Kubernetes Ephemeral Job

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-07-20T09:51:22.058237Z",
      "publishedAt": "2026-07-20T09:51:22.058237Z",
      "statusChangedAt": "2026-07-20T09:51:22.058237Z"
    }
  },
  "server": {
    "name": "io.github.inhuman/mcp-k8s-ephemeral-job",
    "title": "Kubernetes Ephemeral Job",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.7.1",
    "packages": [
      {
        "transport": {
          "type": "stdio"
        },
        "identifier": "docker.io/idconstruct/mcp-k8s-ephemeral-job:v0.7.1",
        "runtimeHint": "docker",
        "registryType": "oci",
        "runtimeArguments": [
          {
            "name": "--volume",
            "type": "named",
            "value": "{kubeconfig_dir}:/kube:ro",
            "variables": {
              "kubeconfig_dir": {
                "isRequired": true,
                "description": "Host directory holding your kubeconfig, e.g. /home/you/.kube"
              }
            },
            "description": "Mount the kubeconfig directory read-only so the server can reach the cluster."
          },
          {
            "name": "--read-only",
            "type": "named",
            "description": "Read-only root filesystem — the server writes nothing locally."
          },
          {
            "name": "--cap-drop",
            "type": "named",
            "value": "ALL",
            "description": "Drop all Linux capabilities."
          },
          {
            "name": "--security-opt",
            "type": "named",
            "value": "no-new-privileges",
            "description": "Block privilege escalation."
          },
          {
            "name": "--memory",
            "type": "named",
            "value": "256m",
            "description": "Memory limit for the server process itself."
          }
        ],
        "environmentVariables": [
          {
            "name": "MCP_K8S_ALLOWED_IMAGES",
            "isRequired": true,
            "description": "Strict image allowlist (CSV). Empty means every call is rejected, so this must be set."
          },
          {
            "name": "MCP_K8S_KUBECONFIG",
            "default": "/kube/config",
            "description": "Path to the kubeconfig inside the container. Empty = use in-cluster credentials."
          },
          {
            "name": "MCP_K8S_NAMESPACE",
            "default": "mcp-ephemeral",
            "description": "Namespace the ephemeral pods are created in. Needs a Role/RoleBinding for jobs and pods."
          },
          {
            "name": "MCP_K8S_TRANSPORT",
            "default": "stdio",
            "description": "MCP transport: stdio | http | sse. Must be 'stdio' for direct docker/stdio use."
          },
          {
            "name": "MCP_K8S_DEFAULT_TIMEOUT_S",
            "default": "60",
            "description": "Default wall-clock timeout per job, seconds."
          },
          {
            "name": "MCP_K8S_MAX_TIMEOUT_S",
            "default": "600",
            "description": "Maximum wall-clock timeout a caller may request, seconds."
          },
          {
            "name": "MCP_K8S_MAX_OUTPUT_BYTES",
            "default": "1048576",
            "description": "Cap on combined stdout/stderr before truncation."
          },
          {
            "name": "MCP_K8S_MAX_ARTIFACT_BYTES",
            "default": "10485760",
            "description": "Cap on the total size of returned artifacts."
          },
          {
            "name": "MCP_K8S_MAX_CONCURRENT",
            "default": "10",
            "description": "Maximum ephemeral pods running at the same time."
          },
          {
            "name": "MCP_K8S_DEFAULT_CPU",
            "default": "1",
            "description": "Pod CPU request; limits come from the caller or the namespace LimitRange."
          },
          {
            "name": "MCP_K8S_DEFAULT_MEMORY",
            "default": "512Mi",
            "description": "Pod memory request; limits come from the caller or the namespace LimitRange."
          },
          {
            "name": "MCP_K8S_SIDECAR_IMAGE",
            "default": "busybox:1.36",
            "description": "Helper image used to inject input files and collect artifacts."
          },
          {
            "name": "MCP_K8S_CLONE_IMAGE",
            "description": "Image carrying git for the clone init container. Empty disables the clone field."
          },
          {
            "name": "MCP_K8S_CLONE_SECRET",
            "isSecret": true,
            "description": "Secret with git tokens, mounted only on the cloner. Empty disables the clone field."
          },
          {
            "name": "MCP_K8S_CACHE_PVC",
            "description": "Existing PVC mounted into every job pod as a shared cache. Empty = no cache."
          },
          {
            "name": "MCP_K8S_CACHE_MOUNT_PATH",
            "description": "Where the cache PVC is mounted, e.g. /go/pkg/mod. Empty = no cache."
          },
          {
            "name": "MCP_K8S_JOB_EXTRA_ENV",
            "description": "JSON object of env vars added to every job pod; caller keys win on collision."
          },
          {
            "name": "MCP_K8S_AUTH_TOKEN",
            "isSecret": true,
            "description": "Optional X-MCP-AUTH token required on every request (http/sse transports only)."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/inhuman/mcp-k8s-ephemeral-job",
      "source": "github"
    },
    "description": "Runs a command in a throwaway Kubernetes pod and returns exit code, output and artifacts."
  }
}