no-crd MCP

{
  "version": "0.18.0",
  "transport": "stdio",
  "identifier": "@nogoo9/no-crd",
  "runtimeHint": "bunx",
  "registryType": "npm",
  "registryBaseUrl": "https://registry.npmjs.org",
  "runtimeArguments": [
    {
      "name": "--transport",
      "type": "named",
      "default": "stdio",
      "valueHint": "stdio|http|both",
      "description": "Transport channel for MCP client-server communication: stdio, http, both"
    },
    {
      "name": "--mode",
      "type": "named",
      "default": "cluster",
      "valueHint": "cluster|namespaced",
      "description": "Kubernetes cluster access scope: cluster-wide or namespace-restricted"
    },
    {
      "name": "--namespace",
      "type": "named",
      "default": "nogoo9",
      "valueHint": "nogoo9",
      "description": "Target namespace for workspace pods, services, and local templates"
    },
    {
      "name": "--port",
      "type": "named",
      "default": "3000",
      "valueHint": "3000",
      "description": "HTTP port for SSE transport, routing proxy, and dashboard UI"
    },
    {
      "name": "--host",
      "type": "named",
      "default": "0.0.0.0",
      "valueHint": "0.0.0.0",
      "description": "Network interface host address to bind the HTTP server to"
    },
    {
      "name": "--log-level",
      "type": "named",
      "default": "info",
      "valueHint": "debug|info|warning|error|fatal",
      "description": "Granularity of output logs: debug, info, warning, error, fatal"
    },
    {
      "name": "--disable-permission-checks",
      "type": "named",
      "description": "Bypass startup diagnostics checking Kubernetes RBAC access permissions"
    },
    {
      "name": "--cors-origin",
      "type": "named",
      "default": "*",
      "valueHint": "*",
      "description": "Allowed origins for HTTP CORS cross-site requests (default: *)"
    },
    {
      "name": "--cors-methods",
      "type": "named",
      "default": "GET, POST, OPTIONS",
      "valueHint": "GET, POST, OPTIONS",
      "description": "Allowed HTTP request methods for CORS configuration"
    },
    {
      "name": "--cors-headers",
      "type": "named",
      "default": "Content-Type, Authorization",
      "valueHint": "Content-Type, Authorization",
      "description": "Allowed HTTP header names for incoming CORS requests"
    },
    {
      "name": "--cors-allow-credentials",
      "type": "named",
      "description": "Allow credentials (cookies, headers) in cross-origin requests"
    },
    {
      "name": "--auth-required-read-scope",
      "type": "named",
      "valueHint": "mcp:read",
      "description": "Mandatory OAuth scope claim value to query or get workspaces"
    },
    {
      "name": "--auth-required-write-scope",
      "type": "named",
      "valueHint": "mcp:write",
      "description": "Mandatory OAuth scope claim value to spawn or stop workspaces"
    },
    {
      "name": "--auth-scope-jsonpath",
      "type": "named",
      "default": "$.scope",
      "valueHint": "$.scope",
      "description": "JSONPath pattern to extract scope permissions from the token payload"
    },
    {
      "name": "--auth-required-read-role",
      "type": "named",
      "valueHint": "reader",
      "description": "OAuth role required to view workspaces (e.g. reader)"
    },
    {
      "name": "--auth-required-write-role",
      "type": "named",
      "valueHint": "writer",
      "description": "OAuth role required to spawn or delete workspaces (e.g. writer)"
    },
    {
      "name": "--auth-roles-jsonpath",
      "type": "named",
      "default": "$.realm_access.roles",
      "valueHint": "$.realm_access.roles",
      "description": "JSONPath query to retrieve user roles list from token payload"
    }
  ],
  "environmentVariables": [
    {
      "name": "KUBECONFIG",
      "description": "Path to the Kubernetes API credentials configuration file"
    },
    {
      "name": "BASE_URL",
      "description": "Hosting URL subpath prefix for gateways and reverse proxies"
    },
    {
      "name": "STATELESS",
      "description": "Disable in-memory session tracking for stateless execution"
    },
    {
      "name": "TLS_CERT",
      "description": "Local file path containing TLS public certificate (HTTPS)"
    },
    {
      "name": "TLS_KEY",
      "description": "Local file path containing TLS private key (HTTPS)"
    },
    {
      "name": "TLS_CA",
      "description": "Local file path containing trusted client Certificate Authority"
    },
    {
      "name": "NODE_TLS_REJECT_UNAUTHORIZED",
      "description": "Set to '0' to allow connection to unverified TLS endpoints"
    },
    {
      "name": "REGISTRY_URL",
      "description": "Default container registry for workspace image resolution"
    },
    {
      "name": "TEMPLATES_DIR",
      "description": "Local filesystem directory containing custom YAML/JSON templates"
    },
    {
      "name": "BUILTIN_TEMPLATES",
      "description": "Enable loading of standard pre-configured templates (default: true)"
    },
    {
      "name": "AUTH_ENABLED",
      "description": "Enforce JWT verification and user tenant isolation (default: false)"
    },
    {
      "name": "JWT_VERIFICATION_REQUIRED",
      "description": "Set to 'false' to skip OIDC cryptographic signature checks"
    },
    {
      "name": "JWT_SECRET",
      "description": "HMAC-SHA symmetric secret key to sign/verify JWT tokens"
    },
    {
      "name": "JWT_PUBLIC_KEY",
      "description": "PEM public key to verify asymmetric OIDC signatures"
    },
    {
      "name": "JWKS_URI",
      "description": "Discovery URI to fetch keys from OIDC provider dynamically"
    },
    {
      "name": "INTROSPECTION_ENDPOINT",
      "description": "RFC 7662 compliant token introspection validation endpoint"
    },
    {
      "name": "OAUTH_CLIENT_ID",
      "description": "Client identifier for OAuth2 authentication flows"
    },
    {
      "name": "OAUTH_CLIENT_SECRET",
      "description": "Client secret credentials used for token introspection"
    },
    {
      "name": "JWT_AUDIENCE",
      "description": "Target audience check value for incoming OIDC tokens"
    },
    {
      "name": "AUTH_ISSUER",
      "description": "Expected token issuer authority check value (e.g. Keycloak)"
    },
    {
      "name": "AUTH_SUB_JSONPATH",
      "description": "JSONPath pattern to extract user identity subject from token"
    },
    {
      "name": "AUTH_ADMIN_ROLE",
      "description": "Bypass role name that grants admin access (default: nogoo9-admin)"
    },
    {
      "name": "AUTH_ADMIN_USERS",
      "description": "Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims"
    },
    {
      "name": "PROXY_SESSION_TTL",
      "description": "Active lifetime in seconds for signed proxy session cookies"
    },
    {
      "name": "PROXY_SESSION_SECRET",
      "description": "Secret key for session cookie signing"
    },
    {
      "name": "UI_ENABLED",
      "description": "Serve the built-in HTML dashboard (default: true)"
    },
    {
      "name": "THEMES_DIR",
      "description": "Filesystem directory to scan for custom CSS themes"
    },
    {
      "name": "THEMES_CONFIGMAP",
      "description": "ConfigMap name storing dynamic CSS theme overrides"
    },
    {
      "name": "DOCS_DIR",
      "description": "Directory containing static documentation web files to serve"
    },
    {
      "name": "OAUTH_DISCOVERY_URL",
      "description": "Standard OIDC .well-known configuration discovery endpoint"
    },
    {
      "name": "OAUTH_LOGIN_METHOD",
      "description": "UI SSO flow login method: 'redirect' or silent 'iframe'"
    },
    {
      "name": "UI_TITLE",
      "description": "Custom dashboard header title for white-label branding"
    },
    {
      "name": "UI_SUBTITLE",
      "description": "Custom dashboard subtitle text below the header title"
    }
  ]
}