Add VL_INSTANCE_TLS_SKIP_VERIFY option to skip TLS certificate verification

Author: mkobozev

README.md

@@ -134,6 +134,7 @@ MCP Server for VictoriaLogs is configured via environment variables:
 | `VL_INSTANCE_ENTRYPOINT`   | URL to VictoriaLogs instance                                                                                                                                                                                                                                        | Yes      | -                | -                                |
 | `VL_INSTANCE_BEARER_TOKEN` | Authentication token for VictoriaLogs API                                                                                                                                                                                                                           | No       | -                | -                                |
 | `VL_INSTANCE_HEADERS`      | Custom HTTP headers to send with requests (comma-separated key=value pairs)                                                                                                                                                                                         | No       | -                | -                                |
+| `VL_INSTANCE_TLS_SKIP_VERIFY` | Skip TLS certificate verification for VictoriaLogs HTTP client. **Warning: use only in development/testing environments, never in production.**                                                                                                                  | No       | `false`          | `true`, `false`                  |
 | `MCP_PASSTHROUGH_HEADERS`  | HTTP header names to forward from incoming MCP requests to VictoriaLogs (comma-separated list). Overrides `VL_INSTANCE_HEADERS` on collision. Only applies in `sse`/`http` modes.                                                                                   | No       | -                | -                                |
 | `VL_DEFAULT_TENANT_ID`     | Default tenant ID used when tenant is not specified in requests (format: `AccountID:ProjectID` or `AccountID`)                                                                                                                                                      | No       | `0:0`            | -                                |
 | `MCP_SERVER_MODE`          | Server operation mode. See [Modes](#modes) for details.                                                                                                                                                                                                             | No       | `stdio`          | `stdio`, `sse`, `http`           |

cmd/mcp-victorialogs/config/config.go

@@ -23,6 +23,8 @@ type Config struct {
 
 	entryPointURL *url.URL
 
+	tlsSkipVerify bool
+
 	// Logging configuration
 	logFormat string
 	logLevel  string
@@ -98,6 +100,8 @@ func InitConfig() (*Config, error) {
 		return nil, fmt.Errorf("MCP_LOG_LEVEL must be 'debug', 'info', 'warn' or 'error'")
 	}
 
+	tlsSkipVerify := strings.ToLower(strings.TrimSpace(os.Getenv("VL_INSTANCE_TLS_SKIP_VERIFY"))) == "true"
+
 	result := &Config{
 		serverMode:         strings.ToLower(os.Getenv("MCP_SERVER_MODE")),
 		listenAddr:         os.Getenv("MCP_LISTEN_ADDR"),
@@ -110,6 +114,7 @@ func InitConfig() (*Config, error) {
 		logFormat:          logFormat,
 		logLevel:           logLevel,
 		defaultTenantID:    logstorage.TenantID{AccountID: 0, ProjectID: 0},
+		tlsSkipVerify:      tlsSkipVerify,
 	}
 	// Left for backward compatibility
 	if result.listenAddr == "" {
@@ -199,6 +204,10 @@ func (c *Config) LogLevel() string {
 	return c.logLevel
 }
 
+func (c *Config) TLSSkipVerify() bool {
+	return c.tlsSkipVerify
+}
+
 func (c *Config) DefaultTenantID() logstorage.TenantID {
 	return c.defaultTenantID
 }

cmd/mcp-victorialogs/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"log"
@@ -50,6 +51,13 @@ func main() {
 		return
 	}
 
+	if c.TLSSkipVerify() {
+		slog.Warn("TLS certificate verification is disabled (VL_INSTANCE_TLS_SKIP_VERIFY=true). Do not use in production.")
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
+		http.DefaultTransport = transport
+	}
+
 	if !c.IsStdio() {
 		slog.Info("Starting mcp-victorialogs",
 			"version", version,