templates/dav: baked stdio image instead of npx

dav-mcp declares tsdav/tsdav-utils as GitHub-URL deps — npx on the
git-less node-runner dies with 'spawn git ENOENT' (observed: dav-michal
CrashLoopBackOff on first deploy). Upstream's ghcr image PID-1s the HTTP
server, so mysources.co.uk/michal/dav-mcp bakes the install and execs
src/server-stdio.js.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/dav.yaml

@@ -0,0 +1,26 @@
+name: dav
+version: "1.0.0"
+description: CalDAV/CardDAV/VTODO (Stalwart or any RFC 4791/6352 server) — calendars, events, tasks, contacts
+# NOT packageName: dav-mcp declares tsdav/tsdav-utils as GitHub-URL deps, so
+# `npx -y dav-mcp` dies with `spawn git ENOENT` on the git-less node-runner,
+# and the upstream ghcr image starts the HTTP server as PID 1. This image
+# bakes the install and execs the stdio entrypoint (NODE_OPTIONS baked in).
+dockerImage: "mysources.co.uk/michal/dav-mcp:4.0.1-stdio1"
+transport: STDIO
+repositoryUrl: https://mysources.co.uk/michal/dav-mcp-image
+healthCheck:
+  # A real CalDAV PROPFIND: a pass proves server URL and credentials.
+  tool: list_calendars
+  arguments: {}
+  intervalSeconds: 60
+  timeoutSeconds: 10
+env:
+  - name: CALDAV_SERVER_URL
+    description: DAV base URL (e.g. http://stalwart.stalwart.svc.cluster.local:8080)
+    required: true
+  - name: CALDAV_USERNAME
+    description: DAV username
+    required: true
+  - name: CALDAV_PASSWORD
+    description: DAV password (use an app password)
+    required: true

templates/jmap.yaml

@@ -0,0 +1,45 @@
+name: jmap
+version: "1.0.0"
+description: JMAP email (Stalwart) — search/read/organize + drafts; send and delete gated off by env
+dockerImage: "mysources.co.uk/michal/jmap-mcp:0.6.5-drafts3"
+transport: STDIO
+repositoryUrl: https://mysources.co.uk/michal/jmap-mcp
+# No command: the image's entrypoint IS the MCP server (deno run), mcpd
+# attaches to PID 1 stdin/stdout. Fork of wyattjoh/jmap-mcp adding
+# create_draft/create_draft_reply, JMAP_DISABLE_* gating, and Basic auth
+# (jmap-jam upstream only speaks Bearer).
+healthCheck:
+  # A real Mailbox/get: a pass proves session URL, auth, and account
+  # resolution, not just process liveness.
+  tool: get_mailboxes
+  arguments: {}
+  intervalSeconds: 60
+  timeoutSeconds: 10
+env:
+  - name: JMAP_SESSION_URL
+    description: JMAP session URL (e.g. http://stalwart.stalwart.svc.cluster.local:8080/.well-known/jmap)
+    required: true
+  - name: JMAP_BEARER_TOKEN
+    description: Bearer token. Provide either this OR JMAP_USERNAME + JMAP_PASSWORD.
+    required: false
+  - name: JMAP_USERNAME
+    description: Username for HTTP Basic auth (e.g. with a Stalwart app password)
+    required: false
+  - name: JMAP_PASSWORD
+    description: Password/app password for HTTP Basic auth
+    required: false
+  - name: JMAP_ACCOUNT_ID
+    description: Account ID (auto-detected when empty)
+    required: false
+  - name: JMAP_DISABLE_SUBMISSION
+    description: "true = do not register send_email/reply_to_email (drafts only)"
+    required: false
+    defaultValue: "true"
+  - name: JMAP_DISABLE_DELETE
+    description: "true = do not register delete_emails (move to Trash still works)"
+    required: false
+    defaultValue: "true"
+  - name: JMAP_REBASE_SESSION_URLS
+    description: "true = rewrite the session's apiUrl/downloadUrl/uploadUrl/eventSourceUrl onto the session URL's origin. Required over a ClusterIP: Stalwart advertises its publicUrl and the hairpinned call 403s at Envoy."
+    required: false
+    defaultValue: "true"

templates/karakeep.yaml

@@ -0,0 +1,24 @@
+name: karakeep
+version: "1.0.0"
+description: Karakeep bookmarks — search, read, create, lists, tags, highlights
+packageName: "@karakeep/mcp"
+runtime: node
+transport: STDIO
+repositoryUrl: https://github.com/karakeep-app/karakeep
+healthCheck:
+  # A real API call (lists all lists): a pass proves address and API key.
+  tool: get-lists
+  arguments: {}
+  intervalSeconds: 60
+  timeoutSeconds: 10
+env:
+  - name: KARAKEEP_API_ADDR
+    description: Karakeep base URL (e.g. http://karakeep-web.karakeep.svc.cluster.local:3000)
+    required: true
+  - name: KARAKEEP_API_KEY
+    description: API key created in the Karakeep UI (Settings → API Keys)
+    required: true
+  - name: NODE_OPTIONS
+    description: V8 heap cap; Node sizes its heap off host RAM, not the cgroup limit
+    required: false
+    defaultValue: "--max-old-space-size=384"

templates/ttrss.yaml

@@ -0,0 +1,26 @@
+name: ttrss
+version: "1.0.0"
+description: Tiny Tiny RSS — feeds, headlines, article content, read/star state, subscribe
+dockerImage: "mysources.co.uk/michal/ttrss-mcp:1.0.0"
+transport: STDIO
+repositoryUrl: https://mysources.co.uk/michal/ttrss-mcp
+# No command: the image's entrypoint IS the MCP server. Custom server; the
+# public tt-rss MCPs only take a pre-made session id and die when it expires.
+# This one logs in with user/password and re-logs-in on NOT_LOGGED_IN.
+healthCheck:
+  # A real getCategories call: a pass proves URL, login, and that the
+  # user's "Enable API access" preference is on.
+  tool: list_categories
+  arguments: {}
+  intervalSeconds: 60
+  timeoutSeconds: 10
+env:
+  - name: TTRSS_URL
+    description: Full API endpoint (e.g. http://ttrss.ttrss.svc.cluster.local/api/)
+    required: true
+  - name: TTRSS_USER
+    description: tt-rss user with "Enable API access" set in preferences
+    required: true
+  - name: TTRSS_PASSWORD
+    description: That user's password
+    required: true