argocd and kube mcp to read-write

manifest/overlays/production/mcp-servers/mcpserver-argocd.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     toolhive.stacklok.dev/registry-export: "true"
     toolhive.stacklok.dev/registry-title: Argo CD MCP
-    toolhive.stacklok.dev/registry-description: Read-only Argo CD MCP server for inspecting homelab GitOps applications and resources.
+    toolhive.stacklok.dev/registry-description: Write-capable Argo CD MCP server for inspecting and operating homelab GitOps applications and resources.
     toolhive.stacklok.dev/registry-url: http://mcp-argocd-mcp-proxy.toolhive-system.svc.cluster.local:8080/mcp
     glance/parent: argocd
 spec:
@@ -24,9 +24,8 @@ spec:
     # argocd-server serves a self-signed cert in-cluster.
     - name: NODE_TLS_REJECT_UNAUTHORIZED
       value: "0"
-    # Start read-only; drop this to enable sync/write tools later.
     - name: MCP_READ_ONLY
-      value: "true"
+      value: "false"
   # ToolHive 0.28.3 does not translate spec.secrets into the workload, so inject
   # the token natively on the `mcp` container via podTemplateSpec.
   resourceOverrides:

manifest/overlays/production/mcp-servers/mcpserver-kubernetes.yaml

@@ -6,11 +6,11 @@ metadata:
   annotations:
     toolhive.stacklok.dev/registry-export: "true"
     toolhive.stacklok.dev/registry-title: Kubernetes MCP
-    toolhive.stacklok.dev/registry-description: Read-only Kubernetes MCP server for safe cluster inspection and troubleshooting.
+    toolhive.stacklok.dev/registry-description: Write-capable Kubernetes MCP server for cluster inspection, troubleshooting, and GitOps maintenance actions.
     toolhive.stacklok.dev/registry-url: http://mcp-kubernetes-mcp-proxy.toolhive-system.svc.cluster.local:8080/mcp
 spec:
   # containers/kubernetes-mcp-server. Authenticates to the API in-cluster via the
-  # kubernetes-mcp ServiceAccount (read-only ClusterRole, see rbac file). Speaks
+  # kubernetes-mcp ServiceAccount (write-capable ClusterRole, see rbac file). Speaks
   # stdio; ToolHive proxies to streamable-http at
   # http://mcp-kubernetes-mcp-proxy.mcp-services:8080/mcp.
   image: ghcr.io/containers/kubernetes-mcp-server:latest
@@ -20,14 +20,12 @@ spec:
   args:
     - --log-file
     - stderr
-    - --read-only
-    - --disable-destructive
   proxyMode: streamable-http
   proxyPort: 8080
   groupRef:
     name: homelab-core
-  # Pin the MCP server pod to our read-only ServiceAccount. The ClusterRole is
-  # the real guardrail: even if a write tool is invoked, the API rejects it.
+  # Pin the MCP server pod to the ServiceAccount that carries its Kubernetes API
+  # write permissions.
   serviceAccount: kubernetes-mcp
   permissionProfile:
     type: builtin