菜单
Local Kind contributor endpoints, API keys, test-mode logins, port-forward URLs, and Sentinel auth for MCP Runtime. Use when developing against kind-mcp-runtime, curling `/api/v1` or MCP paths on localhost:18080, or debugging 401s in test-mode — after cluster bring-up (qa-cluster-bringup).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy, audit, or UI security headers on a live cluster; or for pre-release security-regression sweeps. Complements static-only security-audit/security-audit-platform with real traffic. Assumes qa-cluster-bringup has run.
Run a deep platform-wide security audit of MCP Runtime — every component, every trust boundary, against an explicit threat model. Use when Codex is asked for a thorough security review (not a single PR), pre-release sign-off, red-team-style assessment, or to produce a structured report of findings across operator, gateway, sentinel services, registry, ingress, governance, and CI. For change-scoped reviews use security-audit; for SBOM/image/dependency work use supply-chain-audit; for cluster RBAC/PSS/NetworkPolicy hygiene use k8s-hardening-audit.
API and system design principles for MCP Runtime — RESTful resource design, HTTP semantics, versioning, and the broader system principles (least privilege, secure/deny by default, fail-closed, stable contracts, separation of concerns, validate at boundaries, idempotency, observability, audit, minimized blast radius, good defaults). Use when designing or reviewing an API, CRD, CLI flag, operator/gateway/service behavior, auth/policy path, or any new contract; and as the review lens for "is this good design?".
Real-cluster operational QA for MCP Runtime — operator/CRD reconciliation, CLI flows, setup/test-mode regressions, registry pulls, ingress wiring, rollout health, and observability — against the live Kind contributor cluster. Use when Codex is asked to verify a change does not regress operator, CLI, setup, registry, ingress, or rollout behavior; to do release-readiness operational QA; or to investigate a real-cluster failure. Assumes qa-cluster-bringup has run.
Compose MCP Runtime pre-merge, ship, canary, and release readiness across CI parity, live Kind operations, security, UI/browser QA, protocol compliance, performance, docs, and deployment evidence. Use when asked if a branch can ship, to prepare a release, run a canary, produce release evidence, or coordinate final review before merge/tag/deploy.
Operate or debug the MCP Runtime public k3s deployment and related hack scripts, including setup, clean/restore, rollout, registry TLS/auth, ImagePullBackOff, node DNS vs pod DNS, and post-change live validation. Use when touching hack/deploy/mcpruntime-org/, config/deployments/mcpruntime-org.env.example, public TLS registry behavior, or k3s deployment docs.
| name | mcp-runtime-local-dev |
| description | Local Kind contributor endpoints, API keys, test-mode logins, port-forward URLs, and Sentinel auth for MCP Runtime. Use when developing against kind-mcp-runtime, curling `/api/v1` or MCP paths on localhost:18080, or debugging 401s in test-mode — after cluster bring-up (qa-cluster-bringup). |
Cluster running per .codex/skills/qa-cluster-bringup/SKILL.md or docs/contributor/README.md.
kubectl port-forward -n traefik svc/traefik 18080:8000
| Service | URL |
|---|---|
| UI | http://localhost:18080/ |
| API | http://localhost:18080/api/v1 |
| Grafana | http://localhost:18080/grafana |
| MCP samples | http://localhost:18080/workspace-assistant-mcp/mcp, …/data-utility-mcp/mcp, …/text-analysis-mcp/mcp |
| Prometheus (debug) | kubectl port-forward -n mcp-sentinel svc/prometheus 9090:9090 |
PII redaction: config/ingress/overlays/http + pii-redactor@file — keep off /api/v1 routes (keys and grant subjects must stay exact).
kubectl get secret mcp-sentinel-secrets -n mcp-sentinel -o jsonpath='{.data.UI_API_KEY}' | base64 -d
kubectl get secret mcp-sentinel-secrets -n mcp-sentinel -o jsonpath='{.data.INGEST_API_KEYS}' | base64 -d
UI_API_KEY must appear in both API_KEYS and ADMIN_API_KEYS for admin curl + browser loginINGEST_API_KEYS for analytics ingest only/api/v1 401 → ./bin/mcp-runtime cluster doctorsetup --test-mode seeds (local only):
test@mcpruntime.org / test@123admin@mcpruntime.org / admin@123Override via PLATFORM_DEV_* in mcp-sentinel-secrets; roll the split API Deployments after changes.
kubectl apply -f k8s/21-platform-admin-bootstrap-job.yaml
kubectl wait --for=condition=complete job/mcp-sentinel-platform-admin-bootstrap -n mcp-sentinel --timeout=120s
kubectl patch secret mcp-sentinel-secrets -n mcp-sentinel --type merge -p '{"stringData":{"PLATFORM_ADMIN_PASSWORD":""}}'
Clear PLATFORM_ADMIN_PASSWORD from steady-state API env after bootstrap.
./bin/mcp-runtime status
./bin/mcp-runtime bootstrap # preflight only
./bin/mcp-runtime cluster doctor
Governance traffic and grants: .codex/skills/mcp-runtime-governance/SKILL.md.