no-crd
by nogoo9
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Host interface to bind the HTTP/SSE server to. | 0.0.0.0 |
| MODE | No | Kubernetes access scope. Allowed values: cluster, namespaced. | cluster |
| PORT | No | HTTP server port for SSE transport. | 3000 |
| TLS_CA | No | Path to TLS CA certificate file for HTTPS client/verification. | |
| TLS_KEY | No | Path to TLS private key file to enable HTTPS. | |
| BASE_URL | No | Base URL path prefix for hosting behind a reverse proxy. | |
| DOCS_DIR | No | Base directory from which static documentation files are served. | |
| JWKS_URI | No | Remote JWKS endpoint URL to dynamically retrieve verification keys. | |
| LOG_FILE | No | Output file path for file logging. | nogoo9-mcp.log |
| TLS_CERT | No | Path to TLS certificate file to enable HTTPS. | |
| UI_TITLE | No | Custom title shown in the dashboard header. | nogoo9 Pod Manager |
| LOG_LEVEL | No | Logging verbosity filter. Allowed values: debug, info, warning, error, fatal. | info |
| NAMESPACE | No | Default Kubernetes namespace for operations. | nogoo9 |
| STATELESS | No | Enable stateless request handling. | false |
| TRANSPORT | No | Server transport mode. Allowed values: http, stdio, both. | http |
| JWT_SECRET | No | Symmetric HMAC-SHA256 secret for token verification. | |
| THEMES_DIR | No | Local directory path containing custom CSS UI themes. | themes |
| UI_ENABLED | No | Enables the embedded HTML Pod Manager UI resource. | true |
| AUTH_ISSUER | No | Identifier URL for the Authorization Server advertised in metadata discovery. | |
| UI_SUBTITLE | No | Custom subtitle shown below the dashboard title. | On-demand Kubernetes pod orchestration and agent-sandbox management without CRDs. |
| AUTH_ENABLED | No | Enables JWT token authentication on MCP tools and route proxy. | false |
| CORS_MAX_AGE | No | Custom CORS Access-Control-Max-Age header in seconds. | |
| JWT_AUDIENCE | No | Expected token audience. Falls back to OAUTH_CLIENT_ID if set. | |
| MANAGED_ONLY | No | When true, pod tools only operate on pods managed by this server. | true |
| OAUTH_SCOPES | No | OAuth scopes to request during authorization. | openid profile email offline_access |
| REGISTRY_URL | No | Target container registry URL to query for images. | |
| PROXY_TIMEOUT | No | Timeout in milliseconds for the routing proxy upstream requests. | 120000 |
| TEMPLATES_DIR | No | Path to local directory containing pod template files. | |
| JWT_PUBLIC_KEY | No | PEM encoded RSA/ECDSA public key for asymmetric token verification. | |
| RATE_LIMIT_MAX | No | Maximum requests allowed per window for rate limited routes. | 100 |
| AUTH_ADMIN_ROLE | No | Role name signifying administrator access. | admin |
| OAUTH_CLIENT_ID | No | OAuth client ID for auth configuration. | |
| OAUTH_TOKEN_URL | No | Direct OAuth token exchange endpoint for the backend server. | |
| AUTH_ADMIN_USERS | No | Comma-separated list of user subject IDs (sub) granted admin privileges. | |
| PROXY_KEEP_ALIVE | No | Enable TCP keep-alive for the routing proxy upstream requests. | true |
| THEMES_CONFIGMAP | No | Name of Kubernetes ConfigMap containing custom UI theme configurations. | |
| AUTH_DEFAULT_ROLE | No | Fallback role if the token does not provide scopes/roles. | viewer |
| AUTH_SUB_JSONPATH | No | Payload path to extract unique user identity from JWT payload. | $.sub |
| BUILTIN_TEMPLATES | No | Set to false to disable built-in templates shipped with the package. | true |
| PROXY_SESSION_TTL | No | Session cookie expiration lifetime in seconds. | 1800 |
| RATE_LIMIT_WINDOW | No | Time window in milliseconds for rate limited routes. | 60000 |
| AUTH_ROLES_JSONPATH | No | Payload path to extract user roles from JWT payload. | $.realm_access.roles |
| AUTH_SCOPE_JSONPATH | No | Payload path to extract scopes claim from JWT payload. | $.scope |
| CORS_ALLOWED_ORIGIN | No | CORS Allowed Origin header. | * |
| OAUTH_CLIENT_SECRET | No | OAuth client secret for auth configuration. | |
| OAUTH_DISCOVERY_URL | No | Discovery URL for the OAuth server used by the backend gateway. | |
| CORS_ALLOWED_HEADERS | No | CORS Allowed Headers header. | Content-Type, Authorization, mcp-protocol-version, mcp-session-id |
| CORS_ALLOWED_METHODS | No | CORS Allowed Methods header. | GET, POST, OPTIONS |
| CORS_EXPOSED_HEADERS | No | Custom CORS Access-Control-Expose-Headers header. | mcp-session-id, x-refreshed-token |
| PROXY_SESSION_SECRET | No | HMAC secret key used to sign stateless session cookies. Falls back to JWT_SECRET. | |
| OAUTH_END_SESSION_URL | No | Direct OAuth logout endpoint. | |
| CORS_ALLOW_CREDENTIALS | No | Enable CORS Access-Control-Allow-Credentials header. | false |
| DEFAULT_WORKSPACE_PORT | No | Default target port inside the workspace pods to proxy traffic to. | |
| INTROSPECTION_ENDPOINT | No | Endpoint for token introspection/validation. | |
| PROXY_TOKEN_COOKIE_TTL | No | Default Max-Age for the access token cookie. | 86400 |
| AUTH_REQUIRED_READ_ROLE | No | User role required for read operations. | viewer |
| OAUTH_AUTHORIZATION_URL | No | Direct OAuth authorization URL. | |
| AUTH_REQUIRED_READ_SCOPE | No | OAuth scope required for read operations. | nogoo9:read |
| AUTH_REQUIRED_WRITE_ROLE | No | User role required for write/mutation operations. | user |
| PROXY_REFRESH_COOKIE_TTL | No | Default Max-Age for the encrypted refresh token cookie. | 604800 |
| AUTH_INJECT_WORKSPACE_JWT | No | Determines if the custom 'x-workspace-jwt' header is injected into proxy requests. | true |
| AUTH_REQUIRED_ADMIN_SCOPE | No | OAuth scope required for administrator operations. | nogoo9:admin |
| AUTH_REQUIRED_WRITE_SCOPE | No | OAuth scope required for write/mutation operations. | nogoo9:write |
| DISABLE_PERMISSION_CHECKS | No | Disable Kubernetes RBAC permission checks and assume all tools are enabled. | false |
| JWT_VERIFICATION_REQUIRED | No | Enable/disable JWT signature verification. | true |
| NODE_TLS_REJECT_UNAUTHORIZED | No | Set to 0 to bypass TLS verification (for development/testing only). | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/nogoo9/no-crd'
If you have feedback or need assistance with the MCP directory API, please join our Discord server