74
/ 100
1 day ago
glama
no-crd
Enables AI agents to dynamically spawn, route to, and manage ephemeral containerized sandboxes on Kubernetes without requiring Custom Resource Definitions or cluster-level operators.
Is this your MCP?
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: JWT_SECRET, PROXY_SESSION_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
AUTH_ADMIN_JSONPATH— auth-roles-jsonpath AUTH_ROLES_JSONPATH, $.realm_access.roles JSONPath Payload path to extract user roles from JWT payload.config
AUTH_ADMIN_ROLE— admin String Role name signifying administrator access.config
AUTH_ADMIN_USERS— Comma-separated list of user subject IDs (sub) Comma-separated list of user subject IDs (sub) granted admin privileges without requiring OIDC scope/role claims (workaround fallback).config
AUTH_DEFAULT_ROLE— viewer String Fallback role if the token does not provide scopes/roles.config
AUTH_ENABLED— auth-enabled false true, false Enables JWT token authentication on MCP tools and route proxy.config
AUTH_INJECT_WORKSPACE_JWT— auth-inject-workspace-jwt true true, false Determines if the custom 'x-workspace-jwt' header containing the raw token is injected into proxy requests.config
AUTH_REQUIRED_ADMIN_SCOPE— auth-required-admin-scope nogoo9:admin String OAuth scope required for administrator operations. If not set, admin scope check is bypassed.config
AUTH_REQUIRED_READ_ROLE— auth-required-read-role viewer String User role required for read operations. If not set, read role check is bypassed.config
AUTH_REQUIRED_READ_SCOPE— auth-required-read-scope nogoo9:read String OAuth scope required for read operations. If not set, read scope check is bypassed.config
AUTH_REQUIRED_WRITE_ROLE— auth-required-write-role user String User role required for write/mutation operations. If not set, write role check is bypassed.config
AUTH_REQUIRED_WRITE_SCOPE— auth-required-write-scope nogoo9:write String OAuth scope required for write/mutation operations. If not set, write scope check is bypassed.config
AUTH_ROLES_JSONPATH— auth-roles-jsonpath , AUTH_ADMIN_JSONPATH $.realm_access.roles JSONPath Payload path to extract user roles from JWT payload.config
AUTH_SCOPE_JSONPATH— auth-scope-jsonpath $.scope JSONPath Payload path to extract scopes claim from JWT payload.config
AUTH_SUB_JSONPATH— $.sub JSONPath Payload path to extract unique user identity from JWT payload.config
BASE_URL— base-url "" Path string Base URL path prefix for hosting behind a reverse proxy (e.g. /gateway/no-crd).config
CORS_ALLOWED_HEADERS— cors-headers , CORS_HEADERS Content-Type, Authorization, mcp-protocol-version, mcp-session-id String CORS Allowed Headers header.config
CORS_ALLOWED_METHODS— cors-methods , CORS_METHODS GET, POST, OPTIONS String CORS Allowed Methods header.config
CORS_ALLOWED_ORIGIN— cors-origin , CORS_ORIGIN String CORS Allowed Origin header.config
CORS_ALLOW_CREDENTIALS— cors-allow-credentials , CORS_CREDENTIALS false true, false Enable CORS Access-Control-Allow-Credentials header.config
CORS_EXPOSED_HEADERS— cors-expose-headers , CORS_EXPOSED mcp-session-id, x-refreshed-token String Custom CORS Access-Control-Expose-Headers header.config
CORS_MAX_AGE— cors-max-age - Number Custom CORS Access-Control-Max-Age header in seconds.config
DISABLE_PERMISSION_CHECKS— disable-permission-checks false true, false Disable Kubernetes RBAC permission checks and assume all tools are enabled.config
DOCS_DIR— /app/docs (Docker) or docs/.vitepress/dist (Local) Path string Base directory from which static documentation files are served.config
HOST— H, --host 0.0.0.0 String Host interface to bind the HTTP/SSE server to.config
HOSTNAMEconfig
HTTPS_PROXYconfig
HTTP_PROXYconfig
INTROSPECTION_ENDPOINT— , JWT_INTROSPECTION_ENDPOINT - URL string Endpoint for token introspection/validation.config
JWKS_URI— URL string Remote JWKS endpoint URL to dynamically retrieve verification keys.config
JWT_AUDIENCE— String Expected token audience. Falls back to OAUTH_CLIENT_ID if set.🔐 secret
JWT_SECRET— String Symmetric HMAC-SHA256 secret for token verification.config
JWT_VERIFICATION_REQUIRED— true true, false Enable/disable JWT signature verification (signature checks).config
MANAGED_ONLYconfig
MCP_NO_DAEMONconfig
NAMESPACE— n, --namespace , DEFAULT_NAMESPACE nogoo9 String Default Kubernetes namespace for operations.config
OAUTH_CLIENT_ID— String OAuth client ID for auth configuration.config
OAUTH_DISCOVERY_URL— OAUTH_SERVER_DISCOVERY_URL, - URL string Discovery URL for the OAuth server used by the backend gateway. Falls back to OAUTH_DISCOVERY_URL.config
PEER_DISCOVERY_DELAY_MSconfig
PEER_DISCOVERY_RETRIESconfig
PROXY_KEEP_ALIVE— proxy-keep-alive true true, false Enable TCP keep-alive for the routing proxy upstream requests.🔐 secret
PROXY_SESSION_SECRET— "" String HMAC secret key used to sign stateless session cookies. Falls back to JWT_SECRET if not configured.config
RATE_LIMIT_MAX— 100 Number Maximum requests allowed per window for rate limited routes.config
RATE_LIMIT_WINDOW— 60000 Number Time window in milliseconds for rate limited routes.config
THEMES_CONFIGMAP— String Name of Kubernetes ConfigMap containing custom UI theme configurations.config
THEMES_DIR— themes Path string Local directory path containing custom CSS UI themes.config
http_proxyconfig
https_proxy// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/nogoo9-no-crd-11jx9x)commit: 0f3b6a82ec765ad47faafdbcf5a8139f2c900ff6
code hash: b3a41ebb3a58137dcb345db0de00462f83234cdb04ddd757168cecf36666754d
verified: 7/30/2026, 8:55:28 AM