v2.32.0: gRPC daemons behind the proxy via h2c, and project-scoped MCP server

The proxy can now forward to daemons over cleartext HTTP/2, so gRPC servers work behind it. pitchfork mcp --local limits the MCP server to the current project's daemons.

Added

• proxy_protocol = "h2c" for gRPC daemons (#1048) by @jdx. gRPC needs HTTP/2 end to end, but until now the proxy always talked to daemons over HTTP/1.1. A daemon can now opt in to cleartext HTTP/2 (h2c) for the connection from the proxy to the daemon:

  [daemons.api]
  run = "./my-grpc-server --port 50051"
  port = 50051
  proxy_protocol = "h2c"   # default: "http1"

  • With settings.proxy.https = true, the proxy handles TLS with its own certificate and forwards to the daemon over h2c, so the daemon doesn't need a certificate. Clients can still connect over HTTP/1.1 or HTTP/2.
  • The default stays http1, so existing daemons behave the same as before.
  • Connection-specific headers are removed from h2c requests, except TE: trailers, which gRPC requires.
  • WebSocket upgrades don't work on an h2c daemon. The proxy returns 501 instead.
  • The setting is ignored when proxy_tls = "passthrough".
  • Closes #1047.

• pitchfork mcp --local limits the MCP server to the current project (#1049) by @jdx. With -l / --local (alias --project, the same as pitchfork list --project), the MCP server only exposes daemons from the project in its working directory. pitchfork finds the project the same way it resolves short daemon IDs: it uses the nearest config file and falls back to global if there is none.

  { "mcpServers": { "pitchfork": { "command": "pitchfork", "args": ["mcp", "--local"] } } }

  • pitchfork_status, and pitchfork_logs called without IDs, only return daemons from that project.
  • Start, stop, restart and logs requests for a daemon in another project return an error instead of acting on it.
  • Before a start or restart, the server also checks the daemon's dependencies, including indirect ones. This stops it from starting daemons in another project through a dependency.
  • Without the flag, the MCP server still exposes daemons from all projects.

Full Changelog: v2.31.0...v2.32.0

💚 Sponsor pitchfork

pitchfork is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If pitchfork has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep pitchfork fast, free, and independent.