Enmasse - GitOps for AI integrations

Everything the AI layer consists of takes part in enmasse, the platform's configuration export and import tool - LLM connections under the llm section and MCP gateways under mcp_gateway. What you define in the Dashboard exports to YAML, the YAML lives in git, and importing it recreates the configuration in another environment - dev, test and production differing only in their environment variables.

The llm section

llm:

  - name: My OpenAI
    model: gpt-4o-mini
    address: https://api.openai.com/v1
    secret: Zato_Enmasse_Env.My_OpenAI_API_Key
    timeout: 30
    max_tokens: 2048
    max_history_turns: 10
    chat_expiry: 3600

  - name: My Claude
    model: Sonnet 5
    address: https://api.anthropic.com
    secret: Zato_Enmasse_Env.My_Claude_API_Key

Every key the second connection above omits gets its default, so a minimal definition is a name, a model and an address.

The mcp_gateway section

mcp_gateway:

  - name: billing
    url_path: /mcp/billing
    services:
      - billing.get-invoice
      - billing.list-invoices
    security_groups:
      - partner-agents
    skills:
      - invoice-analysis
    validate_input: true
    is_audit_log_active: true
    max_response_size: 2000
    safeguards_pii_enabled: true
    safeguards_pii_lands:
      - international

Importing a gateway also creates the REST channel that makes it reachable under its URL path - there is nothing separate to define. The only required key is name, every other key gets its documented default:

The response shaping family mirrors the wizard's step 02, all documented under response controls:

An entry with should_delete: true removes the gateway and its REST channel instead of creating or updating it.

Keep secrets out of git

The Zato_Enmasse_Env. prefix makes enmasse read the value from an environment variable of the given name where the import runs - My_OpenAI_API_Key above. The YAML in git then contains no secrets, and each environment supplies its own keys. The mechanism is the same one all enmasse sections use and it is described in the enmasse chapter.

The gateways themselves hold no secrets - their security_groups name groups whose member definitions, with their passwords and keys, are defined in the security section the same YAML file can include.

Export and import

• To export, in the Dashboard click System > Config > Export enmasse - the resulting enmasse.yaml has the llm and mcp_gateway sections with the rest of the configuration, without any secrets, which never leave the server.
• To import, click System > Config > Import enmasse and select the file, or mount it under /opt/hot-deploy/enmasse/enmasse.yaml inside a container for imports that run on startup, as the DevOps guide describes.

An import creates what does not exist yet and updates what does, matching by name - running it again is safe.

See also