MCP Server MCP

Kubernetes Ephemeral Job

By github 👁 1 views ▲ 0 votes

Runs a command in a throwaway Kubernetes pod and returns exit code, output and artifacts.

Homepage Verified source GitHub

Install

oci:docker.io/idconstruct/mcp-k8s-ephemeral-job:v0.7.1

Configuration Example

{
  "remotes": [],
  "packages": [
    {
      "registryType": "oci",
      "identifier": "docker.io/idconstruct/mcp-k8s-ephemeral-job:v0.7.1",
      "runtimeHint": "docker",
      "transport": {
        "type": "stdio"
      },
      "runtimeArguments": [
        {
          "description": "Mount the kubeconfig directory read-only so the server can reach the cluster.",
          "value": "{kubeconfig_dir}:/kube:ro",
          "variables": {
            "kubeconfig_dir": {
              "description": "Host directory holding your kubeconfig, e.g. /home/you/.kube",
              "isRequired": true
            }
          },
          "type": "named",
          "name": "--volume"
        },
        {
          "description": "Read-only root filesystem — the server writes nothing locally.",
          "type": "named",
          "name": "--read-only"
        },
        {
          "description": "Drop all Linux capabilities.",
          "value": "ALL",
          "type": "named",
          "name": "--cap-drop"
        },
        {
          "description": "Block privilege escalation.",
          "value": "no-new-privileges",
          "type": "named",
          "name": "--security-opt"
        },
        {
          "description": "Memory limit for the server process itself.",
          "value": "256m",
          "type": "named",
          "name": "--memory"
        }
      ],
      "environmentVariables": [
        {
          "description": "Strict image allowlist (CSV). Empty means every call is rejected, so this must be set.",
          "isRequired": true,
          "name": "MCP_K8S_ALLOWED_IMAGES"
        },
        {
          "description": "Path to the kubeconfig inside the container. Empty = use in-cluster credentials.",
          "default": "/kube/config",
          "name": "MCP_K8S_KUBECONFIG"
        },
        {
          "description": "Namespace the ephemeral pods are created in. Needs a Role/RoleBinding for jobs and pods.",
          "default": "mcp-ephemeral",
          "name": "MCP_K8S_NAMESPACE"
        },
        {
          "description": "MCP transport: stdio | http | sse. Must be 'stdio' for direct docker/stdio use.",
          "default": "stdio",
          "name": "MCP_K8S_TRANSPORT"
        },
        {
          "description": "Default wall-clock timeout per job, seconds.",
          "default": "60",
          "name": "MCP_K8S_DEFAULT_TIMEOUT_S"
        },
        {
          "description": "Maximum wall-clock timeout a caller may request, seconds.",
          "default": "600",
          "name": "MCP_K8S_MAX_TIMEOUT_S"
        },
        {
          "description": "Cap on combined stdout/stderr before truncation.",
          "default": "1048576",
          "name": "MCP_K8S_MAX_OUTPUT_BYTES"
        },
        {
          "description": "Cap on the total size of returned artifacts.",
          "default": "10485760",
          "name": "MCP_K8S_MAX_ARTIFACT_BYTES"
        },
        {
          "description": "Maximum ephemeral pods running at the same time.",
          "default": "10",
          "name": "MCP_K8S_MAX_CONCURRENT"
        },
        {
          "description": "Pod CPU request; limits come from the caller or the namespace LimitRange.",
          "default": "1",
          "name": "MCP_K8S_DEFAULT_CPU"
        },
        {
          "description": "Pod memory request; limits come from the caller or the namespace LimitRange.",
          "default": "512Mi",
          "name": "MCP_K8S_DEFAULT_MEMORY"
        },
        {
          "description": "Helper image used to inject input files and collect artifacts.",
          "default": "busybox:1.36",
          "name": "MCP_K8S_SIDECAR_IMAGE"
        },
        {
          "description": "Image carrying git for the clone init container. Empty disables the clone field.",
          "name": "MCP_K8S_CLONE_IMAGE"
        },
        {
          "description": "Secret with git tokens, mounted only on the cloner. Empty disables the clone field.",
          "isSecret": true,
          "name": "MCP_K8S_CLONE_SECRET"
        },
        {
          "description": "Existing PVC mounted into every job pod as a shared cache. Empty = no cache.",
          "name": "MCP_K8S_CACHE_PVC"
        },
        {
          "description": "Where the cache PVC is mounted, e.g. /go/pkg/mod. Empty = no cache.",
          "name": "MCP_K8S_CACHE_MOUNT_PATH"
        },
        {
          "description": "JSON object of env vars added to every job pod; caller keys win on collision.",
          "name": "MCP_K8S_JOB_EXTRA_ENV"
        },
        {
          "description": "Optional X-MCP-AUTH token required on every request (http/sse transports only).",
          "isSecret": true,
          "name": "MCP_K8S_AUTH_TOKEN"
        }
      ]
    }
  ]
}

mcp model-context-protocol oci