{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json","name":"io.github.nogoo9/no-crd","description":"Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs","repository":{"url":"https://github.com/nogoo9/no-crd","source":"github"},"version":"0.18.0","packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@nogoo9/no-crd","version":"0.18.0","runtimeHint":"bunx","transport":{"type":"stdio"},"runtimeArguments":[{"description":"Transport channel for MCP client-server communication: stdio, http, both","default":"stdio","type":"named","name":"--transport","valueHint":"stdio|http|both"},{"description":"Kubernetes cluster access scope: cluster-wide or namespace-restricted","default":"cluster","type":"named","name":"--mode","valueHint":"cluster|namespaced"},{"description":"Target namespace for workspace pods, services, and local templates","default":"nogoo9","type":"named","name":"--namespace","valueHint":"nogoo9"},{"description":"HTTP port for SSE transport, routing proxy, and dashboard UI","default":"3000","type":"named","name":"--port","valueHint":"3000"},{"description":"Network interface host address to bind the HTTP server to","default":"0.0.0.0","type":"named","name":"--host","valueHint":"0.0.0.0"},{"description":"Granularity of output logs: debug, info, warning, error, fatal","default":"info","type":"named","name":"--log-level","valueHint":"debug|info|warning|error|fatal"},{"description":"Bypass startup diagnostics checking Kubernetes RBAC access permissions","type":"named","name":"--disable-permission-checks"},{"description":"Allowed origins for HTTP CORS cross-site requests (default: *)","default":"*","type":"named","name":"--cors-origin","valueHint":"*"},{"description":"Allowed HTTP request methods for CORS configuration","default":"GET, POST, OPTIONS","type":"named","name":"--cors-methods","valueHint":"GET, POST, OPTIONS"},{"description":"Allowed HTTP header names for incoming CORS requests","default":"Content-Type, Authorization","type":"named","name":"--cors-headers","valueHint":"Content-Type, Authorization"},{"description":"Allow credentials (cookies, headers) in cross-origin requests","type":"named","name":"--cors-allow-credentials"},{"description":"Mandatory OAuth scope claim value to query or get workspaces","type":"named","name":"--auth-required-read-scope","valueHint":"mcp:read"},{"description":"Mandatory OAuth scope claim value to spawn or stop workspaces","type":"named","name":"--auth-required-write-scope","valueHint":"mcp:write"},{"description":"JSONPath pattern to extract scope permissions from the token payload","default":"$.scope","type":"named","name":"--auth-scope-jsonpath","valueHint":"$.scope"},{"description":"OAuth role required to view workspaces (e.g. reader)","type":"named","name":"--auth-required-read-role","valueHint":"reader"},{"description":"OAuth role required to spawn or delete workspaces (e.g. writer)","type":"named","name":"--auth-required-write-role","valueHint":"writer"},{"description":"JSONPath query to retrieve user roles list from token payload","default":"$.realm_access.roles","type":"named","name":"--auth-roles-jsonpath","valueHint":"$.realm_access.roles"}],"environmentVariables":[{"description":"Path to the Kubernetes API credentials configuration file","name":"KUBECONFIG"},{"description":"Hosting URL subpath prefix for gateways and reverse proxies","name":"BASE_URL"},{"description":"Disable in-memory session tracking for stateless execution","name":"STATELESS"},{"description":"Local file path containing TLS public certificate (HTTPS)","name":"TLS_CERT"},{"description":"Local file path containing TLS private key (HTTPS)","isSecret":true,"name":"TLS_KEY"},{"description":"Local file path containing trusted client Certificate Authority","name":"TLS_CA"},{"description":"Set to '0' to allow connection to unverified TLS endpoints","name":"NODE_TLS_REJECT_UNAUTHORIZED"},{"description":"Default container registry for workspace image resolution","name":"REGISTRY_URL"},{"description":"Local filesystem directory containing custom YAML/JSON templates","name":"TEMPLATES_DIR"},{"description":"Enable loading of standard pre-configured templates (default: true)","name":"BUILTIN_TEMPLATES"},{"description":"Enforce JWT verification and user tenant isolation (default: false)","name":"AUTH_ENABLED"},{"description":"Set to 'false' to skip OIDC cryptographic signature checks","name":"JWT_VERIFICATION_REQUIRED"},{"description":"HMAC-SHA symmetric secret key to sign/verify JWT tokens","isSecret":true,"name":"JWT_SECRET"},{"description":"PEM public key to verify asymmetric OIDC signatures","isSecret":true,"name":"JWT_PUBLIC_KEY"},{"description":"Discovery URI to fetch keys from OIDC provider dynamically","name":"JWKS_URI"},{"description":"RFC 7662 compliant token introspection validation endpoint","name":"INTROSPECTION_ENDPOINT"},{"description":"Client identifier for OAuth2 authentication flows","name":"OAUTH_CLIENT_ID"},{"description":"Client secret credentials used for token introspection","isSecret":true,"name":"OAUTH_CLIENT_SECRET"},{"description":"Target audience check value for incoming OIDC tokens","name":"JWT_AUDIENCE"},{"description":"Expected token issuer authority check value (e.g. Keycloak)","name":"AUTH_ISSUER"},{"description":"JSONPath pattern to extract user identity subject from token","name":"AUTH_SUB_JSONPATH"},{"description":"Bypass role name that grants admin access (default: nogoo9-admin)","name":"AUTH_ADMIN_ROLE"},{"description":"Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims","name":"AUTH_ADMIN_USERS"},{"description":"Active lifetime in seconds for signed proxy session cookies","name":"PROXY_SESSION_TTL"},{"description":"Secret key for session cookie signing","isSecret":true,"name":"PROXY_SESSION_SECRET"},{"description":"Serve the built-in HTML dashboard (default: true)","name":"UI_ENABLED"},{"description":"Filesystem directory to scan for custom CSS themes","name":"THEMES_DIR"},{"description":"ConfigMap name storing dynamic CSS theme overrides","name":"THEMES_CONFIGMAP"},{"description":"Directory containing static documentation web files to serve","name":"DOCS_DIR"},{"description":"Standard OIDC .well-known configuration discovery endpoint","name":"OAUTH_DISCOVERY_URL"},{"description":"UI SSO flow login method: 'redirect' or silent 'iframe'","name":"OAUTH_LOGIN_METHOD"},{"description":"Custom dashboard header title for white-label branding","name":"UI_TITLE"},{"description":"Custom dashboard subtitle text below the header title","name":"UI_SUBTITLE"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-08-12T16:42:05.795235Z","publishedAt":"2026-08-12T16:42:05.795235Z","updatedAt":"2026-08-12T16:42:05.795235Z","isLatest":true}}}