No Crd

Name: No Crd
Author: nogoo9

作者：nogoo9版本 0.18.0i★ –i在你的电脑上运行

注册名称io.github.nogoo9/no-crd

安装

概览

作者提供的说明（英文原文）

Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i尚未统计★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 开发者工具
你需要填写：TLS_KEY, JWT_SECRET, JWT_PUBLIC_KEY, OAUTH_CLIENT_SECRET, PROXY_SESSION_SECRET

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： KUBECONFIG, BASE_URL, STATELESS, TLS_CERT, TLS_KEY, TLS_CA, NODE_TLS_REJECT_UNAUTHORIZED, REGISTRY_URL, TEMPLATES_DIR, BUILTIN_TEMPLATES, AUTH_ENABLED, JWT_VERIFICATION_REQUIRED, JWT_SECRET, JWT_PUBLIC_KEY, JWKS_URI, INTROSPECTION_ENDPOINT, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, JWT_AUDIENCE, AUTH_ISSUER, AUTH_SUB_JSONPATH, AUTH_ADMIN_ROLE, AUTH_ADMIN_USERS, PROXY_SESSION_TTL, PROXY_SESSION_SECRET, UI_ENABLED, THEMES_DIR, THEMES_CONFIGMAP, DOCS_DIR, OAUTH_DISCOVERY_URL, OAUTH_LOGIN_METHOD, UI_TITLE, UI_SUBTITLE

标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。

你需要

npm已安装 Node.js（用于 npx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "no-crd": {
      "command": "npx",
      "args": [
        "-y",
        "@nogoo9/no-crd"
      ],
      "env": {
        "KUBECONFIG": "your-value",
        "BASE_URL": "your-value",
        "STATELESS": "your-value",
        "TLS_CERT": "your-value",
        "TLS_KEY": "your-value",
        "TLS_CA": "your-value",
        "NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
        "REGISTRY_URL": "your-value",
        "TEMPLATES_DIR": "your-value",
        "BUILTIN_TEMPLATES": "your-value",
        "AUTH_ENABLED": "your-value",
        "JWT_VERIFICATION_REQUIRED": "your-value",
        "JWT_SECRET": "your-value",
        "JWT_PUBLIC_KEY": "your-value",
        "JWKS_URI": "your-value",
        "INTROSPECTION_ENDPOINT": "your-value",
        "OAUTH_CLIENT_ID": "your-value",
        "OAUTH_CLIENT_SECRET": "your-value",
        "JWT_AUDIENCE": "your-value",
        "AUTH_ISSUER": "your-value",
        "AUTH_SUB_JSONPATH": "your-value",
        "AUTH_ADMIN_ROLE": "your-value",
        "AUTH_ADMIN_USERS": "your-value",
        "PROXY_SESSION_TTL": "your-value",
        "PROXY_SESSION_SECRET": "your-value",
        "UI_ENABLED": "your-value",
        "THEMES_DIR": "your-value",
        "THEMES_CONFIGMAP": "your-value",
        "DOCS_DIR": "your-value",
        "OAUTH_DISCOVERY_URL": "your-value",
        "OAUTH_LOGIN_METHOD": "your-value",
        "UI_TITLE": "your-value",
        "UI_SUBTITLE": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add no-crd --env KUBECONFIG=your-value --env BASE_URL=your-value --env STATELESS=your-value --env TLS_CERT=your-value --env TLS_KEY=your-value --env TLS_CA=your-value --env NODE_TLS_REJECT_UNAUTHORIZED=your-value --env REGISTRY_URL=your-value --env TEMPLATES_DIR=your-value --env BUILTIN_TEMPLATES=your-value --env AUTH_ENABLED=your-value --env JWT_VERIFICATION_REQUIRED=your-value --env JWT_SECRET=your-value --env JWT_PUBLIC_KEY=your-value --env JWKS_URI=your-value --env INTROSPECTION_ENDPOINT=your-value --env OAUTH_CLIENT_ID=your-value --env OAUTH_CLIENT_SECRET=your-value --env JWT_AUDIENCE=your-value --env AUTH_ISSUER=your-value --env AUTH_SUB_JSONPATH=your-value --env AUTH_ADMIN_ROLE=your-value --env AUTH_ADMIN_USERS=your-value --env PROXY_SESSION_TTL=your-value --env PROXY_SESSION_SECRET=your-value --env UI_ENABLED=your-value --env THEMES_DIR=your-value --env THEMES_CONFIGMAP=your-value --env DOCS_DIR=your-value --env OAUTH_DISCOVERY_URL=your-value --env OAUTH_LOGIN_METHOD=your-value --env UI_TITLE=your-value --env UI_SUBTITLE=your-value -- npx -y @nogoo9/no-crd

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "no-crd": {
      "command": "npx",
      "args": [
        "-y",
        "@nogoo9/no-crd"
      ],
      "env": {
        "KUBECONFIG": "your-value",
        "BASE_URL": "your-value",
        "STATELESS": "your-value",
        "TLS_CERT": "your-value",
        "TLS_KEY": "your-value",
        "TLS_CA": "your-value",
        "NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
        "REGISTRY_URL": "your-value",
        "TEMPLATES_DIR": "your-value",
        "BUILTIN_TEMPLATES": "your-value",
        "AUTH_ENABLED": "your-value",
        "JWT_VERIFICATION_REQUIRED": "your-value",
        "JWT_SECRET": "your-value",
        "JWT_PUBLIC_KEY": "your-value",
        "JWKS_URI": "your-value",
        "INTROSPECTION_ENDPOINT": "your-value",
        "OAUTH_CLIENT_ID": "your-value",
        "OAUTH_CLIENT_SECRET": "your-value",
        "JWT_AUDIENCE": "your-value",
        "AUTH_ISSUER": "your-value",
        "AUTH_SUB_JSONPATH": "your-value",
        "AUTH_ADMIN_ROLE": "your-value",
        "AUTH_ADMIN_USERS": "your-value",
        "PROXY_SESSION_TTL": "your-value",
        "PROXY_SESSION_SECRET": "your-value",
        "UI_ENABLED": "your-value",
        "THEMES_DIR": "your-value",
        "THEMES_CONFIGMAP": "your-value",
        "DOCS_DIR": "your-value",
        "OAUTH_DISCOVERY_URL": "your-value",
        "OAUTH_LOGIN_METHOD": "your-value",
        "UI_TITLE": "your-value",
        "UI_SUBTITLE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "no-crd": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@nogoo9/no-crd"
      ],
      "env": {
        "KUBECONFIG": "your-value",
        "BASE_URL": "your-value",
        "STATELESS": "your-value",
        "TLS_CERT": "your-value",
        "TLS_KEY": "your-value",
        "TLS_CA": "your-value",
        "NODE_TLS_REJECT_UNAUTHORIZED": "your-value",
        "REGISTRY_URL": "your-value",
        "TEMPLATES_DIR": "your-value",
        "BUILTIN_TEMPLATES": "your-value",
        "AUTH_ENABLED": "your-value",
        "JWT_VERIFICATION_REQUIRED": "your-value",
        "JWT_SECRET": "your-value",
        "JWT_PUBLIC_KEY": "your-value",
        "JWKS_URI": "your-value",
        "INTROSPECTION_ENDPOINT": "your-value",
        "OAUTH_CLIENT_ID": "your-value",
        "OAUTH_CLIENT_SECRET": "your-value",
        "JWT_AUDIENCE": "your-value",
        "AUTH_ISSUER": "your-value",
        "AUTH_SUB_JSONPATH": "your-value",
        "AUTH_ADMIN_ROLE": "your-value",
        "AUTH_ADMIN_USERS": "your-value",
        "PROXY_SESSION_TTL": "your-value",
        "PROXY_SESSION_SECRET": "your-value",
        "UI_ENABLED": "your-value",
        "THEMES_DIR": "your-value",
        "THEMES_CONFIGMAP": "your-value",
        "DOCS_DIR": "your-value",
        "OAUTH_DISCOVERY_URL": "your-value",
        "OAUTH_LOGIN_METHOD": "your-value",
        "UI_TITLE": "your-value",
        "UI_SUBTITLE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

KUBECONFIG env
Path to the Kubernetes API credentials configuration file
BASE_URL env
Hosting URL subpath prefix for gateways and reverse proxies
STATELESS env
Disable in-memory session tracking for stateless execution
TLS_CERT env
Local file path containing TLS public certificate (HTTPS)
TLS_KEY 机密 env
Local file path containing TLS private key (HTTPS)
TLS_CA env
Local file path containing trusted client Certificate Authority
NODE_TLS_REJECT_UNAUTHORIZED env
Set to '0' to allow connection to unverified TLS endpoints
REGISTRY_URL env
Default container registry for workspace image resolution
TEMPLATES_DIR env
Local filesystem directory containing custom YAML/JSON templates
BUILTIN_TEMPLATES env
Enable loading of standard pre-configured templates (default: true)
AUTH_ENABLED env
Enforce JWT verification and user tenant isolation (default: false)
JWT_VERIFICATION_REQUIRED env
Set to 'false' to skip OIDC cryptographic signature checks
JWT_SECRET 机密 env
HMAC-SHA symmetric secret key to sign/verify JWT tokens
JWT_PUBLIC_KEY 机密 env
PEM public key to verify asymmetric OIDC signatures
JWKS_URI env
Discovery URI to fetch keys from OIDC provider dynamically
INTROSPECTION_ENDPOINT env
RFC 7662 compliant token introspection validation endpoint
OAUTH_CLIENT_ID env
Client identifier for OAuth2 authentication flows
OAUTH_CLIENT_SECRET 机密 env
Client secret credentials used for token introspection
JWT_AUDIENCE env
Target audience check value for incoming OIDC tokens
AUTH_ISSUER env
Expected token issuer authority check value (e.g. Keycloak)
AUTH_SUB_JSONPATH env
JSONPath pattern to extract user identity subject from token
AUTH_ADMIN_ROLE env
Bypass role name that grants admin access (default: nogoo9-admin)
AUTH_ADMIN_USERS env
Comma-separated list of user subject IDs (sub) granted admin privileges without OIDC scope/role claims
PROXY_SESSION_TTL env
Active lifetime in seconds for signed proxy session cookies
PROXY_SESSION_SECRET 机密 env
Secret key for session cookie signing
UI_ENABLED env
Serve the built-in HTML dashboard (default: true)
THEMES_DIR env
Filesystem directory to scan for custom CSS themes
THEMES_CONFIGMAP env
ConfigMap name storing dynamic CSS theme overrides
DOCS_DIR env
Directory containing static documentation web files to serve
OAUTH_DISCOVERY_URL env
Standard OIDC .well-known configuration discovery endpoint
OAUTH_LOGIN_METHOD env
UI SSO flow login method: 'redirect' or silent 'iframe'
UI_TITLE env
Custom dashboard header title for white-label branding
UI_SUBTITLE env
Custom dashboard subtitle text below the header title

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 nogoo9 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“开发者工具”中的其他服务器比较i

星标数多于此分类中其他 1396 个服务器的 0%
发布到注册中心的时间比此分类中其他 1396 个服务器的 41% 更新
基础检查结果等于或优于此分类中其他 1396 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

No Crd 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：TLS_KEY, JWT_SECRET, JWT_PUBLIC_KEY, OAUTH_CLIENT_SECRET, PROXY_SESSION_SECRET

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.18.0）于3个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。

有什么可以替代它？

同一分类中有：GitHub, Desktop Commander, Cloudflare MCP

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

GitHub

作者：github

Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.

电脑或云端★ 34,245MIT4天前更新

安装

Desktop Commander

作者：wonderwhy-er

MCP server for terminal commands, file operations, and process management

在你的电脑上运行★ 10,225MIT16天前更新

安装

Cloudflare MCP

作者：cloudflare

Cloudflare MCP servers

在云端运行★ 4,446Apache-2.014个月前更新

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

@nogoo9/no-crd

Agent-Driven, On-Demand Pod Orchestration in Kubernetes — Without Custom Resource Definitions.

@nogoo9/no-crd is a lightweight, cross-runtime Model Context Protocol (MCP) server that empowers AI agents and APIs to dynamically spawn, route to, and manage ephemeral containerized sandboxes on standard Kubernetes (k8s/k3s) clusters — without requiring Custom Resource Definitions (CRDs), cluster-level operators, or elevated RBAC permissions.

It provides JupyterHub-like dynamic pod lifecycle management but is completely agnostic to actual workloads and supports multi-runtime execution under Bun, Deno, and Node.js.

📚 For detailed guides, API reference, and configuration options, visit the public [Documentation Website](https://nogoo9.github.io/no-crd/) or access the built-in documentation served directly at `/docs/` (e.g. `http://localhost:3000/docs/`) when running the server.

🗺️ Choose Your Path

To get started with @nogoo9/no-crd, select the track that matches your goals:

Track A: AI Agent & MCP Users $\rightarrow$ MCP Client Setup Guide
*Best for:* Connecting no-crd to Cursor, Claude Desktop, Cline, or Roo Code to let your agent manage pods.
Track B: Platform & Service Deployers $\rightarrow$ SSO & Routing Deployment Guide
*Best for:* Deploying a multi-tenant sandbox service in your Kubernetes cluster with Keycloak OIDC, stateless cookies, and reverse proxy routing.
Track C: SDK & Code Contributors $\rightarrow$ SDK & Contributor Guide
*Best for:* Programmatically controlling pods via the TypeScript SDK or contributing to the core runtime codebase.

🚀 Key Features

No CRDs Required: Runs directly against core Kubernetes resources (Pods, ConfigMaps, ServiceAccounts). Highly portable, secure, and compatible with restricted/managed environments (EKS, GKE, K3s).
Agent Sandbox Spawner: Specialized spawner tools that automate workspace provisioning with context validation, init containers, IAM roles, pre-stop hooks, and lifecycle sync.
ConfigMap-Based Templates: Store, version, and load reusable pod templates stored as standard Kubernetes ConfigMaps.
Local Filesystem Templates: Bake YAML/JSON pod templates into Docker images or mount them from host paths — with built-in defaults shipped in the package.
Isomorphic Multi-Runtime SDK: Imports seamlessly as a composable programmatic SDK or MCP server running under Node.js, Bun, or Deno.
Workspace Routing Proxy (Experimental): Built-in reverse proxy routing that dynamically pipes traffic to running container IPs with secure user token ownership verification, path-scoped session cookies (nocr_token and nocr_sess), and automatic HMAC-signed session management for short-lived token resilience.
Experimental JWT Authentication: Built-in OAuth token validation engine supporting HS256, RS256, ES256, JWKS endpoints, and OAuth 2.0 Token Introspection (RFC 7662).
Embedded Web UI App: Exposes an interactive web-based Pod Manager interface featuring a light/dark theme toggle, client-side PKCE OIDC login with proactive silent token refresh, and workspace file preview rendering (supporting HTML sandboxed iframes and custom Markdown rendering).

⚡ Quick Start

Run Standalone via NPX (No Installation)

# Option 1: Start HTTP/SSE server on port 3000

npx @nogoo9/no-crd --transport http --port 3000

Option 2: Run over standard input/output (stdio) for local IDE agents

npx @nogoo9/no-crd --transport stdio --mode cluster

Install Globally

npm install -g @nogoo9/no-crd

nocrd9 --transport stdio --mode cluster

Run via Docker

docker run -d -p 3000:3000 \

-v "$HOME/.kube/config:/app/.kube/config:ro" \ -e KUBECONFIG=/app/.kube/config \ ghcr.io/nogoo9/no-crd:latest

⚙️ Configuration & Environment Variables

The server and command-line utility are configurable using CLI options or environment variables. Below is the quick reference table of all settings:

🔌 Server Configuration

CLI Option	Environment Variable	Default	Allowed Values	Description
`-t, --transport`	`TRANSPORT`	`http`	`http`, `stdio`, `both`	Server transport mode. `both` fires up both transports simultaneously.
`-p, --port`	`PORT`	`3000`	Number	HTTP server port for SSE transport.
`-H, --host`	`HOST`	`0.0.0.0`	String	Host interface to bind the HTTP/SSE server to.
`--base-url`	`BASE_URL`	`""`	Path string	Base URL path prefix for hosting behind a reverse proxy (e.g. `/gateway/no-crd`).
-	`STATELESS`	`false`	`true`, `false`	Enable stateless request handling (no session affinity).
`-l, --log-level`	`LOG_LEVEL`	`info`	`debug`, `info`, `warning`, `error`, `fatal`	Logging verbosity filter.
-	`LOG_FILE`	`nogoo9-mcp.log`	String	Output file path for file logging.
-	`RATE_LIMIT_MAX`	`100`	Number	Maximum requests allowed per window for rate limited routes.
-	`RATE_LIMIT_WINDOW`	`60000`	Number	Time window in milliseconds for rate limited routes.
`--proxy-timeout`	`PROXY_TIMEOUT`	`120000`	Number	Timeout in milliseconds for the routing proxy upstream requests.
`--proxy-keep-alive`	`PROXY_KEEP_ALIVE`	`true`	`true`, `false`	Enable TCP keep-alive for the routing proxy upstream requests.

🔒 TLS Configuration

CLI Option	Environment Variable	Default	Allowed Values	Description
`--tls-cert`	`TLS_CERT`	-	Path string	Path to TLS certificate file to enable HTTPS.
`--tls-key`	`TLS_KEY`	-	Path string	Path to TLS private key file to enable HTTPS.
`--tls-ca`	`TLS_CA`	-	Path string	Path to TLS CA certificate file for HTTPS client/verification.
-	`NODE_TLS_REJECT_UNAUTHORIZED`	`true`	`0 (false)`, `1 (true)`	Set to `0` to bypass TLS verification (for development/testing only).

🌐 CORS Configuration

CLI Option	Environment Variable	Default	Allowed Values	Description
`--cors-origin`	`CORS_ALLOWED_ORIGIN`, `CORS_ORIGIN`	`*`	String	CORS Allowed Origin header.
`--cors-methods`	`CORS_ALLOWED_METHODS`, `CORS_METHODS`	`GET, POST, OPTIONS`	String	CORS Allowed Methods header.
`--cors-headers`	`CORS_ALLOWED_HEADERS`, `CORS_HEADERS`	`Content-Type, Authorization, mcp-protocol-version, mcp-session-id`	String	CORS Allowed Headers header.
`--cors-allow-credentials`	`CORS_ALLOW_CREDENTIALS`, `CORS_CREDENTIALS`	`false`	`true`, `false`	Enable CORS Access-Control-Allow-Credentials header.
`--cors-expose-headers`	`CORS_EXPOSED_HEADERS`, `CORS_EXPOSED`	`mcp-session-id, x-refreshed-token`	String	Custom CORS Access-Control-Expose-Headers header.
`--cors-max-age`	`CORS_MAX_AGE`	-	Number	Custom CORS Access-Control-Max-Age header in seconds.

☸️ Kubernetes Configuration

CLI Option	Environment Variable	Default	Allowed Values	Description
`-m, --mode`	`MODE`	`cluster`	`cluster`, `namespaced`	Kubernetes access scope. `namespaced` locks operations to a single namespace.
`-n, --namespace`	`NAMESPACE`, `DEFAULT_NAMESPACE`	`nogoo9`	String	Default Kubernetes namespace for operations.
`--disable-permission-checks`	`DISABLE_PERMISSION_CHECKS`	`false`	`true`, `false`	Disable Kubernetes RBAC permission checks and assume all tools are enabled.
`--managed-only`	`MANAGED_ONLY`	`true`	`true`, `false`	When true, pod tools only operate on pods managed by this server (`nogoo9/managed-by` label). No one bypasses this, not even admins. See ADR-008.
`--default-workspace-port`	`DEFAULT_WORKSPACE_PORT`	-	Number	Default target port inside the workspace pods to proxy traffic to.
-	`REGISTRY_URL`	-	URL string	Target container registry URL to query for images (e.g. `http://localhost:5001`).
-	`TEMPLATES_DIR`	-	Path string	Path to local directory containing pod template files (YAML/JSON). See ADR-001.
-	`BUILTIN_TEMPLATES`	`true`	`true`, `false`	Set to `false` to disable built-in templates shipped with the package.

🔑 Authentication Configuration

CLI Option	Environment Variable	Default	Allowed Values	Description
`--auth-enabled`	`AUTH_ENABLED`	`false`	`true`, `false`	Enables JWT token authentication on MCP tools and route proxy.
-	`JWT_VERIFICATION_REQUIRED`	`true`	`true`, `false`	Enable/disable JWT signature verification (signature checks).
-	`JWT_SECRET`	-	String	Symmetric HMAC-SHA256 secret for token verification.
-	`JWT_PUBLIC_KEY`	-	String	PEM encoded RSA/ECDSA public key for asymmetric token verification.
-	`JWKS_URI`	-	URL string	Remote JWKS endpoint URL to dynamically retrieve verification keys.
-	`INTROSPECTION_ENDPOINT`, `JWT_INTROSPECTION_ENDPOINT`	-	URL string	Endpoint for token introspection/validation.
-	`OAUTH_CLIENT_ID`	-	String	OAuth client ID for auth configuration.
-	`OAUTH_CLIENT_SECRET`	-	String	OAuth client secret for auth configuration.
-	`JWT_AUDIENCE`	-	String	Expected token audience. Falls back to `OAUTH_CLIENT_ID` if set.

只显示了开头部分；其余内容请在仓库中阅读