Original setup

The root Makefile drives setup-kagent.sh and deploys kagent + mcp-sqlite-vec
into a cluster named kagent-demo. It additionally needs the argocd CLI.

make install-tools   # installs only what's missing (skips tools already on PATH)
make env-template    # creates .env — add your OPENAI_API_KEY
make create-cluster
make setup           # or: make setup-portkey, for Portkey/Galileo

Troubleshooting

cd deploy
make status          # Check everything
make logs            # Stream kagent + m3 logs
make destroy         # Nuclear option — start fresh

kind picks the wrong container runtime. kind honours
KIND_EXPERIMENTAL_PROVIDER from your environment, and a stale
export KIND_EXPERIMENTAL_PROVIDER=podman in a shell profile silently overrides
everything else. Both Makefiles now blank it out when they select docker, but
check your dotfiles if you see enabling experimental podman provider unexpectedly:

grep -r KIND_EXPERIMENTAL ~/.bashrc ~/.zshrc

permission denied on /var/lib/containers/storage. Podman is resolving
rootful storage paths as an unprivileged user — its rootless setup is missing.
See the Linux/WSL prerequisites above. A brew-installed podman on Linux is the
usual cause; remove it (brew uninstall podman) so the distro package is used.

Changes to helm-charts/m3 have no effect. ArgoCD deploys that chart from
repoURL: https://github.com/papagala/argo-kagent.git at targetRevision: HEAD,
not from your working copy. Local edits only take effect once pushed.