openship adds 6,470 stars in a week with an MCP endpoint that's allowlist-by-default.

oblien/openship (8,660 stars, 75% of its total in seven days, Apache 2.0, 393 commits) points at a repo and then builds, ships, routes, and TLS-terminates the app with built-in CI/CD, as desktop app, web dashboard, and CLI (GitHub). The design decision worth copying: "only routes that opt in are exposed as MCP tools," with permission checks on every call rather than a blanket grant. That posture is correct for handing an agent deploy authority and it's rare enough in MCP servers to be notable.