diff --git a/Caddyfile b/Caddyfile
index 8be470c..ec4d5f7 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -212,3 +212,21 @@ zimaos.hubris.network {
 	}
 	reverse_proxy 192.168.8.195
 }
+
+# Homelab MCP server (read-only context + management tools).
+# Mesh+LAN-gated by the service itself + nftables; no SSO so agent clients work.
+mcp.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.205:9810
+}
+
+# Per-client age-key issuance (mesh-only via source-IP gating in the service).
+# No SSO — agents call this during bootstrap; identity is mesh peer + hostname.
+secrets.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.205:9820
+}