A manager,registry,broker, and infrastructure to manage , deploy, govern, and use MCP servers.
Skill Claude CodeCodex
API and system design principles for MCP Runtime — RESTful resource design, HTTP semantics, versioning, and the broader system principles (least privilege, secure/deny by default, fail-closed, stable contracts, separation of concerns, validate at boundaries, idempotency, observability, audit, minimized blast radius…
Skill Claude CodeCodex
Turn any folder of files into a navigable knowledge graph with community detection, an honest audit trail, and three outputs: interactive HTML, GraphRAG-ready JSON, and a plain-language GRAPHREPORT.md.
Skill Claude CodeCodex
Operate or debug the MCP Runtime public k3s deployment and related hack scripts, including setup, clean/restore, rollout, registry TLS/auth, ImagePullBackOff, node DNS vs pod DNS, and post-change live validation. Use when touching hack/deploy/mcpruntime-org/, config/deployments/mcpruntime-org.env.example, public TLS…
Skill Claude CodeCodex
Audit MCP Runtime Kubernetes posture — RBAC, ServiceAccounts, Pod Security Standards, NetworkPolicies, manifest hygiene, secret access, and cluster CIS controls — across operator, sentinel, registry, traefik, and mcp-servers namespaces. Use when Codex reviews or changes RBAC roles, ServiceAccounts, Deployments…
Skill Claude CodeCodex
Apply and debug MCP Runtime access grants, agent sessions, gateway policy, and MCP JSON-RPC traffic with governance headers. Use when working on MCPAccessGrant, MCPAgentSession, adapter proxy/stdio, access CLI, platform API grant/session endpoints, or allow/deny tool calls.
Skill Claude CodeCodex
Local Kind contributor endpoints, API keys, test-mode logins, port-forward URLs, and Sentinel auth for MCP Runtime. Use when developing against kind-mcp-runtime, curling /api/v1 or MCP paths on localhost:18080, or debugging 401s in test-mode — after cluster bring-up (qa-cluster-bringup).
Skill Claude CodeCodex
Configure and debug public MCP Runtime installs with MCPPLATFORMDOMAIN, Let's Encrypt, registry/mcp/platform hostnames, registry TLS auth, and platform UI ingress. Use for --with-tls setup, ACME failures, DNS NXDOMAIN, registry forward-auth, or production hostname routing — not for local Kind test-mode (use…
Skill Claude CodeCodex
Debug MCP Runtime cluster, ingress, registry, Sentinel auth, MCPServer pods, and platform UI failures on Kind or k3s. Use when setup, doctor, e2e, or live traffic fails; when investigating 401/404/ImagePullBackOff/ACME/TLS/registry push errors; or when AGENTS.md points here for the full failure-mode checklist.
Skill Claude CodeCodex
Validate MCP Runtime against the upstream Model Context Protocol specification at github.com/modelcontextprotocol/modelcontextprotocol — protocol version negotiation, Streamable HTTP transport headers, JSON-RPC 2.0 envelope, initialize/tools/resources/prompts/sampling shapes, session semantics, error codes, and merged…
Skill Claude CodeCodex
Stand up a real Kind+test-mode MCP Runtime cluster end-to-end (the contributor flow from docs/getting-started.md#3-contributor-test-mode-cluster) so the qa-e2e- skills can run real validation. Use when Codex is asked to QA on a live cluster, prepare a target environment for qa-e2e-operations / qa-e2e-security /…
Skill Claude CodeCodex
Real-cluster operational QA for MCP Runtime — operator/CRD reconciliation, CLI flows, setup/test-mode regressions, registry pulls, ingress wiring, rollout health, and observability — against the live Kind contributor cluster. Use when Codex is asked to verify a change does not regress operator, CLI, setup, registry…
Skill Claude CodeCodex
Real-cluster performance regression QA — MCP tools/call latency (p50/p95/p99), concurrent throughput against the gateway, /api/v1/analytics/usage latency under load, and operator burst-reconcile latency. Compares against a stored per-branch baseline and flags regressions above a configurable threshold (default +25…
Skill Claude CodeCodex
Real-cluster security regression QA — backend auth enforcement, grant/session policy, gateway deny paths, audit emission, trust escalation, UI/API security headers, HTTPS redirect modes, and secret-leak scanning in live logs. Use when Codex is asked to verify a change did not regress auth, governance, gateway policy…
Skill Claude CodeCodex
Browser-first real-cluster Sentinel UI/dashboard QA - role-based navigation, auth flows, every tab, forms, filters, destructive actions, rendered data, network/API evidence, console evidence, responsive/accessibility checks, cleanup, static assets, and public-host defenses. Use when Codex is asked to QA UI changes…
Skill Claude CodeCodex
Compose MCP Runtime pre-merge, ship, canary, and release readiness across CI parity, live Kind operations, security, UI/browser QA, protocol compliance, performance, docs, and deployment evidence. Use when asked if a branch can ship, to prepare a release, run a canary, produce release evidence, or coordinate final…
Skill Claude CodeCodex
Audit and update repository documentation, AGENTS.md, contributor runbooks, and test guidance so they match implemented behavior. Use when code, UI, CLI, API/CRD, config, deployment, or test-flow changes may affect user-facing docs, setup instructions, operational/debugging guidance, golden help snapshots, E2E…
Skill Claude CodeCodex
Run a deep platform-wide security audit of MCP Runtime — every component, every trust boundary, against an explicit threat model. Use when Codex is asked for a thorough security review (not a single PR), pre-release sign-off, red-team-style assessment, or to produce a structured report of findings across operator…
Skill Claude CodeCodex
Audit a single MCP Runtime change for security risks and choose the relevant local or CI security checks. Use when Codex reviews or changes authentication, authorization, secrets, TLS, ingress, registry/image handling, Kubernetes RBAC or pod security, gateway policy, audit logging, dependencies, GitHub Actions…
Skill Claude CodeCodex
Audit MCP Runtime supply chain — Go modules, container images, base images, SBOMs, signatures, and GitHub Actions workflows — for known vulnerabilities, unsigned artifacts, weak action pinning, license violations, and pwn-request exposure. Use when Codex bumps dependencies, changes Dockerfiles or workflows, prepares a…