go-package-reference.md

# Go Package Reference

<!-- Generated by docs/scripts/generate_go_package_reference.py; do not edit by hand. -->

This page renders `go doc` output for the main contributor-facing Go packages in a pkg.go.dev-style shape.
Regenerate it from the repository root with:

```bash
python3 docs/scripts/generate_go_package_reference.py
```

## Packages

- [API types](#api-types) `mcp-runtime/api/v1alpha1`
- [Metadata helpers](#metadata-helpers) `mcp-runtime/pkg/metadata`
- [Operator internals](#operator-internals) `mcp-runtime/internal/operator`
- [CLI command routing](#cli-command-routing) `mcp-runtime/internal/cli/root`
- [CLI core](#cli-core) `mcp-runtime/internal/cli/core`
- [CLI Kubernetes helpers](#cli-kubernetes-helpers) `mcp-runtime/internal/cli/kube`
- [CLI Kubernetes errors](#cli-kubernetes-errors) `mcp-runtime/internal/cli/kubeerr`
- [CLI cluster](#cli-cluster) `mcp-runtime/internal/cli/cluster`
- [CLI cert-manager](#cli-cert-manager) `mcp-runtime/internal/cli/certmanager`
- [CLI platform API](#cli-platform-api) `mcp-runtime/internal/cli/platformapi`
- [CLI platform status](#cli-platform-status) `mcp-runtime/internal/cli/platformstatus`
- [CLI registry](#cli-registry) `mcp-runtime/internal/cli/registry`
- [CLI registry config](#cli-registry-config) `mcp-runtime/internal/cli/registry/config`
- [CLI registry references](#cli-registry-references) `mcp-runtime/internal/cli/registry/ref`
- [CLI registry resolution](#cli-registry-resolution) `mcp-runtime/internal/cli/registry/resolve`
- [CLI server](#cli-server) `mcp-runtime/internal/cli/server`
- [CLI setup asset paths](#cli-setup-asset-paths) `mcp-runtime/internal/cli/setup/assetpath`
- [CLI setup ingress manifests](#cli-setup-ingress-manifests) `mcp-runtime/internal/cli/setup/ingressmanifest`
- [CLI setup plan](#cli-setup-plan) `mcp-runtime/internal/cli/setup/plan`
- [CLI binary](#cli-binary) `mcp-runtime/cmd/mcp-runtime`
- [Operator binary](#operator-binary) `mcp-runtime/cmd/operator`

<a id="api-types"></a>
## API types

Package: `v1alpha1`
Import path: `mcp-runtime/api/v1alpha1`

Source command:

```bash
go doc -all ./api/v1alpha1
```

<a id="api-types-overview"></a>
### Overview

Package v1alpha1 contains API Schema definitions for the MCP server resource.

### Jump To

- [Overview](#api-types-overview)
- [Index](#api-types-index)
- [Variables](#api-types-variables)
- [Types](#api-types-types)

<a id="api-types-index"></a>
### Index

- [`Variables`](#api-types-variables)
- [`type AnalyticsConfig struct`](#api-types-type-analyticsconfig-struct)
- [`func (in *AnalyticsConfig) DeepCopy() *AnalyticsConfig`](#api-types-func-in-analyticsconfig-deepcopy-analyticsconfig)
- [`func (in *AnalyticsConfig) DeepCopyInto(out *AnalyticsConfig)`](#api-types-func-in-analyticsconfig-deepcopyinto-out-analyticsconfig)
- [`type AuthConfig struct`](#api-types-type-authconfig-struct)
- [`func (in *AuthConfig) DeepCopy() *AuthConfig`](#api-types-func-in-authconfig-deepcopy-authconfig)
- [`func (in *AuthConfig) DeepCopyInto(out *AuthConfig)`](#api-types-func-in-authconfig-deepcopyinto-out-authconfig)
- [`type AuthMode string`](#api-types-type-authmode-string)
- [`type EnvVar struct`](#api-types-type-envvar-struct)
- [`func (in *EnvVar) DeepCopy() *EnvVar`](#api-types-func-in-envvar-deepcopy-envvar)
- [`func (in *EnvVar) DeepCopyInto(out *EnvVar)`](#api-types-func-in-envvar-deepcopyinto-out-envvar)
- [`type GatewayConfig struct`](#api-types-type-gatewayconfig-struct)
- [`func (in *GatewayConfig) DeepCopy() *GatewayConfig`](#api-types-func-in-gatewayconfig-deepcopy-gatewayconfig)
- [`func (in *GatewayConfig) DeepCopyInto(out *GatewayConfig)`](#api-types-func-in-gatewayconfig-deepcopyinto-out-gatewayconfig)
- [`type InventoryItem struct`](#api-types-type-inventoryitem-struct)
- [`func (in *InventoryItem) DeepCopy() *InventoryItem`](#api-types-func-in-inventoryitem-deepcopy-inventoryitem)
- [`func (in *InventoryItem) DeepCopyInto(out *InventoryItem)`](#api-types-func-in-inventoryitem-deepcopyinto-out-inventoryitem)
- [`type MCPAccessGrant struct`](#api-types-type-mcpaccessgrant-struct)
- [`func (in *MCPAccessGrant) DeepCopy() *MCPAccessGrant`](#api-types-func-in-mcpaccessgrant-deepcopy-mcpaccessgrant)
- [`func (in *MCPAccessGrant) DeepCopyInto(out *MCPAccessGrant)`](#api-types-func-in-mcpaccessgrant-deepcopyinto-out-mcpaccessgrant)
- [`func (in *MCPAccessGrant) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpaccessgrant-deepcopyobject-runtime-object)
- [`func (r *MCPAccessGrant) SetupWebhookWithManager(mgr ctrl.Manager) error`](#api-types-func-r-mcpaccessgrant-setupwebhookwithmanager-mgr-ctrl-manager-error)
- [`func (r *MCPAccessGrant) ValidateCreate() (admission.Warnings, error)`](#api-types-func-r-mcpaccessgrant-validatecreate-admission-warnings-error)
- [`func (r *MCPAccessGrant) ValidateDelete() (admission.Warnings, error)`](#api-types-func-r-mcpaccessgrant-validatedelete-admission-warnings-error)
- [`func (r *MCPAccessGrant) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)`](#api-types-func-r-mcpaccessgrant-validateupdate-runtime-object-admission-warnings-error)
- [`type MCPAccessGrantList struct`](#api-types-type-mcpaccessgrantlist-struct)
- [`func (in *MCPAccessGrantList) DeepCopy() *MCPAccessGrantList`](#api-types-func-in-mcpaccessgrantlist-deepcopy-mcpaccessgrantlist)
- [`func (in *MCPAccessGrantList) DeepCopyInto(out *MCPAccessGrantList)`](#api-types-func-in-mcpaccessgrantlist-deepcopyinto-out-mcpaccessgrantlist)
- [`func (in *MCPAccessGrantList) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpaccessgrantlist-deepcopyobject-runtime-object)
- [`type MCPAccessGrantSpec struct`](#api-types-type-mcpaccessgrantspec-struct)
- [`func (in *MCPAccessGrantSpec) DeepCopy() *MCPAccessGrantSpec`](#api-types-func-in-mcpaccessgrantspec-deepcopy-mcpaccessgrantspec)
- [`func (in *MCPAccessGrantSpec) DeepCopyInto(out *MCPAccessGrantSpec)`](#api-types-func-in-mcpaccessgrantspec-deepcopyinto-out-mcpaccessgrantspec)
- [`type MCPAccessGrantStatus struct`](#api-types-type-mcpaccessgrantstatus-struct)
- [`func (in *MCPAccessGrantStatus) DeepCopy() *MCPAccessGrantStatus`](#api-types-func-in-mcpaccessgrantstatus-deepcopy-mcpaccessgrantstatus)
- [`func (in *MCPAccessGrantStatus) DeepCopyInto(out *MCPAccessGrantStatus)`](#api-types-func-in-mcpaccessgrantstatus-deepcopyinto-out-mcpaccessgrantstatus)
- [`type MCPAgentSession struct`](#api-types-type-mcpagentsession-struct)
- [`func (in *MCPAgentSession) DeepCopy() *MCPAgentSession`](#api-types-func-in-mcpagentsession-deepcopy-mcpagentsession)
- [`func (in *MCPAgentSession) DeepCopyInto(out *MCPAgentSession)`](#api-types-func-in-mcpagentsession-deepcopyinto-out-mcpagentsession)
- [`func (in *MCPAgentSession) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpagentsession-deepcopyobject-runtime-object)
- [`func (r *MCPAgentSession) SetupWebhookWithManager(mgr ctrl.Manager) error`](#api-types-func-r-mcpagentsession-setupwebhookwithmanager-mgr-ctrl-manager-error)
- [`func (r *MCPAgentSession) ValidateCreate() (admission.Warnings, error)`](#api-types-func-r-mcpagentsession-validatecreate-admission-warnings-error)
- [`func (r *MCPAgentSession) ValidateDelete() (admission.Warnings, error)`](#api-types-func-r-mcpagentsession-validatedelete-admission-warnings-error)
- [`func (r *MCPAgentSession) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)`](#api-types-func-r-mcpagentsession-validateupdate-runtime-object-admission-warnings-error)
- [`type MCPAgentSessionList struct`](#api-types-type-mcpagentsessionlist-struct)
- [`func (in *MCPAgentSessionList) DeepCopy() *MCPAgentSessionList`](#api-types-func-in-mcpagentsessionlist-deepcopy-mcpagentsessionlist)
- [`func (in *MCPAgentSessionList) DeepCopyInto(out *MCPAgentSessionList)`](#api-types-func-in-mcpagentsessionlist-deepcopyinto-out-mcpagentsessionlist)
- [`func (in *MCPAgentSessionList) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpagentsessionlist-deepcopyobject-runtime-object)
- [`type MCPAgentSessionSpec struct`](#api-types-type-mcpagentsessionspec-struct)
- [`func (in *MCPAgentSessionSpec) DeepCopy() *MCPAgentSessionSpec`](#api-types-func-in-mcpagentsessionspec-deepcopy-mcpagentsessionspec)
- [`func (in *MCPAgentSessionSpec) DeepCopyInto(out *MCPAgentSessionSpec)`](#api-types-func-in-mcpagentsessionspec-deepcopyinto-out-mcpagentsessionspec)
- [`type MCPAgentSessionStatus struct`](#api-types-type-mcpagentsessionstatus-struct)
- [`func (in *MCPAgentSessionStatus) DeepCopy() *MCPAgentSessionStatus`](#api-types-func-in-mcpagentsessionstatus-deepcopy-mcpagentsessionstatus)
- [`func (in *MCPAgentSessionStatus) DeepCopyInto(out *MCPAgentSessionStatus)`](#api-types-func-in-mcpagentsessionstatus-deepcopyinto-out-mcpagentsessionstatus)
- [`type MCPServer struct`](#api-types-type-mcpserver-struct)
- [`func (in *MCPServer) DeepCopy() *MCPServer`](#api-types-func-in-mcpserver-deepcopy-mcpserver)
- [`func (in *MCPServer) DeepCopyInto(out *MCPServer)`](#api-types-func-in-mcpserver-deepcopyinto-out-mcpserver)
- [`func (in *MCPServer) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpserver-deepcopyobject-runtime-object)
- [`func (r *MCPServer) Default()`](#api-types-func-r-mcpserver-default)
- [`func (r *MCPServer) SetupWebhookWithManager(mgr ctrl.Manager) error`](#api-types-func-r-mcpserver-setupwebhookwithmanager-mgr-ctrl-manager-error)
- [`func (r *MCPServer) String() string`](#api-types-func-r-mcpserver-string-string)
- [`func (r *MCPServer) ValidateCreate() (admission.Warnings, error)`](#api-types-func-r-mcpserver-validatecreate-admission-warnings-error)
- [`func (r *MCPServer) ValidateDelete() (admission.Warnings, error)`](#api-types-func-r-mcpserver-validatedelete-admission-warnings-error)
- [`func (r *MCPServer) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)`](#api-types-func-r-mcpserver-validateupdate-runtime-object-admission-warnings-error)
- [`type MCPServerList struct`](#api-types-type-mcpserverlist-struct)
- [`func (in *MCPServerList) DeepCopy() *MCPServerList`](#api-types-func-in-mcpserverlist-deepcopy-mcpserverlist)
- [`func (in *MCPServerList) DeepCopyInto(out *MCPServerList)`](#api-types-func-in-mcpserverlist-deepcopyinto-out-mcpserverlist)
- [`func (in *MCPServerList) DeepCopyObject() runtime.Object`](#api-types-func-in-mcpserverlist-deepcopyobject-runtime-object)
- [`type MCPServerSpec struct`](#api-types-type-mcpserverspec-struct)
- [`func (in *MCPServerSpec) DeepCopy() *MCPServerSpec`](#api-types-func-in-mcpserverspec-deepcopy-mcpserverspec)
- [`func (in *MCPServerSpec) DeepCopyInto(out *MCPServerSpec)`](#api-types-func-in-mcpserverspec-deepcopyinto-out-mcpserverspec)
- [`type MCPServerStatus struct`](#api-types-type-mcpserverstatus-struct)
- [`func (in *MCPServerStatus) DeepCopy() *MCPServerStatus`](#api-types-func-in-mcpserverstatus-deepcopy-mcpserverstatus)
- [`func (in *MCPServerStatus) DeepCopyInto(out *MCPServerStatus)`](#api-types-func-in-mcpserverstatus-deepcopyinto-out-mcpserverstatus)
- [`type PolicyConfig struct`](#api-types-type-policyconfig-struct)
- [`func (in *PolicyConfig) DeepCopy() *PolicyConfig`](#api-types-func-in-policyconfig-deepcopy-policyconfig)
- [`func (in *PolicyConfig) DeepCopyInto(out *PolicyConfig)`](#api-types-func-in-policyconfig-deepcopyinto-out-policyconfig)
- [`type PolicyDecision string`](#api-types-type-policydecision-string)
- [`type PolicyMode string`](#api-types-type-policymode-string)
- [`type ResourceList struct`](#api-types-type-resourcelist-struct)
- [`func (in *ResourceList) DeepCopy() *ResourceList`](#api-types-func-in-resourcelist-deepcopy-resourcelist)
- [`func (in *ResourceList) DeepCopyInto(out *ResourceList)`](#api-types-func-in-resourcelist-deepcopyinto-out-resourcelist)
- [`type ResourceRequirements struct`](#api-types-type-resourcerequirements-struct)
- [`func (in *ResourceRequirements) DeepCopy() *ResourceRequirements`](#api-types-func-in-resourcerequirements-deepcopy-resourcerequirements)
- [`func (in *ResourceRequirements) DeepCopyInto(out *ResourceRequirements)`](#api-types-func-in-resourcerequirements-deepcopyinto-out-resourcerequirements)
- [`type RolloutConfig struct`](#api-types-type-rolloutconfig-struct)
- [`func (in *RolloutConfig) DeepCopy() *RolloutConfig`](#api-types-func-in-rolloutconfig-deepcopy-rolloutconfig)
- [`func (in *RolloutConfig) DeepCopyInto(out *RolloutConfig)`](#api-types-func-in-rolloutconfig-deepcopyinto-out-rolloutconfig)
- [`type RolloutStrategy string`](#api-types-type-rolloutstrategy-string)
- [`type SecretEnvVar struct`](#api-types-type-secretenvvar-struct)
- [`func (in *SecretEnvVar) DeepCopy() *SecretEnvVar`](#api-types-func-in-secretenvvar-deepcopy-secretenvvar)
- [`func (in *SecretEnvVar) DeepCopyInto(out *SecretEnvVar)`](#api-types-func-in-secretenvvar-deepcopyinto-out-secretenvvar)
- [`type SecretKeyRef struct`](#api-types-type-secretkeyref-struct)
- [`func (in *SecretKeyRef) DeepCopy() *SecretKeyRef`](#api-types-func-in-secretkeyref-deepcopy-secretkeyref)
- [`func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef)`](#api-types-func-in-secretkeyref-deepcopyinto-out-secretkeyref)
- [`type ServerReference struct`](#api-types-type-serverreference-struct)
- [`func (in *ServerReference) DeepCopy() *ServerReference`](#api-types-func-in-serverreference-deepcopy-serverreference)
- [`func (in *ServerReference) DeepCopyInto(out *ServerReference)`](#api-types-func-in-serverreference-deepcopyinto-out-serverreference)
- [`type SessionConfig struct`](#api-types-type-sessionconfig-struct)
- [`func (in *SessionConfig) DeepCopy() *SessionConfig`](#api-types-func-in-sessionconfig-deepcopy-sessionconfig)
- [`func (in *SessionConfig) DeepCopyInto(out *SessionConfig)`](#api-types-func-in-sessionconfig-deepcopyinto-out-sessionconfig)
- [`type SubjectRef struct`](#api-types-type-subjectref-struct)
- [`func (in *SubjectRef) DeepCopy() *SubjectRef`](#api-types-func-in-subjectref-deepcopy-subjectref)
- [`func (in *SubjectRef) DeepCopyInto(out *SubjectRef)`](#api-types-func-in-subjectref-deepcopyinto-out-subjectref)
- [`type ToolConfig struct`](#api-types-type-toolconfig-struct)
- [`func (in *ToolConfig) DeepCopy() *ToolConfig`](#api-types-func-in-toolconfig-deepcopy-toolconfig)
- [`func (in *ToolConfig) DeepCopyInto(out *ToolConfig)`](#api-types-func-in-toolconfig-deepcopyinto-out-toolconfig)
- [`type ToolRule struct`](#api-types-type-toolrule-struct)
- [`func (in *ToolRule) DeepCopy() *ToolRule`](#api-types-func-in-toolrule-deepcopy-toolrule)
- [`func (in *ToolRule) DeepCopyInto(out *ToolRule)`](#api-types-func-in-toolrule-deepcopyinto-out-toolrule)
- [`type TrustLevel string`](#api-types-type-trustlevel-string)

<a id="api-types-variables"></a>
### Variables

```text
var (
	// GroupVersion is group version used to register these objects
	GroupVersion = schema.GroupVersion{Group: "mcpruntime.org", Version: "v1alpha1"}

	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)

	// AddToScheme adds the types in this group-version to the given scheme.
	AddToScheme = SchemeBuilder.AddToScheme
)
```

<a id="api-types-types"></a>
### Types

<a id="api-types-type-analyticsconfig-struct"></a>
```text
type AnalyticsConfig struct {
	// Enabled turns on analytics emission from the gateway sidecar.
	Enabled bool `json:"enabled,omitempty"`

	// IngestURL is the analytics ingest endpoint.
	IngestURL string `json:"ingestURL,omitempty"`

	// Source is the event source label attached to emitted analytics events.
	Source string `json:"source,omitempty"`

	// EventType is the event type label attached to emitted analytics events.
	EventType string `json:"eventType,omitempty"`

	// APIKeySecretRef points to a secret key containing the analytics API key.
	APIKeySecretRef *SecretKeyRef `json:"apiKeySecretRef,omitempty"`
}
    AnalyticsConfig configures analytics emission from the gateway sidecar.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-analyticsconfig-deepcopy-analyticsconfig"></a>
```text
func (in *AnalyticsConfig) DeepCopy() *AnalyticsConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new AnalyticsConfig.

```

<a id="api-types-func-in-analyticsconfig-deepcopyinto-out-analyticsconfig"></a>
```text
func (in *AnalyticsConfig) DeepCopyInto(out *AnalyticsConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-authconfig-struct"></a>
```text
type AuthConfig struct {
	Mode            AuthMode `json:"mode,omitempty"`
	HumanIDHeader   string   `json:"humanIDHeader,omitempty"`
	AgentIDHeader   string   `json:"agentIDHeader,omitempty"`
	SessionIDHeader string   `json:"sessionIDHeader,omitempty"`
	TokenHeader     string   `json:"tokenHeader,omitempty"`
	IssuerURL       string   `json:"issuerURL,omitempty"`
	Audience        string   `json:"audience,omitempty"`
}
    AuthConfig configures how identities are extracted at the gateway.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-authconfig-deepcopy-authconfig"></a>
```text
func (in *AuthConfig) DeepCopy() *AuthConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new AuthConfig.

```

<a id="api-types-func-in-authconfig-deepcopyinto-out-authconfig"></a>
```text
func (in *AuthConfig) DeepCopyInto(out *AuthConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-authmode-string"></a>
```text
type AuthMode string
    +kubebuilder:validation:Enum=none;header;oauth

const (
	AuthModeNone   AuthMode = "none"
	AuthModeHeader AuthMode = "header"
	AuthModeOAuth  AuthMode = "oauth"
)
```

<a id="api-types-type-envvar-struct"></a>
```text
type EnvVar struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}
    EnvVar represents a literal environment variable.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-envvar-deepcopy-envvar"></a>
```text
func (in *EnvVar) DeepCopy() *EnvVar
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new EnvVar.

```

<a id="api-types-func-in-envvar-deepcopyinto-out-envvar"></a>
```text
func (in *EnvVar) DeepCopyInto(out *EnvVar)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-gatewayconfig-struct"></a>
```text
type GatewayConfig struct {
	// Enabled turns on the gateway sidecar for this server.
	Enabled bool `json:"enabled,omitempty"`

	// Image overrides the proxy container image for this server.
	Image string `json:"image,omitempty"`

	// Port is the port the gateway listens on inside the pod (defaults to 8091).
	Port int32 `json:"port,omitempty"`

	// UpstreamURL is the upstream URL the gateway proxies to.
	// Defaults to http://127.0.0.1:<spec.port>.
	UpstreamURL string `json:"upstreamURL,omitempty"`

	// StripPrefix removes a path prefix before forwarding to the upstream server.
	StripPrefix string `json:"stripPrefix,omitempty"`
}
    GatewayConfig configures an optional MCP proxy sidecar for a server.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-gatewayconfig-deepcopy-gatewayconfig"></a>
```text
func (in *GatewayConfig) DeepCopy() *GatewayConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new GatewayConfig.

```

<a id="api-types-func-in-gatewayconfig-deepcopyinto-out-gatewayconfig"></a>
```text
func (in *GatewayConfig) DeepCopyInto(out *GatewayConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-inventoryitem-struct"></a>
```text
type InventoryItem struct {
	Name        string            `json:"name"`
	Description string            `json:"description,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
}
    InventoryItem describes a named MCP prompt, resource, or task.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-inventoryitem-deepcopy-inventoryitem"></a>
```text
func (in *InventoryItem) DeepCopy() *InventoryItem
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new InventoryItem.

```

<a id="api-types-func-in-inventoryitem-deepcopyinto-out-inventoryitem"></a>
```text
func (in *InventoryItem) DeepCopyInto(out *InventoryItem)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpaccessgrant-struct"></a>
```text
type MCPAccessGrant struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MCPAccessGrantSpec   `json:"spec,omitempty"`
	Status MCPAccessGrantStatus `json:"status,omitempty"`
}
    MCPAccessGrant grants a human or agent access to an MCPServer.

```

<a id="api-types-func-in-mcpaccessgrant-deepcopy-mcpaccessgrant"></a>
```text
func (in *MCPAccessGrant) DeepCopy() *MCPAccessGrant
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAccessGrant.

```

<a id="api-types-func-in-mcpaccessgrant-deepcopyinto-out-mcpaccessgrant"></a>
```text
func (in *MCPAccessGrant) DeepCopyInto(out *MCPAccessGrant)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpaccessgrant-deepcopyobject-runtime-object"></a>
```text
func (in *MCPAccessGrant) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-func-r-mcpaccessgrant-setupwebhookwithmanager-mgr-ctrl-manager-error"></a>
```text
func (r *MCPAccessGrant) SetupWebhookWithManager(mgr ctrl.Manager) error
    +kubebuilder:webhook:path=/validate-mcpruntime-org-v1alpha1-mcpaccessgrant,mutating=false,failurePolicy=fail,sideEffects=None,groups=mcpruntime.org,resources=mcpaccessgrants,verbs=create;update,versions=v1alpha1,name=vmcpaccessgrant.kb.io,admissionReviewVersions=v1

```

<a id="api-types-func-r-mcpaccessgrant-validatecreate-admission-warnings-error"></a>
```text
func (r *MCPAccessGrant) ValidateCreate() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpaccessgrant-validatedelete-admission-warnings-error"></a>
```text
func (r *MCPAccessGrant) ValidateDelete() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpaccessgrant-validateupdate-runtime-object-admission-warnings-error"></a>
```text
func (r *MCPAccessGrant) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)

```

<a id="api-types-type-mcpaccessgrantlist-struct"></a>
```text
type MCPAccessGrantList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MCPAccessGrant `json:"items"`
}
    MCPAccessGrantList contains a list of MCPAccessGrant.

```

<a id="api-types-func-in-mcpaccessgrantlist-deepcopy-mcpaccessgrantlist"></a>
```text
func (in *MCPAccessGrantList) DeepCopy() *MCPAccessGrantList
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAccessGrantList.

```

<a id="api-types-func-in-mcpaccessgrantlist-deepcopyinto-out-mcpaccessgrantlist"></a>
```text
func (in *MCPAccessGrantList) DeepCopyInto(out *MCPAccessGrantList)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpaccessgrantlist-deepcopyobject-runtime-object"></a>
```text
func (in *MCPAccessGrantList) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-type-mcpaccessgrantspec-struct"></a>
```text
type MCPAccessGrantSpec struct {
	ServerRef     ServerReference `json:"serverRef"`
	Subject       SubjectRef      `json:"subject"`
	MaxTrust      TrustLevel      `json:"maxTrust,omitempty"`
	PolicyVersion string          `json:"policyVersion,omitempty"`
	Disabled      bool            `json:"disabled,omitempty"`
	ToolRules     []ToolRule      `json:"toolRules,omitempty"`
}
    MCPAccessGrantSpec defines who can use which MCP server and with what trust
    ceiling. +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpaccessgrantspec-deepcopy-mcpaccessgrantspec"></a>
```text
func (in *MCPAccessGrantSpec) DeepCopy() *MCPAccessGrantSpec
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAccessGrantSpec.

```

<a id="api-types-func-in-mcpaccessgrantspec-deepcopyinto-out-mcpaccessgrantspec"></a>
```text
func (in *MCPAccessGrantSpec) DeepCopyInto(out *MCPAccessGrantSpec)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpaccessgrantstatus-struct"></a>
```text
type MCPAccessGrantStatus struct {
	Phase      string             `json:"phase,omitempty"`
	Message    string             `json:"message,omitempty"`
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}
    MCPAccessGrantStatus captures observed grant state.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpaccessgrantstatus-deepcopy-mcpaccessgrantstatus"></a>
```text
func (in *MCPAccessGrantStatus) DeepCopy() *MCPAccessGrantStatus
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAccessGrantStatus.

```

<a id="api-types-func-in-mcpaccessgrantstatus-deepcopyinto-out-mcpaccessgrantstatus"></a>
```text
func (in *MCPAccessGrantStatus) DeepCopyInto(out *MCPAccessGrantStatus)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpagentsession-struct"></a>
```text
type MCPAgentSession struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MCPAgentSessionSpec   `json:"spec,omitempty"`
	Status MCPAgentSessionStatus `json:"status,omitempty"`
}
    MCPAgentSession stores consent and upstream token state for an agent
    session.

```

<a id="api-types-func-in-mcpagentsession-deepcopy-mcpagentsession"></a>
```text
func (in *MCPAgentSession) DeepCopy() *MCPAgentSession
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAgentSession.

```

<a id="api-types-func-in-mcpagentsession-deepcopyinto-out-mcpagentsession"></a>
```text
func (in *MCPAgentSession) DeepCopyInto(out *MCPAgentSession)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpagentsession-deepcopyobject-runtime-object"></a>
```text
func (in *MCPAgentSession) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-func-r-mcpagentsession-setupwebhookwithmanager-mgr-ctrl-manager-error"></a>
```text
func (r *MCPAgentSession) SetupWebhookWithManager(mgr ctrl.Manager) error
    +kubebuilder:webhook:path=/validate-mcpruntime-org-v1alpha1-mcpagentsession,mutating=false,failurePolicy=fail,sideEffects=None,groups=mcpruntime.org,resources=mcpagentsessions,verbs=create;update,versions=v1alpha1,name=vmcpagentsession.kb.io,admissionReviewVersions=v1

```

<a id="api-types-func-r-mcpagentsession-validatecreate-admission-warnings-error"></a>
```text
func (r *MCPAgentSession) ValidateCreate() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpagentsession-validatedelete-admission-warnings-error"></a>
```text
func (r *MCPAgentSession) ValidateDelete() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpagentsession-validateupdate-runtime-object-admission-warnings-error"></a>
```text
func (r *MCPAgentSession) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)

```

<a id="api-types-type-mcpagentsessionlist-struct"></a>
```text
type MCPAgentSessionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MCPAgentSession `json:"items"`
}
    MCPAgentSessionList contains a list of MCPAgentSession.

```

<a id="api-types-func-in-mcpagentsessionlist-deepcopy-mcpagentsessionlist"></a>
```text
func (in *MCPAgentSessionList) DeepCopy() *MCPAgentSessionList
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAgentSessionList.

```

<a id="api-types-func-in-mcpagentsessionlist-deepcopyinto-out-mcpagentsessionlist"></a>
```text
func (in *MCPAgentSessionList) DeepCopyInto(out *MCPAgentSessionList)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpagentsessionlist-deepcopyobject-runtime-object"></a>
```text
func (in *MCPAgentSessionList) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-type-mcpagentsessionspec-struct"></a>
```text
type MCPAgentSessionSpec struct {
	ServerRef              ServerReference `json:"serverRef"`
	Subject                SubjectRef      `json:"subject"`
	ConsentedTrust         TrustLevel      `json:"consentedTrust,omitempty"`
	ExpiresAt              *metav1.Time    `json:"expiresAt,omitempty"`
	Revoked                bool            `json:"revoked,omitempty"`
	UpstreamTokenSecretRef *SecretKeyRef   `json:"upstreamTokenSecretRef,omitempty"`
	PolicyVersion          string          `json:"policyVersion,omitempty"`
}
    MCPAgentSessionSpec defines a consented server-side agent session.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpagentsessionspec-deepcopy-mcpagentsessionspec"></a>
```text
func (in *MCPAgentSessionSpec) DeepCopy() *MCPAgentSessionSpec
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAgentSessionSpec.

```

<a id="api-types-func-in-mcpagentsessionspec-deepcopyinto-out-mcpagentsessionspec"></a>
```text
func (in *MCPAgentSessionSpec) DeepCopyInto(out *MCPAgentSessionSpec)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpagentsessionstatus-struct"></a>
```text
type MCPAgentSessionStatus struct {
	Phase      string             `json:"phase,omitempty"`
	Message    string             `json:"message,omitempty"`
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}
    MCPAgentSessionStatus captures observed session state.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpagentsessionstatus-deepcopy-mcpagentsessionstatus"></a>
```text
func (in *MCPAgentSessionStatus) DeepCopy() *MCPAgentSessionStatus
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPAgentSessionStatus.

```

<a id="api-types-func-in-mcpagentsessionstatus-deepcopyinto-out-mcpagentsessionstatus"></a>
```text
func (in *MCPAgentSessionStatus) DeepCopyInto(out *MCPAgentSessionStatus)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpserver-struct"></a>
```text
type MCPServer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MCPServerSpec   `json:"spec,omitempty"`
	Status MCPServerStatus `json:"status,omitempty"`
}
    MCPServer is the Schema for the mcpservers API.

```

<a id="api-types-func-in-mcpserver-deepcopy-mcpserver"></a>
```text
func (in *MCPServer) DeepCopy() *MCPServer
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPServer.

```

<a id="api-types-func-in-mcpserver-deepcopyinto-out-mcpserver"></a>
```text
func (in *MCPServer) DeepCopyInto(out *MCPServer)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpserver-deepcopyobject-runtime-object"></a>
```text
func (in *MCPServer) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-func-r-mcpserver-default"></a>
```text
func (r *MCPServer) Default()
    +kubebuilder:webhook:path=/mutate-mcpruntime-org-v1alpha1-mcpserver,mutating=true,failurePolicy=fail,sideEffects=None,groups=mcpruntime.org,resources=mcpservers,verbs=create;update,versions=v1alpha1,name=mmcpserver.kb.io,admissionReviewVersions=v1

```

<a id="api-types-func-r-mcpserver-setupwebhookwithmanager-mgr-ctrl-manager-error"></a>
```text
func (r *MCPServer) SetupWebhookWithManager(mgr ctrl.Manager) error
    +kubebuilder:webhook:path=/validate-mcpruntime-org-v1alpha1-mcpserver,mutating=false,failurePolicy=fail,sideEffects=None,groups=mcpruntime.org,resources=mcpservers,verbs=create;update,versions=v1alpha1,name=vmcpserver.kb.io,admissionReviewVersions=v1

```

<a id="api-types-func-r-mcpserver-string-string"></a>
```text
func (r *MCPServer) String() string

```

<a id="api-types-func-r-mcpserver-validatecreate-admission-warnings-error"></a>
```text
func (r *MCPServer) ValidateCreate() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpserver-validatedelete-admission-warnings-error"></a>
```text
func (r *MCPServer) ValidateDelete() (admission.Warnings, error)

```

<a id="api-types-func-r-mcpserver-validateupdate-runtime-object-admission-warnings-error"></a>
```text
func (r *MCPServer) ValidateUpdate(_ runtime.Object) (admission.Warnings, error)

```

<a id="api-types-type-mcpserverlist-struct"></a>
```text
type MCPServerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MCPServer `json:"items"`
}
    MCPServerList contains a list of MCPServer.

```

<a id="api-types-func-in-mcpserverlist-deepcopy-mcpserverlist"></a>
```text
func (in *MCPServerList) DeepCopy() *MCPServerList
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPServerList.

```

<a id="api-types-func-in-mcpserverlist-deepcopyinto-out-mcpserverlist"></a>
```text
func (in *MCPServerList) DeepCopyInto(out *MCPServerList)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-func-in-mcpserverlist-deepcopyobject-runtime-object"></a>
```text
func (in *MCPServerList) DeepCopyObject() runtime.Object
    DeepCopyObject is an autogenerated deepcopy function, copying the receiver,
    creating a new runtime.Object.

```

<a id="api-types-type-mcpserverspec-struct"></a>
```text
type MCPServerSpec struct {
	// Image is the container image for the MCP server.
	Image string `json:"image"`

	// ImageTag is the tag of the container image (defaults to "latest").
	ImageTag string `json:"imageTag,omitempty"`

	// RegistryOverride, if set, overrides the registry portion of the image (e.g., registry.mcpruntime.com).
	RegistryOverride string `json:"registryOverride,omitempty"`

	// UseProvisionedRegistry tells the controller to use the provisioned registry (from operator env) for this server.
	UseProvisionedRegistry bool `json:"useProvisionedRegistry,omitempty"`

	// ImagePullSecrets are secrets to use for pulling the image.
	ImagePullSecrets []string `json:"imagePullSecrets,omitempty"`

	// Replicas is the number of desired replicas (defaults to 1).
	Replicas *int32 `json:"replicas,omitempty"`

	// Port is the port the container listens on (defaults to 8088).
	Port int32 `json:"port,omitempty"`

	// ServicePort is the port exposed by the service (defaults to 80).
	ServicePort int32 `json:"servicePort,omitempty"`

	// IngressPath is the path for the ingress route (defaults to /{name}/mcp).
	IngressPath string `json:"ingressPath,omitempty"`

	// IngressHost is the hostname for the ingress (required unless publicPathPrefix is set; defaults from MCP_DEFAULT_INGRESS_HOST env var if set on the operator).
	IngressHost string `json:"ingressHost,omitempty"`

	// PublicPathPrefix enables path-based public routing and is used to compute /<publicPathPrefix>/mcp.
	// When set, the operator prefers path-based ingress rules without a host match.
	PublicPathPrefix string `json:"publicPathPrefix,omitempty"`

	// IngressClass is the ingress class to use (e.g., "traefik", "nginx", "istio"). Defaults to "traefik".
	IngressClass string `json:"ingressClass,omitempty"`

	// IngressAnnotations are additional annotations for the ingress controller.
	IngressAnnotations map[string]string `json:"ingressAnnotations,omitempty"`

	// Resources defines resource limits and requests.
	Resources ResourceRequirements `json:"resources,omitempty"`

	// EnvVars are literal environment variables to pass to the container.
	EnvVars []EnvVar `json:"envVars,omitempty"`

	// SecretEnvVars are secret-backed environment variables to pass to the container.
	SecretEnvVars []SecretEnvVar `json:"secretEnvVars,omitempty"`

	// Tools describes the MCP tool inventory exposed by the server.
	Tools []ToolConfig `json:"tools,omitempty"`

	// Prompts describes the MCP prompt inventory exposed by the server.
	Prompts []InventoryItem `json:"prompts,omitempty"`

	// MCPResources describes the MCP resource inventory exposed by the server.
	MCPResources []InventoryItem `json:"mcpResources,omitempty"`

	// Tasks describes task templates or workflows exposed by the server.
	Tasks []InventoryItem `json:"tasks,omitempty"`

	// Auth configures how the gateway extracts human, agent, and session identity.
	Auth *AuthConfig `json:"auth,omitempty"`

	// Policy configures gateway-side authorization behavior.
	Policy *PolicyConfig `json:"policy,omitempty"`

	// Session configures server-side agent session behavior.
	Session *SessionConfig `json:"session,omitempty"`

	// Gateway configures an optional MCP proxy sidecar in front of the server container.
	Gateway *GatewayConfig `json:"gateway,omitempty"`

	// Analytics configures audit/analytics emission for the gateway sidecar.
	// Analytics is only applied when Gateway is enabled.
	Analytics *AnalyticsConfig `json:"analytics,omitempty"`

	// Rollout configures deployment rollout behavior for this server.
	Rollout *RolloutConfig `json:"rollout,omitempty"`
}
    MCPServerSpec defines the desired state of MCPServer.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpserverspec-deepcopy-mcpserverspec"></a>
```text
func (in *MCPServerSpec) DeepCopy() *MCPServerSpec
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPServerSpec.

```

<a id="api-types-func-in-mcpserverspec-deepcopyinto-out-mcpserverspec"></a>
```text
func (in *MCPServerSpec) DeepCopyInto(out *MCPServerSpec)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-mcpserverstatus-struct"></a>
```text
type MCPServerStatus struct {
	// Phase represents the current phase of the MCPServer.
	Phase string `json:"phase,omitempty"`

	// Message provides additional information about the status.
	Message string `json:"message,omitempty"`

	// Conditions represent the latest available observations.
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// DeploymentReady indicates if the deployment is ready.
	DeploymentReady bool `json:"deploymentReady,omitempty"`

	// ServiceReady indicates if the service is ready.
	ServiceReady bool `json:"serviceReady,omitempty"`

	// IngressReady indicates if the ingress is ready.
	IngressReady bool `json:"ingressReady,omitempty"`

	// GatewayReady indicates if the gateway configuration and sidecar are ready.
	GatewayReady bool `json:"gatewayReady,omitempty"`

	// PolicyReady indicates if policy data for the gateway has been generated.
	PolicyReady bool `json:"policyReady,omitempty"`

	// CanaryReady indicates if the canary deployment, when configured, is ready.
	CanaryReady bool `json:"canaryReady,omitempty"`
}
    MCPServerStatus defines the observed state of MCPServer.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-mcpserverstatus-deepcopy-mcpserverstatus"></a>
```text
func (in *MCPServerStatus) DeepCopy() *MCPServerStatus
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new MCPServerStatus.

```

<a id="api-types-func-in-mcpserverstatus-deepcopyinto-out-mcpserverstatus"></a>
```text
func (in *MCPServerStatus) DeepCopyInto(out *MCPServerStatus)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-policyconfig-struct"></a>
```text
type PolicyConfig struct {
	Mode            PolicyMode     `json:"mode,omitempty"`
	DefaultDecision PolicyDecision `json:"defaultDecision,omitempty"`
	EnforceOn       string         `json:"enforceOn,omitempty"`
	PolicyVersion   string         `json:"policyVersion,omitempty"`
}
    PolicyConfig configures authorization behavior at the gateway.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-policyconfig-deepcopy-policyconfig"></a>
```text
func (in *PolicyConfig) DeepCopy() *PolicyConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new PolicyConfig.

```

<a id="api-types-func-in-policyconfig-deepcopyinto-out-policyconfig"></a>
```text
func (in *PolicyConfig) DeepCopyInto(out *PolicyConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-policydecision-string"></a>
```text
type PolicyDecision string
    +kubebuilder:validation:Enum=allow;deny

const (
	PolicyDecisionAllow PolicyDecision = "allow"
	PolicyDecisionDeny  PolicyDecision = "deny"
)
```

<a id="api-types-type-policymode-string"></a>
```text
type PolicyMode string
    +kubebuilder:validation:Enum=allow-list;observe

const (
	PolicyModeAllowList PolicyMode = "allow-list"
	PolicyModeObserve   PolicyMode = "observe"
)
```

<a id="api-types-type-resourcelist-struct"></a>
```text
type ResourceList struct {
	CPU    string `json:"cpu,omitempty"`
	Memory string `json:"memory,omitempty"`
}
    ResourceList defines CPU and memory resources.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-resourcelist-deepcopy-resourcelist"></a>
```text
func (in *ResourceList) DeepCopy() *ResourceList
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new ResourceList.

```

<a id="api-types-func-in-resourcelist-deepcopyinto-out-resourcelist"></a>
```text
func (in *ResourceList) DeepCopyInto(out *ResourceList)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-resourcerequirements-struct"></a>
```text
type ResourceRequirements struct {
	Limits   *ResourceList `json:"limits,omitempty"`
	Requests *ResourceList `json:"requests,omitempty"`
}
    ResourceRequirements defines resource limits and requests.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-resourcerequirements-deepcopy-resourcerequirements"></a>
```text
func (in *ResourceRequirements) DeepCopy() *ResourceRequirements
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new ResourceRequirements.

```

<a id="api-types-func-in-resourcerequirements-deepcopyinto-out-resourcerequirements"></a>
```text
func (in *ResourceRequirements) DeepCopyInto(out *ResourceRequirements)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-rolloutconfig-struct"></a>
```text
type RolloutConfig struct {
	Strategy       RolloutStrategy `json:"strategy,omitempty"`
	MaxUnavailable string          `json:"maxUnavailable,omitempty"`
	MaxSurge       string          `json:"maxSurge,omitempty"`
	CanaryReplicas *int32          `json:"canaryReplicas,omitempty"`
}
    RolloutConfig configures deployment rollout behavior.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-rolloutconfig-deepcopy-rolloutconfig"></a>
```text
func (in *RolloutConfig) DeepCopy() *RolloutConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new RolloutConfig.

```

<a id="api-types-func-in-rolloutconfig-deepcopyinto-out-rolloutconfig"></a>
```text
func (in *RolloutConfig) DeepCopyInto(out *RolloutConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-rolloutstrategy-string"></a>
```text
type RolloutStrategy string
    +kubebuilder:validation:Enum=RollingUpdate;Recreate;Canary

const (
	RolloutStrategyRollingUpdate RolloutStrategy = "RollingUpdate"
	RolloutStrategyRecreate      RolloutStrategy = "Recreate"
	RolloutStrategyCanary        RolloutStrategy = "Canary"
)
```

<a id="api-types-type-secretenvvar-struct"></a>
```text
type SecretEnvVar struct {
	Name         string        `json:"name"`
	SecretKeyRef *SecretKeyRef `json:"secretKeyRef,omitempty"`
}
    SecretEnvVar represents a secret-backed environment variable.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-secretenvvar-deepcopy-secretenvvar"></a>
```text
func (in *SecretEnvVar) DeepCopy() *SecretEnvVar
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new SecretEnvVar.

```

<a id="api-types-func-in-secretenvvar-deepcopyinto-out-secretenvvar"></a>
```text
func (in *SecretEnvVar) DeepCopyInto(out *SecretEnvVar)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-secretkeyref-struct"></a>
```text
type SecretKeyRef struct {
	Name string `json:"name"`
	Key  string `json:"key"`
}
    SecretKeyRef points to a single key in a Kubernetes Secret.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-secretkeyref-deepcopy-secretkeyref"></a>
```text
func (in *SecretKeyRef) DeepCopy() *SecretKeyRef
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new SecretKeyRef.

```

<a id="api-types-func-in-secretkeyref-deepcopyinto-out-secretkeyref"></a>
```text
func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-serverreference-struct"></a>
```text
type ServerReference struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace,omitempty"`
}
    ServerReference identifies an MCPServer. +kubebuilder:object:generate=true

```

<a id="api-types-func-in-serverreference-deepcopy-serverreference"></a>
```text
func (in *ServerReference) DeepCopy() *ServerReference
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new ServerReference.

```

<a id="api-types-func-in-serverreference-deepcopyinto-out-serverreference"></a>
```text
func (in *ServerReference) DeepCopyInto(out *ServerReference)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-sessionconfig-struct"></a>
```text
type SessionConfig struct {
	Required            bool   `json:"required,omitempty"`
	Store               string `json:"store,omitempty"`
	HeaderName          string `json:"headerName,omitempty"`
	MaxLifetime         string `json:"maxLifetime,omitempty"`
	IdleTimeout         string `json:"idleTimeout,omitempty"`
	UpstreamTokenHeader string `json:"upstreamTokenHeader,omitempty"`
}
    SessionConfig configures server-side agent session behavior.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-sessionconfig-deepcopy-sessionconfig"></a>
```text
func (in *SessionConfig) DeepCopy() *SessionConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new SessionConfig.

```

<a id="api-types-func-in-sessionconfig-deepcopyinto-out-sessionconfig"></a>
```text
func (in *SessionConfig) DeepCopyInto(out *SessionConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-subjectref-struct"></a>
```text
type SubjectRef struct {
	HumanID string `json:"humanID,omitempty"`
	AgentID string `json:"agentID,omitempty"`
}
    SubjectRef identifies the human and optional agent a grant or session
    applies to. +kubebuilder:object:generate=true

```

<a id="api-types-func-in-subjectref-deepcopy-subjectref"></a>
```text
func (in *SubjectRef) DeepCopy() *SubjectRef
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new SubjectRef.

```

<a id="api-types-func-in-subjectref-deepcopyinto-out-subjectref"></a>
```text
func (in *SubjectRef) DeepCopyInto(out *SubjectRef)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-toolconfig-struct"></a>
```text
type ToolConfig struct {
	Name          string            `json:"name"`
	Description   string            `json:"description,omitempty"`
	RequiredTrust TrustLevel        `json:"requiredTrust,omitempty"`
	Labels        map[string]string `json:"labels,omitempty"`
}
    ToolConfig describes one MCP tool exposed by a server.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-toolconfig-deepcopy-toolconfig"></a>
```text
func (in *ToolConfig) DeepCopy() *ToolConfig
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new ToolConfig.

```

<a id="api-types-func-in-toolconfig-deepcopyinto-out-toolconfig"></a>
```text
func (in *ToolConfig) DeepCopyInto(out *ToolConfig)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-toolrule-struct"></a>
```text
type ToolRule struct {
	Name          string         `json:"name"`
	Decision      PolicyDecision `json:"decision"`
	RequiredTrust TrustLevel     `json:"requiredTrust,omitempty"`
}
    ToolRule controls access to an individual MCP tool.
    +kubebuilder:object:generate=true

```

<a id="api-types-func-in-toolrule-deepcopy-toolrule"></a>
```text
func (in *ToolRule) DeepCopy() *ToolRule
    DeepCopy is an autogenerated deepcopy function, copying the receiver,
    creating a new ToolRule.

```

<a id="api-types-func-in-toolrule-deepcopyinto-out-toolrule"></a>
```text
func (in *ToolRule) DeepCopyInto(out *ToolRule)
    DeepCopyInto is an autogenerated deepcopy function, copying the receiver,
    writing into out. in must be non-nil.

```

<a id="api-types-type-trustlevel-string"></a>
```text
type TrustLevel string
    +kubebuilder:validation:Enum=low;medium;high

const (
	TrustLevelLow    TrustLevel = "low"
	TrustLevelMedium TrustLevel = "medium"
	TrustLevelHigh   TrustLevel = "high"
)
```

<a id="metadata-helpers"></a>
## Metadata helpers

Package: `metadata`
Import path: `mcp-runtime/pkg/metadata`

Source command:

```bash
go doc -all ./pkg/metadata
```

<a id="metadata-helpers-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#metadata-helpers-overview)
- [Index](#metadata-helpers-index)
- [Constants](#metadata-helpers-constants)
- [Functions](#metadata-helpers-functions)
- [Types](#metadata-helpers-types)

<a id="metadata-helpers-index"></a>
### Index

- [`Constants`](#metadata-helpers-constants)
- [`func GenerateCRD(server *ServerMetadata, outputPath string) error`](#metadata-helpers-func-generatecrd-server-servermetadata-outputpath-string-error)
- [`func GenerateCRDsFromRegistry(registry *RegistryFile, outputDir string) error`](#metadata-helpers-func-generatecrdsfromregistry-registry-registryfile-outputdir-string-error)
- [`func NormalizePlatformDomain(raw string) string`](#metadata-helpers-func-normalizeplatformdomain-raw-string-string)
- [`func ResolveMcpIngressHost() string`](#metadata-helpers-func-resolvemcpingresshost-string)
- [`func ResolvePlatformIngressHost() string`](#metadata-helpers-func-resolveplatformingresshost-string)
- [`func ResolveRegistryEndpoint() string`](#metadata-helpers-func-resolveregistryendpoint-string)
- [`func ResolveRegistryHost() string`](#metadata-helpers-func-resolveregistryhost-string)
- [`type AnalyticsConfig struct`](#metadata-helpers-type-analyticsconfig-struct)
- [`type AuthConfig struct`](#metadata-helpers-type-authconfig-struct)
- [`type AuthMode string`](#metadata-helpers-type-authmode-string)
- [`type EnvVar struct`](#metadata-helpers-type-envvar-struct)
- [`type GatewayConfig struct`](#metadata-helpers-type-gatewayconfig-struct)
- [`type InventoryItem struct`](#metadata-helpers-type-inventoryitem-struct)
- [`type PolicyConfig struct`](#metadata-helpers-type-policyconfig-struct)
- [`type PolicyDecision string`](#metadata-helpers-type-policydecision-string)
- [`type PolicyMode string`](#metadata-helpers-type-policymode-string)
- [`type RegistryFile struct`](#metadata-helpers-type-registryfile-struct)
- [`func LoadFromDirectory(dirPath string) (*RegistryFile, error)`](#metadata-helpers-func-loadfromdirectory-dirpath-string-registryfile-error)
- [`func LoadFromFile(filePath string) (*RegistryFile, error)`](#metadata-helpers-func-loadfromfile-filepath-string-registryfile-error)
- [`type ResourceList struct`](#metadata-helpers-type-resourcelist-struct)
- [`type ResourceRequirements struct`](#metadata-helpers-type-resourcerequirements-struct)
- [`type RolloutConfig struct`](#metadata-helpers-type-rolloutconfig-struct)
- [`type RolloutStrategy string`](#metadata-helpers-type-rolloutstrategy-string)
- [`type SecretEnvVar struct`](#metadata-helpers-type-secretenvvar-struct)
- [`type SecretKeyRef struct`](#metadata-helpers-type-secretkeyref-struct)
- [`type ServerMetadata struct`](#metadata-helpers-type-servermetadata-struct)
- [`type SessionConfig struct`](#metadata-helpers-type-sessionconfig-struct)
- [`type ToolConfig struct`](#metadata-helpers-type-toolconfig-struct)
- [`type TrustLevel string`](#metadata-helpers-type-trustlevel-string)

<a id="metadata-helpers-constants"></a>
### Constants

```text
const DefaultRegistryHost = "registry.local"
```

<a id="metadata-helpers-functions"></a>
### Functions

<a id="metadata-helpers-func-generatecrd-server-servermetadata-outputpath-string-error"></a>
```text
func GenerateCRD(server *ServerMetadata, outputPath string) error
    GenerateCRD generates a Kubernetes CRD YAML file for a single server
    metadata entry at the given output path.

```

<a id="metadata-helpers-func-generatecrdsfromregistry-registry-registryfile-outputdir-string-error"></a>
```text
func GenerateCRDsFromRegistry(registry *RegistryFile, outputDir string) error
    GenerateCRDsFromRegistry renders CRD YAML files for every server in a
    registry into outputDir.

```

<a id="metadata-helpers-func-normalizeplatformdomain-raw-string-string"></a>
```text
func NormalizePlatformDomain(raw string) string
    NormalizePlatformDomain returns a lowercased FQDN suitable for "registry." +
    d and "mcp." + d, or an empty string if the input is unusable.

```

<a id="metadata-helpers-func-resolvemcpingresshost-string"></a>
```text
func ResolveMcpIngressHost() string
    ResolveMcpIngressHost is the public hostname for the MCP / gateway
    (operator default): MCP_MCP_INGRESS_HOST, else mcp.<MCP_PLATFORM_DOMAIN>
    when the platform domain is set, else empty (operator falls back to spec or
    publicPathPrefix).

```

<a id="metadata-helpers-func-resolveplatformingresshost-string"></a>
```text
func ResolvePlatformIngressHost() string
    ResolvePlatformIngressHost is the public hostname for the platform / admin
    dashboard UI: MCP_PLATFORM_INGRESS_HOST, else platform.<MCP_PLATFORM_DOMAIN>
    when the platform domain is set, else empty (path-based dev routing is
    used).

```

<a id="metadata-helpers-func-resolveregistryendpoint-string"></a>
```text
func ResolveRegistryEndpoint() string
    ResolveRegistryEndpoint returns the registry hostname/endpoint for pulls
    and in-cluster skopeo (MCP_REGISTRY_ENDPOINT, then MCP_REGISTRY_HOST,
    then registry.<MCP_PLATFORM_DOMAIN> when the platform domain is set).

```

<a id="metadata-helpers-func-resolveregistryhost-string"></a>
```text
func ResolveRegistryHost() string
    ResolveRegistryHost resolves the host used for default image names.
    Precedence: MCP_REGISTRY_INGRESS_HOST, legacy MCP_REGISTRY_HOST, then
    registry.<MCP_PLATFORM_DOMAIN>, else fallback default.
```

<a id="metadata-helpers-types"></a>
### Types

<a id="metadata-helpers-type-analyticsconfig-struct"></a>
```text
type AnalyticsConfig struct {
	Enabled         bool          `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	IngestURL       string        `yaml:"ingestURL,omitempty" json:"ingestURL,omitempty"`
	Source          string        `yaml:"source,omitempty" json:"source,omitempty"`
	EventType       string        `yaml:"eventType,omitempty" json:"eventType,omitempty"`
	APIKeySecretRef *SecretKeyRef `yaml:"apiKeySecretRef,omitempty" json:"apiKeySecretRef,omitempty"`
}
    AnalyticsConfig configures analytics emission from the gateway sidecar.

```

<a id="metadata-helpers-type-authconfig-struct"></a>
```text
type AuthConfig struct {
	Mode            AuthMode `yaml:"mode,omitempty" json:"mode,omitempty"`
	HumanIDHeader   string   `yaml:"humanIDHeader,omitempty" json:"humanIDHeader,omitempty"`
	AgentIDHeader   string   `yaml:"agentIDHeader,omitempty" json:"agentIDHeader,omitempty"`
	SessionIDHeader string   `yaml:"sessionIDHeader,omitempty" json:"sessionIDHeader,omitempty"`
	TokenHeader     string   `yaml:"tokenHeader,omitempty" json:"tokenHeader,omitempty"`
	IssuerURL       string   `yaml:"issuerURL,omitempty" json:"issuerURL,omitempty"`
	Audience        string   `yaml:"audience,omitempty" json:"audience,omitempty"`
}
    AuthConfig configures how identities are extracted at the gateway.

```

<a id="metadata-helpers-type-authmode-string"></a>
```text
type AuthMode string
    +kubebuilder:validation:Enum=none;header;oauth

const (
	AuthModeNone   AuthMode = "none"
	AuthModeHeader AuthMode = "header"
	AuthModeOAuth  AuthMode = "oauth"
)
```

<a id="metadata-helpers-type-envvar-struct"></a>
```text
type EnvVar struct {
	Name  string `yaml:"name" json:"name"`
	Value string `yaml:"value" json:"value"`
}
    EnvVar defines a literal environment variable.

```

<a id="metadata-helpers-type-gatewayconfig-struct"></a>
```text
type GatewayConfig struct {
	Enabled     bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	Image       string `yaml:"image,omitempty" json:"image,omitempty"`
	Port        int32  `yaml:"port,omitempty" json:"port,omitempty"`
	UpstreamURL string `yaml:"upstreamURL,omitempty" json:"upstreamURL,omitempty"`
	StripPrefix string `yaml:"stripPrefix,omitempty" json:"stripPrefix,omitempty"`
}
    GatewayConfig configures an optional MCP proxy sidecar for a server.

```

<a id="metadata-helpers-type-inventoryitem-struct"></a>
```text
type InventoryItem struct {
	Name        string            `yaml:"name" json:"name"`
	Description string            `yaml:"description,omitempty" json:"description,omitempty"`
	Labels      map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
}
    InventoryItem describes a named MCP prompt, resource, or task.

```

<a id="metadata-helpers-type-policyconfig-struct"></a>
```text
type PolicyConfig struct {
	Mode            PolicyMode     `yaml:"mode,omitempty" json:"mode,omitempty"`
	DefaultDecision PolicyDecision `yaml:"defaultDecision,omitempty" json:"defaultDecision,omitempty"`
	EnforceOn       string         `yaml:"enforceOn,omitempty" json:"enforceOn,omitempty"`
	PolicyVersion   string         `yaml:"policyVersion,omitempty" json:"policyVersion,omitempty"`
}
    PolicyConfig configures authorization behavior at the gateway.

```

<a id="metadata-helpers-type-policydecision-string"></a>
```text
type PolicyDecision string
    +kubebuilder:validation:Enum=allow;deny

const (
	PolicyDecisionAllow PolicyDecision = "allow"
	PolicyDecisionDeny  PolicyDecision = "deny"
)
```

<a id="metadata-helpers-type-policymode-string"></a>
```text
type PolicyMode string
    +kubebuilder:validation:Enum=allow-list;observe

const (
	PolicyModeAllowList PolicyMode = "allow-list"
	PolicyModeObserve   PolicyMode = "observe"
)
```

<a id="metadata-helpers-type-registryfile-struct"></a>
```text
type RegistryFile struct {
	// Version of the metadata format.
	Version string `yaml:"version" json:"version"`

	// Servers is a list of MCP server definitions.
	Servers []ServerMetadata `yaml:"servers" json:"servers"`
}
    RegistryFile represents the complete registry/metadata file.

```

<a id="metadata-helpers-func-loadfromdirectory-dirpath-string-registryfile-error"></a>
```text
func LoadFromDirectory(dirPath string) (*RegistryFile, error)
    LoadFromDirectory aggregates all .yaml/.yml registry files in a directory
    into one registry object.

```

<a id="metadata-helpers-func-loadfromfile-filepath-string-registryfile-error"></a>
```text
func LoadFromFile(filePath string) (*RegistryFile, error)
    LoadFromFile reads a single registry YAML file from disk and applies default
    values.

```

<a id="metadata-helpers-type-resourcelist-struct"></a>
```text
type ResourceList struct {
	CPU    string `yaml:"cpu,omitempty" json:"cpu,omitempty"`
	Memory string `yaml:"memory,omitempty" json:"memory,omitempty"`
}
    ResourceList defines CPU and memory resources.

```

<a id="metadata-helpers-type-resourcerequirements-struct"></a>
```text
type ResourceRequirements struct {
	Limits   *ResourceList `yaml:"limits,omitempty" json:"limits,omitempty"`
	Requests *ResourceList `yaml:"requests,omitempty" json:"requests,omitempty"`
}
    ResourceRequirements defines resource limits and requests.

```

<a id="metadata-helpers-type-rolloutconfig-struct"></a>
```text
type RolloutConfig struct {
	Strategy       RolloutStrategy `yaml:"strategy,omitempty" json:"strategy,omitempty"`
	MaxUnavailable string          `yaml:"maxUnavailable,omitempty" json:"maxUnavailable,omitempty"`
	MaxSurge       string          `yaml:"maxSurge,omitempty" json:"maxSurge,omitempty"`
	CanaryReplicas *int32          `yaml:"canaryReplicas,omitempty" json:"canaryReplicas,omitempty"`
}
    RolloutConfig configures deployment rollout behavior.

```

<a id="metadata-helpers-type-rolloutstrategy-string"></a>
```text
type RolloutStrategy string
    +kubebuilder:validation:Enum=RollingUpdate;Recreate;Canary

const (
	RolloutStrategyRollingUpdate RolloutStrategy = "RollingUpdate"
	RolloutStrategyRecreate      RolloutStrategy = "Recreate"
	RolloutStrategyCanary        RolloutStrategy = "Canary"
)
```

<a id="metadata-helpers-type-secretenvvar-struct"></a>
```text
type SecretEnvVar struct {
	Name         string        `yaml:"name" json:"name"`
	SecretKeyRef *SecretKeyRef `yaml:"secretKeyRef,omitempty" json:"secretKeyRef,omitempty"`
}
    SecretEnvVar defines a secret-backed environment variable.

```

<a id="metadata-helpers-type-secretkeyref-struct"></a>
```text
type SecretKeyRef struct {
	Name string `yaml:"name" json:"name"`
	Key  string `yaml:"key" json:"key"`
}
    SecretKeyRef points to a single key in a Kubernetes Secret.

```

<a id="metadata-helpers-type-servermetadata-struct"></a>
```text
type ServerMetadata struct {
	// Name is the unique name of the MCP server.
	Name string `yaml:"name" json:"name"`

	// Image is the container image for the server.
	Image string `yaml:"image" json:"image"`

	// ImageTag is the tag of the container image (defaults to "latest").
	ImageTag string `yaml:"imageTag,omitempty" json:"imageTag,omitempty"`

	// Route is the route path for the server (defaults to name/mcp).
	Route string `yaml:"route,omitempty" json:"route,omitempty"`

	// IngressHost is the hostname for the server ingress route.
	IngressHost string `yaml:"ingressHost,omitempty" json:"ingressHost,omitempty"`

	// PublicPathPrefix enables hostless path-based routing and resolves to /<publicPathPrefix>/mcp.
	PublicPathPrefix string `yaml:"publicPathPrefix,omitempty" json:"publicPathPrefix,omitempty"`

	// Port is the port the container listens on (defaults to 8088).
	Port int32 `yaml:"port,omitempty" json:"port,omitempty"`

	// Replicas is the number of desired replicas (defaults to 1).
	Replicas *int32 `yaml:"replicas,omitempty" json:"replicas,omitempty"`

	// Resources defines resource limits and requests.
	Resources *ResourceRequirements `yaml:"resources,omitempty" json:"resources,omitempty"`

	// EnvVars are literal environment variables to pass to the container.
	EnvVars []EnvVar `yaml:"envVars,omitempty" json:"envVars,omitempty"`

	// SecretEnvVars are secret-backed environment variables to pass to the container.
	SecretEnvVars []SecretEnvVar `yaml:"secretEnvVars,omitempty" json:"secretEnvVars,omitempty"`

	// Namespace is the Kubernetes namespace (defaults to "mcp-servers").
	Namespace string `yaml:"namespace,omitempty" json:"namespace,omitempty"`

	// Tools describes the MCP tool inventory exposed by the server.
	Tools []ToolConfig `yaml:"tools,omitempty" json:"tools,omitempty"`

	// Prompts describes the MCP prompt inventory exposed by the server.
	Prompts []InventoryItem `yaml:"prompts,omitempty" json:"prompts,omitempty"`

	// MCPResources describes the MCP resource inventory exposed by the server.
	MCPResources []InventoryItem `yaml:"mcpResources,omitempty" json:"mcpResources,omitempty"`

	// Tasks describes task templates or workflows exposed by the server.
	Tasks []InventoryItem `yaml:"tasks,omitempty" json:"tasks,omitempty"`

	// Auth configures how the gateway extracts human, agent, and session identity.
	Auth *AuthConfig `yaml:"auth,omitempty" json:"auth,omitempty"`

	// Policy configures gateway-side authorization behavior.
	Policy *PolicyConfig `yaml:"policy,omitempty" json:"policy,omitempty"`

	// Session configures server-side agent session behavior.
	Session *SessionConfig `yaml:"session,omitempty" json:"session,omitempty"`

	// Gateway configures an optional MCP proxy sidecar in front of the server container.
	Gateway *GatewayConfig `yaml:"gateway,omitempty" json:"gateway,omitempty"`

	// Analytics configures analytics emission for the gateway sidecar.
	Analytics *AnalyticsConfig `yaml:"analytics,omitempty" json:"analytics,omitempty"`

	// Rollout configures deployment rollout behavior.
	Rollout *RolloutConfig `yaml:"rollout,omitempty" json:"rollout,omitempty"`
}
    ServerMetadata defines the metadata for an MCP server.

```

<a id="metadata-helpers-type-sessionconfig-struct"></a>
```text
type SessionConfig struct {
	Required            bool   `yaml:"required,omitempty" json:"required,omitempty"`
	Store               string `yaml:"store,omitempty" json:"store,omitempty"`
	HeaderName          string `yaml:"headerName,omitempty" json:"headerName,omitempty"`
	MaxLifetime         string `yaml:"maxLifetime,omitempty" json:"maxLifetime,omitempty"`
	IdleTimeout         string `yaml:"idleTimeout,omitempty" json:"idleTimeout,omitempty"`
	UpstreamTokenHeader string `yaml:"upstreamTokenHeader,omitempty" json:"upstreamTokenHeader,omitempty"`
}
    SessionConfig configures server-side agent session behavior.

```

<a id="metadata-helpers-type-toolconfig-struct"></a>
```text
type ToolConfig struct {
	Name          string            `yaml:"name" json:"name"`
	Description   string            `yaml:"description,omitempty" json:"description,omitempty"`
	RequiredTrust TrustLevel        `yaml:"requiredTrust,omitempty" json:"requiredTrust,omitempty"`
	Labels        map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
}
    ToolConfig describes one MCP tool exposed by a server.

```

<a id="metadata-helpers-type-trustlevel-string"></a>
```text
type TrustLevel string
    +kubebuilder:validation:Enum=low;medium;high

const (
	TrustLevelLow    TrustLevel = "low"
	TrustLevelMedium TrustLevel = "medium"
	TrustLevelHigh   TrustLevel = "high"
)
```

<a id="operator-internals"></a>
## Operator internals

Package: `operator`
Import path: `mcp-runtime/internal/operator`

Source command:

```bash
go doc -all ./internal/operator
```

<a id="operator-internals-overview"></a>
### Overview

Package operator provides the Kubernetes operator for MCPServer resources.

### Jump To

- [Overview](#operator-internals-overview)
- [Index](#operator-internals-index)
- [Constants](#operator-internals-constants)
- [Variables](#operator-internals-variables)
- [Functions](#operator-internals-functions)
- [Types](#operator-internals-types)

<a id="operator-internals-index"></a>
### Index

- [`Constants`](#operator-internals-constants)
- [`Variables`](#operator-internals-variables)
- [`func NormalizeIngressReadinessMode(value string) (string, bool)`](#operator-internals-func-normalizeingressreadinessmode-value-string-string-bool)
- [`type MCPServerReconciler struct`](#operator-internals-type-mcpserverreconciler-struct)
- [`func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)`](#operator-internals-func-r-mcpserverreconciler-reconcile-ctx-context-context-req-ctrl-request-ctrl-result-error)
- [`func (r *MCPServerReconciler) SetupWithManager(mgr ctrl.Manager) error`](#operator-internals-func-r-mcpserverreconciler-setupwithmanager-mgr-ctrl-manager-error)
- [`type OperatorConfig struct`](#operator-internals-type-operatorconfig-struct)
- [`func LoadOperatorConfig() *OperatorConfig`](#operator-internals-func-loadoperatorconfig-operatorconfig)
- [`func (c *OperatorConfig) HasProvisionedRegistry() bool`](#operator-internals-func-c-operatorconfig-hasprovisionedregistry-bool)
- [`func (c *OperatorConfig) ToRegistryConfig() *RegistryConfig`](#operator-internals-func-c-operatorconfig-toregistryconfig-registryconfig)
- [`type RegistryConfig struct`](#operator-internals-type-registryconfig-struct)

<a id="operator-internals-constants"></a>
### Constants

```text
const (
	// DefaultRequestCPU is the default CPU request for containers.
	DefaultRequestCPU = "50m"
	// DefaultRequestMemory is the default memory request for containers.
	DefaultRequestMemory = "64Mi"
	// DefaultLimitCPU is the default CPU limit for containers.
	DefaultLimitCPU = "500m"
	// DefaultLimitMemory is the default memory limit for containers.
	DefaultLimitMemory = "256Mi"
)
    Resource defaults for MCPServer deployments.

const (
	// DefaultReplicas is the default number of replicas.
	DefaultReplicas = 1
	// DefaultPort is the default container port.
	DefaultPort = 8088
	// DefaultGatewayPort is the default container port for the MCP proxy sidecar.
	DefaultGatewayPort = 8091
	// DefaultServicePort is the default service port.
	DefaultServicePort = 80
)
    MCPServer defaults.

const (
	// LabelApp is the standard app label key.
	LabelApp = "app"
	// LabelManagedBy is the label indicating the managing controller.
	LabelManagedBy = "app.kubernetes.io/managed-by"
	// LabelManagedByValue is the value for the managed-by label.
	LabelManagedByValue = "mcp-runtime"
)
    Labels used by the operator.

const (
	// DefaultIngressClass is the default ingress class.
	DefaultIngressClass = "traefik"
	// DefaultIngressPathType is the default path type for ingress rules.
	DefaultIngressPathType = "Prefix"
	// IngressReadinessModeStrict requires Ingress.status.loadBalancer.ingress to be populated.
	IngressReadinessModeStrict = "strict"
	// IngressReadinessModePermissive treats an Ingress with rules as ready when LB status is absent.
	IngressReadinessModePermissive = "permissive"
)
    Ingress configuration.

const (
	// DefaultRegistrySecretName is the default name for registry pull secrets.
	// #nosec G101 -- This is a secret name, not a credential.
	DefaultRegistrySecretName = "mcp-runtime-registry-creds"
)
    Secret names.

const (
	// RequeueDelayNotReady is the delay before requeueing when resources are not ready.
	RequeueDelayNotReady = 10 // seconds
)
    Requeue delays for reconciliation.
```

<a id="operator-internals-variables"></a>
### Variables

```text
var (
	// Reconciliation errors.
	ErrReconcileDeployment = fmt.Errorf("failed to reconcile deployment")
	ErrReconcileService    = fmt.Errorf("failed to reconcile service")
	ErrReconcileIngress    = fmt.Errorf("failed to reconcile ingress")
	ErrUpdateStatus        = fmt.Errorf("failed to update status")
	ErrApplyDefaults       = fmt.Errorf("failed to apply defaults")

	// Validation errors.
	ErrMissingIngressHost = fmt.Errorf("missing ingress host")
	ErrMissingIngressPath = fmt.Errorf("missing ingress path")

	// Resource errors.
	ErrInvalidCPURequest    = fmt.Errorf("invalid CPU request")
	ErrInvalidMemoryRequest = fmt.Errorf("invalid memory request")
	ErrInvalidCPULimit      = fmt.Errorf("invalid CPU limit")
	ErrInvalidMemoryLimit   = fmt.Errorf("invalid memory limit")
)
    Sentinel errors for operator operations.

var DefaultOperatorConfig = LoadOperatorConfig()
    DefaultOperatorConfig is the default configuration loaded at startup.
```

<a id="operator-internals-functions"></a>
### Functions

<a id="operator-internals-func-normalizeingressreadinessmode-value-string-string-bool"></a>
```text
func NormalizeIngressReadinessMode(value string) (string, bool)
    NormalizeIngressReadinessMode returns a supported ingress readiness mode.
    Empty or invalid values fall back to strict mode.
```

<a id="operator-internals-types"></a>
### Types

<a id="operator-internals-type-mcpserverreconciler-struct"></a>
```text
type MCPServerReconciler struct {
	client.Client
	Scheme *runtime.Scheme

	// DefaultIngressHost is the default ingress host if not specified in the CR.
	DefaultIngressHost string

	// IngressReadinessMode controls how ingress readiness is evaluated.
	IngressReadinessMode string

	// ProvisionedRegistry holds the provisioned registry configuration.
	// If nil or URL is empty, provisioned registry features are disabled.
	ProvisionedRegistry *RegistryConfig

	// GatewayProxyImage is the default image used for the optional MCP gateway sidecar.
	GatewayProxyImage string

	// DefaultAnalyticsIngestURL is the default analytics ingest endpoint used when analytics is enabled.
	DefaultAnalyticsIngestURL string

	// ClusterName is the cluster label attached to policy and audit events.
	ClusterName string
}
    MCPServerReconciler reconciles a MCPServer object

```

<a id="operator-internals-func-r-mcpserverreconciler-reconcile-ctx-context-context-req-ctrl-request-ctrl-result-error"></a>
```text
func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
    Reconcile is part of the main kubernetes reconciliation loop

```

<a id="operator-internals-func-r-mcpserverreconciler-setupwithmanager-mgr-ctrl-manager-error"></a>
```text
func (r *MCPServerReconciler) SetupWithManager(mgr ctrl.Manager) error
    SetupWithManager sets up the controller with the Manager.

```

<a id="operator-internals-type-operatorconfig-struct"></a>
```text
type OperatorConfig struct {
	// DefaultIngressHost is the default host for ingress resources.
	DefaultIngressHost string

	// DefaultIngressClass is the ingress class to use.
	DefaultIngressClass string

	// IngressReadinessMode controls how ingress readiness is evaluated.
	IngressReadinessMode string

	// ProvisionedRegistryURL is the URL of the provisioned registry.
	ProvisionedRegistryURL string

	// ProvisionedRegistryUsername is the username for the provisioned registry.
	ProvisionedRegistryUsername string

	// ProvisionedRegistryPassword is the password for the provisioned registry.
	ProvisionedRegistryPassword string

	// ProvisionedRegistrySecretName is the name of the secret for registry credentials.
	ProvisionedRegistrySecretName string

	// InternalRegistryEndpoint is the internal registry endpoint to use for image refs when not using a provisioned registry.
	InternalRegistryEndpoint string

	// RequeueDelaySeconds is the delay in seconds before requeueing when resources aren't ready.
	RequeueDelaySeconds int

	// GatewayProxyImage is the default image used for the optional MCP gateway sidecar.
	GatewayProxyImage string

	// AnalyticsIngestURL is the default analytics ingest endpoint for gateway sidecars.
	AnalyticsIngestURL string

	// ClusterName is the cluster label attached to emitted audit events.
	ClusterName string
}
    OperatorConfig holds configuration for the operator loaded from environment
    variables.

```

<a id="operator-internals-func-loadoperatorconfig-operatorconfig"></a>
```text
func LoadOperatorConfig() *OperatorConfig
    LoadOperatorConfig loads operator configuration from environment variables.

```

<a id="operator-internals-func-c-operatorconfig-hasprovisionedregistry-bool"></a>
```text
func (c *OperatorConfig) HasProvisionedRegistry() bool
    HasProvisionedRegistry returns true if a provisioned registry is configured.

```

<a id="operator-internals-func-c-operatorconfig-toregistryconfig-registryconfig"></a>
```text
func (c *OperatorConfig) ToRegistryConfig() *RegistryConfig
    ToRegistryConfig converts the config to a RegistryConfig if provisioned
    registry is enabled.

```

<a id="operator-internals-type-registryconfig-struct"></a>
```text
type RegistryConfig struct {
	URL        string
	Username   string
	Password   string
	SecretName string
}
    RegistryConfig holds configuration for a provisioned container registry.
```

<a id="cli-command-routing"></a>
## CLI command routing

Package: `root`
Import path: `mcp-runtime/internal/cli/root`

Source command:

```bash
go doc -all ./internal/cli/root
```

<a id="cli-command-routing-overview"></a>
### Overview

Package root provides the foldered CLI command routing layer for the mcp-runtime
binary.

Each subpackage owns one top-level Cobra command boundary and uses
internal/cli/core for shared CLI infrastructure.

### Jump To

- [Overview](#cli-command-routing-overview)
- [Index](#cli-command-routing-index)
- [Functions](#cli-command-routing-functions)

<a id="cli-command-routing-index"></a>
### Index

- [`func AddCommands(root *cobra.Command, logger *zap.Logger)`](#cli-command-routing-func-addcommands-root-cobra-command-logger-zap-logger)

<a id="cli-command-routing-functions"></a>
### Functions

<a id="cli-command-routing-func-addcommands-root-cobra-command-logger-zap-logger"></a>
```text
func AddCommands(root *cobra.Command, logger *zap.Logger)
    AddCommands registers every top-level mcp-runtime command on root.
```

<a id="cli-core"></a>
## CLI core

Package: `core`
Import path: `mcp-runtime/internal/cli/core`

Source command:

```bash
go doc -all ./internal/cli/core
```

<a id="cli-core-overview"></a>
### Overview

Package cli contains shared CLI infrastructure used by command packages.

Command-specific behavior belongs in internal/cli/<command>; this package is
limited to config, constants, errors, runtime composition, process execution,
kubectl clients, terminal output, and test doubles.

### Jump To

- [Overview](#cli-core-overview)
- [Index](#cli-core-index)
- [Constants](#cli-core-constants)
- [Variables](#cli-core-variables)
- [Functions](#cli-core-functions)
- [Types](#cli-core-types)

<a id="cli-core-index"></a>
### Index

- [`Constants`](#cli-core-constants)
- [`Variables`](#cli-core-variables)
- [`func Cyan(msg string) string`](#cli-core-func-cyan-msg-string-string)
- [`func Error(msg string)`](#cli-core-func-error-msg-string)
- [`func GetAnalyticsIngestURLOverride() string`](#cli-core-func-getanalyticsingesturloverride-string)
- [`func GetCertTimeout() time.Duration`](#cli-core-func-getcerttimeout-time-duration)
- [`func GetClusterName() string`](#cli-core-func-getclustername-string)
- [`func GetDefaultServerPort() int`](#cli-core-func-getdefaultserverport-int)
- [`func GetDeploymentTimeout() time.Duration`](#cli-core-func-getdeploymenttimeout-time-duration)
- [`func GetGatewayProxyImageOverride() string`](#cli-core-func-getgatewayproxyimageoverride-string)
- [`func GetHelperPodTimeout() time.Duration`](#cli-core-func-gethelperpodtimeout-time-duration)
- [`func GetMcpIngressHost() string`](#cli-core-func-getmcpingresshost-string)
- [`func GetOperatorImageOverride() string`](#cli-core-func-getoperatorimageoverride-string)
- [`func GetPlatformIngressHost() string`](#cli-core-func-getplatformingresshost-string)
- [`func GetRegistryClusterIssuerName() string`](#cli-core-func-getregistryclusterissuername-string)
- [`func GetRegistryEndpoint() string`](#cli-core-func-getregistryendpoint-string)
- [`func GetRegistryIngressHost() string`](#cli-core-func-getregistryingresshost-string)
- [`func GetRegistryPort() int`](#cli-core-func-getregistryport-int)
- [`func GetSkopeoImage() string`](#cli-core-func-getskopeoimage-string)
- [`func Green(msg string) string`](#cli-core-func-green-msg-string-string)
- [`func Header(title string)`](#cli-core-func-header-title-string)
- [`func Info(msg string)`](#cli-core-func-info-msg-string)
- [`func IsDebugMode() bool`](#cli-core-func-isdebugmode-bool)
- [`func LogStructuredError(logger *zap.Logger, err error, msg string)`](#cli-core-func-logstructurederror-logger-zap-logger-err-error-msg-string)
- [`func NewSetupStepFailedError() error`](#cli-core-func-newsetupstepfailederror-error)
- [`func NewWithSentinel(base error, msg string) error`](#cli-core-func-newwithsentinel-base-error-msg-string-error)
- [`func Red(msg string) string`](#cli-core-func-red-msg-string-string)
- [`func Section(title string)`](#cli-core-func-section-title-string)
- [`func SetDebugMode(enabled bool)`](#cli-core-func-setdebugmode-enabled-bool)
- [`func SpinnerStart(msg string) func(success bool, finalMsg string)`](#cli-core-func-spinnerstart-msg-string-func-success-bool-finalmsg-string)
- [`func Step(title string)`](#cli-core-func-step-title-string)
- [`func Success(msg string)`](#cli-core-func-success-msg-string)
- [`func SwapDefaultKubectlClient(c *KubectlClient) (restore func())`](#cli-core-func-swapdefaultkubectlclient-c-kubectlclient-restore-func)
- [`func SwapExecExecutor(e Executor) (restore func())`](#cli-core-func-swapexecexecutor-e-executor-restore-func)
- [`func Table(data [][]string)`](#cli-core-func-table-data-string)
- [`func TableBoxed(data [][]string)`](#cli-core-func-tableboxed-data-string)
- [`func ValidateK8sNameAndNamespace(nameLabel string, nameSentinel error, name, namespace string) (string, string, error)`](#cli-core-func-validatek8snameandnamespace-namelabel-string-namesentinel-error-name-namespace-string-string-string-error)
- [`func ValidateManifestField(field, value string) (string, error)`](#cli-core-func-validatemanifestfield-field-value-string-string-error)
- [`func Warn(msg string)`](#cli-core-func-warn-msg-string)
- [`func WrapWithSentinel(base, cause error, msg string) error`](#cli-core-func-wrapwithsentinel-base-cause-error-msg-string-error)
- [`func WrapWithSentinelAndContext(base, cause error, msg string, context map[string]any) error`](#cli-core-func-wrapwithsentinelandcontext-base-cause-error-msg-string-context-map-string-any-error)
- [`func Yellow(msg string) string`](#cli-core-func-yellow-msg-string-string)
- [`type CLIConfig struct`](#cli-core-type-cliconfig-struct)
- [`func LoadCLIConfig() *CLIConfig`](#cli-core-func-loadcliconfig-cliconfig)
- [`type Command interface`](#cli-core-type-command-interface)
- [`func ExecCommandWithValidators(name string, args []string, validators ...ExecValidator) (Command, error)`](#cli-core-func-execcommandwithvalidators-name-string-args-string-validators-execvalidator-command-error)
- [`type ExecSpec struct`](#cli-core-type-execspec-struct)
- [`type ExecValidator func(ExecSpec) error`](#cli-core-type-execvalidator-func-execspec-error)
- [`func AllowlistBins(allowed ...string) ExecValidator`](#cli-core-func-allowlistbins-allowed-string-execvalidator)
- [`func NoControlChars() ExecValidator`](#cli-core-func-nocontrolchars-execvalidator)
- [`func NoShellMeta() ExecValidator`](#cli-core-func-noshellmeta-execvalidator)
- [`func PathUnder(root string) ExecValidator`](#cli-core-func-pathunder-root-string-execvalidator)
- [`type Executor interface`](#cli-core-type-executor-interface)
- [`func DefaultExecutor() Executor`](#cli-core-func-defaultexecutor-executor)
- [`type KubectlClient struct`](#cli-core-type-kubectlclient-struct)
- [`func DefaultKubectlClient() *KubectlClient`](#cli-core-func-defaultkubectlclient-kubectlclient)
- [`func NewKubectlClient(exec Executor) (*KubectlClient, error)`](#cli-core-func-newkubectlclient-exec-executor-kubectlclient-error)
- [`func NewTestKubectlClient(exec Executor) *KubectlClient`](#cli-core-func-newtestkubectlclient-exec-executor-kubectlclient)
- [`func NewTestKubectlClientWithValidators(exec Executor, validators []ExecValidator) *KubectlClient`](#cli-core-func-newtestkubectlclientwithvalidators-exec-executor-validators-execvalidator-kubectlclient)
- [`func (c *KubectlClient) CombinedOutput(args []string) ([]byte, error)`](#cli-core-func-c-kubectlclient-combinedoutput-args-string-byte-error)
- [`func (c *KubectlClient) CommandArgs(args []string) (Command, error)`](#cli-core-func-c-kubectlclient-commandargs-args-string-command-error)
- [`func (c *KubectlClient) Output(args []string) ([]byte, error)`](#cli-core-func-c-kubectlclient-output-args-string-byte-error)
- [`func (c *KubectlClient) Run(args []string) error`](#cli-core-func-c-kubectlclient-run-args-string-error)
- [`func (c *KubectlClient) RunWithOutput(args []string, stdout, stderr io.Writer) error`](#cli-core-func-c-kubectlclient-runwithoutput-args-string-stdout-stderr-io-writer-error)
- [`type KubectlRunner interface`](#cli-core-type-kubectlrunner-interface)
- [`func DefaultKubectlRunner() KubectlRunner`](#cli-core-func-defaultkubectlrunner-kubectlrunner)
- [`type MockCommand struct`](#cli-core-type-mockcommand-struct)
- [`func (m *MockCommand) CombinedOutput() ([]byte, error)`](#cli-core-func-m-mockcommand-combinedoutput-byte-error)
- [`func (m *MockCommand) Output() ([]byte, error)`](#cli-core-func-m-mockcommand-output-byte-error)
- [`func (m *MockCommand) Run() error`](#cli-core-func-m-mockcommand-run-error)
- [`func (m *MockCommand) SetStderr(w io.Writer)`](#cli-core-func-m-mockcommand-setstderr-w-io-writer)
- [`func (m *MockCommand) SetStdin(r io.Reader)`](#cli-core-func-m-mockcommand-setstdin-r-io-reader)
- [`func (m *MockCommand) SetStdout(w io.Writer)`](#cli-core-func-m-mockcommand-setstdout-w-io-writer)
- [`type MockExecutor struct`](#cli-core-type-mockexecutor-struct)
- [`func (m *MockExecutor) Command(name string, args []string, validators ...ExecValidator) (Command, error)`](#cli-core-func-m-mockexecutor-command-name-string-args-string-validators-execvalidator-command-error)
- [`func (m *MockExecutor) HasCommand(name string) bool`](#cli-core-func-m-mockexecutor-hascommand-name-string-bool)
- [`func (m *MockExecutor) LastCommand() ExecSpec`](#cli-core-func-m-mockexecutor-lastcommand-execspec)
- [`func (m *MockExecutor) Reset()`](#cli-core-func-m-mockexecutor-reset)
- [`type Printer struct`](#cli-core-type-printer-struct)
- [`func (p *Printer) Cyan(msg string) string`](#cli-core-func-p-printer-cyan-msg-string-string)
- [`func (p *Printer) Error(msg string)`](#cli-core-func-p-printer-error-msg-string)
- [`func (p *Printer) Green(msg string) string`](#cli-core-func-p-printer-green-msg-string-string)
- [`func (p *Printer) Header(title string)`](#cli-core-func-p-printer-header-title-string)
- [`func (p *Printer) Info(msg string)`](#cli-core-func-p-printer-info-msg-string)
- [`func (p *Printer) Printf(format string, a ...interface`](#cli-core-func-p-printer-printf-format-string-a-interface)
- [`func (p *Printer) Println(a ...interface`](#cli-core-func-p-printer-println-a-interface)
- [`func (p *Printer) Red(msg string) string`](#cli-core-func-p-printer-red-msg-string-string)
- [`func (p *Printer) Section(title string)`](#cli-core-func-p-printer-section-title-string)
- [`func (p *Printer) SpinnerStart(msg string) func(success bool, finalMsg string)`](#cli-core-func-p-printer-spinnerstart-msg-string-func-success-bool-finalmsg-string)
- [`func (p *Printer) Step(title string)`](#cli-core-func-p-printer-step-title-string)
- [`func (p *Printer) Success(msg string)`](#cli-core-func-p-printer-success-msg-string)
- [`func (p *Printer) Table(data [][]string)`](#cli-core-func-p-printer-table-data-string)
- [`func (p *Printer) TableBoxed(data [][]string)`](#cli-core-func-p-printer-tableboxed-data-string)
- [`func (p *Printer) Warn(msg string)`](#cli-core-func-p-printer-warn-msg-string)
- [`func (p *Printer) Yellow(msg string) string`](#cli-core-func-p-printer-yellow-msg-string-string)
- [`type Runtime struct`](#cli-core-type-runtime-struct)
- [`func NewRuntime(logger *zap.Logger) *Runtime`](#cli-core-func-newruntime-logger-zap-logger-runtime)
- [`func (r *Runtime) Config() *CLIConfig`](#cli-core-func-r-runtime-config-cliconfig)
- [`func (r *Runtime) Executor() Executor`](#cli-core-func-r-runtime-executor-executor)
- [`func (r *Runtime) KubectlClient() *KubectlClient`](#cli-core-func-r-runtime-kubectlclient-kubectlclient)
- [`func (r *Runtime) KubectlRunner() KubectlRunner`](#cli-core-func-r-runtime-kubectlrunner-kubectlrunner)
- [`func (r *Runtime) Logger() *zap.Logger`](#cli-core-func-r-runtime-logger-zap-logger)
- [`func (r *Runtime) Printer() *Printer`](#cli-core-func-r-runtime-printer-printer)

<a id="cli-core-constants"></a>
### Constants

```text
const (

	// Exported aliases for tests and subpackages (same values as above).
	DefaultRegistryEndpoint    = defaultRegistryEndpoint
	DefaultRegistryIngressHost = defaultRegistryIngressHost
)
    Default values

const (
	// NamespaceMCPRuntime is the namespace for the MCP runtime operator.
	NamespaceMCPRuntime = "mcp-runtime"

	// NamespaceRegistry is the namespace for the container registry.
	NamespaceRegistry = "registry"

	// NamespaceMCPServers is the default namespace for MCP server deployments.
	NamespaceMCPServers = "mcp-servers"

	// DefaultAnalyticsNamespace is the namespace for the bundled mcp-sentinel stack.
	DefaultAnalyticsNamespace = "mcp-sentinel"
)
    This file defines constants used across the CLI, including:
      - Kubernetes namespace names
      - Deployment and resource names
      - Label selectors
      - Default values

const (
	// OperatorDeploymentName is the name of the operator deployment.
	OperatorDeploymentName = "mcp-runtime-operator-controller-manager"

	// OperatorManagerContainerName is the main manager container in the operator deployment.
	OperatorManagerContainerName = "manager"

	// RegistryDeploymentName is the name of the registry deployment.
	RegistryDeploymentName = "registry"

	// RegistryServiceName is the name of the registry service.
	RegistryServiceName = "registry"

	// RegistryPVCName is the name of the registry persistent volume claim.
	RegistryPVCName = "registry-storage"
)
    Deployment and resource names.

const (
	// MCPServerCRDName is the full name of the MCPServer CRD.
	MCPServerCRDName = "mcpservers.mcpruntime.org"

	// CertManagerCRDName is the full name of the cert-manager Certificate CRD.
	CertManagerCRDName = "certificates.cert-manager.io"
)
    CRD identifiers.

const (
	// LabelApp is the standard app label key.
	LabelApp = "app"

	// LabelManagedBy is the label indicating the managing controller.
	LabelManagedBy = "app.kubernetes.io/managed-by"

	// LabelManagedByValue is the value for the managed-by label.
	LabelManagedByValue = "mcp-runtime"
)
    Labels used for resource identification.

const (
	// SelectorRegistry is the label selector for registry pods.
	SelectorRegistry = "app=registry"

	// SelectorOperator is the label selector for operator pods.
	SelectorOperator = "control-plane=controller-manager"

	// SelectorManagedBy is the label selector for MCP-managed resources.
	SelectorManagedBy = "app.kubernetes.io/managed-by=mcp-runtime"
)
    Selector strings for kubectl queries.
```

<a id="cli-core-variables"></a>
### Variables

```text
var (
	// CLI errors.
	ErrImageRequired             = newSentinelError("image is required", errx.CodeCLI, errx.DescCLI)
	ErrInvalidServerName         = newSentinelError("invalid server name", errx.CodeCLI, errx.DescCLI)
	ErrGetWorkingDirectoryFailed = newSentinelError("get working directory", errx.CodeCLI, errx.DescCLI)
	ErrControlCharsNotAllowed    = newSentinelError("value must not contain control characters", errx.CodeCLI, errx.DescCLI)
	ErrFieldRequired             = newSentinelError("field is required", errx.CodeCLI, errx.DescCLI)
	ErrGetHomeDirectoryFailed    = newSentinelError("failed to get home directory", errx.CodeCLI, errx.DescCLI)
	ErrUnknownRegistryMode       = newSentinelError("unknown registry mode", errx.CodeCLI, errx.DescCLI)

	// Pipeline errors.
	ErrLoadMetadataFailed      = newSentinelError("failed to load metadata", errx.CodePipeline, errx.DescPipeline)
	ErrNoServersInMetadata     = newSentinelError("no servers found in metadata", errx.CodePipeline, errx.DescPipeline)
	ErrGenerateCRDsFailed      = newSentinelError("failed to generate CRDs", errx.CodePipeline, errx.DescPipeline)
	ErrListManifestFilesFailed = newSentinelError("failed to list manifest files", errx.CodePipeline, errx.DescPipeline)
	ErrNoManifestFilesFound    = newSentinelError("no manifest files found", errx.CodePipeline, errx.DescPipeline)
	ErrApplyManifestFailed     = newSentinelError("failed to apply manifest", errx.CodePipeline, errx.DescPipeline)

	// Operator errors.
	ErrOperatorNotFound = newSentinelError("operator not found", errx.CodeOperator, errx.DescOperator)
	ErrOperatorNotReady = newSentinelError("operator not ready", errx.CodeOperator, errx.DescOperator)

	// Setup errors.
	ErrClusterInitFailed                   = newSentinelError("failed to initialize cluster", errx.CodeSetup, errx.DescSetup)
	ErrClusterConfigFailed                 = newSentinelError("cluster configuration failed", errx.CodeSetup, errx.DescSetup)
	ErrTLSSetupFailed                      = newSentinelError("TLS setup failed", errx.CodeSetup, errx.DescSetup)
	ErrDeployRegistryFailed                = newSentinelError("failed to deploy registry", errx.CodeSetup, errx.DescSetup)
	ErrOperatorImageBuildFailed            = newSentinelError("operator image build failed", errx.CodeSetup, errx.DescSetup)
	ErrGatewayProxyImageBuildFailed        = newSentinelError("gateway proxy image build failed", errx.CodeSetup, errx.DescSetup)
	ErrEnsureRegistryNamespaceFailed       = newSentinelError("failed to ensure registry namespace", errx.CodeSetup, errx.DescSetup)
	ErrPushOperatorImageInternalFailed     = newSentinelError("failed to push operator image to internal registry", errx.CodeSetup, errx.DescSetup)
	ErrPushGatewayProxyImageInternalFailed = newSentinelError("failed to push gateway proxy image to internal registry", errx.CodeSetup, errx.DescSetup)
	ErrOperatorDeploymentFailed            = newSentinelError("operator deployment failed", errx.CodeSetup, errx.DescSetup)
	ErrConfigureExternalRegistryEnvFailed  = newSentinelError("failed to configure external registry env on operator", errx.CodeSetup, errx.DescSetup)
	ErrRestartOperatorDeploymentFailed     = newSentinelError("failed to restart operator deployment after registry env update", errx.CodeSetup, errx.DescSetup)
	ErrCRDCheckFailed                      = newSentinelError("CRD check failed", errx.CodeSetup, errx.DescSetup)
	ErrRenderSecretManifestFailed          = newSentinelError("render secret manifest", errx.CodeSetup, errx.DescSetup)
	ErrApplySecretManifestFailed           = newSentinelError("apply secret manifest", errx.CodeSetup, errx.DescSetup)
	ErrMarshalDockerConfigFailed           = newSentinelError("marshal docker config", errx.CodeSetup, errx.DescSetup)
	ErrApplyImagePullSecretFailed          = newSentinelError("apply imagePullSecret", errx.CodeSetup, errx.DescSetup)
	ErrPushImageInClusterFailed            = newSentinelError("failed to push image in-cluster", errx.CodeSetup, errx.DescSetup)
	ErrSetupStepFailed                     = newSentinelError("setup step failed", errx.CodeSetup, errx.DescSetup)
	ErrApplyCRDFailed                      = newSentinelError("failed to apply CRD", errx.CodeSetup, errx.DescSetup)
	ErrEnsureOperatorNamespaceFailed       = newSentinelError("failed to ensure operator namespace", errx.CodeSetup, errx.DescSetup)
	ErrApplyRBACFailed                     = newSentinelError("failed to apply RBAC", errx.CodeSetup, errx.DescSetup)
	ErrReadManagerYAMLFailed               = newSentinelError("failed to read manager.yaml", errx.CodeSetup, errx.DescSetup)
	ErrParseManagerYAMLFailed              = newSentinelError("failed to parse manager.yaml", errx.CodeSetup, errx.DescSetup)
	ErrSetOperatorImageFailed              = newSentinelError("failed to set operator image", errx.CodeSetup, errx.DescSetup)
	ErrMutateManagerYAMLFailed             = newSentinelError("failed to mutate manager.yaml", errx.CodeSetup, errx.DescSetup)
	ErrRenderManagerYAMLFailed             = newSentinelError("failed to render mutated manager.yaml", errx.CodeSetup, errx.DescSetup)
	ErrCreateTempFileFailed                = newSentinelError("failed to create temp file", errx.CodeSetup, errx.DescSetup)
	ErrCloseTempFileFailed                 = newSentinelError("failed to close temp file", errx.CodeSetup, errx.DescSetup)
	ErrWriteTempFileFailed                 = newSentinelError("failed to write temp file", errx.CodeSetup, errx.DescSetup)
	ErrApplyManagerDeploymentFailed        = newSentinelError("failed to apply manager deployment", errx.CodeSetup, errx.DescSetup)
	ErrClusterIssuerApplyFailed            = newSentinelError("failed to apply ClusterIssuer", errx.CodeSetup, errx.DescSetup)
	ErrCreateRegistryNamespaceFailed       = newSentinelError("failed to create registry namespace", errx.CodeSetup, errx.DescSetup)
	ErrApplyCertificateFailed              = newSentinelError("failed to apply Certificate", errx.CodeSetup, errx.DescSetup)

	// Cert errors.
	ErrCertManagerNotInstalled     = newSentinelError("cert-manager not installed", errx.CodeCert, errx.DescCert)
	ErrCertManagerInstallFailed    = newSentinelError("cert-manager install failed", errx.CodeCert, errx.DescCert)
	ErrCASecretNotFound            = newSentinelError("CA secret not found", errx.CodeCert, errx.DescCert)
	ErrCertificateNotReady         = newSentinelError("certificate not ready", errx.CodeCert, errx.DescCert)
	ErrClusterIssuerNotFound       = newSentinelError("ClusterIssuer not found", errx.CodeCert, errx.DescCert)
	ErrRegistryCertificateNotFound = newSentinelError("registry Certificate not found", errx.CodeCert, errx.DescCert)

	// Cluster errors.
	ErrCRDNotInstalled                = newSentinelError("MCPServer CRD not installed", errx.CodeCluster, errx.DescCluster)
	ErrClusterNotAccessible           = newSentinelError("cluster not accessible", errx.CodeCluster, errx.DescCluster)
	ErrNamespaceNotFound              = newSentinelError("namespace not found", errx.CodeCluster, errx.DescCluster)
	ErrDeploymentTimeout              = newSentinelError("deployment timed out waiting for readiness", errx.CodeCluster, errx.DescCluster)
	ErrInstallCRDFailed               = newSentinelError("failed to install CRD", errx.CodeCluster, errx.DescCluster)
	ErrEnsureRuntimeNamespaceFailed   = newSentinelError("failed to ensure mcp-runtime namespace", errx.CodeCluster, errx.DescCluster)
	ErrEnsureServersNamespaceFailed   = newSentinelError("failed to ensure mcp-servers namespace", errx.CodeCluster, errx.DescCluster)
	ErrKubeconfigNotReadable          = newSentinelError("kubeconfig not found or not readable", errx.CodeCluster, errx.DescCluster)
	ErrSetKubeconfigFailed            = newSentinelError("failed to set KUBECONFIG", errx.CodeCluster, errx.DescCluster)
	ErrSetContextFailed               = newSentinelError("failed to set context", errx.CodeCluster, errx.DescCluster)
	ErrAKSKubeconfigNotImplemented    = newSentinelError("AKS kubeconfig not yet implemented", errx.CodeCluster, errx.DescCluster)
	ErrGKEKubeconfigNotImplemented    = newSentinelError("GKE kubeconfig not yet implemented", errx.CodeCluster, errx.DescCluster)
	ErrUnsupportedProvider            = newSentinelError("unsupported provider", errx.CodeCluster, errx.DescCluster)
	ErrUnsupportedIngressController   = newSentinelError("unsupported ingress controller", errx.CodeCluster, errx.DescCluster)
	ErrInstallIngressControllerFailed = newSentinelError("failed to install ingress controller", errx.CodeCluster, errx.DescCluster)
	ErrCreateKindConfigFailed         = newSentinelError("failed to create temp kind config", errx.CodeCluster, errx.DescCluster)
	ErrCloseKindConfigFailed          = newSentinelError("failed to close kind config", errx.CodeCluster, errx.DescCluster)
	ErrWriteKindConfigFailed          = newSentinelError("failed to write kind config", errx.CodeCluster, errx.DescCluster)
	ErrCreateKindClusterFailed        = newSentinelError("failed to create kind cluster", errx.CodeCluster, errx.DescCluster)
	ErrGKEProvisioningNotImplemented  = newSentinelError("GKE provisioning not yet implemented", errx.CodeCluster, errx.DescCluster)
	ErrProvisionEKSFailed             = newSentinelError("failed to provision EKS cluster", errx.CodeCluster, errx.DescCluster)
	ErrAKSProvisioningNotImplemented  = newSentinelError("AKS provisioning not yet implemented", errx.CodeCluster, errx.DescCluster)

	// Registry errors.
	ErrRegistryNotReady             = newSentinelError("registry not ready", errx.CodeRegistry, errx.DescRegistry)
	ErrRegistryNotFound             = newSentinelError("registry not found", errx.CodeRegistry, errx.DescRegistry)
	ErrBuildOperatorImageFailed     = newSentinelError("failed to build operator image", errx.CodeRegistry, errx.DescRegistry)
	ErrPushOperatorImageFailed      = newSentinelError("failed to push operator image", errx.CodeRegistry, errx.DescRegistry)
	ErrBuildGatewayProxyImageFailed = newSentinelError("failed to build gateway proxy image", errx.CodeRegistry, errx.DescRegistry)
	ErrPushGatewayProxyImageFailed  = newSentinelError("failed to push gateway proxy image", errx.CodeRegistry, errx.DescRegistry)
	ErrUnsupportedRegistryType      = newSentinelError("unsupported registry type", errx.CodeRegistry, errx.DescRegistry)
	ErrEnsureNamespaceFailed        = newSentinelError("failed to ensure namespace", errx.CodeRegistry, errx.DescRegistry)
	ErrReadRegistryStorageFailed    = newSentinelError("failed to read current registry storage size", errx.CodeRegistry, errx.DescRegistry)
	ErrUpdateRegistryStorageFailed  = newSentinelError("failed to update registry storage size", errx.CodeRegistry, errx.DescRegistry)
	ErrRegistryLoginFailed          = newSentinelError("failed to login to registry", errx.CodeRegistry, errx.DescRegistry)
	ErrTagImageFailed               = newSentinelError("failed to tag image", errx.CodeRegistry, errx.DescRegistry)
	ErrPushImageFailed              = newSentinelError("failed to push image", errx.CodeRegistry, errx.DescRegistry)
	ErrHelperNamespaceNotFound      = newSentinelError("helper namespace not found", errx.CodeRegistry, errx.DescRegistry)
	ErrSaveImageFailed              = newSentinelError("failed to save image", errx.CodeRegistry, errx.DescRegistry)
	ErrStartHelperPodFailed         = newSentinelError("failed to start helper pod", errx.CodeRegistry, errx.DescRegistry)
	ErrHelperPodNotReady            = newSentinelError("helper pod not ready", errx.CodeRegistry, errx.DescRegistry)
	ErrCopyImageToHelperFailed      = newSentinelError("failed to copy image tar to helper pod", errx.CodeRegistry, errx.DescRegistry)
	ErrPushImageFromHelperFailed    = newSentinelError("failed to push image from helper pod", errx.CodeRegistry, errx.DescRegistry)

	// Config errors.
	ErrRegistryURLRequired           = newSentinelError("registry url is required", errx.CodeConfig, errx.DescConfig)
	ErrRegistryURLMissingInConfig    = newSentinelError("registry url missing in config", errx.CodeConfig, errx.DescConfig)
	ErrSaveRegistryConfigFailed      = newSentinelError("failed to save registry config", errx.CodeConfig, errx.DescConfig)
	ErrReadRegistryConfigFailed      = newSentinelError("failed to read registry config", errx.CodeConfig, errx.DescConfig)
	ErrUnmarshalRegistryConfigFailed = newSentinelError("failed to unmarshal registry config", errx.CodeConfig, errx.DescConfig)

	// Build errors.
	ErrBuildImageFailed         = newSentinelError("failed to build image", errx.CodeBuild, errx.DescBuild)
	ErrMetadataFileNotFound     = newSentinelError("metadata file not found", errx.CodeBuild, errx.DescBuild)
	ErrServerNotFoundInMetadata = newSentinelError("server not found in metadata", errx.CodeBuild, errx.DescBuild)
	ErrMarshalMetadataFailed    = newSentinelError("failed to marshal metadata", errx.CodeBuild, errx.DescBuild)
	ErrWriteMetadataFailed      = newSentinelError("failed to write metadata", errx.CodeBuild, errx.DescBuild)

	// Server errors.
	ErrMarshalManifestFailed = newSentinelError("failed to marshal manifest", errx.CodeServer, errx.DescServer)
	ErrWriteManifestFailed   = newSentinelError("failed to write manifest", errx.CodeServer, errx.DescServer)
	ErrInvalidFilePath       = newSentinelError("invalid file path", errx.CodeServer, errx.DescServer)
	ErrFileNotAccessible     = newSentinelError("cannot access file", errx.CodeServer, errx.DescServer)
	ErrFileIsDirectory       = newSentinelError("path is a directory, not a file", errx.CodeServer, errx.DescServer)
	ErrGetMCPServerFailed    = newSentinelError("kubectl get mcpserver failed", errx.CodeServer, errx.DescServer)
	ErrListServersFailed     = newSentinelError("failed to list servers", errx.CodeServer, errx.DescServer)
	ErrCreateServerFailed    = newSentinelError("failed to create server", errx.CodeServer, errx.DescServer)
	ErrDeleteServerFailed    = newSentinelError("failed to delete server", errx.CodeServer, errx.DescServer)
	ErrViewServerLogsFailed  = newSentinelError("failed to view server logs", errx.CodeServer, errx.DescServer)
)
    Sentinel errors for CLI operations. Errors are defined and registered in one
    step using newSentinelError to eliminate redundancy.

var DefaultCLIConfig = LoadCLIConfig()
    DefaultCLIConfig is the global CLI configuration loaded at startup.

var DefaultPrinter = &Printer{}
    DefaultPrinter is the default printer instance used by package-level
    functions.

var ValidK8sName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)
    ValidK8sName matches Kubernetes resource name requirements (RFC 1123
    subdomain).
```

<a id="cli-core-functions"></a>
### Functions

<a id="cli-core-func-cyan-msg-string-string"></a>
```text
func Cyan(msg string) string
    Cyan returns cyan text.

```

<a id="cli-core-func-error-msg-string"></a>
```text
func Error(msg string)
    Error prints an error message.

```

<a id="cli-core-func-getanalyticsingesturloverride-string"></a>
```text
func GetAnalyticsIngestURLOverride() string
    GetAnalyticsIngestURLOverride returns the analytics ingest URL override,
    empty if not set.

```

<a id="cli-core-func-getcerttimeout-time-duration"></a>
```text
func GetCertTimeout() time.Duration
    GetCertTimeout returns the certificate issuance timeout.

```

<a id="cli-core-func-getclustername-string"></a>
```text
func GetClusterName() string
    GetClusterName returns the cluster label attached to analytics/audit events.

```

<a id="cli-core-func-getdefaultserverport-int"></a>
```text
func GetDefaultServerPort() int
    GetDefaultServerPort returns the default MCP server port.

```

<a id="cli-core-func-getdeploymenttimeout-time-duration"></a>
```text
func GetDeploymentTimeout() time.Duration
    GetDeploymentTimeout returns the deployment wait timeout.

```

<a id="cli-core-func-getgatewayproxyimageoverride-string"></a>
```text
func GetGatewayProxyImageOverride() string
    GetGatewayProxyImageOverride returns the gateway proxy image override,
    empty if not set.

```

<a id="cli-core-func-gethelperpodtimeout-time-duration"></a>
```text
func GetHelperPodTimeout() time.Duration
    GetHelperPodTimeout returns the helper pod ready timeout (e.g. registry
    pusher pod).

```

<a id="cli-core-func-getmcpingresshost-string"></a>
```text
func GetMcpIngressHost() string
    GetMcpIngressHost returns the public MCP / gateway host (mcp.<domain> when
    MCP_PLATFORM_DOMAIN is set), or empty if not configured.

```

<a id="cli-core-func-getoperatorimageoverride-string"></a>
```text
func GetOperatorImageOverride() string
    GetOperatorImageOverride returns the operator image override, empty if not
    set.

```

<a id="cli-core-func-getplatformingresshost-string"></a>
```text
func GetPlatformIngressHost() string
    GetPlatformIngressHost returns the public dashboard UI host
    (platform.<domain> when MCP_PLATFORM_DOMAIN is set), or empty if not
    configured. When empty the dev path-based routing on the gateway ingress is
    used.

```

<a id="cli-core-func-getregistryclusterissuername-string"></a>
```text
func GetRegistryClusterIssuerName() string
    GetRegistryClusterIssuerName returns the cluster issuer name used on the
    registry TLS ingress annotation (empty if unset).

```

<a id="cli-core-func-getregistryendpoint-string"></a>
```text
func GetRegistryEndpoint() string
    GetRegistryEndpoint returns the configured registry endpoint for image refs
    and pushes.

```

<a id="cli-core-func-getregistryingresshost-string"></a>
```text
func GetRegistryIngressHost() string
    GetRegistryIngressHost returns the configured registry ingress host.

```

<a id="cli-core-func-getregistryport-int"></a>
```text
func GetRegistryPort() int
    GetRegistryPort returns the registry port.

```

<a id="cli-core-func-getskopeoimage-string"></a>
```text
func GetSkopeoImage() string
    GetSkopeoImage returns the skopeo image for in-cluster operations.

```

<a id="cli-core-func-green-msg-string-string"></a>
```text
func Green(msg string) string
    Green returns green text.

```

<a id="cli-core-func-header-title-string"></a>
```text
func Header(title string)
    Header prints a header banner.

```

<a id="cli-core-func-info-msg-string"></a>
```text
func Info(msg string)
    Info prints an info message.

```

<a id="cli-core-func-isdebugmode-bool"></a>
```text
func IsDebugMode() bool
    IsDebugMode returns whether debug mode is enabled.

```

<a id="cli-core-func-logstructurederror-logger-zap-logger-err-error-msg-string"></a>
```text
func LogStructuredError(logger *zap.Logger, err error, msg string)
```

<a id="cli-core-func-newsetupstepfailederror-error"></a>
```text
func NewSetupStepFailedError() error
```

<a id="cli-core-func-newwithsentinel-base-error-msg-string-error"></a>
```text
func NewWithSentinel(base error, msg string) error
```

<a id="cli-core-func-red-msg-string-string"></a>
```text
func Red(msg string) string
    Red returns red text.

```

<a id="cli-core-func-section-title-string"></a>
```text
func Section(title string)
    Section prints a section header.

```

<a id="cli-core-func-setdebugmode-enabled-bool"></a>
```text
func SetDebugMode(enabled bool)
    SetDebugMode sets the global debug mode flag. When enabled,
    logStructuredError will output structured error logs to terminal.

```

<a id="cli-core-func-spinnerstart-msg-string-func-success-bool-finalmsg-string"></a>
```text
func SpinnerStart(msg string) func(success bool, finalMsg string)
    SpinnerStart starts a spinner.

```

<a id="cli-core-func-step-title-string"></a>
```text
func Step(title string)
    Step prints a step header.

```

<a id="cli-core-func-success-msg-string"></a>
```text
func Success(msg string)
    Success prints a success message.

```

<a id="cli-core-func-swapdefaultkubectlclient-c-kubectlclient-restore-func"></a>
```text
func SwapDefaultKubectlClient(c *KubectlClient) (restore func())
    SwapDefaultKubectlClient replaces the shared kubectl client (tests only).

```

<a id="cli-core-func-swapexecexecutor-e-executor-restore-func"></a>
```text
func SwapExecExecutor(e Executor) (restore func())
    SwapExecExecutor replaces the global process executor (tests only).

```

<a id="cli-core-func-table-data-string"></a>
```text
func Table(data [][]string)
    Table prints a table.

```

<a id="cli-core-func-tableboxed-data-string"></a>
```text
func TableBoxed(data [][]string)
    TableBoxed prints a boxed table.

```

<a id="cli-core-func-validatek8snameandnamespace-namelabel-string-namesentinel-error-name-namespace-string-string-string-error"></a>
```text
func ValidateK8sNameAndNamespace(nameLabel string, nameSentinel error, name, namespace string) (string, string, error)
    ValidateK8sNameAndNamespace validates a name+namespace pair against RFC-1123
    subdomain rules plus ValidateManifestField. nameLabel customizes the
    invalid-name error message ("server name", "resource name"); nameSentinel
    (may be nil) selects the sentinel error category.

```

<a id="cli-core-func-validatemanifestfield-field-value-string-string-error"></a>
```text
func ValidateManifestField(field, value string) (string, error)
    ValidateManifestField rejects control characters, requires non-empty after
    trimming, and returns the trimmed value.

```

<a id="cli-core-func-warn-msg-string"></a>
```text
func Warn(msg string)
    Warn prints a warning message.

```

<a id="cli-core-func-wrapwithsentinel-base-cause-error-msg-string-error"></a>
```text
func WrapWithSentinel(base, cause error, msg string) error
```

<a id="cli-core-func-wrapwithsentinelandcontext-base-cause-error-msg-string-context-map-string-any-error"></a>
```text
func WrapWithSentinelAndContext(base, cause error, msg string, context map[string]any) error
```

<a id="cli-core-func-yellow-msg-string-string"></a>
```text
func Yellow(msg string) string
    Yellow returns yellow text.
```

<a id="cli-core-types"></a>
### Types

<a id="cli-core-type-cliconfig-struct"></a>
```text
type CLIConfig struct {
	// Timeouts
	DeploymentTimeout time.Duration
	CertTimeout       time.Duration
	HelperPodTimeout  time.Duration

	// Registry settings
	RegistryPort        int
	RegistryEndpoint    string
	RegistryIngressHost string
	// McpIngressHost is the public gateway / MCP host (e.g. mcp.mcpruntime.com), from
	// MCP_MCP_INGRESS_HOST or mcp.<MCP_PLATFORM_DOMAIN>. Empty if unset.
	McpIngressHost string
	// PlatformIngressHost is the public dashboard UI host (e.g. platform.mcpruntime.com), from
	// MCP_PLATFORM_INGRESS_HOST or platform.<MCP_PLATFORM_DOMAIN>. Empty falls back to path-based dev routing.
	PlatformIngressHost string
	// RegistryClusterIssuerName is the cert-manager.io/cluster-issuer name for the registry ingress
	// (e.g. letsencrypt-prod, mcp-runtime-ca, or an org issuer from --tls-cluster-issuer). Set by setup --with-tls, not from env.
	RegistryClusterIssuerName string
	SkopeoImage               string
	OperatorImage             string // Override for operator image
	GatewayProxyImage         string // Optional default image for the MCP gateway sidecar
	AnalyticsIngestURL        string // Optional analytics ingest URL override for the MCP gateway sidecar
	IngressReadinessMode      string // Optional operator ingress readiness mode: strict or permissive
	ClusterName               string // Optional cluster label attached to analytics/audit events

	// Server defaults
	DefaultServerPort int

	// External/Provisioned registry credentials
	ProvisionedRegistryURL      string
	ProvisionedRegistryUsername string
	ProvisionedRegistryPassword string
}
    CLIConfig holds all CLI configuration loaded from environment variables.
    Use LoadCLIConfig() to create an instance with values from the environment.

```

<a id="cli-core-func-loadcliconfig-cliconfig"></a>
```text
func LoadCLIConfig() *CLIConfig
    LoadCLIConfig loads CLI configuration from environment variables.

```

<a id="cli-core-type-command-interface"></a>
```text
type Command interface {
	Output() ([]byte, error)
	CombinedOutput() ([]byte, error)
	Run() error
	SetStdout(w io.Writer)
	SetStderr(w io.Writer)
	SetStdin(r io.Reader)
}
    Command represents a command that can be executed.

```

<a id="cli-core-func-execcommandwithvalidators-name-string-args-string-validators-execvalidator-command-error"></a>
```text
func ExecCommandWithValidators(name string, args []string, validators ...ExecValidator) (Command, error)
    ExecCommandWithValidators runs the named binary with args after validators
    pass.

```

<a id="cli-core-type-execspec-struct"></a>
```text
type ExecSpec struct {
	Name string
	Args []string
}

```

<a id="cli-core-type-execvalidator-func-execspec-error"></a>
```text
type ExecValidator func(ExecSpec) error

```

<a id="cli-core-func-allowlistbins-allowed-string-execvalidator"></a>
```text
func AllowlistBins(allowed ...string) ExecValidator

```

<a id="cli-core-func-nocontrolchars-execvalidator"></a>
```text
func NoControlChars() ExecValidator

```

<a id="cli-core-func-noshellmeta-execvalidator"></a>
```text
func NoShellMeta() ExecValidator

```

<a id="cli-core-func-pathunder-root-string-execvalidator"></a>
```text
func PathUnder(root string) ExecValidator

```

<a id="cli-core-type-executor-interface"></a>
```text
type Executor interface {
	Command(name string, args []string, validators ...ExecValidator) (Command, error)
}
    Executor creates commands for execution.

```

<a id="cli-core-func-defaultexecutor-executor"></a>
```text
func DefaultExecutor() Executor
    DefaultExecutor returns the shared process executor used by CLI commands.

```

<a id="cli-core-type-kubectlclient-struct"></a>
```text
type KubectlClient struct {
	// Has unexported fields.
}
    KubectlClient wraps kubectl command execution with validation.

```

<a id="cli-core-func-defaultkubectlclient-kubectlclient"></a>
```text
func DefaultKubectlClient() *KubectlClient
    DefaultKubectlClient returns the shared kubectl client used by CLI commands.

```

<a id="cli-core-func-newkubectlclient-exec-executor-kubectlclient-error"></a>
```text
func NewKubectlClient(exec Executor) (*KubectlClient, error)
    NewKubectlClient creates a KubectlClient with default validators.

```

<a id="cli-core-func-newtestkubectlclient-exec-executor-kubectlclient"></a>
```text
func NewTestKubectlClient(exec Executor) *KubectlClient
    NewTestKubectlClient returns a KubectlClient for tests (no path validators).

```

<a id="cli-core-func-newtestkubectlclientwithvalidators-exec-executor-validators-execvalidator-kubectlclient"></a>
```text
func NewTestKubectlClientWithValidators(exec Executor, validators []ExecValidator) *KubectlClient
    NewTestKubectlClientWithValidators returns a KubectlClient for tests using
    the given validator list (or nil for none).

```

<a id="cli-core-func-c-kubectlclient-combinedoutput-args-string-byte-error"></a>
```text
func (c *KubectlClient) CombinedOutput(args []string) ([]byte, error)
    CombinedOutput runs kubectl with the given arguments and returns combined
    stdout/stderr.

```

<a id="cli-core-func-c-kubectlclient-commandargs-args-string-command-error"></a>
```text
func (c *KubectlClient) CommandArgs(args []string) (Command, error)
    CommandArgs builds a kubectl command with the given arguments. Validates
    arguments against configured validators before building.

```

<a id="cli-core-func-c-kubectlclient-output-args-string-byte-error"></a>
```text
func (c *KubectlClient) Output(args []string) ([]byte, error)
    Output runs kubectl with the given arguments and returns stdout.

```

<a id="cli-core-func-c-kubectlclient-run-args-string-error"></a>
```text
func (c *KubectlClient) Run(args []string) error
    Run runs kubectl with the given arguments.

```

<a id="cli-core-func-c-kubectlclient-runwithoutput-args-string-stdout-stderr-io-writer-error"></a>
```text
func (c *KubectlClient) RunWithOutput(args []string, stdout, stderr io.Writer) error
    RunWithOutput runs kubectl with the given arguments, piping to the provided
    writers.

```

<a id="cli-core-type-kubectlrunner-interface"></a>
```text
type KubectlRunner interface {
	CommandArgs(args []string) (Command, error)
	Run(args []string) error
	RunWithOutput(args []string, stdout, stderr io.Writer) error
}
    KubectlRunner captures the kubectl methods used by setup helpers.

```

<a id="cli-core-func-defaultkubectlrunner-kubectlrunner"></a>
```text
func DefaultKubectlRunner() KubectlRunner
    DefaultKubectlRunner returns the shared kubectl runner used by CLI commands.

```

<a id="cli-core-type-mockcommand-struct"></a>
```text
type MockCommand struct {
	Args       []string
	OutputData []byte
	OutputErr  error
	RunErr     error
	StdoutW    io.Writer
	StderrW    io.Writer
	StdinR     io.Reader
	RunFunc    func() error
}
    MockCommand is a test double for Command interface.

```

<a id="cli-core-func-m-mockcommand-combinedoutput-byte-error"></a>
```text
func (m *MockCommand) CombinedOutput() ([]byte, error)

```

<a id="cli-core-func-m-mockcommand-output-byte-error"></a>
```text
func (m *MockCommand) Output() ([]byte, error)

```

<a id="cli-core-func-m-mockcommand-run-error"></a>
```text
func (m *MockCommand) Run() error

```

<a id="cli-core-func-m-mockcommand-setstderr-w-io-writer"></a>
```text
func (m *MockCommand) SetStderr(w io.Writer)

```

<a id="cli-core-func-m-mockcommand-setstdin-r-io-reader"></a>
```text
func (m *MockCommand) SetStdin(r io.Reader)

```

<a id="cli-core-func-m-mockcommand-setstdout-w-io-writer"></a>
```text
func (m *MockCommand) SetStdout(w io.Writer)

```

<a id="cli-core-type-mockexecutor-struct"></a>
```text
type MockExecutor struct {
	// Commands records all commands that were created.
	Commands []ExecSpec
	// DefaultOutput is returned by commands when CommandFunc is nil.
	DefaultOutput []byte
	// DefaultErr is the error returned by Output/CombinedOutput.
	DefaultErr error
	// DefaultRunErr is the error returned by Run.
	DefaultRunErr error
	// CommandFunc allows custom behavior per command.
	CommandFunc func(spec ExecSpec) *MockCommand
}
    MockExecutor is a test double for Executor interface.

```

<a id="cli-core-func-m-mockexecutor-command-name-string-args-string-validators-execvalidator-command-error"></a>
```text
func (m *MockExecutor) Command(name string, args []string, validators ...ExecValidator) (Command, error)

```

<a id="cli-core-func-m-mockexecutor-hascommand-name-string-bool"></a>
```text
func (m *MockExecutor) HasCommand(name string) bool
    HasCommand checks if a command with the given name was executed.

```

<a id="cli-core-func-m-mockexecutor-lastcommand-execspec"></a>
```text
func (m *MockExecutor) LastCommand() ExecSpec
    LastCommand returns the most recent command spec.

```

<a id="cli-core-func-m-mockexecutor-reset"></a>
```text
func (m *MockExecutor) Reset()
    Reset clears recorded commands.

```

<a id="cli-core-type-printer-struct"></a>
```text
type Printer struct {
	// Quiet suppresses non-essential output
	Quiet bool
	// Writer overrides the output destination when set.
	Writer io.Writer
}
    Printer provides formatted terminal output methods. Use the default instance
    via package-level functions.

```

<a id="cli-core-func-p-printer-cyan-msg-string-string"></a>
```text
func (p *Printer) Cyan(msg string) string
    Cyan returns cyan-colored text.

```

<a id="cli-core-func-p-printer-error-msg-string"></a>
```text
func (p *Printer) Error(msg string)
    Error prints an error message. Note: Errors are intentionally not suppressed
    in quiet mode to ensure critical issues are always visible, even when
    non-essential output is disabled.

```

<a id="cli-core-func-p-printer-green-msg-string-string"></a>
```text
func (p *Printer) Green(msg string) string
    Green returns green-colored text.

```

<a id="cli-core-func-p-printer-header-title-string"></a>
```text
func (p *Printer) Header(title string)
    Header prints a full-width header banner.

```

<a id="cli-core-func-p-printer-info-msg-string"></a>
```text
func (p *Printer) Info(msg string)
    Info prints an informational message.

```

<a id="cli-core-func-p-printer-printf-format-string-a-interface"></a>
```text
func (p *Printer) Printf(format string, a ...interface{})
    Printf prints formatted text.

```

<a id="cli-core-func-p-printer-println-a-interface"></a>
```text
func (p *Printer) Println(a ...interface{})
    Println prints a plain line.

```

<a id="cli-core-func-p-printer-red-msg-string-string"></a>
```text
func (p *Printer) Red(msg string) string
    Red returns red-colored text.

```

<a id="cli-core-func-p-printer-section-title-string"></a>
```text
func (p *Printer) Section(title string)
    Section prints a prominent section header.

```

<a id="cli-core-func-p-printer-spinnerstart-msg-string-func-success-bool-finalmsg-string"></a>
```text
func (p *Printer) SpinnerStart(msg string) func(success bool, finalMsg string)
    SpinnerStart starts a spinner with the given message. Returns a stop
    function.

```

<a id="cli-core-func-p-printer-step-title-string"></a>
```text
func (p *Printer) Step(title string)
    Step prints a step indicator (e.g., "Step 1: Initialize").

```

<a id="cli-core-func-p-printer-success-msg-string"></a>
```text
func (p *Printer) Success(msg string)
    Success prints a success message.

```

<a id="cli-core-func-p-printer-table-data-string"></a>
```text
func (p *Printer) Table(data [][]string)
    Table prints a formatted table. First row is treated as header.

```

<a id="cli-core-func-p-printer-tableboxed-data-string"></a>
```text
func (p *Printer) TableBoxed(data [][]string)
    TableBoxed prints a formatted table with box borders.

```

<a id="cli-core-func-p-printer-warn-msg-string"></a>
```text
func (p *Printer) Warn(msg string)
    Warn prints a warning message. Note: Warnings are intentionally not
    suppressed in quiet mode to ensure important notices are visible even when
    non-essential output is disabled.

```

<a id="cli-core-func-p-printer-yellow-msg-string-string"></a>
```text
func (p *Printer) Yellow(msg string) string
    Yellow returns yellow-colored text.

```

<a id="cli-core-type-runtime-struct"></a>
```text
type Runtime struct {
	// Has unexported fields.
}
    Runtime is the shared CLI facade for wiring common dependencies once and
    handing typed managers to the foldered command packages.

```

<a id="cli-core-func-newruntime-logger-zap-logger-runtime"></a>
```text
func NewRuntime(logger *zap.Logger) *Runtime
    NewRuntime builds the shared CLI runtime facade.

```

<a id="cli-core-func-r-runtime-config-cliconfig"></a>
```text
func (r *Runtime) Config() *CLIConfig
    Config returns the loaded CLI configuration.

```

<a id="cli-core-func-r-runtime-executor-executor"></a>
```text
func (r *Runtime) Executor() Executor
    Executor returns the shared process executor.

```

<a id="cli-core-func-r-runtime-kubectlclient-kubectlclient"></a>
```text
func (r *Runtime) KubectlClient() *KubectlClient
    KubectlClient returns the shared kubectl client.

```

<a id="cli-core-func-r-runtime-kubectlrunner-kubectlrunner"></a>
```text
func (r *Runtime) KubectlRunner() KubectlRunner
    KubectlRunner returns the shared kubectl runner.

```

<a id="cli-core-func-r-runtime-logger-zap-logger"></a>
```text
func (r *Runtime) Logger() *zap.Logger
    Logger returns the shared logger.

```

<a id="cli-core-func-r-runtime-printer-printer"></a>
```text
func (r *Runtime) Printer() *Printer
    Printer returns the shared terminal printer.
```

<a id="cli-kubernetes-helpers"></a>
## CLI Kubernetes helpers

Package: `kube`
Import path: `mcp-runtime/internal/cli/kube`

Source command:

```bash
go doc -all ./internal/cli/kube
```

<a id="cli-kubernetes-helpers-overview"></a>
### Overview

Package kube contains shared kubectl-oriented helpers for CLI commands.

### Jump To

- [Overview](#cli-kubernetes-helpers-overview)
- [Index](#cli-kubernetes-helpers-index)
- [Functions](#cli-kubernetes-helpers-functions)
- [Types](#cli-kubernetes-helpers-types)

<a id="cli-kubernetes-helpers-index"></a>
### Index

- [`func ApplyManifestContent[T Command](commandArgs func([]string) (T, error), manifest string) error`](#cli-kubernetes-helpers-func-applymanifestcontent-t-command-commandargs-func-string-t-error-manifest-string-error)
- [`func ApplyManifestContentWithNamespace[T Command](commandArgs func([]string) (T, error), manifest, namespace string) error`](#cli-kubernetes-helpers-func-applymanifestcontentwithnamespace-t-command-commandargs-func-string-t-error-manifest-namespace-string-error)
- [`func ApplyManifestFromFile[T Command](commandArgs func([]string) (T, error), file string, stdout, stderr io.Writer) error`](#cli-kubernetes-helpers-func-applymanifestfromfile-t-command-commandargs-func-string-t-error-file-string-stdout-stderr-io-writer-error)
- [`func EnsureNamespace[T Command](commandArgs func([]string) (T, error), name string) error`](#cli-kubernetes-helpers-func-ensurenamespace-t-command-commandargs-func-string-t-error-name-string-error)
- [`func NormalizePatchDocument(raw string) (string, error)`](#cli-kubernetes-helpers-func-normalizepatchdocument-raw-string-string-error)
- [`func NormalizePatchFile(file string) (string, error)`](#cli-kubernetes-helpers-func-normalizepatchfile-file-string-string-error)
- [`func ReadFileAtPath(path string) ([]byte, error)`](#cli-kubernetes-helpers-func-readfileatpath-path-string-byte-error)
- [`func ResolveRegularFilePath(file string) (string, error)`](#cli-kubernetes-helpers-func-resolveregularfilepath-file-string-string-error)
- [`func WriteOutputFile(file string, data []byte) error`](#cli-kubernetes-helpers-func-writeoutputfile-file-string-data-byte-error)
- [`type Command interface`](#cli-kubernetes-helpers-type-command-interface)

<a id="cli-kubernetes-helpers-functions"></a>
### Functions

<a id="cli-kubernetes-helpers-func-applymanifestcontent-t-command-commandargs-func-string-t-error-manifest-string-error"></a>
```text
func ApplyManifestContent[T Command](commandArgs func([]string) (T, error), manifest string) error
    ApplyManifestContent applies manifest YAML from a string via kubectl stdin.

```

<a id="cli-kubernetes-helpers-func-applymanifestcontentwithnamespace-t-command-commandargs-func-string-t-error-manifest-namespace-string-error"></a>
```text
func ApplyManifestContentWithNamespace[T Command](commandArgs func([]string) (T, error), manifest, namespace string) error
    ApplyManifestContentWithNamespace applies manifest YAML from stdin,
    optionally scoped to a namespace.

```

<a id="cli-kubernetes-helpers-func-applymanifestfromfile-t-command-commandargs-func-string-t-error-file-string-stdout-stderr-io-writer-error"></a>
```text
func ApplyManifestFromFile[T Command](commandArgs func([]string) (T, error), file string, stdout, stderr io.Writer) error
    ApplyManifestFromFile applies a manifest file using kubectl.

```

<a id="cli-kubernetes-helpers-func-ensurenamespace-t-command-commandargs-func-string-t-error-name-string-error"></a>
```text
func EnsureNamespace[T Command](commandArgs func([]string) (T, error), name string) error
    EnsureNamespace applies/creates a namespace idempotently.

```

<a id="cli-kubernetes-helpers-func-normalizepatchdocument-raw-string-string-error"></a>
```text
func NormalizePatchDocument(raw string) (string, error)
    NormalizePatchDocument parses YAML or JSON patch content and returns a JSON
    string suitable for kubectl patch --type=json (or merge) style inputs.

```

<a id="cli-kubernetes-helpers-func-normalizepatchfile-file-string-string-error"></a>
```text
func NormalizePatchFile(file string) (string, error)
    NormalizePatchFile reads a patch file from disk and returns normalized JSON
    like NormalizePatchDocument.

```

<a id="cli-kubernetes-helpers-func-readfileatpath-path-string-byte-error"></a>
```text
func ReadFileAtPath(path string) ([]byte, error)
    ReadFileAtPath reads a regular file without following symlink escapes
    outside its parent directory.

```

<a id="cli-kubernetes-helpers-func-resolveregularfilepath-file-string-string-error"></a>
```text
func ResolveRegularFilePath(file string) (string, error)
    ResolveRegularFilePath resolves a path and rejects directories.

```

<a id="cli-kubernetes-helpers-func-writeoutputfile-file-string-data-byte-error"></a>
```text
func WriteOutputFile(file string, data []byte) error
    WriteOutputFile writes data to a path under a resolved parent directory with
    0600 file permissions and 0750 (or tighter) directory permissions.
```

<a id="cli-kubernetes-helpers-types"></a>
### Types

<a id="cli-kubernetes-helpers-type-command-interface"></a>
```text
type Command interface {
	SetStdin(io.Reader)
	SetStdout(io.Writer)
	SetStderr(io.Writer)
	Run() error
}
    Command is the minimal command shape needed for stdin-based kubectl apply.
```

<a id="cli-kubernetes-errors"></a>
## CLI Kubernetes errors

Package: `kubeerr`
Import path: `mcp-runtime/internal/cli/kubeerr`

Source command:

```bash
go doc -all ./internal/cli/kubeerr
```

<a id="cli-kubernetes-errors-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-kubernetes-errors-overview)
- [Index](#cli-kubernetes-errors-index)
- [Functions](#cli-kubernetes-errors-functions)

<a id="cli-kubernetes-errors-index"></a>
### Index

- [`func CommandDetail(output string, fallback error) string`](#cli-kubernetes-errors-func-commanddetail-output-string-fallback-error-string)
- [`func SetupHint(detail string) (string, bool)`](#cli-kubernetes-errors-func-setuphint-detail-string-string-bool)

<a id="cli-kubernetes-errors-functions"></a>
### Functions

<a id="cli-kubernetes-errors-func-commanddetail-output-string-fallback-error-string"></a>
```text
func CommandDetail(output string, fallback error) string
    CommandDetail extracts a single-line error detail from kubectl output or the
    exec error.

```

<a id="cli-kubernetes-errors-func-setuphint-detail-string-string-bool"></a>
```text
func SetupHint(detail string) (string, bool)
    SetupHint returns a friendlier message when the cluster has not been
    provisioned yet.
```

<a id="cli-cluster"></a>
## CLI cluster

Package: `cluster`
Import path: `mcp-runtime/internal/cli/cluster`

Source command:

```bash
go doc -all ./internal/cli/cluster
```

<a id="cli-cluster-overview"></a>
### Overview

Package cluster owns routing for the cluster top-level command.

Cluster doctor diagnostics: distribution detection, registry and Traefik checks,
Sentinel probes, and remediation hints. See docs/cluster-readiness.md.

Package cluster implements cluster operations for the cluster CLI command.

### Jump To

- [Overview](#cli-cluster-overview)
- [Index](#cli-cluster-index)
- [Functions](#cli-cluster-functions)
- [Types](#cli-cluster-types)

<a id="cli-cluster-index"></a>
### Index

- [`func New(runtime *core.Runtime) *cobra.Command`](#cli-cluster-func-new-runtime-core-runtime-cobra-command)
- [`func NewWithManager(mgr *ClusterManager) *cobra.Command`](#cli-cluster-func-newwithmanager-mgr-clustermanager-cobra-command)
- [`func PrintDoctorReport(r DoctorReport)`](#cli-cluster-func-printdoctorreport-r-doctorreport)
- [`type ClusterManager struct`](#cli-cluster-type-clustermanager-struct)
- [`func DefaultClusterManager(logger *zap.Logger) *ClusterManager`](#cli-cluster-func-defaultclustermanager-logger-zap-logger-clustermanager)
- [`func NewClusterManager(kubectl *core.KubectlClient, exec core.Executor, logger *zap.Logger) *ClusterManager`](#cli-cluster-func-newclustermanager-kubectl-core-kubectlclient-exec-core-executor-logger-zap-logger-clustermanager)
- [`func (m *ClusterManager) CheckClusterStatus() error`](#cli-cluster-func-m-clustermanager-checkclusterstatus-error)
- [`func (m *ClusterManager) ConfigureCluster(opts IngressOptions) error`](#cli-cluster-func-m-clustermanager-configurecluster-opts-ingressoptions-error)
- [`func (m *ClusterManager) ConfigureClusterWithValues(mode, manifest string, force bool) error`](#cli-cluster-func-m-clustermanager-configureclusterwithvalues-mode-manifest-string-force-bool-error)
- [`func (m *ClusterManager) ConfigureKubeconfig(kubeconfig, context string) error`](#cli-cluster-func-m-clustermanager-configurekubeconfig-kubeconfig-context-string-error)
- [`func (m *ClusterManager) ConfigureKubeconfigFromProvider(provider, region, clusterName, resourceGroup, project, zone, kubeconfig string) error`](#cli-cluster-func-m-clustermanager-configurekubeconfigfromprovider-provider-region-clustername-resourcegroup-project-zone-kubeconfig-string-error)
- [`func (m *ClusterManager) EnsureNamespace(name string) error`](#cli-cluster-func-m-clustermanager-ensurenamespace-name-string-error)
- [`func (m *ClusterManager) InitCluster(kubeconfig, context string) error`](#cli-cluster-func-m-clustermanager-initcluster-kubeconfig-context-string-error)
- [`func (m *ClusterManager) KubectlRunner() core.KubectlRunner`](#cli-cluster-func-m-clustermanager-kubectlrunner-core-kubectlrunner)
- [`func (m *ClusterManager) Logger() *zap.Logger`](#cli-cluster-func-m-clustermanager-logger-zap-logger)
- [`func (m *ClusterManager) ProvisionCluster(provider, region string, nodeCount int, clusterName string, dryRun bool) error`](#cli-cluster-func-m-clustermanager-provisioncluster-provider-region-string-nodecount-int-clustername-string-dryrun-bool-error)
- [`type Distribution string`](#cli-cluster-type-distribution-string)
- [`func DetectDistribution(kubectl core.KubectlRunner) Distribution`](#cli-cluster-func-detectdistribution-kubectl-core-kubectlrunner-distribution)
- [`type DoctorCheck struct`](#cli-cluster-type-doctorcheck-struct)
- [`type DoctorCheckProgress func(DoctorCheckProgressEvent) func(DoctorCheck)`](#cli-cluster-type-doctorcheckprogress-func-doctorcheckprogressevent-func-doctorcheck)
- [`type DoctorCheckProgressEvent struct`](#cli-cluster-type-doctorcheckprogressevent-struct)
- [`type DoctorReport struct`](#cli-cluster-type-doctorreport-struct)
- [`func RunDoctor(kubectl core.KubectlRunner) DoctorReport`](#cli-cluster-func-rundoctor-kubectl-core-kubectlrunner-doctorreport)
- [`func RunDoctorAndPrint(kubectl core.KubectlRunner) DoctorReport`](#cli-cluster-func-rundoctorandprint-kubectl-core-kubectlrunner-doctorreport)
- [`func RunDoctorWithProgress(kubectl core.KubectlRunner, progress DoctorCheckProgress) DoctorReport`](#cli-cluster-func-rundoctorwithprogress-kubectl-core-kubectlrunner-progress-doctorcheckprogress-doctorreport)
- [`func (r DoctorReport) AllOK() bool`](#cli-cluster-func-r-doctorreport-allok-bool)
- [`type IngressOptions struct`](#cli-cluster-type-ingressoptions-struct)

<a id="cli-cluster-functions"></a>
### Functions

<a id="cli-cluster-func-new-runtime-core-runtime-cobra-command"></a>
```text
func New(runtime *core.Runtime) *cobra.Command
    New returns the cluster command.

```

<a id="cli-cluster-func-newwithmanager-mgr-clustermanager-cobra-command"></a>
```text
func NewWithManager(mgr *ClusterManager) *cobra.Command
    NewWithManager returns the cluster command using the provided manager.

```

<a id="cli-cluster-func-printdoctorreport-r-doctorreport"></a>
```text
func PrintDoctorReport(r DoctorReport)
    PrintDoctorReport emits a human-readable report using the standard printer.
```

<a id="cli-cluster-types"></a>
### Types

<a id="cli-cluster-type-clustermanager-struct"></a>
```text
type ClusterManager struct {
	// Has unexported fields.
}
    ClusterManager handles cluster operations with injected dependencies.

```

<a id="cli-cluster-func-defaultclustermanager-logger-zap-logger-clustermanager"></a>
```text
func DefaultClusterManager(logger *zap.Logger) *ClusterManager
    DefaultClusterManager returns a ClusterManager using default clients.

```

<a id="cli-cluster-func-newclustermanager-kubectl-core-kubectlclient-exec-core-executor-logger-zap-logger-clustermanager"></a>
```text
func NewClusterManager(kubectl *core.KubectlClient, exec core.Executor, logger *zap.Logger) *ClusterManager
    NewClusterManager creates a ClusterManager with the given dependencies.

```

<a id="cli-cluster-func-m-clustermanager-checkclusterstatus-error"></a>
```text
func (m *ClusterManager) CheckClusterStatus() error
    CheckClusterStatus checks and displays cluster status.

```

<a id="cli-cluster-func-m-clustermanager-configurecluster-opts-ingressoptions-error"></a>
```text
func (m *ClusterManager) ConfigureCluster(opts IngressOptions) error
    ConfigureCluster configures cluster settings like ingress.

```

<a id="cli-cluster-func-m-clustermanager-configureclusterwithvalues-mode-manifest-string-force-bool-error"></a>
```text
func (m *ClusterManager) ConfigureClusterWithValues(mode, manifest string, force bool) error
    ConfigureClusterWithValues adapts exported flag values into the internal
    ingress options shape.

```

<a id="cli-cluster-func-m-clustermanager-configurekubeconfig-kubeconfig-context-string-error"></a>
```text
func (m *ClusterManager) ConfigureKubeconfig(kubeconfig, context string) error
    ConfigureKubeconfig sets KUBECONFIG and optionally switches context.

```

<a id="cli-cluster-func-m-clustermanager-configurekubeconfigfromprovider-provider-region-clustername-resourcegroup-project-zone-kubeconfig-string-error"></a>
```text
func (m *ClusterManager) ConfigureKubeconfigFromProvider(provider, region, clusterName, resourceGroup, project, zone, kubeconfig string) error
    ConfigureKubeconfigFromProvider updates kubeconfig using a cloud provider
    CLI.

```

<a id="cli-cluster-func-m-clustermanager-ensurenamespace-name-string-error"></a>
```text
func (m *ClusterManager) EnsureNamespace(name string) error
    EnsureNamespace applies/creates a namespace idempotently.

```

<a id="cli-cluster-func-m-clustermanager-initcluster-kubeconfig-context-string-error"></a>
```text
func (m *ClusterManager) InitCluster(kubeconfig, context string) error
    InitCluster initializes cluster configuration.

```

<a id="cli-cluster-func-m-clustermanager-kubectlrunner-core-kubectlrunner"></a>
```text
func (m *ClusterManager) KubectlRunner() core.KubectlRunner
    KubectlRunner exposes the shared kubectl runner for foldered command
    routing.

```

<a id="cli-cluster-func-m-clustermanager-logger-zap-logger"></a>
```text
func (m *ClusterManager) Logger() *zap.Logger
    Logger exposes the shared logger for foldered command routing.

```

<a id="cli-cluster-func-m-clustermanager-provisioncluster-provider-region-string-nodecount-int-clustername-string-dryrun-bool-error"></a>
```text
func (m *ClusterManager) ProvisionCluster(provider, region string, nodeCount int, clusterName string, dryRun bool) error
    ProvisionCluster provisions a new Kubernetes cluster. When dryRun is true,
    it prints the configuration and command that would run without creating any
    cluster or calling out to cloud APIs.

```

<a id="cli-cluster-type-distribution-string"></a>
```text
type Distribution string
    Distribution identifies a Kubernetes flavor for remediation messaging.

const (
	DistroK3s           Distribution = "k3s"
	DistroKind          Distribution = "kind"
	DistroMinikube      Distribution = "minikube"
	DistroDockerDesktop Distribution = "docker-desktop"
	DistroGeneric       Distribution = "generic"
)
```

<a id="cli-cluster-func-detectdistribution-kubectl-core-kubectlrunner-distribution"></a>
```text
func DetectDistribution(kubectl core.KubectlRunner) Distribution
    DetectDistribution inspects node info to guess which distribution is
    running. This is best-effort: callers should treat DistroGeneric as
    "probably kubeadm/unknown".

```

<a id="cli-cluster-type-doctorcheck-struct"></a>
```text
type DoctorCheck struct {
	Name   string
	OK     bool
	Detail string
	Remedy string // Short hint; detailed steps come from the distro checklist.
}
    DoctorCheck is a single preflight check result.

```

<a id="cli-cluster-type-doctorcheckprogress-func-doctorcheckprogressevent-func-doctorcheck"></a>
```text
type DoctorCheckProgress func(DoctorCheckProgressEvent) func(DoctorCheck)
    DoctorCheckProgress is called before each doctor check starts. It returns an
    optional completion callback that receives the finished check result.

```

<a id="cli-cluster-type-doctorcheckprogressevent-struct"></a>
```text
type DoctorCheckProgressEvent struct {
	Name   string
	Detail string
	Index  int
	Total  int
}
    DoctorCheckProgressEvent describes the check that is about to run.

```

<a id="cli-cluster-type-doctorreport-struct"></a>
```text
type DoctorReport struct {
	Distribution Distribution
	Checks       []DoctorCheck
}
    DoctorReport aggregates the full preflight result.

```

<a id="cli-cluster-func-rundoctor-kubectl-core-kubectlrunner-doctorreport"></a>
```text
func RunDoctor(kubectl core.KubectlRunner) DoctorReport
    RunDoctor executes cluster diagnostics and returns a report.

```

<a id="cli-cluster-func-rundoctorandprint-kubectl-core-kubectlrunner-doctorreport"></a>
```text
func RunDoctorAndPrint(kubectl core.KubectlRunner) DoctorReport
    RunDoctorAndPrint streams doctor progress and results as checks execute.

```

<a id="cli-cluster-func-rundoctorwithprogress-kubectl-core-kubectlrunner-progress-doctorcheckprogress-doctorreport"></a>
```text
func RunDoctorWithProgress(kubectl core.KubectlRunner, progress DoctorCheckProgress) DoctorReport
    RunDoctorWithProgress executes cluster diagnostics and calls progress hooks
    before and after each check. It is useful for UIs that need live feedback.

```

<a id="cli-cluster-func-r-doctorreport-allok-bool"></a>
```text
func (r DoctorReport) AllOK() bool
    AllOK reports whether every check passed.

```

<a id="cli-cluster-type-ingressoptions-struct"></a>
```text
type IngressOptions struct {
	Mode     string
	Manifest string
	Force    bool
}
    IngressOptions captures ingress install settings used by both cluster
    configuration and the setup command.
```

<a id="cli-cert-manager"></a>
## CLI cert-manager

Package: `certmanager`
Import path: `mcp-runtime/internal/cli/certmanager`

Source command:

```bash
go doc -all ./internal/cli/certmanager
```

<a id="cli-cert-manager-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-cert-manager-overview)
- [Index](#cli-cert-manager-index)
- [Constants](#cli-cert-manager-constants)
- [Functions](#cli-cert-manager-functions)
- [Types](#cli-cert-manager-types)

<a id="cli-cert-manager-index"></a>
### Index

- [`Constants`](#cli-cert-manager-constants)
- [`func ACMETLSDNSNames() []string`](#cli-cert-manager-func-acmetlsdnsnames-string)
- [`func ApplyClusterIssuerWithKubectl(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-applyclusterissuerwithkubectl-kubectl-core-kubectlrunner-error)
- [`func ApplyLetsEncryptClusterIssuer(kubectl core.KubectlRunner, email string, staging bool, logger *zap.Logger) error`](#cli-cert-manager-func-applyletsencryptclusterissuer-kubectl-core-kubectlrunner-email-string-staging-bool-logger-zap-logger-error)
- [`func ApplyRegistryCertificateForACME(kubectl core.KubectlRunner, dnsNames []string, issuerName string) error`](#cli-cert-manager-func-applyregistrycertificateforacme-kubectl-core-kubectlrunner-dnsnames-string-issuername-string-error)
- [`func ApplyRegistryCertificateWithKubectl(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-applyregistrycertificatewithkubectl-kubectl-core-kubectlrunner-error)
- [`func CheckCASecretWithKubectl(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-checkcasecretwithkubectl-kubectl-core-kubectlrunner-error)
- [`func CheckCertManagerInstalledWithKubectl(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-checkcertmanagerinstalledwithkubectl-kubectl-core-kubectlrunner-error)
- [`func CheckCertificateWithKubectl(kubectl core.KubectlRunner, name, namespace string) error`](#cli-cert-manager-func-checkcertificatewithkubectl-kubectl-core-kubectlrunner-name-namespace-string-error)
- [`func CheckClusterIssuerWithKubectl(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-checkclusterissuerwithkubectl-kubectl-core-kubectlrunner-error)
- [`func CheckNamedClusterIssuerWithKubectl(kubectl core.KubectlRunner, name string) error`](#cli-cert-manager-func-checknamedclusterissuerwithkubectl-kubectl-core-kubectlrunner-name-string-error)
- [`func ClusterIssuerNameForACME(staging bool) string`](#cli-cert-manager-func-clusterissuernameforacme-staging-bool-string)
- [`func EnsureCertManagerInstalled(kubectl core.KubectlRunner, logger *zap.Logger) error`](#cli-cert-manager-func-ensurecertmanagerinstalled-kubectl-core-kubectlrunner-logger-zap-logger-error)
- [`func PreflightACMEHostnamesPort80(dnsNames []string)`](#cli-cert-manager-func-preflightacmehostnamesport80-dnsnames-string)
- [`func ValidateACMEHostnameForPublicCA() error`](#cli-cert-manager-func-validateacmehostnameforpublicca-error)
- [`func ValidateIngressManifestForACME(ingressManifest string) error`](#cli-cert-manager-func-validateingressmanifestforacme-ingressmanifest-string-error)
- [`func WaitForCertificateReadyWithKubectl(kubectl core.KubectlRunner, name, namespace string, timeout time.Duration) error`](#cli-cert-manager-func-waitforcertificatereadywithkubectl-kubectl-core-kubectlrunner-name-namespace-string-timeout-time-duration-error)
- [`func WaitForTraefikDeploymentForACME(kubectl core.KubectlRunner) error`](#cli-cert-manager-func-waitfortraefikdeploymentforacme-kubectl-core-kubectlrunner-error)
- [`type CertManager struct`](#cli-cert-manager-type-certmanager-struct)
- [`func NewCertManager(kubectl core.KubectlRunner, logger *zap.Logger) *CertManager`](#cli-cert-manager-func-newcertmanager-kubectl-core-kubectlrunner-logger-zap-logger-certmanager)
- [`func (m *CertManager) Apply(dryRun bool) error`](#cli-cert-manager-func-m-certmanager-apply-dryrun-bool-error)
- [`func (m *CertManager) Status() error`](#cli-cert-manager-func-m-certmanager-status-error)
- [`func (m *CertManager) Wait(timeout time.Duration) error`](#cli-cert-manager-func-m-certmanager-wait-timeout-time-duration-error)

<a id="cli-cert-manager-constants"></a>
### Constants

```text
const (
	CertClusterIssuerName   = certClusterIssuerName
	RegistryCertificateName = registryCertificateName
)
```

<a id="cli-cert-manager-functions"></a>
### Functions

<a id="cli-cert-manager-func-acmetlsdnsnames-string"></a>
```text
func ACMETLSDNSNames() []string
```

<a id="cli-cert-manager-func-applyclusterissuerwithkubectl-kubectl-core-kubectlrunner-error"></a>
```text
func ApplyClusterIssuerWithKubectl(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-func-applyletsencryptclusterissuer-kubectl-core-kubectlrunner-email-string-staging-bool-logger-zap-logger-error"></a>
```text
func ApplyLetsEncryptClusterIssuer(kubectl core.KubectlRunner, email string, staging bool, logger *zap.Logger) error
```

<a id="cli-cert-manager-func-applyregistrycertificateforacme-kubectl-core-kubectlrunner-dnsnames-string-issuername-string-error"></a>
```text
func ApplyRegistryCertificateForACME(kubectl core.KubectlRunner, dnsNames []string, issuerName string) error
```

<a id="cli-cert-manager-func-applyregistrycertificatewithkubectl-kubectl-core-kubectlrunner-error"></a>
```text
func ApplyRegistryCertificateWithKubectl(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-func-checkcasecretwithkubectl-kubectl-core-kubectlrunner-error"></a>
```text
func CheckCASecretWithKubectl(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-func-checkcertmanagerinstalledwithkubectl-kubectl-core-kubectlrunner-error"></a>
```text
func CheckCertManagerInstalledWithKubectl(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-func-checkcertificatewithkubectl-kubectl-core-kubectlrunner-name-namespace-string-error"></a>
```text
func CheckCertificateWithKubectl(kubectl core.KubectlRunner, name, namespace string) error
```

<a id="cli-cert-manager-func-checkclusterissuerwithkubectl-kubectl-core-kubectlrunner-error"></a>
```text
func CheckClusterIssuerWithKubectl(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-func-checknamedclusterissuerwithkubectl-kubectl-core-kubectlrunner-name-string-error"></a>
```text
func CheckNamedClusterIssuerWithKubectl(kubectl core.KubectlRunner, name string) error
```

<a id="cli-cert-manager-func-clusterissuernameforacme-staging-bool-string"></a>
```text
func ClusterIssuerNameForACME(staging bool) string
    ClusterIssuerNameForACME returns the ClusterIssuer resource name for Let's
    Encrypt.

```

<a id="cli-cert-manager-func-ensurecertmanagerinstalled-kubectl-core-kubectlrunner-logger-zap-logger-error"></a>
```text
func EnsureCertManagerInstalled(kubectl core.KubectlRunner, logger *zap.Logger) error
```

<a id="cli-cert-manager-func-preflightacmehostnamesport80-dnsnames-string"></a>
```text
func PreflightACMEHostnamesPort80(dnsNames []string)
```

<a id="cli-cert-manager-func-validateacmehostnameforpublicca-error"></a>
```text
func ValidateACMEHostnameForPublicCA() error
```

<a id="cli-cert-manager-func-validateingressmanifestforacme-ingressmanifest-string-error"></a>
```text
func ValidateIngressManifestForACME(ingressManifest string) error
```

<a id="cli-cert-manager-func-waitforcertificatereadywithkubectl-kubectl-core-kubectlrunner-name-namespace-string-timeout-time-duration-error"></a>
```text
func WaitForCertificateReadyWithKubectl(kubectl core.KubectlRunner, name, namespace string, timeout time.Duration) error
```

<a id="cli-cert-manager-func-waitfortraefikdeploymentforacme-kubectl-core-kubectlrunner-error"></a>
```text
func WaitForTraefikDeploymentForACME(kubectl core.KubectlRunner) error
```

<a id="cli-cert-manager-types"></a>
### Types

<a id="cli-cert-manager-type-certmanager-struct"></a>
```text
type CertManager struct {
	// Has unexported fields.
}
    CertManager manages cert-manager resources for the platform.

```

<a id="cli-cert-manager-func-newcertmanager-kubectl-core-kubectlrunner-logger-zap-logger-certmanager"></a>
```text
func NewCertManager(kubectl core.KubectlRunner, logger *zap.Logger) *CertManager
    NewCertManager creates a CertManager with the given dependencies.

```

<a id="cli-cert-manager-func-m-certmanager-apply-dryrun-bool-error"></a>
```text
func (m *CertManager) Apply(dryRun bool) error
    Apply installs cert-manager resources required for registry TLS. When dryRun
    is true, the read-only preflight checks still run (to catch obvious problems
    like missing cert-manager) but no kubectl apply is performed.

```

<a id="cli-cert-manager-func-m-certmanager-status-error"></a>
```text
func (m *CertManager) Status() error
    Status verifies cert-manager installation and required resources.

```

<a id="cli-cert-manager-func-m-certmanager-wait-timeout-time-duration-error"></a>
```text
func (m *CertManager) Wait(timeout time.Duration) error
    Wait blocks until the registry certificate is Ready or times out.
```

<a id="cli-platform-api"></a>
## CLI platform API

Package: `platformapi`
Import path: `mcp-runtime/internal/cli/platformapi`

Source command:

```bash
go doc -all ./internal/cli/platformapi
```

<a id="cli-platform-api-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-platform-api-overview)
- [Index](#cli-platform-api-index)
- [Functions](#cli-platform-api-functions)
- [Types](#cli-platform-api-types)

<a id="cli-platform-api-index"></a>
### Index

- [`func HasPlatformClient() bool`](#cli-platform-api-func-hasplatformclient-bool)
- [`func NormalizeBaseURL(raw string) string`](#cli-platform-api-func-normalizebaseurl-raw-string-string)
- [`type PlatformClient struct`](#cli-platform-api-type-platformclient-struct)
- [`func NewPlatformClient() (*PlatformClient, error)`](#cli-platform-api-func-newplatformclient-platformclient-error)
- [`func ResolvePlatformOrKube(useKube bool) (*PlatformClient, bool, error)`](#cli-platform-api-func-resolveplatformorkube-usekube-bool-platformclient-bool-error)
- [`func (c *PlatformClient) ApplyAccessFromYAMLFile(ctx context.Context, path string) error`](#cli-platform-api-func-c-platformclient-applyaccessfromyamlfile-ctx-context-context-path-string-error)
- [`func (c *PlatformClient) DeleteGrant(ctx context.Context, namespace, name string) error`](#cli-platform-api-func-c-platformclient-deletegrant-ctx-context-context-namespace-name-string-error)
- [`func (c *PlatformClient) DeleteSession(ctx context.Context, namespace, name string) error`](#cli-platform-api-func-c-platformclient-deletesession-ctx-context-context-namespace-name-string-error)
- [`func (c *PlatformClient) GetGrant(ctx context.Context, namespace, name string) (sentinelaccess.GrantSummary, error)`](#cli-platform-api-func-c-platformclient-getgrant-ctx-context-context-namespace-name-string-sentinelaccess-grantsummary-error)
- [`func (c *PlatformClient) GetRuntimePolicy(ctx context.Context, namespace, server string) ([]byte, error)`](#cli-platform-api-func-c-platformclient-getruntimepolicy-ctx-context-context-namespace-server-string-byte-error)
- [`func (c *PlatformClient) GetSession(ctx context.Context, namespace, name string) (sentinelaccess.SessionSummary, error)`](#cli-platform-api-func-c-platformclient-getsession-ctx-context-context-namespace-name-string-sentinelaccess-sessionsummary-error)
- [`func (c *PlatformClient) ListGrants(ctx context.Context, namespace string) ([]sentinelaccess.GrantSummary, error)`](#cli-platform-api-func-c-platformclient-listgrants-ctx-context-context-namespace-string-sentinelaccess-grantsummary-error)
- [`func (c *PlatformClient) ListRuntimeServers(ctx context.Context, namespace string) ([]ServerListItem, error)`](#cli-platform-api-func-c-platformclient-listruntimeservers-ctx-context-context-namespace-string-serverlistitem-error)
- [`func (c *PlatformClient) ListSessions(ctx context.Context, namespace string) ([]sentinelaccess.SessionSummary, error)`](#cli-platform-api-func-c-platformclient-listsessions-ctx-context-context-namespace-string-sentinelaccess-sessionsummary-error)
- [`func (c *PlatformClient) PostGrantToggle(ctx context.Context, namespace, name, action string) error`](#cli-platform-api-func-c-platformclient-postgranttoggle-ctx-context-context-namespace-name-action-string-error)
- [`func (c *PlatformClient) PostSessionToggle(ctx context.Context, namespace, name, action string) error`](#cli-platform-api-func-c-platformclient-postsessiontoggle-ctx-context-context-namespace-name-action-string-error)
- [`type ServerListItem struct`](#cli-platform-api-type-serverlistitem-struct)

<a id="cli-platform-api-functions"></a>
### Functions

<a id="cli-platform-api-func-hasplatformclient-bool"></a>
```text
func HasPlatformClient() bool
```

<a id="cli-platform-api-func-normalizebaseurl-raw-string-string"></a>
```text
func NormalizeBaseURL(raw string) string
    NormalizeBaseURL trims whitespace, trailing slashes, and an optional
    trailing /api suffix from a platform base URL.
```

<a id="cli-platform-api-types"></a>
### Types

<a id="cli-platform-api-type-platformclient-struct"></a>
```text
type PlatformClient struct {
	// Has unexported fields.
}
    PlatformClient calls the mcp-sentinel API with an API key.

```

<a id="cli-platform-api-func-newplatformclient-platformclient-error"></a>
```text
func NewPlatformClient() (*PlatformClient, error)
    NewPlatformClient returns a client when platform credentials and
    API base URL are configured. If the user is not logged in, returns
    authfile.ErrNotFound so the caller can fall back to kubectl.

```

<a id="cli-platform-api-func-resolveplatformorkube-usekube-bool-platformclient-bool-error"></a>
```text
func ResolvePlatformOrKube(useKube bool) (*PlatformClient, bool, error)
    ResolvePlatformOrKube returns a platform API client when useKube is false
    and auth resolves; otherwise useKubectl is true.

```

<a id="cli-platform-api-func-c-platformclient-applyaccessfromyamlfile-ctx-context-context-path-string-error"></a>
```text
func (c *PlatformClient) ApplyAccessFromYAMLFile(ctx context.Context, path string) error

```

<a id="cli-platform-api-func-c-platformclient-deletegrant-ctx-context-context-namespace-name-string-error"></a>
```text
func (c *PlatformClient) DeleteGrant(ctx context.Context, namespace, name string) error

```

<a id="cli-platform-api-func-c-platformclient-deletesession-ctx-context-context-namespace-name-string-error"></a>
```text
func (c *PlatformClient) DeleteSession(ctx context.Context, namespace, name string) error

```

<a id="cli-platform-api-func-c-platformclient-getgrant-ctx-context-context-namespace-name-string-sentinelaccess-grantsummary-error"></a>
```text
func (c *PlatformClient) GetGrant(ctx context.Context, namespace, name string) (sentinelaccess.GrantSummary, error)

```

<a id="cli-platform-api-func-c-platformclient-getruntimepolicy-ctx-context-context-namespace-server-string-byte-error"></a>
```text
func (c *PlatformClient) GetRuntimePolicy(ctx context.Context, namespace, server string) ([]byte, error)

```

<a id="cli-platform-api-func-c-platformclient-getsession-ctx-context-context-namespace-name-string-sentinelaccess-sessionsummary-error"></a>
```text
func (c *PlatformClient) GetSession(ctx context.Context, namespace, name string) (sentinelaccess.SessionSummary, error)

```

<a id="cli-platform-api-func-c-platformclient-listgrants-ctx-context-context-namespace-string-sentinelaccess-grantsummary-error"></a>
```text
func (c *PlatformClient) ListGrants(ctx context.Context, namespace string) ([]sentinelaccess.GrantSummary, error)

```

<a id="cli-platform-api-func-c-platformclient-listruntimeservers-ctx-context-context-namespace-string-serverlistitem-error"></a>
```text
func (c *PlatformClient) ListRuntimeServers(ctx context.Context, namespace string) ([]ServerListItem, error)

```

<a id="cli-platform-api-func-c-platformclient-listsessions-ctx-context-context-namespace-string-sentinelaccess-sessionsummary-error"></a>
```text
func (c *PlatformClient) ListSessions(ctx context.Context, namespace string) ([]sentinelaccess.SessionSummary, error)

```

<a id="cli-platform-api-func-c-platformclient-postgranttoggle-ctx-context-context-namespace-name-action-string-error"></a>
```text
func (c *PlatformClient) PostGrantToggle(ctx context.Context, namespace, name, action string) error

```

<a id="cli-platform-api-func-c-platformclient-postsessiontoggle-ctx-context-context-namespace-name-action-string-error"></a>
```text
func (c *PlatformClient) PostSessionToggle(ctx context.Context, namespace, name, action string) error

```

<a id="cli-platform-api-type-serverlistitem-struct"></a>
```text
type ServerListItem struct {
	Name      string            `json:"name"`
	Namespace string            `json:"namespace"`
	Ready     string            `json:"ready"`
	Status    string            `json:"status"`
	Labels    map[string]string `json:"labels"`
	Age       string            `json:"age"`
}
    ServerListItem is one row from the platform API runtime servers list.
```

<a id="cli-platform-status"></a>
## CLI platform status

Package: `platformstatus`
Import path: `mcp-runtime/internal/cli/platformstatus`

Source command:

```bash
go doc -all ./internal/cli/platformstatus
```

<a id="cli-platform-status-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-platform-status-overview)
- [Index](#cli-platform-status-index)
- [Variables](#cli-platform-status-variables)
- [Functions](#cli-platform-status-functions)
- [Types](#cli-platform-status-types)

<a id="cli-platform-status-index"></a>
### Index

- [`Variables`](#cli-platform-status-variables)
- [`func AnalyticsNamespaceInstalled(kubectl core.KubectlRunner, clusterReachable bool) (bool, error)`](#cli-platform-status-func-analyticsnamespaceinstalled-kubectl-core-kubectlrunner-clusterreachable-bool-bool-error)
- [`func AnalyticsStackRow(status, details string) []string`](#cli-platform-status-func-analyticsstackrow-status-details-string-string)
- [`func CheckClusterStatusQuiet(kubectl core.KubectlRunner) error`](#cli-platform-status-func-checkclusterstatusquiet-kubectl-core-kubectlrunner-error)
- [`func WorkloadStatusRow(kubectl core.KubectlRunner, workload PlatformWorkload, clusterReachable bool) []string`](#cli-platform-status-func-workloadstatusrow-kubectl-core-kubectlrunner-workload-platformworkload-clusterreachable-bool-string)
- [`type PlatformWorkload struct`](#cli-platform-status-type-platformworkload-struct)

<a id="cli-platform-status-variables"></a>
### Variables

```text
var DefaultPlatformStatusWorkloads = []PlatformWorkload{
	{Component: "ClickHouse", Namespace: core.DefaultAnalyticsNamespace, Kind: "statefulset", Name: "clickhouse"},
	{Component: "Zookeeper", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "zookeeper"},
	{Component: "Kafka", Namespace: core.DefaultAnalyticsNamespace, Kind: "statefulset", Name: "kafka"},
	{Component: "Ingest", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "mcp-sentinel-ingest"},
	{Component: "Processor", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "mcp-sentinel-processor"},
	{Component: "API", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "mcp-sentinel-api"},
	{Component: "UI", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "mcp-sentinel-ui"},
	{Component: "Gateway", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "mcp-sentinel-gateway"},
	{Component: "Prometheus", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "prometheus"},
	{Component: "Grafana", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "grafana"},
	{Component: "OTel Collector", Namespace: core.DefaultAnalyticsNamespace, Kind: "deployment", Name: "otel-collector"},
	{Component: "Tempo", Namespace: core.DefaultAnalyticsNamespace, Kind: "statefulset", Name: "tempo"},
	{Component: "Loki", Namespace: core.DefaultAnalyticsNamespace, Kind: "statefulset", Name: "loki"},
	{Component: "Promtail", Namespace: core.DefaultAnalyticsNamespace, Kind: "daemonset", Name: "promtail"},
}
    DefaultPlatformStatusWorkloads lists bundled analytics stack workloads for
    status output.
```

<a id="cli-platform-status-functions"></a>
### Functions

<a id="cli-platform-status-func-analyticsnamespaceinstalled-kubectl-core-kubectlrunner-clusterreachable-bool-bool-error"></a>
```text
func AnalyticsNamespaceInstalled(kubectl core.KubectlRunner, clusterReachable bool) (bool, error)
    AnalyticsNamespaceInstalled reports whether the analytics namespace exists.

```

<a id="cli-platform-status-func-analyticsstackrow-status-details-string-string"></a>
```text
func AnalyticsStackRow(status, details string) []string
    AnalyticsStackRow builds a table row for the analytics namespace aggregate
    status.

```

<a id="cli-platform-status-func-checkclusterstatusquiet-kubectl-core-kubectlrunner-error"></a>
```text
func CheckClusterStatusQuiet(kubectl core.KubectlRunner) error
    CheckClusterStatusQuiet probes cluster connectivity without printing status.

```

<a id="cli-platform-status-func-workloadstatusrow-kubectl-core-kubectlrunner-workload-platformworkload-clusterreachable-bool-string"></a>
```text
func WorkloadStatusRow(kubectl core.KubectlRunner, workload PlatformWorkload, clusterReachable bool) []string
    WorkloadStatusRow renders one workload row for platform status tables.
```

<a id="cli-platform-status-types"></a>
### Types

<a id="cli-platform-status-type-platformworkload-struct"></a>
```text
type PlatformWorkload struct {
	Component string
	Namespace string
	Kind      string
	Name      string
}
    PlatformWorkload identifies a namespaced workload for status tables.
```

<a id="cli-registry"></a>
## CLI registry

Package: `registry`
Import path: `mcp-runtime/internal/cli/registry`

Source command:

```bash
go doc -all ./internal/cli/registry
```

<a id="cli-registry-overview"></a>
### Overview

Package registry owns routing for the registry top-level command.

### Jump To

- [Overview](#cli-registry-overview)
- [Index](#cli-registry-index)
- [Functions](#cli-registry-functions)
- [Types](#cli-registry-types)

<a id="cli-registry-index"></a>
### Index

- [`func DefaultGitTag() string`](#cli-registry-func-defaultgittag-string)
- [`func DeployRegistry(logger *zap.Logger, namespace string, port int, registryType, registryStorageSize, manifestPath string) error`](#cli-registry-func-deployregistry-logger-zap-logger-namespace-string-port-int-registrytype-registrystoragesize-manifestpath-string-error)
- [`func New(runtime *core.Runtime) *cobra.Command`](#cli-registry-func-new-runtime-core-runtime-cobra-command)
- [`func NewWithManager(mgr *RegistryManager) *cobra.Command`](#cli-registry-func-newwithmanager-mgr-registrymanager-cobra-command)
- [`func ResolveExternalRegistryConfig(flagCfg *config.ExternalRegistryConfig) (*config.ExternalRegistryConfig, error)`](#cli-registry-func-resolveexternalregistryconfig-flagcfg-config-externalregistryconfig-config-externalregistryconfig-error)
- [`func ResolvePlatformRegistryURL(logger *zap.Logger) string`](#cli-registry-func-resolveplatformregistryurl-logger-zap-logger-string)
- [`func RunRegistryProvision(mgr *RegistryManager, url, username, password, operatorImage string, dryRun bool) error`](#cli-registry-func-runregistryprovision-mgr-registrymanager-url-username-password-operatorimage-string-dryrun-bool-error)
- [`func RunRegistryPush(mgr *RegistryManager, image, registryURL, name, mode, helperNamespace string) error`](#cli-registry-func-runregistrypush-mgr-registrymanager-image-registryurl-name-mode-helpernamespace-string-error)
- [`type RegistryManager struct`](#cli-registry-type-registrymanager-struct)
- [`func DefaultRegistryManager(logger *zap.Logger) *RegistryManager`](#cli-registry-func-defaultregistrymanager-logger-zap-logger-registrymanager)
- [`func NewRegistryManager(kubectl *core.KubectlClient, exec core.Executor, logger *zap.Logger) *RegistryManager`](#cli-registry-func-newregistrymanager-kubectl-core-kubectlclient-exec-core-executor-logger-zap-logger-registrymanager)
- [`func (m *RegistryManager) CheckRegistryStatus(namespace string) error`](#cli-registry-func-m-registrymanager-checkregistrystatus-namespace-string-error)
- [`func (m *RegistryManager) LoginRegistry(registryURL, username, password string) error`](#cli-registry-func-m-registrymanager-loginregistry-registryurl-username-password-string-error)
- [`func (m *RegistryManager) PushDirect(source, target string) error`](#cli-registry-func-m-registrymanager-pushdirect-source-target-string-error)
- [`func (m *RegistryManager) PushInCluster(source, target, helperNS string) error`](#cli-registry-func-m-registrymanager-pushincluster-source-target-helperns-string-error)
- [`func (m *RegistryManager) ShowRegistryInfo() error`](#cli-registry-func-m-registrymanager-showregistryinfo-error)

<a id="cli-registry-functions"></a>
### Functions

<a id="cli-registry-func-defaultgittag-string"></a>
```text
func DefaultGitTag() string
```

<a id="cli-registry-func-deployregistry-logger-zap-logger-namespace-string-port-int-registrytype-registrystoragesize-manifestpath-string-error"></a>
```text
func DeployRegistry(logger *zap.Logger, namespace string, port int, registryType, registryStorageSize, manifestPath string) error
```

<a id="cli-registry-func-new-runtime-core-runtime-cobra-command"></a>
```text
func New(runtime *core.Runtime) *cobra.Command
    New returns the registry command.

```

<a id="cli-registry-func-newwithmanager-mgr-registrymanager-cobra-command"></a>
```text
func NewWithManager(mgr *RegistryManager) *cobra.Command
    NewWithManager returns the registry command using the provided manager.

```

<a id="cli-registry-func-resolveexternalregistryconfig-flagcfg-config-externalregistryconfig-config-externalregistryconfig-error"></a>
```text
func ResolveExternalRegistryConfig(flagCfg *config.ExternalRegistryConfig) (*config.ExternalRegistryConfig, error)
```

<a id="cli-registry-func-resolveplatformregistryurl-logger-zap-logger-string"></a>
```text
func ResolvePlatformRegistryURL(logger *zap.Logger) string
```

<a id="cli-registry-func-runregistryprovision-mgr-registrymanager-url-username-password-operatorimage-string-dryrun-bool-error"></a>
```text
func RunRegistryProvision(mgr *RegistryManager, url, username, password, operatorImage string, dryRun bool) error
    RunRegistryProvision contains the registry provision command flow for folder
    packages.

```

<a id="cli-registry-func-runregistrypush-mgr-registrymanager-image-registryurl-name-mode-helpernamespace-string-error"></a>
```text
func RunRegistryPush(mgr *RegistryManager, image, registryURL, name, mode, helperNamespace string) error
    RunRegistryPush contains the registry push command flow for folder packages.
```

<a id="cli-registry-types"></a>
### Types

<a id="cli-registry-type-registrymanager-struct"></a>
```text
type RegistryManager struct {
	// Has unexported fields.
}
    RegistryManager handles registry operations with injected dependencies.

```

<a id="cli-registry-func-defaultregistrymanager-logger-zap-logger-registrymanager"></a>
```text
func DefaultRegistryManager(logger *zap.Logger) *RegistryManager
    DefaultRegistryManager returns a RegistryManager using default clients.

```

<a id="cli-registry-func-newregistrymanager-kubectl-core-kubectlclient-exec-core-executor-logger-zap-logger-registrymanager"></a>
```text
func NewRegistryManager(kubectl *core.KubectlClient, exec core.Executor, logger *zap.Logger) *RegistryManager
    NewRegistryManager creates a RegistryManager with the given dependencies.

```

<a id="cli-registry-func-m-registrymanager-checkregistrystatus-namespace-string-error"></a>
```text
func (m *RegistryManager) CheckRegistryStatus(namespace string) error
    CheckRegistryStatus checks and displays registry status.

```

<a id="cli-registry-func-m-registrymanager-loginregistry-registryurl-username-password-string-error"></a>
```text
func (m *RegistryManager) LoginRegistry(registryURL, username, password string) error
    LoginRegistry logs into a container registry.

```

<a id="cli-registry-func-m-registrymanager-pushdirect-source-target-string-error"></a>
```text
func (m *RegistryManager) PushDirect(source, target string) error
    PushDirect pushes an image directly using docker.

```

<a id="cli-registry-func-m-registrymanager-pushincluster-source-target-helperns-string-error"></a>
```text
func (m *RegistryManager) PushInCluster(source, target, helperNS string) error
    PushInCluster pushes an image using an in-cluster helper pod.

```

<a id="cli-registry-func-m-registrymanager-showregistryinfo-error"></a>
```text
func (m *RegistryManager) ShowRegistryInfo() error
    ShowRegistryInfo displays registry connection information.
```

<a id="cli-registry-config"></a>
## CLI registry config

Package: `config`
Import path: `mcp-runtime/internal/cli/registry/config`

Source command:

```bash
go doc -all ./internal/cli/registry/config
```

<a id="cli-registry-config-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-registry-config-overview)
- [Index](#cli-registry-config-index)
- [Variables](#cli-registry-config-variables)
- [Functions](#cli-registry-config-functions)
- [Types](#cli-registry-config-types)

<a id="cli-registry-config-index"></a>
### Index

- [`Variables`](#cli-registry-config-variables)
- [`func Marshal(cfg *ExternalRegistryConfig) ([]byte, error)`](#cli-registry-config-func-marshal-cfg-externalregistryconfig-byte-error)
- [`func Path() (string, error)`](#cli-registry-config-func-path-string-error)
- [`func Save(cfg *ExternalRegistryConfig) error`](#cli-registry-config-func-save-cfg-externalregistryconfig-error)
- [`type Env struct`](#cli-registry-config-type-env-struct)
- [`type ExternalRegistryConfig struct`](#cli-registry-config-type-externalregistryconfig-struct)
- [`func Load() (*ExternalRegistryConfig, error)`](#cli-registry-config-func-load-externalregistryconfig-error)
- [`func Resolve(flagCfg *ExternalRegistryConfig, env Env) (*ExternalRegistryConfig, error)`](#cli-registry-config-func-resolve-flagcfg-externalregistryconfig-env-env-externalregistryconfig-error)

<a id="cli-registry-config-variables"></a>
### Variables

```text
var (
	ErrURLRequired        = errors.New("registry url is required")
	ErrURLMissingInConfig = errors.New("registry url missing in config")
)
```

<a id="cli-registry-config-functions"></a>
### Functions

<a id="cli-registry-config-func-marshal-cfg-externalregistryconfig-byte-error"></a>
```text
func Marshal(cfg *ExternalRegistryConfig) ([]byte, error)
```

<a id="cli-registry-config-func-path-string-error"></a>
```text
func Path() (string, error)
```

<a id="cli-registry-config-func-save-cfg-externalregistryconfig-error"></a>
```text
func Save(cfg *ExternalRegistryConfig) error
```

<a id="cli-registry-config-types"></a>
### Types

<a id="cli-registry-config-type-env-struct"></a>
```text
type Env struct {
	URL      string
	Username string
	Password string
}

```

<a id="cli-registry-config-type-externalregistryconfig-struct"></a>
```text
type ExternalRegistryConfig struct {
	URL      string `yaml:"url"`
	Username string `yaml:"username,omitempty"`
	Password string `yaml:"password,omitempty"`
}

```

<a id="cli-registry-config-func-load-externalregistryconfig-error"></a>
```text
func Load() (*ExternalRegistryConfig, error)

```

<a id="cli-registry-config-func-resolve-flagcfg-externalregistryconfig-env-env-externalregistryconfig-error"></a>
```text
func Resolve(flagCfg *ExternalRegistryConfig, env Env) (*ExternalRegistryConfig, error)
    Resolve returns external registry config using precedence: flags > env >
    config file.
```

<a id="cli-registry-references"></a>
## CLI registry references

Package: `ref`
Import path: `mcp-runtime/internal/cli/registry/ref`

Source command:

```bash
go doc -all ./internal/cli/registry/ref
```

<a id="cli-registry-references-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-registry-references-overview)
- [Index](#cli-registry-references-index)
- [Functions](#cli-registry-references-functions)

<a id="cli-registry-references-index"></a>
### Index

- [`func DropRegistryPrefix(repo string) string`](#cli-registry-references-func-dropregistryprefix-repo-string-string)
- [`func SplitImage(image string) (string, string)`](#cli-registry-references-func-splitimage-image-string-string-string)

<a id="cli-registry-references-functions"></a>
### Functions

<a id="cli-registry-references-func-dropregistryprefix-repo-string-string"></a>
```text
func DropRegistryPrefix(repo string) string
    DropRegistryPrefix removes an explicit registry host from an image
    repository.

```

<a id="cli-registry-references-func-splitimage-image-string-string-string"></a>
```text
func SplitImage(image string) (string, string)
    SplitImage returns the repository/name portion and optional tag for an image
    reference.
```

<a id="cli-registry-resolution"></a>
## CLI registry resolution

Package: `resolve`
Import path: `mcp-runtime/internal/cli/registry/resolve`

Source command:

```bash
go doc -all ./internal/cli/registry/resolve
```

<a id="cli-registry-resolution-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-registry-resolution-overview)
- [Index](#cli-registry-resolution-index)
- [Functions](#cli-registry-resolution-functions)
- [Types](#cli-registry-resolution-types)

<a id="cli-registry-resolution-index"></a>
### Index

- [`func GitTag(command CommandFactory) string`](#cli-registry-resolution-func-gittag-command-commandfactory-string)
- [`func PlatformURL(logger *zap.Logger, kubectl KubectlCommand, cfg Config) string`](#cli-registry-resolution-func-platformurl-logger-zap-logger-kubectl-kubectlcommand-cfg-config-string)
- [`type CommandFactory func(name string, args []string) (OutputCommand, error)`](#cli-registry-resolution-type-commandfactory-func-name-string-args-string-outputcommand-error)
- [`type Config struct`](#cli-registry-resolution-type-config-struct)
- [`type KubectlCommand func(args []string) (OutputCommand, error)`](#cli-registry-resolution-type-kubectlcommand-func-args-string-outputcommand-error)
- [`type OutputCommand interface`](#cli-registry-resolution-type-outputcommand-interface)

<a id="cli-registry-resolution-functions"></a>
### Functions

<a id="cli-registry-resolution-func-gittag-command-commandfactory-string"></a>
```text
func GitTag(command CommandFactory) string
    GitTag returns a short git SHA when available, otherwise "latest".

```

<a id="cli-registry-resolution-func-platformurl-logger-zap-logger-kubectl-kubectlcommand-cfg-config-string"></a>
```text
func PlatformURL(logger *zap.Logger, kubectl KubectlCommand, cfg Config) string
    PlatformURL resolves the registry host:port used for image names.
```

<a id="cli-registry-resolution-types"></a>
### Types

<a id="cli-registry-resolution-type-commandfactory-func-name-string-args-string-outputcommand-error"></a>
```text
type CommandFactory func(name string, args []string) (OutputCommand, error)

```

<a id="cli-registry-resolution-type-config-struct"></a>
```text
type Config struct {
	RegistryEndpoint        string
	DefaultRegistryEndpoint string
	RegistryPort            int
}

```

<a id="cli-registry-resolution-type-kubectlcommand-func-args-string-outputcommand-error"></a>
```text
type KubectlCommand func(args []string) (OutputCommand, error)

```

<a id="cli-registry-resolution-type-outputcommand-interface"></a>
```text
type OutputCommand interface {
	Output() ([]byte, error)
}
```

<a id="cli-server"></a>
## CLI server

Package: `server`
Import path: `mcp-runtime/internal/cli/server`

Source command:

```bash
go doc -all ./internal/cli/server
```

<a id="cli-server-overview"></a>
### Overview

Package server owns routing for the server top-level command.

### Jump To

- [Overview](#cli-server-overview)
- [Index](#cli-server-index)
- [Functions](#cli-server-functions)
- [Types](#cli-server-types)

<a id="cli-server-index"></a>
### Index

- [`func BuildImage(logger *zap.Logger, serverName, dockerfile, metadataFile, metadataDir, registryURL, tag, context string) error`](#cli-server-func-buildimage-logger-zap-logger-servername-dockerfile-metadatafile-metadatadir-registryurl-tag-context-string-error)
- [`func New(runtime *core.Runtime) *cobra.Command`](#cli-server-func-new-runtime-core-runtime-cobra-command)
- [`func NewWithManager(mgr *ServerManager) *cobra.Command`](#cli-server-func-newwithmanager-mgr-servermanager-cobra-command)
- [`type ServerManager struct`](#cli-server-type-servermanager-struct)
- [`func DefaultServerManager(logger *zap.Logger) *ServerManager`](#cli-server-func-defaultservermanager-logger-zap-logger-servermanager)
- [`func NewServerManager(kubectl *core.KubectlClient, logger *zap.Logger) *ServerManager`](#cli-server-func-newservermanager-kubectl-core-kubectlclient-logger-zap-logger-servermanager)
- [`func (m *ServerManager) ApplyServerFromFile(file string) error`](#cli-server-func-m-servermanager-applyserverfromfile-file-string-error)
- [`func (m *ServerManager) BindUseKubeFlag(cmd *cobra.Command)`](#cli-server-func-m-servermanager-bindusekubeflag-cmd-cobra-command)
- [`func (m *ServerManager) CreateServer(name, namespace, image, imageTag string) error`](#cli-server-func-m-servermanager-createserver-name-namespace-image-imagetag-string-error)
- [`func (m *ServerManager) CreateServerFromFile(file string) error`](#cli-server-func-m-servermanager-createserverfromfile-file-string-error)
- [`func (m *ServerManager) DeleteServer(name, namespace string) error`](#cli-server-func-m-servermanager-deleteserver-name-namespace-string-error)
- [`func (m *ServerManager) ExportServer(name, namespace, file string) error`](#cli-server-func-m-servermanager-exportserver-name-namespace-file-string-error)
- [`func (m *ServerManager) GetServer(name, namespace string) error`](#cli-server-func-m-servermanager-getserver-name-namespace-string-error)
- [`func (m *ServerManager) InspectServerPolicy(name, namespace string) error`](#cli-server-func-m-servermanager-inspectserverpolicy-name-namespace-string-error)
- [`func (m *ServerManager) ListServers(namespace string) error`](#cli-server-func-m-servermanager-listservers-namespace-string-error)
- [`func (m *ServerManager) Logger() *zap.Logger`](#cli-server-func-m-servermanager-logger-zap-logger)
- [`func (m *ServerManager) PatchServer(name, namespace, patchType, patch, patchFile string) error`](#cli-server-func-m-servermanager-patchserver-name-namespace-patchtype-patch-patchfile-string-error)
- [`func (m *ServerManager) ServerStatus(namespace string) error`](#cli-server-func-m-servermanager-serverstatus-namespace-string-error)
- [`func (m *ServerManager) ViewServerLogs(name, namespace string, follow, previous bool, tail int, since string) error`](#cli-server-func-m-servermanager-viewserverlogs-name-namespace-string-follow-previous-bool-tail-int-since-string-error)

<a id="cli-server-functions"></a>
### Functions

<a id="cli-server-func-buildimage-logger-zap-logger-servername-dockerfile-metadatafile-metadatadir-registryurl-tag-context-string-error"></a>
```text
func BuildImage(logger *zap.Logger, serverName, dockerfile, metadataFile, metadataDir, registryURL, tag, context string) error
    BuildImage builds a Docker image and updates MCP metadata for the server.

```

<a id="cli-server-func-new-runtime-core-runtime-cobra-command"></a>
```text
func New(runtime *core.Runtime) *cobra.Command
    New returns the server command.

```

<a id="cli-server-func-newwithmanager-mgr-servermanager-cobra-command"></a>
```text
func NewWithManager(mgr *ServerManager) *cobra.Command
    NewWithManager returns the server command using the provided manager.
```

<a id="cli-server-types"></a>
### Types

<a id="cli-server-type-servermanager-struct"></a>
```text
type ServerManager struct {
	// Has unexported fields.
}
    ServerManager handles MCP server operations with injected dependencies.

```

<a id="cli-server-func-defaultservermanager-logger-zap-logger-servermanager"></a>
```text
func DefaultServerManager(logger *zap.Logger) *ServerManager
    DefaultServerManager returns a ServerManager using the default kubectl
    client.

```

<a id="cli-server-func-newservermanager-kubectl-core-kubectlclient-logger-zap-logger-servermanager"></a>
```text
func NewServerManager(kubectl *core.KubectlClient, logger *zap.Logger) *ServerManager
    NewServerManager creates a ServerManager with the given dependencies.

```

<a id="cli-server-func-m-servermanager-applyserverfromfile-file-string-error"></a>
```text
func (m *ServerManager) ApplyServerFromFile(file string) error
    ApplyServerFromFile applies an MCPServer manifest from disk.

```

<a id="cli-server-func-m-servermanager-bindusekubeflag-cmd-cobra-command"></a>
```text
func (m *ServerManager) BindUseKubeFlag(cmd *cobra.Command)
    BindUseKubeFlag wires the shared --use-kube flag onto the command.

```

<a id="cli-server-func-m-servermanager-createserver-name-namespace-image-imagetag-string-error"></a>
```text
func (m *ServerManager) CreateServer(name, namespace, image, imageTag string) error
    CreateServer creates a new MCP server with the given parameters.

```

<a id="cli-server-func-m-servermanager-createserverfromfile-file-string-error"></a>
```text
func (m *ServerManager) CreateServerFromFile(file string) error
    CreateServerFromFile creates an MCP server from a YAML file.

```

<a id="cli-server-func-m-servermanager-deleteserver-name-namespace-string-error"></a>
```text
func (m *ServerManager) DeleteServer(name, namespace string) error
    DeleteServer deletes an MCP server.

```

<a id="cli-server-func-m-servermanager-exportserver-name-namespace-file-string-error"></a>
```text
func (m *ServerManager) ExportServer(name, namespace, file string) error
    ExportServer exports an MCPServer manifest to stdout or a file.

```

<a id="cli-server-func-m-servermanager-getserver-name-namespace-string-error"></a>
```text
func (m *ServerManager) GetServer(name, namespace string) error
    GetServer retrieves details for a specific MCP server.

```

<a id="cli-server-func-m-servermanager-inspectserverpolicy-name-namespace-string-error"></a>
```text
func (m *ServerManager) InspectServerPolicy(name, namespace string) error
    InspectServerPolicy prints the rendered gateway policy ConfigMap content for
    a server.

```

<a id="cli-server-func-m-servermanager-listservers-namespace-string-error"></a>
```text
func (m *ServerManager) ListServers(namespace string) error
    ListServers lists all MCP servers in the given namespace.

```

<a id="cli-server-func-m-servermanager-logger-zap-logger"></a>
```text
func (m *ServerManager) Logger() *zap.Logger
    Logger exposes the manager logger to foldered command packages.

```

<a id="cli-server-func-m-servermanager-patchserver-name-namespace-patchtype-patch-patchfile-string-error"></a>
```text
func (m *ServerManager) PatchServer(name, namespace, patchType, patch, patchFile string) error
    PatchServer patches an existing MCPServer resource using
    merge/json/strategic patch types.

```

<a id="cli-server-func-m-servermanager-serverstatus-namespace-string-error"></a>
```text
func (m *ServerManager) ServerStatus(namespace string) error
    ServerStatus shows the status of MCP servers in a namespace.

```

<a id="cli-server-func-m-servermanager-viewserverlogs-name-namespace-string-follow-previous-bool-tail-int-since-string-error"></a>
```text
func (m *ServerManager) ViewServerLogs(name, namespace string, follow, previous bool, tail int, since string) error
    ViewServerLogs views logs from an MCP server.
```

<a id="cli-setup-asset-paths"></a>
## CLI setup asset paths

Package: `assetpath`
Import path: `mcp-runtime/internal/cli/setup/assetpath`

Source command:

```bash
go doc -all ./internal/cli/setup/assetpath
```

<a id="cli-setup-asset-paths-overview"></a>
### Overview

Package assetpath resolves repository-relative asset paths from the current
working directory by walking upward until go.mod, services/, and k8s/ match.

### Jump To

- [Overview](#cli-setup-asset-paths-overview)
- [Index](#cli-setup-asset-paths-index)
- [Functions](#cli-setup-asset-paths-functions)

<a id="cli-setup-asset-paths-index"></a>
### Index

- [`func IsRepoRoot(dir string) bool`](#cli-setup-asset-paths-func-isreporoot-dir-string-bool)
- [`func ResolveRepoAssetPath(path string) (string, error)`](#cli-setup-asset-paths-func-resolverepoassetpath-path-string-string-error)
- [`func ResolveRepoRoot() (string, error)`](#cli-setup-asset-paths-func-resolvereporoot-string-error)

<a id="cli-setup-asset-paths-functions"></a>
### Functions

<a id="cli-setup-asset-paths-func-isreporoot-dir-string-bool"></a>
```text
func IsRepoRoot(dir string) bool
    IsRepoRoot reports whether dir looks like the mcp-runtime repository root.

```

<a id="cli-setup-asset-paths-func-resolverepoassetpath-path-string-string-error"></a>
```text
func ResolveRepoAssetPath(path string) (string, error)
    ResolveRepoAssetPath finds a repo-relative path from the current working
    directory by walking upward until the asset exists. The repo assumes a
    flattened root layout (for example services/ and k8s/ at the top level).

```

<a id="cli-setup-asset-paths-func-resolvereporoot-string-error"></a>
```text
func ResolveRepoRoot() (string, error)
    ResolveRepoRoot walks upward from the working directory until IsRepoRoot
    reports true.
```

<a id="cli-setup-ingress-manifests"></a>
## CLI setup ingress manifests

Package: `ingressmanifest`
Import path: `mcp-runtime/internal/cli/setup/ingressmanifest`

Source command:

```bash
go doc -all ./internal/cli/setup/ingressmanifest
```

<a id="cli-setup-ingress-manifests-overview"></a>
### Overview

Package ingressmanifest builds YAML for the host-based Sentinel platform UI
Ingress.

### Jump To

- [Overview](#cli-setup-ingress-manifests-overview)
- [Index](#cli-setup-ingress-manifests-index)
- [Constants](#cli-setup-ingress-manifests-constants)
- [Functions](#cli-setup-ingress-manifests-functions)

<a id="cli-setup-ingress-manifests-index"></a>
### Index

- [`Constants`](#cli-setup-ingress-manifests-constants)
- [`func RenderPlatformUIIngress(host, issuerName, analyticsNamespace string) string`](#cli-setup-ingress-manifests-func-renderplatformuiingress-host-issuername-analyticsnamespace-string-string)

<a id="cli-setup-ingress-manifests-constants"></a>
### Constants

```text
const (
	// PlatformIngressName is the Kubernetes Ingress resource name for the dashboard.
	PlatformIngressName = "mcp-sentinel-platform-ui"
	// PlatformHTTPRedirectIngressName is the HTTP-only redirect Ingress resource name.
	PlatformHTTPRedirectIngressName = "mcp-sentinel-platform-ui-http"
	// PlatformTLSSecretName is the TLS secret name used when TLS is enabled.
	PlatformTLSSecretName = "mcp-sentinel-platform-tls"
)
```

<a id="cli-setup-ingress-manifests-functions"></a>
### Functions

<a id="cli-setup-ingress-manifests-func-renderplatformuiingress-host-issuername-analyticsnamespace-string-string"></a>
```text
func RenderPlatformUIIngress(host, issuerName, analyticsNamespace string) string
    RenderPlatformUIIngress emits an Ingress that maps platform.<domain> to
    the dashboard UI and /api on the same UI service (which reverse-proxies to
    mcp-sentinel-api via API_UPSTREAM). Grafana and Prometheus are intentionally
    NOT exposed on the public platform host: those tools have no built-in auth
    in this stack, so operators must reach them via port-forward or a private
    ingress instead.

    When issuerName is set, a TLS section and cert-manager annotation
    are added so cert-manager's ingress-shim provisions a Certificate for
    platform.<domain> into the mcp-sentinel-platform-tls Secret in the same
    namespace as the Ingress. A second Ingress on the `web` entrypoint is
    also emitted so HTTP requests to the same host hit the UI service, which
    redirects to HTTPS. (We can't rely on Traefik's entrypoint-level redirect
    because the prod overlay disables it to keep HTTP-01 ACME challenges working
    on first issue.)
```

<a id="cli-setup-plan"></a>
## CLI setup plan

Package: `plan`
Import path: `mcp-runtime/internal/cli/setup/plan`

Source command:

```bash
go doc -all ./internal/cli/setup/plan
```

<a id="cli-setup-plan-overview"></a>
### Overview

Package plan contains pure setup planning types and default resolution.

### Jump To

- [Overview](#cli-setup-plan-overview)
- [Index](#cli-setup-plan-index)
- [Constants](#cli-setup-plan-constants)
- [Types](#cli-setup-plan-types)

<a id="cli-setup-plan-index"></a>
### Index

- [`Constants`](#cli-setup-plan-constants)
- [`type Input struct`](#cli-setup-plan-type-input-struct)
- [`type Plan struct`](#cli-setup-plan-type-plan-struct)
- [`func Build(input Input) Plan`](#cli-setup-plan-func-build-input-input-plan)

<a id="cli-setup-plan-constants"></a>
### Constants

```text
const (
	StorageModeDynamic  = "dynamic"
	StorageModeHostpath = "hostpath"
)
```

<a id="cli-setup-plan-types"></a>
### Types

<a id="cli-setup-plan-type-input-struct"></a>
```text
type Input struct {
	Kubeconfig             string
	Context                string
	RegistryType           string
	RegistryStorageSize    string
	StorageMode            string
	IngressMode            string
	IngressManifest        string
	IngressManifestChanged bool
	ForceIngressInstall    bool
	TLSEnabled             bool
	TestMode               bool
	StrictProd             bool
	DeployAnalytics        bool
	OperatorArgs           []string
	// Let's Encrypt (HTTP-01 via cert-manager). If empty, other TLS modes apply; mutually exclusive with TLSClusterIssuer.
	ACMEmail    string
	ACMEStaging bool
	// TLSClusterIssuer is a pre-existing cert-manager.io ClusterIssuer (e.g. org internal CA / Vault / ADCS). Mutually exclusive with ACMEmail.
	TLSClusterIssuer   string
	InstallCertManager bool
}
    Input captures the raw CLI inputs for setup.

```

<a id="cli-setup-plan-type-plan-struct"></a>
```text
type Plan struct {
	Kubeconfig          string
	Context             string
	RegistryType        string
	RegistryStorageSize string
	StorageMode         string
	Ingress             cluster.IngressOptions
	RegistryManifest    string
	TLSEnabled          bool
	TestMode            bool
	StrictProd          bool
	DeployAnalytics     bool
	OperatorArgs        []string
	ACMEmail            string
	ACMEStaging         bool
	TLSClusterIssuer    string
	InstallCertManager  bool
}
    Plan captures the resolved setup decisions.

```

<a id="cli-setup-plan-func-build-input-input-plan"></a>
```text
func Build(input Input) Plan
    Build resolves CLI inputs into a concrete setup plan.
```

<a id="cli-binary"></a>
## CLI binary

Package: `main`
Import path: `mcp-runtime/cmd/mcp-runtime`

Source command:

```bash
go doc -cmd ./cmd/mcp-runtime
```

<a id="cli-binary-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#cli-binary-overview)
- [Index](#cli-binary-index)

<a id="cli-binary-index"></a>
### Index

_No exported declarations._

<a id="operator-binary"></a>
## Operator binary

Package: `main`
Import path: `mcp-runtime/cmd/operator`

Source command:

```bash
go doc -cmd ./cmd/operator
```

<a id="operator-binary-overview"></a>
### Overview

_No package overview is documented._

### Jump To

- [Overview](#operator-binary-overview)
- [Index](#operator-binary-index)

<a id="operator-binary-index"></a>
### Index

_No exported declarations._