{"servers":[{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","name":"io.github.inhuman/mcp-k8s-ephemeral-job","description":"Runs a command in a throwaway Kubernetes pod and returns exit code, output and artifacts.","title":"Kubernetes Ephemeral Job","repository":{"url":"https://github.com/inhuman/mcp-k8s-ephemeral-job","source":"github"},"version":"0.7.1","packages":[{"registryType":"oci","identifier":"docker.io/idconstruct/mcp-k8s-ephemeral-job:v0.7.1","runtimeHint":"docker","transport":{"type":"stdio"},"runtimeArguments":[{"description":"Mount the kubeconfig directory read-only so the server can reach the cluster.","value":"{kubeconfig_dir}:/kube:ro","variables":{"kubeconfig_dir":{"description":"Host directory holding your kubeconfig, e.g. /home/you/.kube","isRequired":true}},"type":"named","name":"--volume"},{"description":"Read-only root filesystem — the server writes nothing locally.","type":"named","name":"--read-only"},{"description":"Drop all Linux capabilities.","value":"ALL","type":"named","name":"--cap-drop"},{"description":"Block privilege escalation.","value":"no-new-privileges","type":"named","name":"--security-opt"},{"description":"Memory limit for the server process itself.","value":"256m","type":"named","name":"--memory"}],"environmentVariables":[{"description":"Strict image allowlist (CSV). Empty means every call is rejected, so this must be set.","isRequired":true,"name":"MCP_K8S_ALLOWED_IMAGES"},{"description":"Path to the kubeconfig inside the container. Empty = use in-cluster credentials.","default":"/kube/config","name":"MCP_K8S_KUBECONFIG"},{"description":"Namespace the ephemeral pods are created in. Needs a Role/RoleBinding for jobs and pods.","default":"mcp-ephemeral","name":"MCP_K8S_NAMESPACE"},{"description":"MCP transport: stdio | http | sse. Must be 'stdio' for direct docker/stdio use.","default":"stdio","name":"MCP_K8S_TRANSPORT"},{"description":"Default wall-clock timeout per job, seconds.","default":"60","name":"MCP_K8S_DEFAULT_TIMEOUT_S"},{"description":"Maximum wall-clock timeout a caller may request, seconds.","default":"600","name":"MCP_K8S_MAX_TIMEOUT_S"},{"description":"Cap on combined stdout/stderr before truncation.","default":"1048576","name":"MCP_K8S_MAX_OUTPUT_BYTES"},{"description":"Cap on the total size of returned artifacts.","default":"10485760","name":"MCP_K8S_MAX_ARTIFACT_BYTES"},{"description":"Maximum ephemeral pods running at the same time.","default":"10","name":"MCP_K8S_MAX_CONCURRENT"},{"description":"Pod CPU request; limits come from the caller or the namespace LimitRange.","default":"1","name":"MCP_K8S_DEFAULT_CPU"},{"description":"Pod memory request; limits come from the caller or the namespace LimitRange.","default":"512Mi","name":"MCP_K8S_DEFAULT_MEMORY"},{"description":"Helper image used to inject input files and collect artifacts.","default":"busybox:1.36","name":"MCP_K8S_SIDECAR_IMAGE"},{"description":"Image carrying git for the clone init container. Empty disables the clone field.","name":"MCP_K8S_CLONE_IMAGE"},{"description":"Secret with git tokens, mounted only on the cloner. Empty disables the clone field.","isSecret":true,"name":"MCP_K8S_CLONE_SECRET"},{"description":"Existing PVC mounted into every job pod as a shared cache. Empty = no cache.","name":"MCP_K8S_CACHE_PVC"},{"description":"Where the cache PVC is mounted, e.g. /go/pkg/mod. Empty = no cache.","name":"MCP_K8S_CACHE_MOUNT_PATH"},{"description":"JSON object of env vars added to every job pod; caller keys win on collision.","name":"MCP_K8S_JOB_EXTRA_ENV"},{"description":"Optional X-MCP-AUTH token required on every request (http/sse transports only).","isSecret":true,"name":"MCP_K8S_AUTH_TOKEN"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-07-20T09:51:22.058237Z","publishedAt":"2026-07-20T09:51:22.058237Z","updatedAt":"2026-07-20T09:51:22.058237Z","isLatest":true}}}],"metadata":{"count":1}}