openshift-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| APP_NAME | No | ||
| VAULT_ADDR | No | ||
| POSTGRES_DB | No | ||
| VAULT_TOKEN | No | ||
| MCP_HTTP_HOST | No | ||
| MCP_HTTP_PATH | No | ||
| MCP_HTTP_PORT | No | ||
| POSTGRES_HOST | No | ||
| POSTGRES_PORT | No | ||
| POSTGRES_USER | No | ||
| VAULT_KV_MOUNT | No | ||
| MCP_SERVER_NAME | No | ||
| POSTGRES_PASSWORD | No | ||
| MCP_ADMIN_AUTH_KEY | No | ||
| MCP_HTTP_AUTH_MODE | No | ||
| MCP_SERVER_VERSION | No | ||
| MCP_TRANSPORT_MODE | No | ||
| OPENSHIFT_AUTH_MODE | No | ||
| VAULT_AGENT_ENABLED | No | ||
| MCP_HTTP_ALLOWED_IPS | No | ||
| MCP_HTTP_AUTH_TOKENS | No | ||
| MCP_HTTP_HEALTH_PATH | No | ||
| MCP_HTTP_TRUST_PROXY | No | ||
| OPENSHIFT_TIMEOUT_MS | No | ||
| VAULT_AGENT_AUTH_MODE | No | ||
| OPENSHIFT_API_BASE_URL | No | ||
| MCP_HTTP_MAX_BODY_BYTES | No | ||
| MCP_HTTP_ALLOWED_ORIGINS | No | ||
| VAULT_AGENT_LISTENER_ADDR | No | ||
| MCP_ALLOW_SENSITIVE_OUTPUT | No | ||
| MCP_CONFIG_DEFAULT_USER_ID | No | ||
| OPENSHIFT_TOKEN_INDEX_PATH | No | ||
| VAULT_WRITE_RETRY_ATTEMPTS | No | ||
| VAULT_AGENT_TOKEN_FILE_PATH | No | ||
| VAULT_AGENT_LISTENER_ENABLED | No | ||
| MCP_HTTP_RATE_LIMIT_WINDOW_MS | No | ||
| VAULT_WRITE_RETRY_MAX_DELAY_MS | No | ||
| VAULT_WRITE_RETRY_BASE_DELAY_MS | No | ||
| MCP_HTTP_RATE_LIMIT_MAX_REQUESTS | No | ||
| OPENSHIFT_USER_TOKEN_SECRET_PATH_PREFIX | No | ||
| OPENSHIFT_TOKEN_METADATA_CONFIG_KEY_PREFIX | No |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| openshift_connection_info | Return OpenShift MCP server, persistence, and scope model details. |
| mcp_admin_auth_status | Return MCP admin authorization status without exposing key material. |
| mcp_admin_auth_verify | Verify an MCP_ADMIN_AUTH_KEY-compatible authorization key. |
| mcp_admin_auth_rotate | Rotate MCP admin authorization into Vault. The current key is required and the new key is never returned. |
| openshift_health_check | Call OpenShift API server health endpoint. |
| openshift_list_endpoints | List OpenShift endpoints exposed by this MCP server. |
| openshift_discover_api_groups | Discover every Kubernetes, OpenShift, aggregated, operator, and custom API group/version installed on the cluster. |
| openshift_discover_api_resources | Discover resources, scope, verbs, short names, categories, and subresources for an installed API version. |
| openshift_discover_openapi | List OpenAPI v3 schemas or retrieve one schema using an api/... or apis/... path returned by the index. |
| openshift_resource_request | Operate on any discovered core, OpenShift, aggregated, operator, or custom resource using structured coordinates. |
| openshift_list_projects | List OpenShift projects using the user's Vault-managed token. |
| openshift_get_projectC | Get details for one OpenShift project. |
| openshift_list_pods | List pods for an OpenShift namespace. |
| openshift_get_version | Get the OpenShift and Kubernetes API server version. |
| openshift_get_pod | Get one pod and its container/status details. |
| openshift_get_pod_logs | Get pod logs with container, previous instance, time, and tail controls. |
| openshift_list_events | List cluster or namespace events with field and event-type filters. |
| openshift_list_deployments | List deployments in a namespace. |
| openshift_scale_deployment | Set deployment replicas through the scale subresource. |
| openshift_rollout_restart | Restart a deployment rollout by updating its pod-template restart annotation. |
| openshift_list_services | List Kubernetes services in a namespace. |
| openshift_list_routes | List OpenShift routes in a namespace. |
| openshift_get_route | Get one OpenShift route. |
| openshift_list_cluster_operators | List OpenShift ClusterOperators and their conditions. |
| openshift_get_cluster_version | Get ClusterVersion status, desired version, history, and available updates. |
| openshift_list_nodes | List cluster nodes and their conditions. |
| openshift_can_i | Check whether the current user's OpenShift token may perform a resource action. |
| openshift_list_role_bindings | List RoleBindings across the cluster or in one namespace. |
| openshift_list_crds | List installed CustomResourceDefinitions. |
| openshift_list_subscriptions | List Operator Lifecycle Manager subscriptions across the cluster or in one namespace. |
| openshift_get_resource_usage | Get pod or node resource usage from the Kubernetes Metrics API. |
| openshift_api_request | Generic OpenShift API request with user-scoped token resolution and mutating auth guard. |
| openshift_set_user_tokenC | Set or rotate a user-scoped OpenShift bearer token. Token is stored in Vault, metadata in Postgres, and index entry in Vault. |
| openshift_get_user_token_metadataC | Get user token metadata from Postgres and current Vault token index state. |
| openshift_deactivate_user_tokenC | Deactivate a user token in Vault index and remove the direct user token secret. |
| config_get | Read user-scoped configuration from Postgres. |
| config_set | Write user-scoped configuration to Postgres. |
| redshift_list_clusters | List Redshift clusters configured for a user without exposing credentials. |
| redshift_get_cluster | Get Redshift cluster connection metadata without exposing credentials. |
| redshift_set_cluster | Create or replace a named Redshift cluster configuration and its Vault-backed credentials. |
| redshift_remove_cluster | Remove a named Redshift cluster configuration and its credentials. |
| redshift_health_check | Test connectivity to a named Redshift cluster. |
| redshift_queryC | Run a parameterized SQL statement against a named Redshift cluster. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
The server mixes OpenShift token management with a Redshift query tool, creating confusion about its purpose. An agent may select the wrong tool expecting OpenShift functionality.
Tools use service prefixes (openshift_, redshift_) which are consistent within each domain, but the mix of two prefixes breaks overall consistency. Verb_noun pattern is used, but the prefix inconsistency lowers the score.
With 5 tools, the count is within the typical well-scoped range (3-15). However, the mix of two domains suggests the scope might be slightly too broad for a single server.
The OpenShift coverage lacks basic CRUD operations (e.g., list, create, delete projects). Redshift is limited to a single query tool, missing management or schema operations. The surface is significantly incomplete for both domains.