Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

mcp-runtime-platform-public

Estrelas4

Forks1

Atualizado16 de junho de 2026 às 18:30

Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

Agent-Hellboy

Agent-Hellboy/mcp-runtime

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Administradores de redes e sistemas de computadorInformática e Matemática·SOC 15-1244

SKILL.md

readonly

name	mcp-runtime-platform-public
description	Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

MCP Runtime — public platform (domain, TLS, DNS)

Hostname model

With export MCP_PLATFORM_DOMAIN=example.com (apex only, no https://):

Role	Host
Registry (push/pull ingress)	`registry.example.com`
MCP servers (default host-based)	`mcp.example.com`
Dashboard / API / Grafana path	`platform.example.com`

Override individual hosts with MCP_REGISTRY_INGRESS_HOST, MCP_MCP_INGRESS_HOST, MCP_PLATFORM_INGRESS_HOST.

Operator may set MCP_DEFAULT_INGRESS_HOST=mcp.<domain> from platform domain env.

Expected URLs (after DNS + TLS)

Dashboard: https://platform.<domain>/ (API at /api/v1/* via Traefik). Grafana at /grafana via mcp-sentinel-platform-observability + sentinel-admin-auth@file (admin cookie or admin x-api-key). Prometheus stays internal — port-forward only for backend debug.
Registry: https://registry.<domain>/v2/ (admin auth via registry-admin-auth@file → /api/v1/registry/authz)
MCP server: https://mcp.<domain>/<server-name>/mcp (path-based; set spec.publicPathPrefix and MCP_PATH)

Default MCPServer ingress class: traefik.

TLS setup

./bin/mcp-runtime setup --with-tls --acme-email <addr>
# staging: --acme-staging or MCP_ACME_STAGING=1
# enterprise CA (no ACME): --with-tls --tls-cluster-issuer <name>  # mutually exclusive with --acme-email

DNS requirements

A/AAAA (or CNAME) for registry., mcp., and platform. → same ingress IP/LB
Port 80 → Traefik for HTTP-01 before certs issue
Typos (regsitry, platfrom) break matching certificates

Certificates

registry/registry-cert → registry/registry-tls (only supported owner for that Secret; registry Ingress must not use cert-manager.io/cluster-issuer on the Ingress itself)
Platform UI: mcp-sentinel-platform-tls in mcp-sentinel via mcp-sentinel-platform-ui Ingress
Bundled HTTPS may create cert-manager/mcp-runtime-ca; nodes must trust tls.crt for image pulls
Private CA without ACME: config/cert-manager/ and omit --acme-email

Registry and image pull (public)

MCP_REGISTRY_HOST — public alias; do not let it override node pull endpoint incorrectly
HTTPS public: MCP_REGISTRY_ENDPOINT=registry.<domain>
Platform pull secrets: MCP_PLATFORM_IMAGE_PULL_SECRET in mcp-runtime and mcp-sentinel when using external auth registries
Tenant pulls: platform creates mcp-runtime-registry-pull on mcp-workload SA per team namespace

OIDC / Google sign-in

Non-test public TLS (--platform-mode public --with-tls) requires GOOGLE_CLIENT_ID / MCP_GOOGLE_CLIENT_ID, or all of OIDC_ISSUER, OIDC_AUDIENCE, OIDC_JWKS_URL. Setup preserves existing values in mcp-sentinel-config on reruns.

k3s-specific

Use .codex/skills/k3s-public-ops/SKILL.md, docs/k3s-deployment-runbook.md, and docs/cluster-readiness.md for scripted deploy, node registries.yaml, and multitenancy smoke.

Troubleshooting cross-links

General failures (ImagePullBackOff, UI 404, cert-manager pods missing): .codex/skills/mcp-runtime-troubleshooting/reference.md.

Mais deste repositório

mesmo repositório

qa-e2e-security

Agent-Hellboy/mcp-runtime

Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy, audit, or UI security headers on a live cluster; or for pre-release security-regression sweeps. Complements static-only security-audit/security-audit-platform with real traffic. Assumes qa-cluster-bringup has run.

2026-07-034

security-audit-platform

Agent-Hellboy/mcp-runtime

Run a deep platform-wide security audit of MCP Runtime — every component, every trust boundary, against an explicit threat model. Use when Codex is asked for a thorough security review (not a single PR), pre-release sign-off, red-team-style assessment, or to produce a structured report of findings across operator, gateway, sentinel services, registry, ingress, governance, and CI. For change-scoped reviews use security-audit; for SBOM/image/dependency work use supply-chain-audit; for cluster RBAC/PSS/NetworkPolicy hygiene use k8s-hardening-audit.

2026-07-034

design-principles

Agent-Hellboy/mcp-runtime

API and system design principles for MCP Runtime — RESTful resource design, HTTP semantics, versioning, and the broader system principles (least privilege, secure/deny by default, fail-closed, stable contracts, separation of concerns, validate at boundaries, idempotency, observability, audit, minimized blast radius, good defaults). Use when designing or reviewing an API, CRD, CLI flag, operator/gateway/service behavior, auth/policy path, or any new contract; and as the review lens for "is this good design?".

2026-06-244

qa-e2e-operations

Agent-Hellboy/mcp-runtime

Real-cluster operational QA for MCP Runtime — operator/CRD reconciliation, CLI flows, setup/test-mode regressions, registry pulls, ingress wiring, rollout health, and observability — against the live Kind contributor cluster. Use when Codex is asked to verify a change does not regress operator, CLI, setup, registry, ingress, or rollout behavior; to do release-readiness operational QA; or to investigate a real-cluster failure. Assumes qa-cluster-bringup has run.

2026-06-234

release-readiness

Agent-Hellboy/mcp-runtime

Compose MCP Runtime pre-merge, ship, canary, and release readiness across CI parity, live Kind operations, security, UI/browser QA, protocol compliance, performance, docs, and deployment evidence. Use when asked if a branch can ship, to prepare a release, run a canary, produce release evidence, or coordinate final review before merge/tag/deploy.

2026-06-224

k3s-public-ops

Agent-Hellboy/mcp-runtime

Operate or debug the MCP Runtime public k3s deployment and related hack scripts, including setup, clean/restore, rollout, registry TLS/auth, ImagePullBackOff, node DNS vs pod DNS, and post-change live validation. Use when touching hack/deploy/mcpruntime-org/, config/deployments/mcpruntime-org.env.example, public TLS registry behavior, or k3s deployment docs.

2026-06-164

name	mcp-runtime-platform-public
description	Configure and debug public MCP Runtime installs with MCP_PLATFORM_DOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use qa-cluster-bringup).

MCP Runtime — public platform (domain, TLS, DNS)

Hostname model

With export MCP_PLATFORM_DOMAIN=example.com (apex only, no https://):

Role	Host
Registry (push/pull ingress)	`registry.example.com`
MCP servers (default host-based)	`mcp.example.com`
Dashboard / API / Grafana path	`platform.example.com`

Override individual hosts with MCP_REGISTRY_INGRESS_HOST, MCP_MCP_INGRESS_HOST, MCP_PLATFORM_INGRESS_HOST.

Operator may set MCP_DEFAULT_INGRESS_HOST=mcp.<domain> from platform domain env.

Expected URLs (after DNS + TLS)

Dashboard: https://platform.<domain>/ (API at /api/v1/* via Traefik). Grafana at /grafana via mcp-sentinel-platform-observability + sentinel-admin-auth@file (admin cookie or admin x-api-key). Prometheus stays internal — port-forward only for backend debug.
Registry: https://registry.<domain>/v2/ (admin auth via registry-admin-auth@file → /api/v1/registry/authz)
MCP server: https://mcp.<domain>/<server-name>/mcp (path-based; set spec.publicPathPrefix and MCP_PATH)

Default MCPServer ingress class: traefik.

TLS setup

./bin/mcp-runtime setup --with-tls --acme-email <addr>
# staging: --acme-staging or MCP_ACME_STAGING=1
# enterprise CA (no ACME): --with-tls --tls-cluster-issuer <name>  # mutually exclusive with --acme-email

DNS requirements

A/AAAA (or CNAME) for registry., mcp., and platform. → same ingress IP/LB
Port 80 → Traefik for HTTP-01 before certs issue
Typos (regsitry, platfrom) break matching certificates

Certificates

registry/registry-cert → registry/registry-tls (only supported owner for that Secret; registry Ingress must not use cert-manager.io/cluster-issuer on the Ingress itself)
Platform UI: mcp-sentinel-platform-tls in mcp-sentinel via mcp-sentinel-platform-ui Ingress
Bundled HTTPS may create cert-manager/mcp-runtime-ca; nodes must trust tls.crt for image pulls
Private CA without ACME: config/cert-manager/ and omit --acme-email

Registry and image pull (public)

MCP_REGISTRY_HOST — public alias; do not let it override node pull endpoint incorrectly
HTTPS public: MCP_REGISTRY_ENDPOINT=registry.<domain>
Platform pull secrets: MCP_PLATFORM_IMAGE_PULL_SECRET in mcp-runtime and mcp-sentinel when using external auth registries
Tenant pulls: platform creates mcp-runtime-registry-pull on mcp-workload SA per team namespace

OIDC / Google sign-in

k3s-specific

Use .codex/skills/k3s-public-ops/SKILL.md, docs/k3s-deployment-runbook.md, and docs/cluster-readiness.md for scripted deploy, node registries.yaml, and multitenancy smoke.

Troubleshooting cross-links

General failures (ImagePullBackOff, UI 404, cert-manager pods missing): .codex/skills/mcp-runtime-troubleshooting/reference.md.