no-crd
by nogoo9
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Host interface to bind the HTTP/SSE server to. | 0.0.0.0 |
| MODE | No | Kubernetes access scope. Allowed values: cluster, namespaced. | cluster |
| PORT | No | HTTP server port for SSE transport. | 3000 |
| TLS_CA | No | Path to TLS CA certificate file for HTTPS client/verification. | |
| TLS_KEY | No | Path to TLS private key file to enable HTTPS. | |
| BASE_URL | No | Base URL path prefix for hosting behind a reverse proxy. | |
| DOCS_DIR | No | Base directory from which static documentation files are served. | |
| JWKS_URI | No | Remote JWKS endpoint URL to dynamically retrieve verification keys. | |
| LOG_FILE | No | Output file path for file logging. | nogoo9-mcp.log |
| TLS_CERT | No | Path to TLS certificate file to enable HTTPS. | |
| UI_TITLE | No | Custom title shown in the dashboard header. | nogoo9 Pod Manager |
| LOG_LEVEL | No | Logging verbosity filter. Allowed values: debug, info, warning, error, fatal. | info |
| NAMESPACE | No | Default Kubernetes namespace for operations. | nogoo9 |
| STATELESS | No | Enable stateless request handling. | false |
| TRANSPORT | No | Server transport mode. Allowed values: http, stdio, both. | http |
| JWT_SECRET | No | Symmetric HMAC-SHA256 secret for token verification. | |
| THEMES_DIR | No | Local directory path containing custom CSS UI themes. | themes |
| UI_ENABLED | No | Enables the embedded HTML Pod Manager UI resource. | true |
| AUTH_ISSUER | No | Identifier URL for the Authorization Server advertised in metadata discovery. | |
| UI_SUBTITLE | No | Custom subtitle shown below the dashboard title. | On-demand Kubernetes pod orchestration and agent-sandbox management without CRDs. |
| AUTH_ENABLED | No | Enables JWT token authentication on MCP tools and route proxy. | false |
| CORS_MAX_AGE | No | Custom CORS Access-Control-Max-Age header in seconds. | |
| JWT_AUDIENCE | No | Expected token audience. Falls back to OAUTH_CLIENT_ID if set. | |
| MANAGED_ONLY | No | When true, pod tools only operate on pods managed by this server. | true |
| OAUTH_SCOPES | No | OAuth scopes to request during authorization. | openid profile email offline_access |
| REGISTRY_URL | No | Target container registry URL to query for images. | |
| PROXY_TIMEOUT | No | Timeout in milliseconds for the routing proxy upstream requests. | 120000 |
| TEMPLATES_DIR | No | Path to local directory containing pod template files. | |
| JWT_PUBLIC_KEY | No | PEM encoded RSA/ECDSA public key for asymmetric token verification. | |
| RATE_LIMIT_MAX | No | Maximum requests allowed per window for rate limited routes. | 100 |
| AUTH_ADMIN_ROLE | No | Role name signifying administrator access. | admin |
| OAUTH_CLIENT_ID | No | OAuth client ID for auth configuration. | |
| OAUTH_TOKEN_URL | No | Direct OAuth token exchange endpoint for the backend server. | |
| AUTH_ADMIN_USERS | No | Comma-separated list of user subject IDs (sub) granted admin privileges. | |
| PROXY_KEEP_ALIVE | No | Enable TCP keep-alive for the routing proxy upstream requests. | true |
| THEMES_CONFIGMAP | No | Name of Kubernetes ConfigMap containing custom UI theme configurations. | |
| AUTH_DEFAULT_ROLE | No | Fallback role if the token does not provide scopes/roles. | viewer |
| AUTH_SUB_JSONPATH | No | Payload path to extract unique user identity from JWT payload. | $.sub |
| BUILTIN_TEMPLATES | No | Set to false to disable built-in templates shipped with the package. | true |
| PROXY_SESSION_TTL | No | Session cookie expiration lifetime in seconds. | 1800 |
| RATE_LIMIT_WINDOW | No | Time window in milliseconds for rate limited routes. | 60000 |
| AUTH_ROLES_JSONPATH | No | Payload path to extract user roles from JWT payload. | $.realm_access.roles |
| AUTH_SCOPE_JSONPATH | No | Payload path to extract scopes claim from JWT payload. | $.scope |
| CORS_ALLOWED_ORIGIN | No | CORS Allowed Origin header. | * |
| OAUTH_CLIENT_SECRET | No | OAuth client secret for auth configuration. | |
| OAUTH_DISCOVERY_URL | No | Discovery URL for the OAuth server used by the backend gateway. | |
| CORS_ALLOWED_HEADERS | No | CORS Allowed Headers header. | Content-Type, Authorization, mcp-protocol-version, mcp-session-id |
| CORS_ALLOWED_METHODS | No | CORS Allowed Methods header. | GET, POST, OPTIONS |
| CORS_EXPOSED_HEADERS | No | Custom CORS Access-Control-Expose-Headers header. | mcp-session-id, x-refreshed-token |
| PROXY_SESSION_SECRET | No | HMAC secret key used to sign stateless session cookies. Falls back to JWT_SECRET. | |
| OAUTH_END_SESSION_URL | No | Direct OAuth logout endpoint. | |
| CORS_ALLOW_CREDENTIALS | No | Enable CORS Access-Control-Allow-Credentials header. | false |
| DEFAULT_WORKSPACE_PORT | No | Default target port inside the workspace pods to proxy traffic to. | |
| INTROSPECTION_ENDPOINT | No | Endpoint for token introspection/validation. | |
| PROXY_TOKEN_COOKIE_TTL | No | Default Max-Age for the access token cookie. | 86400 |
| AUTH_REQUIRED_READ_ROLE | No | User role required for read operations. | viewer |
| OAUTH_AUTHORIZATION_URL | No | Direct OAuth authorization URL. | |
| AUTH_REQUIRED_READ_SCOPE | No | OAuth scope required for read operations. | nogoo9:read |
| AUTH_REQUIRED_WRITE_ROLE | No | User role required for write/mutation operations. | user |
| PROXY_REFRESH_COOKIE_TTL | No | Default Max-Age for the encrypted refresh token cookie. | 604800 |
| AUTH_INJECT_WORKSPACE_JWT | No | Determines if the custom 'x-workspace-jwt' header is injected into proxy requests. | true |
| AUTH_REQUIRED_ADMIN_SCOPE | No | OAuth scope required for administrator operations. | nogoo9:admin |
| AUTH_REQUIRED_WRITE_SCOPE | No | OAuth scope required for write/mutation operations. | nogoo9:write |
| DISABLE_PERMISSION_CHECKS | No | Disable Kubernetes RBAC permission checks and assume all tools are enabled. | false |
| JWT_VERIFICATION_REQUIRED | No | Enable/disable JWT signature verification. | true |
| NODE_TLS_REJECT_UNAUTHORIZED | No | Set to 0 to bypass TLS verification (for development/testing only). | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivitySlowing
ResponsivenessUnresponsive