MCP server exposing a Node-RED instance's admin API as agent tools.
Single Deployment + Service + Ingress, image tracked off the upstream
releases -- the tags are v-prefixed but the ghcr image tags are not,
hence the version-pattern.
MCP_HTTP_TOKEN is required rather than optional: upstream's listener
binds all container interfaces, so there is no loopback-trust mode. The
chart therefore requires existingSecret instead of defaulting it away.
readOnly defaults on, so an agent cannot deploy flows by accident.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
