Run any Skill in Manus with one click

mcp-runtime-platform-public

Stars4

Forks1

UpdatedJune 16, 2026 at 18:30

Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

Agent-Hellboy

Agent-Hellboy/mcp-runtime

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Network and Computer Systems AdministratorsComputer and Mathematical Occupations·SOC 15-1244

SKILL.md

readonly

name	mcp-runtime-platform-public
description	Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

MCP Runtime — public platform (domain, TLS, DNS)

Hostname model

With export MCP_PLATFORM_DOMAIN=example.com (apex only, no https://):

Role	Host
Registry (push/pull ingress)	`registry.example.com`
MCP servers (default host-based)	`mcp.example.com`
Dashboard / API / Grafana path	`platform.example.com`

Override individual hosts with MCP_REGISTRY_INGRESS_HOST, MCP_MCP_INGRESS_HOST, MCP_PLATFORM_INGRESS_HOST.

Operator may set MCP_DEFAULT_INGRESS_HOST=mcp.<domain> from platform domain env.

Expected URLs (after DNS + TLS)

Dashboard: https://platform.<domain>/ (API at /api/v1/* via Traefik). Grafana at /grafana via mcp-sentinel-platform-observability + sentinel-admin-auth@file (admin cookie or admin x-api-key). Prometheus stays internal — port-forward only for backend debug.
Registry: https://registry.<domain>/v2/ (admin auth via registry-admin-auth@file → /api/v1/registry/authz)
MCP server: https://mcp.<domain>/<server-name>/mcp (path-based; set spec.publicPathPrefix and MCP_PATH)

Default MCPServer ingress class: traefik.

TLS setup

./bin/mcp-runtime setup --with-tls --acme-email <addr>
# staging: --acme-staging or MCP_ACME_STAGING=1
# enterprise CA (no ACME): --with-tls --tls-cluster-issuer <name>  # mutually exclusive with --acme-email

DNS requirements

A/AAAA (or CNAME) for registry., mcp., and platform. → same ingress IP/LB
Port 80 → Traefik for HTTP-01 before certs issue
Typos (regsitry, platfrom) break matching certificates

Certificates

registry/registry-cert → registry/registry-tls (only supported owner for that Secret; registry Ingress must not use cert-manager.io/cluster-issuer on the Ingress itself)
Platform UI: mcp-sentinel-platform-tls in mcp-sentinel via mcp-sentinel-platform-ui Ingress
Bundled HTTPS may create cert-manager/mcp-runtime-ca; nodes must trust tls.crt for image pulls
Private CA without ACME: config/cert-manager/ and omit --acme-email

Registry and image pull (public)

MCP_REGISTRY_HOST — public alias; do not let it override node pull endpoint incorrectly
HTTPS public: MCP_REGISTRY_ENDPOINT=registry.<domain>
Platform pull secrets: MCP_PLATFORM_IMAGE_PULL_SECRET in mcp-runtime and mcp-sentinel when using external auth registries
Tenant pulls: platform creates mcp-runtime-registry-pull on mcp-workload SA per team namespace

OIDC / Google sign-in

Non-test public TLS (--platform-mode public --with-tls) requires GOOGLE_CLIENT_ID / MCP_GOOGLE_CLIENT_ID, or all of OIDC_ISSUER, OIDC_AUDIENCE, OIDC_JWKS_URL. Setup preserves existing values in mcp-sentinel-config on reruns.

k3s-specific

Use .codex/skills/k3s-public-ops/SKILL.md, docs/k3s-deployment-runbook.md, and docs/cluster-readiness.md for scripted deploy, node registries.yaml, and multitenancy smoke.

Troubleshooting cross-links

General failures (ImagePullBackOff, UI 404, cert-manager pods missing): .codex/skills/mcp-runtime-troubleshooting/reference.md.

More from this repository

same repository

qa-e2e-security

Agent-Hellboy/mcp-runtime

Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy, audit, or UI security headers on a live cluster; or for pre-release security-regression sweeps. Complements static-only security-audit/security-audit-platform with real traffic. Assumes qa-cluster-bringup has run.

2026-07-034

security-audit-platform

Agent-Hellboy/mcp-runtime

Run a deep platform-wide security audit of MCP Runtime — every component, every trust boundary, against an explicit threat model. Use when Codex is asked for a thorough security review (not a single PR), pre-release sign-off, red-team-style assessment, or to produce a structured report of findings across operator, gateway, sentinel services, registry, ingress, governance, and CI. For change-scoped reviews use security-audit; for SBOM/image/dependency work use supply-chain-audit; for cluster RBAC/PSS/NetworkPolicy hygiene use k8s-hardening-audit.

2026-07-034

design-principles

Agent-Hellboy/mcp-runtime

API and system design principles for MCP Runtime — RESTful resource design, HTTP semantics, versioning, and the broader system principles (least privilege, secure/deny by default, fail-closed, stable contracts, separation of concerns, validate at boundaries, idempotency, observability, audit, minimized blast radius, good defaults). Use when designing or reviewing an API, CRD, CLI flag, operator/gateway/service behavior, auth/policy path, or any new contract; and as the review lens for "is this good design?".

2026-06-244

qa-e2e-operations

Agent-Hellboy/mcp-runtime

Real-cluster operational QA for MCP Runtime — operator/CRD reconciliation, CLI flows, setup/test-mode regressions, registry pulls, ingress wiring, rollout health, and observability — against the live Kind contributor cluster. Use when Codex is asked to verify a change does not regress operator, CLI, setup, registry, ingress, or rollout behavior; to do release-readiness operational QA; or to investigate a real-cluster failure. Assumes qa-cluster-bringup has run.

2026-06-234

release-readiness

Agent-Hellboy/mcp-runtime

Compose MCP Runtime pre-merge, ship, canary, and release readiness across CI parity, live Kind operations, security, UI/browser QA, protocol compliance, performance, docs, and deployment evidence. Use when asked if a branch can ship, to prepare a release, run a canary, produce release evidence, or coordinate final review before merge/tag/deploy.

2026-06-224

k3s-public-ops

Agent-Hellboy/mcp-runtime

Operate or debug the MCP Runtime public k3s deployment and related hack scripts, including setup, clean/restore, rollout, registry TLS/auth, ImagePullBackOff, node DNS vs pod DNS, and post-change live validation. Use when touching hack/deploy/mcpruntime-org/, config/deployments/mcpruntime-org.env.example, public TLS registry behavior, or k3s deployment docs.

2026-06-164

name	mcp-runtime-platform-public
description	Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

MCP Runtime — public platform (domain, TLS, DNS)

Hostname model

With export MCP_PLATFORM_DOMAIN=example.com (apex only, no https://):

Role	Host
Registry (push/pull ingress)	`registry.example.com`
MCP servers (default host-based)	`mcp.example.com`
Dashboard / API / Grafana path	`platform.example.com`

Override individual hosts with MCP_REGISTRY_INGRESS_HOST, MCP_MCP_INGRESS_HOST, MCP_PLATFORM_INGRESS_HOST.

Operator may set MCP_DEFAULT_INGRESS_HOST=mcp.<domain> from platform domain env.

Expected URLs (after DNS + TLS)

Dashboard: https://platform.<domain>/ (API at /api/v1/* via Traefik). Grafana at /grafana via mcp-sentinel-platform-observability + sentinel-admin-auth@file (admin cookie or admin x-api-key). Prometheus stays internal — port-forward only for backend debug.
Registry: https://registry.<domain>/v2/ (admin auth via registry-admin-auth@file → /api/v1/registry/authz)
MCP server: https://mcp.<domain>/<server-name>/mcp (path-based; set spec.publicPathPrefix and MCP_PATH)

Default MCPServer ingress class: traefik.

TLS setup

./bin/mcp-runtime setup --with-tls --acme-email <addr>
# staging: --acme-staging or MCP_ACME_STAGING=1
# enterprise CA (no ACME): --with-tls --tls-cluster-issuer <name>  # mutually exclusive with --acme-email

DNS requirements

A/AAAA (or CNAME) for registry., mcp., and platform. → same ingress IP/LB
Port 80 → Traefik for HTTP-01 before certs issue
Typos (regsitry, platfrom) break matching certificates

Certificates

registry/registry-cert → registry/registry-tls (only supported owner for that Secret; registry Ingress must not use cert-manager.io/cluster-issuer on the Ingress itself)
Platform UI: mcp-sentinel-platform-tls in mcp-sentinel via mcp-sentinel-platform-ui Ingress
Bundled HTTPS may create cert-manager/mcp-runtime-ca; nodes must trust tls.crt for image pulls
Private CA without ACME: config/cert-manager/ and omit --acme-email

Registry and image pull (public)

MCP_REGISTRY_HOST — public alias; do not let it override node pull endpoint incorrectly
HTTPS public: MCP_REGISTRY_ENDPOINT=registry.<domain>
Platform pull secrets: MCP_PLATFORM_IMAGE_PULL_SECRET in mcp-runtime and mcp-sentinel when using external auth registries
Tenant pulls: platform creates mcp-runtime-registry-pull on mcp-workload SA per team namespace

OIDC / Google sign-in

k3s-specific

Use .codex/skills/k3s-public-ops/SKILL.md, docs/k3s-deployment-runbook.md, and docs/cluster-readiness.md for scripted deploy, node registries.yaml, and multitenancy smoke.

Troubleshooting cross-links

General failures (ImagePullBackOff, UI 404, cert-manager pods missing): .codex/skills/mcp-runtime-troubleshooting/reference.md.