charts

cloakbrowser-mcp

Version: 0.2.3 Type: application AppVersion: 1.10.0 Artifact Hub

CloakBrowser MCP — a Model Context Protocol browser-automation server that runs upstream @playwright/mcp with the CloakBrowser Chromium binary. This Helm chart packages the bridge in its streamable-http transport so it can be reached over the network, driven entirely from values.yaml via the bjw-s common library.

TL;DR

helm repo add obeone https://charts.obeone.cloud
helm repo update
helm install cloakbrowser-mcp obeone/cloakbrowser-mcp

About

CloakBrowser MCP is a Model Context Protocol browser-automation server: it runs the upstream @playwright/mcp bridge on top of the CloakBrowser stealth Chromium build, so AI agents can drive a real browser that keeps a low fingerprint. This chart packages the bridge with its streamable-http transport, making the MCP endpoint reachable over the network from inside (or outside) the cluster.

Prerequisites

Configuration

This chart is built on the bjw-s-labs common library. Most configuration keys (controllers, service, ingress, persistence, …) follow its schema; see the common library documentation for everything it supports beyond what is spelled out in values.yaml.

Defaults are meant to work out of the box on any cluster. The full list of options lives in values.yaml, is validated by values.schema.json at install time, and is documented in the Values section below. Override it with your own values file:

helm install cloakbrowser-mcp obeone/cloakbrowser-mcp -f my-values.yaml

Upgrading

helm repo update
helm upgrade cloakbrowser-mcp obeone/cloakbrowser-mcp

Each release lists its changes in the Artifact Hub changelog; give it a look before jumping across several chart versions.

Uninstalling

helm uninstall cloakbrowser-mcp

PersistentVolumeClaims created by the chart are kept around: delete them manually if you also want the data gone.

Requirements

Kubernetes: >=1.31.0-0

Repository Name Version
https://bjw-s-labs.github.io/helm-charts common 5.0.1

Values

Key Type Default Description
controllers.main.containers.main.env object {"CLOAK_PLAYWRIGHT_MCP_HTTP_HOST":"0.0.0.0","CLOAK_PLAYWRIGHT_MCP_HTTP_PORT":"3000","CLOAK_PLAYWRIGHT_MCP_LOG_LEVEL":"info","CLOAK_PLAYWRIGHT_MCP_TRANSPORT":"streamable-http","PLAYWRIGHT_MCP_HEADLESS":"true","PLAYWRIGHT_MCP_OUTPUT_DIR":"/data"} Environment driving the bridge. The image entrypoint takes no args, so the whole configuration is expressed through these CLOAK_/PLAYWRIGHT_ variables.
controllers.main.containers.main.image.pullPolicy string "IfNotPresent"  
controllers.main.containers.main.image.repository string "swimmwatch/cloakbrowser-mcp" Container image. The same tag is published on Docker Hub and ghcr.io.
controllers.main.containers.main.image.tag string ""  
controllers.main.containers.main.probes.liveness.custom bool true  
controllers.main.containers.main.probes.liveness.enabled bool true  
controllers.main.containers.main.probes.liveness.spec.failureThreshold int 5  
controllers.main.containers.main.probes.liveness.spec.httpGet.path string "/healthz"  
controllers.main.containers.main.probes.liveness.spec.httpGet.port int 3000  
controllers.main.containers.main.probes.liveness.spec.initialDelaySeconds int 10  
controllers.main.containers.main.probes.liveness.spec.periodSeconds int 30  
controllers.main.containers.main.probes.liveness.spec.timeoutSeconds int 5  
controllers.main.containers.main.probes.readiness.custom bool true  
controllers.main.containers.main.probes.readiness.enabled bool true  
controllers.main.containers.main.probes.readiness.spec.failureThreshold int 3  
controllers.main.containers.main.probes.readiness.spec.httpGet.path string "/readyz"  
controllers.main.containers.main.probes.readiness.spec.httpGet.port int 3000  
controllers.main.containers.main.probes.readiness.spec.initialDelaySeconds int 5  
controllers.main.containers.main.probes.readiness.spec.periodSeconds int 10  
controllers.main.containers.main.probes.readiness.spec.timeoutSeconds int 5  
controllers.main.containers.main.probes.startup.custom bool true  
controllers.main.containers.main.probes.startup.enabled bool true  
controllers.main.containers.main.probes.startup.spec.failureThreshold int 30  
controllers.main.containers.main.probes.startup.spec.httpGet.path string "/healthz"  
controllers.main.containers.main.probes.startup.spec.httpGet.port int 3000  
controllers.main.containers.main.probes.startup.spec.periodSeconds int 5  
controllers.main.containers.main.resources.limits.memory string "2Gi"  
controllers.main.containers.main.resources.requests.cpu string "250m"  
controllers.main.containers.main.resources.requests.memory string "512Mi"  
controllers.main.containers.main.securityContext.allowPrivilegeEscalation bool false  
controllers.main.containers.main.securityContext.capabilities.drop[0] string "ALL"  
defaultPodOptions object {"automountServiceAccountToken":false,"securityContext":{"fsGroup":1000,"runAsGroup":1000,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}}} Pod-wide options applied to every controller in this chart.
ingress object {"main":{"className":"","enabled":false,"hosts":[{"host":"chart-example.local","paths":[{"path":"/","pathType":"Prefix","service":{"identifier":"main","port":"http"}}]}],"tls":[{"hosts":["chart-example.local"],"secretName":"tls-chart-example-local"}]}} Ingress. Disabled by default; flip enabled and set a real host to expose the MCP endpoint. The bridge speaks plain HTTP, so terminate TLS at the ingress.
persistence object {"data":{"globalMounts":[{"path":"/data"}],"type":"emptyDir"},"dshm":{"globalMounts":[{"path":"/dev/shm"}],"medium":"Memory","sizeLimit":"1Gi","type":"emptyDir"}} Storage. Artifacts under /data are transient by default (emptyDir). Switch the “data” volume to a persistentVolumeClaim if you need to keep them across restarts.
route object {"main":{"enabled":false,"hostnames":["chart-example.local"],"kind":"HTTPRoute","parentRefs":[{"name":"gateway","namespace":"gateway-system"}],"rules":[{"backendRefs":[{"identifier":"main"}],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]}} Gateway API HTTPRoute, mirroring the Ingress above. Disabled by default: pick either Ingress or HTTPRoute, not both. Requires the Gateway API CRDs and an existing Gateway in the cluster.
route.main.enabled bool false Enable the HTTPRoute. Mutually exclusive with ingress.main.enabled.
route.main.hostnames list ["chart-example.local"] Hostnames served by this route.
route.main.kind string "HTTPRoute" Route kind. HTTPRoute, GRPCRoute, TCPRoute, TLSRoute or UDPRoute.
route.main.parentRefs list [{"name":"gateway","namespace":"gateway-system"}] Gateways this route attaches to.
route.main.rules list [{"backendRefs":[{"identifier":"main"}],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}] Routing rules. identifier refers to a Service defined above.
service object {"main":{"controller":"main","ports":{"http":{"port":3000,"protocol":"TCP","targetPort":3000}},"type":"ClusterIP"}} Service exposing the streamable-http MCP endpoint inside the cluster.

Verifying the chart signature

Charts in this repository are signed with GPG and every release ships a provenance file. The public key is available at charts.obeone.cloud/public_key.gpg, fingerprint B9FE852F28888D27F8C9A11CD33E04CD22E335CE.

# Import the signing key into a legacy keyring (helm verifies with GnuPG v1 keyrings)
curl -fsSL https://charts.obeone.cloud/public_key.gpg | gpg --import
gpg --export > ~/.gnupg/pubring.gpg

# Pull the chart and check it against its provenance file
helm pull --verify obeone/cloakbrowser-mcp

Support

This is a personal chart repository, maintained on a best-effort basis. Bug reports and contributions are welcome on GitHub.

Autogenerated from chart metadata using helm-docs v1.14.2