ramenBLOCK
Self-hosted, multi-zone, highly available MCP server (Model Context Protocol) for Kubernetes on GKE and EKS. A git repo of Python tools becomes canary-deployed Rust + Python workers behind one load balancer, with OAuth 2.1 sign-in, per-group roles, secrets, IP rules, throttling and audit.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Build your MCP tools in Python, deploy them across zones on GKE, EKS and AKS. Rust MCP node + Python 3.12 runtime workers, Streamable HTTP at the edge and gRPC inside, guardrails per tool, Entra ID and Google Workspace sign-in, autoscaling — managed from one FastAPI console.
Docs: https://bkraad47.github.io/ramen/ · Get started · The MCP repo · Connect a client with OAuth · How it works · Deploy on GCP · Deploy on AWS · [Deploy
7d5fb4bf4601OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ramen-tests --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env DEMO_TOKEN=${DEMO_TOKEN} --env GOOGLE_OAUTH_ACCESS_TOKEN=${GOOGLE_OAUTH_ACCESS_TOKEN} -- uvx ramen-tests{
"mcpServers": {
"ramen-tests": {
"command": "uvx",
"args": [
"ramen-tests"
],
"env": {
"AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
"AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
"DEMO_TOKEN": "${DEMO_TOKEN}",
"GOOGLE_OAUTH_ACCESS_TOKEN": "${GOOGLE_OAUTH_ACCESS_TOKEN}"
}
}
}
}Trust audit
BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
return eval(str)
let conditionalSource = ' return (function(' + paramName + '){ return ('func = new Function('event', code)varsValues = maybeEval(elt, function() { return Function('return (' + str + ')')() }, {})exec(compile(py.read_text(encoding="utf-8"), str(py), "exec"), module.__dict__) # no pycache: reload-safe
except Exception: # noqa: BLE001 - not in a pod: fall back to KUBECONFIG / ~/.kube/config
ap.add_argument("--insecure", action="store_true", help="skip TLS verification (laptop against a fresh cluster)")verify = False if a.insecure else (a.ca or True)
with httpx.Client(base_url=base, cookies=cookies, verify=False, timeout=30) as c:
**Rails that call an LLM** (`self check input`, `self check output`, jailbreak detection and the rest of NeMo's
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request,os,ssl;tls=os.environ.get('RAMEN_TLS')=='self';u=('https://127.0.0.1:8443' if tls else 'http://127.0.0.1:'+os.environ.get('LOOPBACK = ("http://127.0.0.1", "http://localhost")json={"redis_url": "redis://u:p@host:6379", "ip_per_min": 10, "token_per_min": 5},assert raw["redis_item_url"] != "redis://u:p@host:6379" and raw["redis_item_url"].startswith("enc:")json={"redis_url": "redis://u:p@host:6379", "ip_per_min": 20, "token_per_min": 15},assert raw["redis_scope_url"] != "redis://u:p@host:6379" and raw["redis_scope_url"].startswith("enc:")assert got == {"DEMO_MODE": "demo", "DB_URL": "postgres://u:s3cret@db/app"}.terraform.lock.hcl
.terraform.lock.hcl
.terraform.lock.hcl
.mcpbignore
if remote.get(key) != hashlib.md5(path.read_bytes()).hexdigest():
return name if len(name) <= 64 else "ramen-" + hashlib.sha1(name.encode()).hexdigest()[:24]
digest = hashlib.md5(data).digest()
digest = base64.b64encode(hashlib.md5(path.read_bytes()).digest()).decode()
Gates applied: instruction_override, no_behavioural_pass.
7d5fb4bf4601full audit observations/trust-audit/mcp-server/bkraad47__ramen.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 7d5fb4bf4601 | BLOCK | F | 38 | first audit |
Questions
What is the ramen MCP server?
Self-hosted, multi-zone, highly available MCP server (Model Context Protocol) for Kubernetes on GKE and EKS. A git repo of Python tools becomes canary-deployed Rust + Python workers behind one load balancer, with OAuth 2.1 sign-in, per-group roles, secrets, IP rules, throttling and audit.
Is ramen safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (38/100) and found 10 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does ramen need?
It reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, DEMO_TOKEN, GOOGLE_OAUTH_ACCESS_TOKEN, RAILS_API_KEY, RAMEN_ADMIN_KEY, RAMEN_ADMIN_PASSWORD, RAMEN_AZURE_KEY_VAULT, RAMEN_FERNET_KEY, RAMEN_LOCAL_SESSION_SECRET, RAMEN_MCP_KEY and RAMEN_MIN_PASSWORD_LEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ramen run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as ramen-tests.
How current is this page?
The grade is for one exact copy of the source (7d5fb4bf4601), read on 2026-10-11. The repository is watched and re-audited when it changes.