The road travelled by Flava MCP Hub: plumbing for the AI era
Flava MCP Hub가 걸어온 길: AI 시대를 위한 배관 공사
B · Useful, limited Architecture write-up by the tech lead and backend engineer of LINE Plus's company-wide MCP platform; specific design and failure details, but adoption and time figures are self-reported and the one-week baseline is an internal estimate.
Summary based on the full text·Original: about 12 minutes to read
In short
A Korean post on the LY Corporation tech blog (late October 2026) by the tech lead and a backend engineer of Flava MCP Hub, the company-wide MCP platform on LINE Plus's private cloud. Teams had been building MCP servers on their own, each re-implementing company authentication, with no catalogue and no usage data. The hub adds a catalogue, a runtime and a gateway, built as four layers: connection, proxy, authorisation and monitoring. A local stdio connector bridges the gap between the MCP standard and an internal IAM that does not accept unregistered clients. The team later replaced the open-source gateway with its own Go version.
Key numbers
- 650+MCP servers running on the platform
- 200+teams using it
- 11.5 million+cumulative tool calls through the hub
- about 1 week to under 5 minutestime to deploy a new MCP server with company authentication, internal estimate before versus now
- about 2 monthsinitial development window that led the team to start on an open-source gateway
As reported by the source.
Korean·Web page·opens techblog.lycorp.co.jp
What it reports
- Four problems before the hub: MCP servers spread without control and were rebuilt by teams unaware of each other; authentication differed per client and server; internal auth did not fit the MCP standard; nobody knew who used what.
- Pick a server from the catalogue and connect in under 1 minute; deploy a new authenticated server in under 5 minutes, against an internally estimated week before.
- Layer 1, a connector the client sees as a standard stdio MCP server, handles OIDC, browser callback, token cache, refresh and Bearer header injection. Layer 2, the gateway, standardises CORS, headers and transport. Layer 3 validates tokens centrally, so servers carry no auth code. Layer 4 logs tool calls, auth results and latency end to end.
- The "protocol gap": MCP expects clients to connect to unknown servers via dynamic client registration or client ID metadata documents; the internal IAM requires pre-registered clients and its own tokens.
- Problems with the Rust-based open-source gateway: the team mostly knew Go; JWKS loading failed on an ES512 key, stopping the gateway; auth middleware ran before CORS, so browser preflight requests were rejected; frequent out-of-memory failures; fork and patch overhead.
- The team says LLM-assisted code analysis lowered the cost of rewriting the gateway in Go.
- Unplanned value: since all tool calls pass the hub, traffic data now shows which tools are used and which servers other teams reuse, and drives decisions on what to support and template next.
- Next: OpenAPI-to-MCP conversion of existing REST APIs, reuse of teams' existing API auth, tracking the 2026-07-28 MCP spec, CLI and skill support, and ID-JAG token exchange so one token is swapped for per-server tokens without separate consent screens.
How they got it
Builders' description of their own platform, with operating figures from the hub's monitoring. No method is given for the figures; the one-week baseline is labelled an internal estimate.
Limits
- Self-reported adoption numbers with no breakdown of active versus idle servers or usage over time.
- Before-and-after time is an estimate, not measured.
- No cost, incident or security-review data.
- The open-source gateway is not named; the issues refer to the version the team ran.
Why it matters for companies
Any company where teams start wiring agents to internal systems will hit the same four problems. The design choices here are reusable: one local connector that hides company auth from every client, one gateway that validates tokens so servers do not, and full logging of tool calls. The logging turned out to be the most useful part, because it shows actual agent use across the company. The gateway story is a reminder that a fast open-source start may need replacing once internal auth and stability requirements diverge from the project's roadmap.
Key passages in translation
Korean original
실제 MCP 서버 로직은 많지 않더라도, 이를 사내에서 사용할 수 있는 형태로 만드는 데 더 많은 노력이 들어갑니다.
Even when the actual MCP server logic is small, more effort goes into making it usable inside the company.
Korean original
핵심은 클라이언트가 사내 인증의 존재 자체를 몰라도 된다는 점입니다.
The key point is that the client does not need to know that company authentication exists at all.
Korean original
처음에는 연결을 쉽게 만들기 위한 구조였지만, 운영을 시작한 뒤에는 전사 AI 도구 사용을 이해하는 관측 지점이 됐습니다.
It started as a structure to make connection easy, but once in operation it became the observation point for understanding AI tool use across the company.
Summary based on the full text. Read the original for the full argument and data.Read the original on techblog.lycorp.co.jp
- Tags
- AI enablement