MCP Server
MCP
io.github.nogoo9/no-crd
By Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs
Install
npx -y @nogoo9/[email protected]Configuration Example
{
"remotes": [],
"packages": [
{
"registryType": "npm",
"registryBaseUrl": "https://registry.npmjs.org",
"identifier": "@nogoo9/no-crd",
"version": "0.18.0",
"runtimeHint": "bunx",
"transport": {
"type": "stdio"
},
"runtimeArguments": [
{
"description": "Transport channel for MCP client-server communication: stdio, http, both",
"default": "stdio",
"type": "named",
"name": "--transport",
"valueHint": "stdio|http|both"
},
{
"description": "Kubernetes cluster access scope: cluster-wide or namespace-restricted",
"default": "cluster",
"type": "named",
"name": "--mode",
"valueHint": "cluster|namespaced"
},
{
"description": "Target namespace for workspace pods, services, and local templates",
"default": "nogoo9",
"type": "named",
"name": "--namespace",
"valueHint": "nogoo9"
},
{
"description": "HTTP port for SSE transport, routing proxy, and dashboard UI",
"default": "3000",
"type": "named",
"name": "--port",
"valueHint": "3000"
},
{
"description": "Network interface host address to bind the HTTP server to",
"default": "0.0.0.0",
"type": "named",
"name": "--host",
"valueHint": "0.0.0.0"
},
{
"description": "Granularity of output logs: debug, info, warning, error, fatal",
"default": "info",
"type": "named",
"name": "--log-level",
"valueHint": "debug|info|warning|error|fatal"
},
{
"description": "Bypass startup diagnostics checking Kubernetes RBAC access permissions",
"type": "named",
"name": "--disable-permission-checks"
},
{
"description": "Allowed origins for HTTP CORS cross-site requests (default: *)",
"default": "*",
"type": "named",
"name": "--cors-origin",
"valueHint": "*"
},
{
"description": "Allowed HTTP request methods for CORS configuration",
"default": "GET, POST, OPTIONS",
"type": "named",
"name": "--cors-methods",
"valueHint": "GET, POST, OPTIONS"
},
{
"description": "Allowed HTTP header names for incoming CORS requests",
"default": "Content-Type, Authorization",
"type": "named",
"name": "--cors-headers",
"valueHint": "Content-Type, Authorization"
},
{
"description": "Allow credentials (cookies, headers) in cross-origin requests",
"type": "named",
"name": "--cors-allow-credentials"
},
{
"description": "Mandatory OAuth scope claim value to query or get workspaces",
"type": "named",
"name": "--auth-required-read-scope",
"valueHint": "mcp:read"
},
{
"description": "Mandatory OAuth scope claim value to spawn or stop workspaces",
"type": "named",
"name": "--auth-required-write-scope",
"valueHint": "mcp:write"
},
{
"description": "JSONPath pattern to extract scope permissions from the token payload",
"default": "$.scope",
"type": "named",
"name": "--auth-scope-jsonpath",
"valueHint": "$.scope"
},
{
"description": "OAuth role required to view workspaces (e.g. reader)",
"type": "named",
"name": "--auth-required-read-role",
"valueHint": "reader"
},
{
"description": "OAuth role required to spawn or delete workspaces (e.g. writer)",
"type": "named",
"name": "--auth-required-write-role",
"valueHint": "writer"
},
{
"description": "JSONPath query to retrieve user roles list from token payload",
"default": "$.realm_access.roles",
"type": "named",
"name": "--auth-roles-jsonpath",
"valueHint": "$.realm_access.roles"
}
],
"environmentVariables": [
{
"description": "Path to the Kubernetes API credentials configuration file",
"name": "KUBECONFIG"
},
{
"description": "Hosting URL subpath prefix for gateways and reverse proxies",
"name": "BASE_URL"
},
{
"description": "Disable in-memory session tracking for stateless execution",
"name": "STATELESS"
},
{
"description": "Local file path containing TLS public certificate (HTTPS)",
"name": "TLS_CERT"
},
{
"description": "Local file path containing TLS private key (HTTPS)",
"isSecret": true,
"name": "TLS_KEY"
},
{
"description": "Local file path containing trusted client Certificate Authority",
"name": "TLS_CA"
},
{
"description": "Set to '0' to allow connection to unverified TLS endpoints",
"name": "NODE_TLS_REJECT_UNAUTHORIZED"
},
{
"description": "Default container registry for workspace image resolution",
"name": "REGISTRY_URL"
},
{
"description": "Local filesystem directory containing custom YAML/JSON templates",
"name": "TEMPLATES_DIR"
},
{
"description": "Enable loading of standard pre-configured templates (default: true)",
"name": "BUILTIN_TEMPLATES"
},
{
"description": "Enforce JWT verification and user tenant isolation (default: false)",
"name": "AUTH_ENABLED"
},
{
"description": "Set to 'false' to skip OIDC cryptographic signature checks",
"name": "JWT_VERIFICATION_REQUIRED"
},
{
"description": "HMAC-SHA symmetric secret key to sign/verify JWT tokens",
"isSecret": true,
"name": "JWT_SECRET"
},
{
"description": "PEM public key to verify asymmetric OIDC signatures",
"isSecret": true,
"name": "JWT_PUBLIC_KEY"
},
{
"description": "Discovery URI to fetch keys from OIDC provider dynamically",
"name": "JWKS_URI"
},
{
"description": "RFC 7662 compliant token introspection validation endpoint",
"name": "INTROSPECTION_ENDPOINT"
},
{
"description": "Client identifier for OAuth2 authentication flows",
"name": "OAUTH_CLIENT_ID"
},
{
"description": "Client secret credentials used for token introspection",
"isSecret": true,
"name": "OAUTH_CLIENT_SECRET"
},
{
"description": "Target audience check value for incoming OIDC tokens",
"name": "JWT_AUDIENCE"
},
{
"description": "Expected token issuer authority check value (e.g. Keycloak)",
"name": "AUTH_ISSUER"
},
{
"description": "JSONPath pattern to extract user identity subject from token",
"name": "AUTH_SUB_JSONPATH"
},
{
"description": "Bypass role name that grants admin access (default: nogoo9-admin)",
"name": "AUTH_ADMIN_ROLE"
},
{
"description": "Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims",
"name": "AUTH_ADMIN_USERS"
},
{
"description": "Active lifetime in seconds for signed proxy session cookies",
"name": "PROXY_SESSION_TTL"
},
{
"description": "Secret key for session cookie signing",
"isSecret": true,
"name": "PROXY_SESSION_SECRET"
},
{
"description": "Serve the built-in HTML dashboard (default: true)",
"name": "UI_ENABLED"
},
{
"description": "Filesystem directory to scan for custom CSS themes",
"name": "THEMES_DIR"
},
{
"description": "ConfigMap name storing dynamic CSS theme overrides",
"name": "THEMES_CONFIGMAP"
},
{
"description": "Directory containing static documentation web files to serve",
"name": "DOCS_DIR"
},
{
"description": "Standard OIDC .well-known configuration discovery endpoint",
"name": "OAUTH_DISCOVERY_URL"
},
{
"description": "UI SSO flow login method: 'redirect' or silent 'iframe'",
"name": "OAUTH_LOGIN_METHOD"
},
{
"description": "Custom dashboard header title for white-label branding",
"name": "UI_TITLE"
},
{
"description": "Custom dashboard subtitle text below the header title",
"name": "UI_SUBTITLE"
}
]
}
]
}
mcp
model-context-protocol
npm
Comments
Sign in to leave a comment