io.github.nogoo9/no-crd

io.github.nogoo9/no-crd·v0.5.6·Kubernetes

Quality Score

/100

Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs

Repository →

§00 Trust verdict · v1 advisory · method

UNVERIFIEDno verdict on file

Verdict not yet evaluated for this tool. The hybrid eval runs adversarial cases first; coverage rolls out as the corpus expands. Until a verdict is recorded, an agent should treat this tool as not-yet-cleared and fall back to its own checks. Method: hybrid eval, four-state verdict, honest limits.

§01 Install

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "no-crd": {
      "command": "npx",
      "args": [
        "-y",
        "@nogoo9/no-crd"
      ],
      "env": {
        "KUBECONFIG": "<kubeconfig>",
        "BASE_URL": "<base_url>",
        "STATELESS": "<stateless>",
        "TLS_CERT": "<tls_cert>",
        "TLS_KEY": "<your-tls_key>",
        "TLS_CA": "<tls_ca>",
        "NODE_TLS_REJECT_UNAUTHORIZED": "<node_tls_reject_unauthorized>",
        "REGISTRY_URL": "<registry_url>",
        "TEMPLATES_DIR": "<templates_dir>",
        "BUILTIN_TEMPLATES": "<builtin_templates>",
        "AUTH_ENABLED": "<auth_enabled>",
        "JWT_VERIFICATION_REQUIRED": "<jwt_verification_required>",
        "JWT_SECRET": "<your-jwt_secret>",
        "JWT_PUBLIC_KEY": "<your-jwt_public_key>",
        "JWKS_URI": "<jwks_uri>",
        "INTROSPECTION_ENDPOINT": "<introspection_endpoint>",
        "OAUTH_CLIENT_ID": "<oauth_client_id>",
        "OAUTH_CLIENT_SECRET": "<your-oauth_client_secret>",
        "JWT_AUDIENCE": "<jwt_audience>",
        "AUTH_ISSUER": "<auth_issuer>",
        "AUTH_SUB_JSONPATH": "<auth_sub_jsonpath>",
        "AUTH_ADMIN_ROLE": "<auth_admin_role>",
        "PROXY_SESSION_TTL": "<proxy_session_ttl>",
        "PROXY_SESSION_SECRET": "<your-proxy_session_secret>",
        "UI_ENABLED": "<ui_enabled>",
        "THEMES_DIR": "<themes_dir>",
        "THEMES_CONFIGMAP": "<themes_configmap>",
        "DOCS_DIR": "<docs_dir>",
        "OAUTH_DISCOVERY_URL": "<oauth_discovery_url>",
        "OAUTH_LOGIN_METHOD": "<oauth_login_method>",
        "UI_TITLE": "<ui_title>",
        "UI_SUBTITLE": "<ui_subtitle>"
      }
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "no-crd": {
      "command": "npx",
      "args": [
        "-y",
        "@nogoo9/no-crd"
      ],
      "env": {
        "KUBECONFIG": "<kubeconfig>",
        "BASE_URL": "<base_url>",
        "STATELESS": "<stateless>",
        "TLS_CERT": "<tls_cert>",
        "TLS_KEY": "<your-tls_key>",
        "TLS_CA": "<tls_ca>",
        "NODE_TLS_REJECT_UNAUTHORIZED": "<node_tls_reject_unauthorized>",
        "REGISTRY_URL": "<registry_url>",
        "TEMPLATES_DIR": "<templates_dir>",
        "BUILTIN_TEMPLATES": "<builtin_templates>",
        "AUTH_ENABLED": "<auth_enabled>",
        "JWT_VERIFICATION_REQUIRED": "<jwt_verification_required>",
        "JWT_SECRET": "<your-jwt_secret>",
        "JWT_PUBLIC_KEY": "<your-jwt_public_key>",
        "JWKS_URI": "<jwks_uri>",
        "INTROSPECTION_ENDPOINT": "<introspection_endpoint>",
        "OAUTH_CLIENT_ID": "<oauth_client_id>",
        "OAUTH_CLIENT_SECRET": "<your-oauth_client_secret>",
        "JWT_AUDIENCE": "<jwt_audience>",
        "AUTH_ISSUER": "<auth_issuer>",
        "AUTH_SUB_JSONPATH": "<auth_sub_jsonpath>",
        "AUTH_ADMIN_ROLE": "<auth_admin_role>",
        "PROXY_SESSION_TTL": "<proxy_session_ttl>",
        "PROXY_SESSION_SECRET": "<your-proxy_session_secret>",
        "UI_ENABLED": "<ui_enabled>",
        "THEMES_DIR": "<themes_dir>",
        "THEMES_CONFIGMAP": "<themes_configmap>",
        "DOCS_DIR": "<docs_dir>",
        "OAUTH_DISCOVERY_URL": "<oauth_discovery_url>",
        "OAUTH_LOGIN_METHOD": "<oauth_login_method>",
        "UI_TITLE": "<ui_title>",
        "UI_SUBTITLE": "<ui_subtitle>"
      }
    }
  }
}

Cline (cline_mcp_settings.json)

npx -y @nogoo9/no-crd

§02 Environment variables

KUBECONFIG

Path to the Kubernetes API credentials configuration file

BASE_URL

Hosting URL subpath prefix for gateways and reverse proxies

STATELESS

Disable in-memory session tracking for stateless execution

TLS_CERT

Local file path containing TLS public certificate (HTTPS)

TLS_KEY

secret

Local file path containing TLS private key (HTTPS)

TLS_CA

Local file path containing trusted client Certificate Authority

NODE_TLS_REJECT_UNAUTHORIZED

Set to '0' to allow connection to unverified TLS endpoints

REGISTRY_URL

Default container registry for workspace image resolution

TEMPLATES_DIR

Local filesystem directory containing custom YAML/JSON templates

BUILTIN_TEMPLATES

Enable loading of standard pre-configured templates (default: true)

AUTH_ENABLED

Enforce JWT verification and user tenant isolation (default: false)

JWT_VERIFICATION_REQUIRED

Set to 'false' to skip OIDC cryptographic signature checks

JWT_SECRET

secret

HMAC-SHA symmetric secret key to sign/verify JWT tokens

JWT_PUBLIC_KEY

secret

PEM public key to verify asymmetric OIDC signatures

JWKS_URI

Discovery URI to fetch keys from OIDC provider dynamically

INTROSPECTION_ENDPOINT

RFC 7662 compliant token introspection validation endpoint

OAUTH_CLIENT_ID

Client identifier for OAuth2 authentication flows

OAUTH_CLIENT_SECRET

secret

Client secret credentials used for token introspection

JWT_AUDIENCE

Target audience check value for incoming OIDC tokens

AUTH_ISSUER

Expected token issuer authority check value (e.g. Keycloak)

AUTH_SUB_JSONPATH

JSONPath pattern to extract user identity subject from token

AUTH_ADMIN_ROLE

Bypass role name that grants admin access (default: nogoo9-admin)

PROXY_SESSION_TTL

Active lifetime in seconds for signed proxy session cookies

PROXY_SESSION_SECRET

secret

Secret key for session cookie signing

UI_ENABLED

Serve the built-in HTML dashboard (default: true)

THEMES_DIR

Filesystem directory to scan for custom CSS themes

THEMES_CONFIGMAP

ConfigMap name storing dynamic CSS theme overrides

DOCS_DIR

Directory containing static documentation web files to serve

OAUTH_DISCOVERY_URL

Standard OIDC .well-known configuration discovery endpoint

OAUTH_LOGIN_METHOD

UI SSO flow login method: 'redirect' or silent 'iframe'

UI_TITLE

Custom dashboard header title for white-label branding

UI_SUBTITLE

Custom dashboard subtitle text below the header title

§03 MCP Quality Score · methodology

freshness

completeness

installability

documentation

stability

§04 Alternatives in Kubernetes

Willform Agent

ai.willform/willform-agent

Deploy containers on Kubernetes with x402 billing. 9 workload types and source builds.

com.googleapis.container/mcp

Provides read access to your GKE and Kubernetes resources.

io.github.Argo-RPG-Platform/argo-mcp

MCP server for Argo RPG Platform — connects AI assistants to campaign data via OAuth2