QUICKSTART · 1.0.0-BETA.5

Run Kavrynt
on Kubernetes.

Install the signed beta chart on EKS, AKS, GKE, OpenShift, self-managed clusters, or Kind. No source access is needed.

01

Before you begin

You need Kubernetes 1.29+, kubectl, and Helm 3.14+. Docker and Kind are only needed for a local test cluster. To authenticate agents, you need an OAuth 2.1 identity provider that issues JWT access tokens.

kubectl config current-context
helm version --short

# Local testing only
kind create cluster --name kavrynt-trial
02

Install Kavrynt

One chart installs the MCPServer CRD, the Operator, and the Gateway from signed, multi-architecture images. MCP client authentication is on by default: name your identity provider, or opt out for a local trial.

# With your identity provider
helm upgrade --install kavrynt oci://registry-1.docker.io/kavrynt/kavrynt \
  --version 1.0.0-beta.5 \
  --namespace kavrynt-system --create-namespace --wait \
  --set gateway.auth.resourceURL=https://mcp.example.com \
  --set-json 'gateway.auth.issuers=[{"issuer":"https://login.example.com/realms/agents"}]'

# Local trial: MCP routes accept unauthenticated calls
helm upgrade --install kavrynt oci://registry-1.docker.io/kavrynt/kavrynt \
  --version 1.0.0-beta.5 \
  --namespace kavrynt-system --create-namespace --wait \
  --set gateway.auth.enabled=false

kubectl get deployments -n kavrynt-system
03

Declare an MCP server

Point an MCPServer at any MCP server reachable over HTTP in your cluster.

kubectl apply -f - <<'EOF'
apiVersion: kavrynt.io/v1alpha1
kind: MCPServer
metadata:
  name: example-mcp-server
  namespace: default
spec:
  version: 0.1.0
  transport: http
  endpoint: http://example-mcp-server.default.svc.cluster.local:8080
EOF

kubectl get mcpservers
04

Route through the Gateway

Each Ready server is routed at /mcp/<namespace>.<name>. Agents send an access token for that route; caller credentials are never forwarded to MCP servers. The console is at /ui/.

kubectl port-forward -n kavrynt-system svc/kavrynt-gateway 18080:8080 &
curl -fsS http://127.0.0.1:18080/v1/routes
# console: http://127.0.0.1:18080/ui/  user: admin  password:
kubectl -n kavrynt-system get secret kavrynt-gateway-console-admin \
  -o jsonpath='{.data.password}' | base64 -d
FULL GUIDE

Step-by-step runbook
with expected output.

The documentation quickstart works on any Kubernetes cluster with a sample MCP server, expected results, and cleanup. To test more, follow the developer testing runbook: policy, audit, your own MCP server, and how to send feedback. The beta is for evaluation in development and staging clusters. Tool authorization policy, audit events, and credentials for MCP servers are covered in the security guide.