feat: add gh CLI, kubeseal CLI, and Helm MCP sidecar

Install GitHub CLI (gh) via official APT repo and kubeseal via GitHub
Releases binary in the Dockerfile. Add mcp-helm sidecar on port 8088
for AI-assisted Helm chart browsing, with corresponding values, schema,
deployment template, and .mcp.json configuration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.mcp.json

@@ -19,10 +19,9 @@
       "type": "sse",
       "url": "http://localhost:8086/sse"
     },
-    "pgtuner": {
+    "helm": {
       "type": "sse",
-      "url": "http://localhost:8085/sse"
+      "url": "http://localhost:8088/sse"
     }
   }
-}
-
+}

Dockerfile

@@ -90,6 +90,20 @@ RUN curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" |
     tar -xz --strip-components=1 -C /usr/local/bin linux-amd64/helm && \
     chmod +x /usr/local/bin/helm
 
+# Install GitHub CLI (gh) via official APT repo
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
+    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && \
+    apt-get install -y gh && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install kubeseal CLI for Bitnami Sealed Secrets
+RUN KUBESEAL_VERSION=$(curl -sL https://api.github.com/repos/bitnami-labs/sealed-secrets/releases/latest | jq -r '.tag_name' | sed 's/^v//') && \
+    curl -fsSL "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-linux-amd64.tar.gz" | \
+    tar -xz -C /usr/local/bin kubeseal && \
+    chmod +x /usr/local/bin/kubeseal
+
 # Install VSCode (using Microsoft's current recommended setup)
 RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /tmp/microsoft.gpg && \
     install -D -o root -g root -m 644 /tmp/microsoft.gpg /usr/share/keyrings/microsoft.gpg && \

chart/templates/deployment.yaml

@@ -179,6 +179,29 @@ spec:
           resources:
             {{- toYaml .Values.mcp.sidecars.flux.resources | nindent 12 }}
         {{- end }}
+        {{- if .Values.mcp.sidecars.helm.enabled }}
+        - name: helm-mcp
+          image: "{{ .Values.mcp.sidecars.helm.image.repository }}:{{ .Values.mcp.sidecars.helm.image.tag }}"
+          args:
+            - -mode=sse
+            - -port={{ .Values.mcp.sidecars.helm.port }}
+          ports:
+            - containerPort: {{ .Values.mcp.sidecars.helm.port }}
+              name: helm-mcp
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.helm.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.helm.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.mcp.sidecars.helm.resources | nindent 12 }}
+        {{- end }}
         {{- if .Values.mcp.sidecars.homeassistant.enabled }}
         - name: homeassistant-mcp
           image: "{{ .Values.mcp.sidecars.homeassistant.image.repository }}:{{ .Values.mcp.sidecars.homeassistant.image.tag }}"

chart/values.schema.json

@@ -270,6 +270,9 @@
             "pgtuner": {
               "$ref": "#/$defs/mcpSidecar"
             },
+            "helm": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
             "playwright": {
               "$ref": "#/$defs/mcpSidecar"
             }

chart/values.yaml

@@ -124,6 +124,20 @@ mcp:
           cpu: "500m"
 
 
+    # Helm chart browsing and management
+    helm:
+      enabled: true
+      image:
+        repository: ghcr.io/zekker6/mcp-helm
+        tag: v1.3.1
+      port: 8088
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
 
     # Home Assistant smart home control
     homeassistant: