mcp-server values

Every value of chart mcp-server 0.2.0, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.

Value	Type	Default	Description
image	object		The MCP server image; it must serve streamable HTTP on port at path
image.repository	string	""
image.tag	string	""
image.pullPolicy	string	IfNotPresent	One of: Always, IfNotPresent, Never.
command	array	[]
args	array	[]
env	object	{}	Plain environment variables, name to value
envFromSecret	string	""	Existing Secret whose keys become environment variables (the server's credential)
secretEnv	array	[]	Single environment variables from keys of existing Secrets: [{name, secret, key}]
serviceAccountName	string	""	Existing ServiceAccount for the pod; empty: the namespace default, without a token mount
port	integer	8000	Not 80, 443, 8080 or 8443 (open to every project)
path	string	/mcp
mcp.appProtocol	string	agentgateway.dev/mcp	Port appProtocol an MCP gateway discovers; empty leaves it unset
mcp.targetName	string	""	Tool prefix on the gateway (<targetName>_<tool>); empty: the release name
rbacProxy	object		Authenticate every call with kube-rbac-proxy in front of the server: the caller's ServiceAccount token must allow services/proxy on this Service (TokenReview and SubjectAccessReview). The server must then listen on 127.0.0.1:<port>. serviceAccountName must name a ServiceAccount bound to system:auth-delegator (cluster-scoped, not in this chart).
rbacProxy.enabled	boolean	false
rbacProxy.image	string	quay.io/brancz/kube-rbac-proxy:v0.23.0
rbacProxy.port	integer	8443
rbacProxy.tlsSecretName	string	""	TLS Secret for the proxy (for example created by a service CA through service.annotations)
rbacProxy.callers	array	[]	Subjects allowed to call: [{kind: ServiceAccount, name, namespace}]
service.annotations	object	{}
route	object		Publish the endpoint off-cluster (with rbacProxy: reencrypt to the proxy)
route.enabled	boolean	false
route.host	string	""
route.path	string	""
route.annotations	object	{}
podLabels	object	{}	Extra pod labels and annotations, e.g. sidecar.istio.io/inject: "false" in a mesh namespace
podAnnotations	object	{}
resources.requests.cpu	string	10m
resources.requests.memory	string	64Mi
resources.limits.cpu	string	500m
resources.limits.memory	string	256Mi
networkPolicy.enabled	boolean	true
networkPolicy.ingressNamespaces	array	[]	Namespaces (label selectors) that may call the server besides its own, e.g. the gateway's
networkPolicy.egress.enabled	boolean	true	The server reaches the public internet only, plus allowCidrs
networkPolicy.egress.exceptCidrs	array	["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "169.254.0...
networkPolicy.egress.extraExceptCidrs	array	[]	Your own public ranges
networkPolicy.egress.allow	array	[]	Private addresses the server must reach (its upstream), each with ports
networkPolicy.egress.dnsNamespace	string	openshift-dns	- cidr: 192.0.2.10/32 ports: [443]
networkPolicy.egress.dnsPort	integer	5353