Kubernetes operator that gives AI agents a sandboxed bash shell in per-session pods.
Agents call one tool, bash: pipes, redirects, and whatever CLIs are in the sandbox image. The MCP server is stateless. Session state lives in the pod. Commands leave the pod through a credential proxy, which discards the token the shell presents. A kubernetes target replaces it with the investigation credential. An allowlist target injects nothing.
flowchart LR
Client[MCP client] --> Server[MCP server]
Server --> Sandbox[Sandbox pod]
Sandbox --> Proxy[Credential proxy]
Proxy --> API[Allowed targets]
- One
CliMcpInstanceis one sandbox class: image, proxy targets, and pool. - The operator owns the Deployments, NetworkPolicies, warm pool, and idle cleanup. The MCP server claims or creates a pod and proxies the command.
- A
kubernetestarget gives the sandbox a dummy kubeconfig; the real credential stays on the proxy. Anallowlisttarget reaches only the listed hosts and injects no credential.
How the pieces behave: Architecture.
OLM, or the kustomize manifests. Apply a custom resource. A kubernetes target also needs an investigation kubeconfig Secret (cli-mcp-<name>-kubeconfig, key kubeconfig). On generic Kubernetes, create Secret cli-mcp--tls with keys tls.crt and tls.key. On OpenShift the Service serving-cert annotation fills that Secret. The operator does not create it.
apiVersion: cli-mcp.redhat.com/v1alpha1
kind: CliMcpInstance
metadata:
name: oc
spec:
proxy:
targets:
- type: kubernetes| Parameter | Required | Description |
|---|---|---|
command |
yes | Full bash |
timeout |
no | Seconds (default 60, max 300) |
Send X-Session-ID (an RFC 1123 label) so later calls reuse the same shell and /workspace. DELETE /sessions/{id} removes the sandbox. Otherwise the operator collects it after the idle timeout. A non-zero exit is a tool result with isError: true and the command output. It is not a transport error.
make build # operator, server, agent, and proxy
make test
make lintmake run starts the operator. make run-server starts the MCP server alone.