no-crd

{
  "name": "io.github.nogoo9/no-crd",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json",
  "version": "0.18.0",
  "packages": [
    {
      "version": "0.18.0",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@nogoo9/no-crd",
      "runtimeHint": "bunx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "runtimeArguments": [
        {
          "name": "--transport",
          "type": "named",
          "default": "stdio",
          "valueHint": "stdio|http|both",
          "description": "Transport channel for MCP client-server communication: stdio, http, both"
        },
        {
          "name": "--mode",
          "type": "named",
          "default": "cluster",
          "valueHint": "cluster|namespaced",
          "description": "Kubernetes cluster access scope: cluster-wide or namespace-restricted"
        },
        {
          "name": "--namespace",
          "type": "named",
          "default": "nogoo9",
          "valueHint": "nogoo9",
          "description": "Target namespace for workspace pods, services, and local templates"
        },
        {
          "name": "--port",
          "type": "named",
          "default": "3000",
          "valueHint": "3000",
          "description": "HTTP port for SSE transport, routing proxy, and dashboard UI"
        },
        {
          "name": "--host",
          "type": "named",
          "default": "0.0.0.0",
          "valueHint": "0.0.0.0",
          "description": "Network interface host address to bind the HTTP server to"
        },
        {
          "name": "--log-level",
          "type": "named",
          "default": "info",
          "valueHint": "debug|info|warning|error|fatal",
          "description": "Granularity of output logs: debug, info, warning, error, fatal"
        },
        {
          "name": "--disable-permission-checks",
          "type": "named",
          "description": "Bypass startup diagnostics checking Kubernetes RBAC access permissions"
        },
        {
          "name": "--cors-origin",
          "type": "named",
          "default": "*",
          "valueHint": "*",
          "description": "Allowed origins for HTTP CORS cross-site requests (default: *)"
        },
        {
          "name": "--cors-methods",
          "type": "named",
          "default": "GET, POST, OPTIONS",
          "valueHint": "GET, POST, OPTIONS",
          "description": "Allowed HTTP request methods for CORS configuration"
        },
        {
          "name": "--cors-headers",
          "type": "named",
          "default": "Content-Type, Authorization",
          "valueHint": "Content-Type, Authorization",
          "description": "Allowed HTTP header names for incoming CORS requests"
        },
        {
          "name": "--cors-allow-credentials",
          "type": "named",
          "description": "Allow credentials (cookies, headers) in cross-origin requests"
        },
        {
          "name": "--auth-required-read-scope",
          "type": "named",
          "valueHint": "mcp:read",
          "description": "Mandatory OAuth scope claim value to query or get workspaces"
        },
        {
          "name": "--auth-required-write-scope",
          "type": "named",
          "valueHint": "mcp:write",
          "description": "Mandatory OAuth scope claim value to spawn or stop workspaces"
        },
        {
          "name": "--auth-scope-jsonpath",
          "type": "named",
          "default": "$.scope",
          "valueHint": "$.scope",
          "description": "JSONPath pattern to extract scope permissions from the token payload"
        },
        {
          "name": "--auth-required-read-role",
          "type": "named",
          "valueHint": "reader",
          "description": "OAuth role required to view workspaces (e.g. reader)"
        },
        {
          "name": "--auth-required-write-role",
          "type": "named",
          "valueHint": "writer",
          "description": "OAuth role required to spawn or delete workspaces (e.g. writer)"
        },
        {
          "name": "--auth-roles-jsonpath",
          "type": "named",
          "default": "$.realm_access.roles",
          "valueHint": "$.realm_access.roles",
          "description": "JSONPath query to retrieve user roles list from token payload"
        }
      ],
      "environmentVariables": [
        {
          "name": "KUBECONFIG",
          "description": "Path to the Kubernetes API credentials configuration file"
        },
        {
          "name": "BASE_URL",
          "description": "Hosting URL subpath prefix for gateways and reverse proxies"
        },
        {
          "name": "STATELESS",
          "description": "Disable in-memory session tracking for stateless execution"
        },
        {
          "name": "TLS_CERT",
          "description": "Local file path containing TLS public certificate (HTTPS)"
        },
        {
          "name": "TLS_KEY",
          "isSecret": true,
          "description": "Local file path containing TLS private key (HTTPS)"
        },
        {
          "name": "TLS_CA",
          "description": "Local file path containing trusted client Certificate Authority"
        },
        {
          "name": "NODE_TLS_REJECT_UNAUTHORIZED",
          "description": "Set to '0' to allow connection to unverified TLS endpoints"
        },
        {
          "name": "REGISTRY_URL",
          "description": "Default container registry for workspace image resolution"
        },
        {
          "name": "TEMPLATES_DIR",
          "description": "Local filesystem directory containing custom YAML/JSON templates"
        },
        {
          "name": "BUILTIN_TEMPLATES",
          "description": "Enable loading of standard pre-configured templates (default: true)"
        },
        {
          "name": "AUTH_ENABLED",
          "description": "Enforce JWT verification and user tenant isolation (default: false)"
        },
        {
          "name": "JWT_VERIFICATION_REQUIRED",
          "description": "Set to 'false' to skip OIDC cryptographic signature checks"
        },
        {
          "name": "JWT_SECRET",
          "isSecret": true,
          "description": "HMAC-SHA symmetric secret key to sign/verify JWT tokens"
        },
        {
          "name": "JWT_PUBLIC_KEY",
          "isSecret": true,
          "description": "PEM public key to verify asymmetric OIDC signatures"
        },
        {
          "name": "JWKS_URI",
          "description": "Discovery URI to fetch keys from OIDC provider dynamically"
        },
        {
          "name": "INTROSPECTION_ENDPOINT",
          "description": "RFC 7662 compliant token introspection validation endpoint"
        },
        {
          "name": "OAUTH_CLIENT_ID",
          "description": "Client identifier for OAuth2 authentication flows"
        },
        {
          "name": "OAUTH_CLIENT_SECRET",
          "isSecret": true,
          "description": "Client secret credentials used for token introspection"
        },
        {
          "name": "JWT_AUDIENCE",
          "description": "Target audience check value for incoming OIDC tokens"
        },
        {
          "name": "AUTH_ISSUER",
          "description": "Expected token issuer authority check value (e.g. Keycloak)"
        },
        {
          "name": "AUTH_SUB_JSONPATH",
          "description": "JSONPath pattern to extract user identity subject from token"
        },
        {
          "name": "AUTH_ADMIN_ROLE",
          "description": "Bypass role name that grants admin access (default: nogoo9-admin)"
        },
        {
          "name": "AUTH_ADMIN_USERS",
          "description": "Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims"
        },
        {
          "name": "PROXY_SESSION_TTL",
          "description": "Active lifetime in seconds for signed proxy session cookies"
        },
        {
          "name": "PROXY_SESSION_SECRET",
          "isSecret": true,
          "description": "Secret key for session cookie signing"
        },
        {
          "name": "UI_ENABLED",
          "description": "Serve the built-in HTML dashboard (default: true)"
        },
        {
          "name": "THEMES_DIR",
          "description": "Filesystem directory to scan for custom CSS themes"
        },
        {
          "name": "THEMES_CONFIGMAP",
          "description": "ConfigMap name storing dynamic CSS theme overrides"
        },
        {
          "name": "DOCS_DIR",
          "description": "Directory containing static documentation web files to serve"
        },
        {
          "name": "OAUTH_DISCOVERY_URL",
          "description": "Standard OIDC .well-known configuration discovery endpoint"
        },
        {
          "name": "OAUTH_LOGIN_METHOD",
          "description": "UI SSO flow login method: 'redirect' or silent 'iframe'"
        },
        {
          "name": "UI_TITLE",
          "description": "Custom dashboard header title for white-label branding"
        },
        {
          "name": "UI_SUBTITLE",
          "description": "Custom dashboard subtitle text below the header title"
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/nogoo9/no-crd",
    "source": "github"
  },
  "description": "Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs"
}