Argo CD

Proxy for a self-hosted Argo CD instance's REST API through the managed gateway: application status, diffs, sync, and rollback. All operations are gated by PBAC policy.

Authentication

Argo CD authenticates REST calls with an API token. This connector supports two auth modes, chosen per managed resource at install time via the Authentication field:

• Per-user API token (user_secret, default, recommended) — each user links their own Argo CD API token once, through a PolicyArc-hosted browser page reached by MCP URL elicitation on the first call. The token posts only to the AS (never through the MCP client or the model), is stored encrypted per (subject, resource), and is sent as Authorization: Bearer <token> on that user's calls — so Argo CD attributes every action to the real account, scoped to that account's own RBAC. This is the natural fit for a shop that hasn't set up SSO: everyone already has their own Argo CD account and can mint their own token from it.
• Shared token (static) — every call uses one operator-held API token from the token_env secret. Argo CD attributes all calls to that one identity.

Either way, PolicyArc enforces per-user authorization at the gateway via policy before the request reaches Argo CD — worth being deliberate about, since sync_application and rollback_application change what's actually running in a cluster. See Per-user upstream credentials for how the user_secret collection flow works.

Setup

• base_url — your Argo CD instance's base URL, e.g. https://argocd.example.com.
• upstream_auth.type — user_secret (default) or static.
• token_env — static mode only — a secret holding an Argo CD API token. Hidden when user_secret is selected.

Creating an Argo CD API token

argocd account generate-token --account <your-account> from the CLI, or Argo CD UI → Settings → Accounts → your account → Generate New Token. In user_secret mode each user does this for themselves on the collection page; in static mode the operator provisions the shared token once — scope its account's RBAC role to whatever sync/rollback access is actually intended, since a shared token means every caller gets that same access.

Manifest reference

• ID: identos.argocd
• Version: 1.0.0
• Resource type: urn:connector:identos:argocd
• Capabilities: mcp

Supported auth modes

Type	Details
user_secret	—
static	scheme bearer; setup fields: token_env

Setup fields

ID	Label	Default	Secret?	Notes
base_url	Argo CD base URL	—	no	placeholder: https://argocd.example.com
upstream_auth.type	Authentication	user_secret	no	user_secret (recommended) has each user link their own Argo CD API token, so actions are attributed to the real account and scoped to that account's RBAC — the natural fit for a shop without SSO. static uses one shared token for everyone.
token_env	API token	—	yes	Used only for the static method. A secret holding an Argo CD API token, sent as Authorization: Bearer <token>. / shown when upstream_auth.type == 'static'

Scopes

Scope
argocd:apps:read
argocd:apps:write

Routes

Method	Pattern	Scope	Resource template
GET	/applications	argocd:apps:read	—
GET	/applications/{name}	argocd:apps:read	argocd://applications/{{name}}
GET	/applications/{name}/managed-resources	argocd:apps:read	argocd://applications/{{name}}/managed-resources
POST	/applications/{name}/sync	argocd:apps:write	argocd://applications/{{name}}
POST	/applications/{name}/rollback	argocd:apps:write	argocd://applications/{{name}}

MCP tools

Name	Scope	Description
list_applications	argocd:apps:read	List Argo CD applications and their sync/health status.
get_application	argocd:apps:read	Get an Argo CD application's full status: sync state, health, source, and destination.
get_managed_resources	argocd:apps:read	Get the live-vs-desired diff for an application's managed Kubernetes resources.
sync_application	argocd:apps:write	Trigger a sync, deploying the application's current target revision (e.g. the latest commit on its tracked Gitea/git branch) to its destination cluster.
rollback_application	argocd:apps:write	Roll an application back to a previous deployment recorded in its history.