# Aviatrix Network Policy Controller

> a controller to create Aviatrix FirewallPolicies for Obot-deployed MCP servers

- **Type:** MCP server
- **Install:** `agentstack add mcp-obot-platform-aviatrix-network-policy-controller`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [obot-platform](https://agentstack.voostack.com/s/obot-platform)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [obot-platform](https://github.com/obot-platform)
- **Source:** https://github.com/obot-platform/aviatrix-network-policy-controller

## Install

```sh
agentstack add mcp-obot-platform-aviatrix-network-policy-controller
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# aviatrix-network-policy-controller

A controller to create Aviatrix `FirewallPolicy` resources for Obot-deployed MCP servers.

## Helm values

The controller is intended to be installed by Obot when the Obot server is configured with a network policy provider chart. Obot supplies the runtime-specific values listed below and merges any YAML or JSON from `OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_VALUES` into the chart values.

| Value | Default | Description |
| --- | --- | --- |
| `image.repository` | `ghcr.io/obot-platform/aviatrix-network-policy-controller` | Controller image repository. |
| `image.tag` | `""` | Controller image tag. Defaults to the chart `appVersion`; if `appVersion` is a development version such as `0.0.0-dev`, the chart uses `main`. |
| `image.pullPolicy` | `Always` | Kubernetes image pull policy for the controller container. |
| `imagePullSecrets` | `[]` | Image pull secrets added to the controller pod. |
| `nameOverride` | `""` | Overrides the chart name used in generated resource names. |
| `fullnameOverride` | `""` | Overrides the full release name used in generated resource names. |
| `serviceAccount.create` | `true` | Reserved for service account configuration. The chart currently renders a service account for the controller. |
| `serviceAccount.name` | `""` | Existing or custom service account name for the controller. Defaults to the chart fullname. |
| `podSecurityContext` | See `chart/values.yaml` | Pod-level security context for the controller pod. |
| `securityContext` | See `chart/values.yaml` | Container-level security context for the controller container. |
| `resources` | See `chart/values.yaml` | CPU and memory requests and limits for the controller container. |
| `secretName` | `obot-network-policy-provider` | Secret containing the Obot network policy provider API key. Obot creates and rotates this secret when the provider is enabled. |
| `obotStorageURL` | `""` | Required. Internal HTTPS URL for Obot storage APIs. Obot sets this automatically when it installs the provider. |
| `obotStorageTokenFile` | `/var/run/secrets/obot-network-policy-provider/apiKey` | File path inside the controller container that contains the Obot storage API key. |
| `mcpRuntimeNamespace` | `obot-mcp` | Kubernetes namespace containing the MCP server runtime resources and Aviatrix `FirewallPolicy` objects. |
| `obot.serviceAccount.name` | `""` | Obot server service account name. Obot sets this automatically so the provider can bind back to the Obot runtime context. |
| `obot.serviceAccount.namespace` | `""` | Namespace containing the Obot server service account. Obot sets this automatically. |

## Obot configuration

Enable this provider from Obot by setting either `OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME` with `OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_REPO`, or `OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_PATH` for a local chart. The MCP runtime backend must be `kubernetes`.

Use `OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_VALUES` to override chart values. For example:

```yaml
mcpRuntimeNamespace: custom-mcp-runtime
resources:
  requests:
    cpu: 100m
    memory: 128Mi
```

Obot always supplies `mcpRuntimeNamespace`, `obotStorageURL`, `secretName`, `obotStorageTokenFile`, and `obot.serviceAccount` defaults before applying this override blob.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [obot-platform](https://github.com/obot-platform)
- **Source:** [obot-platform/aviatrix-network-policy-controller](https://github.com/obot-platform/aviatrix-network-policy-controller)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-obot-platform-aviatrix-network-policy-controller
- Seller: https://agentstack.voostack.com/s/obot-platform
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.