GitHub
GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.
Description from the maker (original English)
Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs
These three are never merged into one score: opinions, measurements and popularity are different things.
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
Pick the AI app you use, then copy the settings.
KUBECONFIG, BASE_URL, STATELESS, TLS_CERT, TLS_KEY, TLS_CA, NODE_TLS_REJECT_UNAUTHORIZED, REGISTRY_URL, TEMPLATES_DIR, BUILTIN_TEMPLATES, AUTH_ENABLED, JWT_VERIFICATION_REQUIRED, JWT_SECRET, JWT_PUBLIC_KEY, JWKS_URI, INTROSPECTION_ENDPOINT, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, JWT_AUDIENCE, AUTH_ISSUER, AUTH_SUB_JSONPATH, AUTH_ADMIN_ROLE, AUTH_ADMIN_USERS, PROXY_SESSION_TTL, PROXY_SESSION_SECRET, UI_ENABLED, THEMES_DIR, THEMES_CONFIGMAP, DOCS_DIR, OAUTH_DISCOVERY_URL, OAUTH_LOGIN_METHOD, UI_TITLE, UI_SUBTITLEValues marked secret are keys to your account. Never share them or paste them into a chat.
You need
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"no-crd": {
"command": "npx",
"args": [
"-y",
"@nogoo9/no-crd"
],
"env": {
"KUBECONFIG": "your-value",
"BASE_URL": "your-value",
"STATELESS": "your-value",
"TLS_CERT": "your-value",
"TLS_KEY": "your-value",
"TLS_CA": "your-value",
"NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
"REGISTRY_URL": "your-value",
"TEMPLATES_DIR": "your-value",
"BUILTIN_TEMPLATES": "your-value",
"AUTH_ENABLED": "your-value",
"JWT_VERIFICATION_REQUIRED": "your-value",
"JWT_SECRET": "your-value",
"JWT_PUBLIC_KEY": "your-value",
"JWKS_URI": "your-value",
"INTROSPECTION_ENDPOINT": "your-value",
"OAUTH_CLIENT_ID": "your-value",
"OAUTH_CLIENT_SECRET": "your-value",
"JWT_AUDIENCE": "your-value",
"AUTH_ISSUER": "your-value",
"AUTH_SUB_JSONPATH": "your-value",
"AUTH_ADMIN_ROLE": "your-value",
"AUTH_ADMIN_USERS": "your-value",
"PROXY_SESSION_TTL": "your-value",
"PROXY_SESSION_SECRET": "your-value",
"UI_ENABLED": "your-value",
"THEMES_DIR": "your-value",
"THEMES_CONFIGMAP": "your-value",
"DOCS_DIR": "your-value",
"OAUTH_DISCOVERY_URL": "your-value",
"OAUTH_LOGIN_METHOD": "your-value",
"UI_TITLE": "your-value",
"UI_SUBTITLE": "your-value"
}
}
}
}Run this in your terminal
claude mcp add no-crd --env KUBECONFIG=your-value --env BASE_URL=your-value --env STATELESS=your-value --env TLS_CERT=your-value --env TLS_KEY=your-value --env TLS_CA=your-value --env NODE_TLS_REJECT_UNAUTHORIZED=your-value --env REGISTRY_URL=your-value --env TEMPLATES_DIR=your-value --env BUILTIN_TEMPLATES=your-value --env AUTH_ENABLED=your-value --env JWT_VERIFICATION_REQUIRED=your-value --env JWT_SECRET=your-value --env JWT_PUBLIC_KEY=your-value --env JWKS_URI=your-value --env INTROSPECTION_ENDPOINT=your-value --env OAUTH_CLIENT_ID=your-value --env OAUTH_CLIENT_SECRET=your-value --env JWT_AUDIENCE=your-value --env AUTH_ISSUER=your-value --env AUTH_SUB_JSONPATH=your-value --env AUTH_ADMIN_ROLE=your-value --env AUTH_ADMIN_USERS=your-value --env PROXY_SESSION_TTL=your-value --env PROXY_SESSION_SECRET=your-value --env UI_ENABLED=your-value --env THEMES_DIR=your-value --env THEMES_CONFIGMAP=your-value --env DOCS_DIR=your-value --env OAUTH_DISCOVERY_URL=your-value --env OAUTH_LOGIN_METHOD=your-value --env UI_TITLE=your-value --env UI_SUBTITLE=your-value -- npx -y @nogoo9/no-crdFill in the empty values before running it.
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"no-crd": {
"command": "npx",
"args": [
"-y",
"@nogoo9/no-crd"
],
"env": {
"KUBECONFIG": "your-value",
"BASE_URL": "your-value",
"STATELESS": "your-value",
"TLS_CERT": "your-value",
"TLS_KEY": "your-value",
"TLS_CA": "your-value",
"NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
"REGISTRY_URL": "your-value",
"TEMPLATES_DIR": "your-value",
"BUILTIN_TEMPLATES": "your-value",
"AUTH_ENABLED": "your-value",
"JWT_VERIFICATION_REQUIRED": "your-value",
"JWT_SECRET": "your-value",
"JWT_PUBLIC_KEY": "your-value",
"JWKS_URI": "your-value",
"INTROSPECTION_ENDPOINT": "your-value",
"OAUTH_CLIENT_ID": "your-value",
"OAUTH_CLIENT_SECRET": "your-value",
"JWT_AUDIENCE": "your-value",
"AUTH_ISSUER": "your-value",
"AUTH_SUB_JSONPATH": "your-value",
"AUTH_ADMIN_ROLE": "your-value",
"AUTH_ADMIN_USERS": "your-value",
"PROXY_SESSION_TTL": "your-value",
"PROXY_SESSION_SECRET": "your-value",
"UI_ENABLED": "your-value",
"THEMES_DIR": "your-value",
"THEMES_CONFIGMAP": "your-value",
"DOCS_DIR": "your-value",
"OAUTH_DISCOVERY_URL": "your-value",
"OAUTH_LOGIN_METHOD": "your-value",
"UI_TITLE": "your-value",
"UI_SUBTITLE": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Paste into .vscode/mcp.json in your project
{
"servers": {
"no-crd": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@nogoo9/no-crd"
],
"env": {
"KUBECONFIG": "your-value",
"BASE_URL": "your-value",
"STATELESS": "your-value",
"TLS_CERT": "your-value",
"TLS_KEY": "your-value",
"TLS_CA": "your-value",
"NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
"REGISTRY_URL": "your-value",
"TEMPLATES_DIR": "your-value",
"BUILTIN_TEMPLATES": "your-value",
"AUTH_ENABLED": "your-value",
"JWT_VERIFICATION_REQUIRED": "your-value",
"JWT_SECRET": "your-value",
"JWT_PUBLIC_KEY": "your-value",
"JWKS_URI": "your-value",
"INTROSPECTION_ENDPOINT": "your-value",
"OAUTH_CLIENT_ID": "your-value",
"OAUTH_CLIENT_SECRET": "your-value",
"JWT_AUDIENCE": "your-value",
"AUTH_ISSUER": "your-value",
"AUTH_SUB_JSONPATH": "your-value",
"AUTH_ADMIN_ROLE": "your-value",
"AUTH_ADMIN_USERS": "your-value",
"PROXY_SESSION_TTL": "your-value",
"PROXY_SESSION_SECRET": "your-value",
"UI_ENABLED": "your-value",
"THEMES_DIR": "your-value",
"THEMES_CONFIGMAP": "your-value",
"DOCS_DIR": "your-value",
"OAUTH_DISCOVERY_URL": "your-value",
"OAUTH_LOGIN_METHOD": "your-value",
"UI_TITLE": "your-value",
"UI_SUBTITLE": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
KUBECONFIG envBASE_URL envSTATELESS envTLS_CERT envTLS_CA envNODE_TLS_REJECT_UNAUTHORIZED envREGISTRY_URL envTEMPLATES_DIR envBUILTIN_TEMPLATES envAUTH_ENABLED envJWT_VERIFICATION_REQUIRED envJWKS_URI envINTROSPECTION_ENDPOINT envOAUTH_CLIENT_ID envJWT_AUDIENCE envAUTH_ISSUER envAUTH_SUB_JSONPATH envAUTH_ADMIN_ROLE envAUTH_ADMIN_USERS envPROXY_SESSION_TTL envUI_ENABLED envTHEMES_DIR envTHEMES_CONFIGMAP envDOCS_DIR envOAUTH_DISCOVERY_URL envOAUTH_LOGIN_METHOD envUI_TITLE envUI_SUBTITLE envThese settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
Runs on your computer; the tool list appears in your AI app after you install it.
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
The registry name was verified with the GitHub account nogoo9, which owns the repo
We have not read this repo from GitHub yet
We have not read this repo from GitHub yet
This one runs on your computer; there is no internet endpoint
Runs on your computer and uses local settings instead
Runs on your computer; we can only read tool lists from internet endpoints
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
You need to fill in: TLS_KEY, JWT_SECRET, JWT_PUBLIC_KEY, OAUTH_CLIENT_SECRET, PROXY_SESSION_SECRET
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
The GitHub repo last changed –, and the latest version (0.18.0) reached the registry 3 months ago.
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
In the same category: GitHub, Desktop Commander, Cloudflare MCP
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.
MCP server for terminal commands, file operations, and process management
Cloudflare MCP servers
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
Agent-Driven, On-Demand Pod Orchestration in Kubernetes — Without Custom Resource Definitions.
@nogoo9/no-crd is a lightweight, cross-runtime Model Context Protocol (MCP) server that empowers AI agents and APIs to dynamically spawn, route to, and manage ephemeral containerized sandboxes on standard Kubernetes (k8s/k3s) clusters — without requiring Custom Resource Definitions (CRDs), cluster-level operators, or elevated RBAC permissions.
It provides JupyterHub-like dynamic pod lifecycle management but is completely agnostic to actual workloads and supports multi-runtime execution under Bun, Deno, and Node.js.
📚 For detailed guides, API reference, and configuration options, visit the public [Documentation Website](https://nogoo9.github.io/no-crd/) or access the built-in documentation served directly at `/docs/` (e.g. `http://localhost:3000/docs/`) when running the server.
To get started with @nogoo9/no-crd, select the track that matches your goals:
no-crd to Cursor, Claude Desktop, Cline, or Roo Code to let your agent manage pods.nocr_token and nocr_sess), and automatic HMAC-signed session management for short-lived token resilience.# Option 1: Start HTTP/SSE server on port 3000
npx @nogoo9/no-crd --transport http --port 3000
npx @nogoo9/no-crd --transport stdio --mode cluster
npm install -g @nogoo9/no-crd
nocrd9 --transport stdio --mode cluster
docker run -d -p 3000:3000 \
-v "$HOME/.kube/config:/app/.kube/config:ro" \ -e KUBECONFIG=/app/.kube/config \ ghcr.io/nogoo9/no-crd:latest
The server and command-line utility are configurable using CLI options or environment variables. Below is the quick reference table of all settings:
| CLI Option | Environment Variable | Default | Allowed Values | Description |
|---|---|---|---|---|
-t, --transport | TRANSPORT | http | http, stdio, both | Server transport mode. both fires up both transports simultaneously. |
-p, --port | PORT | 3000 | Number | HTTP server port for SSE transport. |
-H, --host | HOST | 0.0.0.0 | String | Host interface to bind the HTTP/SSE server to. |
--base-url | BASE_URL | "" | Path string | Base URL path prefix for hosting behind a reverse proxy (e.g. /gateway/no-crd). |
| - | STATELESS | false | true, false | Enable stateless request handling (no session affinity). |
-l, --log-level | LOG_LEVEL | info | debug, info, warning, error, fatal | Logging verbosity filter. |
| - | LOG_FILE | nogoo9-mcp.log | String | Output file path for file logging. |
| - | RATE_LIMIT_MAX | 100 | Number | Maximum requests allowed per window for rate limited routes. |
| - | RATE_LIMIT_WINDOW | 60000 | Number | Time window in milliseconds for rate limited routes. |
--proxy-timeout | PROXY_TIMEOUT | 120000 | Number | Timeout in milliseconds for the routing proxy upstream requests. |
--proxy-keep-alive | PROXY_KEEP_ALIVE | true | true, false | Enable TCP keep-alive for the routing proxy upstream requests. |
| CLI Option | Environment Variable | Default | Allowed Values | Description |
|---|---|---|---|---|
--tls-cert | TLS_CERT | - | Path string | Path to TLS certificate file to enable HTTPS. |
--tls-key | TLS_KEY | - | Path string | Path to TLS private key file to enable HTTPS. |
--tls-ca | TLS_CA | - | Path string | Path to TLS CA certificate file for HTTPS client/verification. |
| - | NODE_TLS_REJECT_UNAUTHORIZED | true | 0 (false), 1 (true) | Set to 0 to bypass TLS verification (for development/testing only). |
| CLI Option | Environment Variable | Default | Allowed Values | Description |
|---|---|---|---|---|
--cors-origin | CORS_ALLOWED_ORIGIN, CORS_ORIGIN | * | String | CORS Allowed Origin header. |
--cors-methods | CORS_ALLOWED_METHODS, CORS_METHODS | GET, POST, OPTIONS | String | CORS Allowed Methods header. |
--cors-headers | CORS_ALLOWED_HEADERS, CORS_HEADERS | Content-Type, Authorization, mcp-protocol-version, mcp-session-id | String | CORS Allowed Headers header. |
--cors-allow-credentials | CORS_ALLOW_CREDENTIALS, CORS_CREDENTIALS | false | true, false | Enable CORS Access-Control-Allow-Credentials header. |
--cors-expose-headers | CORS_EXPOSED_HEADERS, CORS_EXPOSED | mcp-session-id, x-refreshed-token | String | Custom CORS Access-Control-Expose-Headers header. |
--cors-max-age | CORS_MAX_AGE | - | Number | Custom CORS Access-Control-Max-Age header in seconds. |
| CLI Option | Environment Variable | Default | Allowed Values | Description |
|---|---|---|---|---|
-m, --mode | MODE | cluster | cluster, namespaced | Kubernetes access scope. namespaced locks operations to a single namespace. |
-n, --namespace | NAMESPACE, DEFAULT_NAMESPACE | nogoo9 | String | Default Kubernetes namespace for operations. |
--disable-permission-checks | DISABLE_PERMISSION_CHECKS | false | true, false | Disable Kubernetes RBAC permission checks and assume all tools are enabled. |
--managed-only | MANAGED_ONLY | true | true, false | When true, pod tools only operate on pods managed by this server (nogoo9/managed-by label). No one bypasses this, not even admins. See ADR-008. |
--default-workspace-port | DEFAULT_WORKSPACE_PORT | - | Number | Default target port inside the workspace pods to proxy traffic to. |
| - | REGISTRY_URL | - | URL string | Target container registry URL to query for images (e.g. http://localhost:5001). |
| - | TEMPLATES_DIR | - | Path string | Path to local directory containing pod template files (YAML/JSON). See ADR-001. |
| - | BUILTIN_TEMPLATES | true | true, false | Set to false to disable built-in templates shipped with the package. |
| CLI Option | Environment Variable | Default | Allowed Values | Description |
|---|---|---|---|---|
--auth-enabled | AUTH_ENABLED | false | true, false | Enables JWT token authentication on MCP tools and route proxy. |
| - | JWT_VERIFICATION_REQUIRED | true | true, false | Enable/disable JWT signature verification (signature checks). |
| - | JWT_SECRET | - | String | Symmetric HMAC-SHA256 secret for token verification. |
| - | JWT_PUBLIC_KEY | - | String | PEM encoded RSA/ECDSA public key for asymmetric token verification. |
| - | JWKS_URI | - | URL string | Remote JWKS endpoint URL to dynamically retrieve verification keys. |
| - | INTROSPECTION_ENDPOINT, JWT_INTROSPECTION_ENDPOINT | - | URL string | Endpoint for token introspection/validation. |
| - | OAUTH_CLIENT_ID | - | String | OAuth client ID for auth configuration. |
| - | OAUTH_CLIENT_SECRET | - | String | OAuth client secret for auth configuration. |
| - | JWT_AUDIENCE | - | String | Expected token audience. Falls back to OAUTH_CLIENT_ID if set. |
| - | AUTH_ISSUER, JWT_ISSUER | "" | URL string | Identifier URL
Only the beginning is shown; read the rest in the repo