No Crd runs on your own machine — the client starts it, so there is no endpoint to ping. 95 installs a week from npm. Last commit 12 Aug 2026.
Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs
We read the source, 20 h ago · rules 3dff92dd89df
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
customStyleTag.innerHTML = css;
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add no-crd -- npx -y @nogoo9/no-crd
{
"mcpServers": {
"no-crd": {
"args": [
"-y",
"@nogoo9/no-crd"
],
"command": "npx"
}
}
}
[mcp_servers.no-crd]
command = "npx"
args = ["-y", "@nogoo9/no-crd"]
{
"mcpServers": {
"no-crd": {
"args": [
"-y",
"@nogoo9/no-crd"
],
"command": "npx"
}
}
}
{
"mcpServers": {
"no-crd": {
"args": [
"-y",
"@nogoo9/no-crd"
],
"command": "npx"
}
}
}
This one needs environment variables set before it will start:
KUBECONFIG (Path to the Kubernetes API credentials configuration file), BASE_URL (Hosting URL subpath prefix for gateways and reverse proxies), STATELESS (Disable in-memory session tracking for stateless execution), TLS_CERT (Local file path containing TLS public certificate (HTTPS)), TLS_KEY (Local file path containing TLS private key (HTTPS)), TLS_CA (Local file path containing trusted client Certificate Authority), NODE_TLS_REJECT_UNAUTHORIZED (Set to '0' to allow connection to unverified TLS endpoints), REGISTRY_URL (Default container registry for workspace image resolution), TEMPLATES_DIR (Local filesystem directory containing custom YAML/JSON templates), BUILTIN_TEMPLATES (Enable loading of standard pre-configured templates (default: true)), AUTH_ENABLED (Enforce JWT verification and user tenant isolation (default: false)), JWT_VERIFICATION_REQUIRED (Set to 'false' to skip OIDC cryptographic signature checks), JWT_SECRET (HMAC-SHA symmetric secret key to sign/verify JWT tokens), JWT_PUBLIC_KEY (PEM public key to verify asymmetric OIDC signatures), JWKS_URI (Discovery URI to fetch keys from OIDC provider dynamically), INTROSPECTION_ENDPOINT (RFC 7662 compliant token introspection validation endpoint), OAUTH_CLIENT_ID (Client identifier for OAuth2 authentication flows), OAUTH_CLIENT_SECRET (Client secret credentials used for token introspection), JWT_AUDIENCE (Target audience check value for incoming OIDC tokens), AUTH_ISSUER (Expected token issuer authority check value (e.g. Keycloak)), AUTH_SUB_JSONPATH (JSONPath pattern to extract user identity subject from token), AUTH_ADMIN_ROLE (Bypass role name that grants admin access (default: nogoo9-admin)), AUTH_ADMIN_USERS (Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims), PROXY_SESSION_TTL (Active lifetime in seconds for signed proxy session cookies), PROXY_SESSION_SECRET (Secret key for session cookie signing), UI_ENABLED (Serve the built-in HTML dashboard (default: true)), THEMES_DIR (Filesystem directory to scan for custom CSS themes), THEMES_CONFIGMAP (ConfigMap name storing dynamic CSS theme overrides), DOCS_DIR (Directory containing static documentation web files to serve), OAUTH_DISCOVERY_URL (Standard OIDC .well-known configuration discovery endpoint), OAUTH_LOGIN_METHOD (UI SSO flow login method: 'redirect' or silent 'iframe'), UI_TITLE (Custom dashboard header title for white-label branding), UI_SUBTITLE (Custom dashboard subtitle text below the header title).
The author declared them in the registry entry; get the values from the project itself.
Guardrailed fleet ops for AI agents: multi-cluster Kubernetes via OCM with policy, approval, audit.
Guardrailed fleet ops for AI agents: multi-cluster Kubernetes via OCM with policy, approval, audit.
SDK for creating, managing, and operating Kubernetes clusters and workloads with ease.
Safe Kubernetes access for AI agents via MCP. Read-only by default, with explicit permission modes.
Kubernetes MCP server with RBAC-style, context-scoped guardrails for AI agents.
SSH & Kubernetes access broker for AI agents; the model never touches a credential.
TypeScript MCP server for AI-powered containerization workflows with Docker and Kubernetes support
Kubernetes monitoring & ops for AI agents — safe-by-default access modes and guards.
Answers built from our own checks of this server.