Get high-level cluster information: name, API URL, version, channel, and platform type.

Show ClusterVersion history, conditions (Available/Progressing/Degraded), and available updates.

List all ClusterOperators with Available/Progressing/Degraded/Version columns; degraded operators are listed first.

Get detailed conditions, versions, and related objects for a single ClusterOperator.

Get Infrastructure and Network configuration CRDs from config.openshift.io/v1.

List all nodes with ROLES, STATUS, OS image, KUBELET version, and AGE.

Get capacity, allocatable resources, conditions, and taints for a node.

Cordon a node so that no new pods are scheduled on it.

Uncordon a node to allow new pods to be scheduled on it again.

Drain a node by evicting all evictable pods (cordons the node first).

Args: name: Name of the node to drain. ignore_daemonsets: Ignore DaemonSet-managed pods (default True). delete_emptydir_data: Allow deletion of pods with emptyDir volumes (default False). force: Force eviction of pods not managed by a controller (default False). grace_period: Seconds for graceful termination; -1 uses pod default. cluster: Named cluster to target (empty = default).

List all namespaces with STATUS, LABELS, and AGE.

Create a new namespace, optionally with labels.

Args: name: Namespace name. labels: Comma-separated KEY=VALUE pairs (e.g. "env=prod,team=platform"). cluster: Named cluster to target (empty = default).

DESTRUCTIVE: Delete a namespace and ALL resources within it.

This action is irreversible. All pods, services, persistent volume claims, and other objects in the namespace will be permanently deleted.

Args: name: Namespace to delete. cluster: Named cluster to target (empty = default).

List ResourceQuotas and LimitRanges in a namespace.

List the most recent 50 events, optionally filtered by namespace, field selector, or involved object name.

Args: namespace: Namespace to query (empty = all namespaces). field_selector: Kubernetes field selector (e.g. "reason=BackOff"). involved_object: Filter by involvedObject.name (appended to field_selector). cluster: Named cluster to target (empty = default).

Get ETCD cluster status from operator.openshift.io/v1 etcds/cluster.

Show all configured MCP clusters and the active oc kubeconfig contexts.

List pods with NAMESPACE, NAME, STATUS, READY, RESTARTS, NODE, and AGE columns.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector (e.g. "app=nginx"). field_selector: Field selector (e.g. "status.phase=Running"). cluster: Named cluster to target (empty = default).

Show detailed information for a pod: phase, node, IP, QoS class, container states, and conditions.

Args: name: Pod name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Fetch logs from a pod container.

Args: name: Pod name. namespace: Namespace (default: "default"). container: Container name (empty = first/only container). previous: Return logs from the previous container instance. tail_lines: Number of lines from the end (default 100, 0 = unlimited). since_seconds: Only return logs newer than this many seconds. cluster: Named cluster to target (empty = default).

Execute a command inside a pod via oc exec. command is split with shlex — shell metacharacters (pipes, redirects) are not interpreted.

Delete a pod.

Args: name: Pod name. namespace: Namespace (default: "default"). force: Force-delete immediately (grace-period=0). cluster: Named cluster to target (empty = default).

Run 'oc describe pod' for detailed pod information including events.

Args: name: Pod name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List Deployments with NAMESPACE, NAME, READY, UP-TO-DATE, AVAILABLE, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter deployments. cluster: Named cluster to target (empty = default).

Scale a Deployment to the specified number of replicas.

Args: name: Deployment name. replicas: Desired replica count. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Trigger a rolling restart of a Deployment (equivalent to 'oc rollout restart').

Args: name: Deployment name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Undo a Deployment rollout, optionally to a specific revision.

Args: name: Deployment name. namespace: Namespace (default: "default"). revision: Target revision number (0 = previous revision). cluster: Named cluster to target (empty = default).

Show the rollout status of a Deployment (equivalent to 'oc rollout status').

Args: name: Deployment name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List StatefulSets with NAMESPACE, NAME, READY, SERVICE, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter StatefulSets. cluster: Named cluster to target (empty = default).

Scale a StatefulSet to the specified number of replicas.

Args: name: StatefulSet name. replicas: Desired replica count. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List DaemonSets with NAMESPACE, NAME, DESIRED, CURRENT, READY, UP-TO-DATE, AVAILABLE, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter DaemonSets. cluster: Named cluster to target (empty = default).

List Jobs with NAMESPACE, NAME, COMPLETIONS, ACTIVE, SUCCEEDED, FAILED, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter Jobs. cluster: Named cluster to target (empty = default).

List CronJobs with NAMESPACE, NAME, SCHEDULE, SUSPEND, ACTIVE, LAST RUN, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter CronJobs. cluster: Named cluster to target (empty = default).

Create a Job immediately from a CronJob template (manual trigger).

Args: cronjob_name: Source CronJob name. job_name: Name for the newly created Job. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List OpenShift DeploymentConfigs (apps.openshift.io/v1) with NAMESPACE, NAME, REVISION, DESIRED, CURRENT, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). cluster: Named cluster to target (empty = default).

Trigger a new rollout of an OpenShift DeploymentConfig (oc rollout latest dc/).

Args: name: DeploymentConfig name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List Services with NAMESPACE, NAME, TYPE, CLUSTER-IP, EXTERNAL-IP, PORT(S), and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter Services. cluster: Named cluster to target (empty = default).

Show detailed info for a Service including selector, ports, and current Endpoints.

Args: name: Service name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Delete a Service.

Args: name: Service name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List OpenShift Routes (route.openshift.io/v1) with NAMESPACE, NAME, HOST/PATH, TLS, SERVICE, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). cluster: Named cluster to target (empty = default).

Get detailed information for an OpenShift Route including admitted status and TLS config.

Args: name: Route name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Create an OpenShift Route by exposing a Service.

Uses 'oc expose' to create a basic route and then patches TLS termination and path if required.

Args: name: Route name. namespace: Namespace. service: Name of the Service to expose. host: Hostname for the route (empty = let the router assign one). path: URL path prefix (default "/"). tls_termination: TLS termination type: "edge", "passthrough", "reencrypt", or "" (no TLS). port: Target port name or number (empty = first port from Service). cluster: Named cluster to target (empty = default).

Delete an OpenShift Route.

Args: name: Route name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

List Kubernetes Ingress objects with NAMESPACE, NAME, CLASS, HOSTS, ADDRESS, PORTS, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). label_selector: Label selector to filter Ingresses. cluster: Named cluster to target (empty = default).

List NetworkPolicies with NAMESPACE, NAME, POD-SELECTOR, POLICY-TYPES, and AGE.

Args: namespace: Namespace to query (empty = all namespaces). cluster: Named cluster to target (empty = default).

Delete a NetworkPolicy.

Args: name: NetworkPolicy name. namespace: Namespace (default: "default"). cluster: Named cluster to target (empty = default).

Get the cluster-wide Network configuration from config.openshift.io/v1 networks/cluster.

Shows network type, cluster networks, service networks, and machine networks.

Get an OpenShift IngressController from operator.openshift.io/v1.

Args: name: IngressController name (default: "default"). cluster: Named cluster to target (empty = default).

List PersistentVolumes with capacity, access modes, storage class, reclaim policy, status, and claim.

Get detailed PersistentVolume info including CSI, NFS, HostPath, or EBS source.

Delete a PersistentVolume. WARNING: ensure no PVC is bound before deleting.

List PersistentVolumeClaims with status, volume, capacity, access modes, and storage class.

Get detailed PersistentVolumeClaim info including conditions.

Create a PersistentVolumeClaim. storage_request example: 10Gi access_mode: ReadWriteOnce, ReadOnlyMany, ReadWriteMany, ReadWriteOncePod.

Delete a PersistentVolumeClaim. WARNING: data loss may occur if PVC is in use.

List StorageClasses. The cluster default is marked with (default).

List VolumeSnapshots (snapshot.storage.k8s.io/v1) with source PVC, class, and ready status.

Create a VolumeSnapshot from a PersistentVolumeClaim.

List ConfigMaps with namespace, name, key count, and age.

Get ConfigMap keys and values. Values longer than 200 characters are truncated.

Create a ConfigMap. data is KEY=VALUE pairs separated by newlines or commas. Example: KEY1=value1\nKEY2=value2

Set or update a single key in a ConfigMap using strategic merge patch.

Delete a ConfigMap.

List Secrets showing type and key count only — secret values are never displayed.

List the key names of a Secret. Values are never shown for security.

List ServiceAccounts with number of secrets and image pull secrets.

List OpenShift users with their identities and group memberships.

Get OpenShift user details: full name, identities, and group memberships.

List OpenShift Groups with member count and up to 5 member names.

Create an empty OpenShift Group.

Add a user to an OpenShift Group (atomic — uses oc adm groups add-users).

Remove a user from an OpenShift Group (atomic — uses oc adm groups remove-users).

List Roles in a namespace with the number of policy rules.

List ClusterRoles with the number of policy rules.

List RoleBindings in a namespace with role reference and bound subjects.

List ClusterRoleBindings with role reference and bound subjects.

Create a RoleBinding in a namespace. subject_kind: User, Group, or ServiceAccount. cluster_role: if True, references a ClusterRole instead of a Role.

Delete a RoleBinding.

List all actions a user can perform using 'oc auth can-i --list --as='. Specify namespace to scope the check; omit for cluster-wide actions.

List BuildConfigs with strategy type, source, last version, and age.

Describe a BuildConfig in detail using oc describe bc.

Start a new build from a BuildConfig. Optionally supply from_dir to use a local directory as the binary source.

List Builds with phase, duration, reason, and age.

Get detailed Build information: phase, reason, output image, and timing.

Retrieve logs for a Build. Set follow=True to stream (returns available output).

List ImageStreams with their internal Docker repository and tag count.

List tags for an ImageStream with image digest and creation timestamp.

List installed operators (ClusterServiceVersions) with display name, version, and phase.

Get ClusterServiceVersion status: phase, conditions, and owned CRDs. If namespace is empty, all namespaces are searched for a CSV whose name matches.

List OLM Subscriptions with package, channel, source, current CSV, and age.

Create an OLM Subscription to install an operator from a CatalogSource. install_mode is informational only (set via OperatorGroup, not Subscription spec).

Delete an OLM Subscription. Set also_delete_csv=True to also remove the currently installed CSV.

List CatalogSources with display name, type, publisher, and connection state.

List OperatorGroups with their target namespaces and service account.

List InstallPlans with approval mode, approved status, phase, and CSV names.

Approve a Manual InstallPlan by patching spec.approved=True.

List OperatorConditions (operators.coreos.com/v2) with active condition summary.

List MachineSets with desired/ready/available replica counts, instance type, and age.

Describe a MachineSet showing all spec and status details.

Scale a MachineSet to the given number of replicas by patching spec.replicas. WARNING: Scaling down will cause machines (and their nodes) to be deleted.

List Machines with phase, node ref, provider ID, and age.

Get detailed Machine info: phase, nodeRef, providerID, addresses, conditions.

Delete a Machine — the Machine controller will drain and terminate the underlying node. WARNING: Destructive. The node will be cordoned, drained, and terminated.

List MachineConfigPools with rendered config, machine counts, and status flags.

Get MachineConfigPool detail: conditions and machine counts.

Pause a MachineConfigPool — prevents config updates from rolling out to nodes.

Unpause a MachineConfigPool — allows pending config updates to roll out to nodes.

List MachineConfigs with role label (machineconfiguration.openshift.io/role), generation, and age.

List active alerts from Alertmanager, optionally filtered by severity and/or state. severity: critical | warning | info state: active | suppressed | unprocessed

Get full labels, annotations, status, and silence info for all instances of a named alert.

List PrometheusRules (monitoring.coreos.com/v1) with rule group count.

List PrometheusRules with counts of alerting rules and recording rules per resource.

Execute a PromQL instant query against Thanos Querier and return results as a table.

Execute a PromQL range query. start/end in ISO8601 or Unix timestamp; step e.g. '5m'.

List Alertmanager silences with ID, state, matchers, comment, creator, and end time.

Create an Alertmanager silence. matchers: comma-separated key=value or key=~regex pairs. Example: 'alertname=Watchdog,severity=~warning|critical' duration_hours: silence duration in hours (default 4).

Delete an Alertmanager silence by its ID.

Read the cluster-monitoring-config ConfigMap from the openshift-monitoring namespace.

List all SecurityContextConstraints sorted by priority descending.

Get full SCC detail: volumes, capabilities, allowedCapabilities, users, and groups.

Create a custom SecurityContextConstraint CR. run_as_any: if True, sets RunAsAny for runAsUser and fsGroup. allow_privilege_escalation: if True, allows processes to gain more privileges than their parent (required for setuid binaries).

Grant an SCC to a ServiceAccount via 'oc adm policy add-scc-to-user'. Equivalent to: oc adm policy add-scc-to-user system:serviceaccount::

Revoke an SCC from a ServiceAccount via 'oc adm policy remove-scc-from-user'.

Grant a ClusterRole to a user via 'oc adm policy add-cluster-role-to-user'.

Grant a ClusterRole to a group via 'oc adm policy add-cluster-role-to-group'.

Get the cluster OAuth configuration and identity providers from config.openshift.io/v1.

List events that indicate pod security or SCC violations (FailedCreate + security keywords).

List HorizontalPodAutoscalers with min/max/current/desired replicas and metrics.

Create an HPA using 'oc autoscale'. target_ref format: 'Deployment/my-app' or 'DeploymentConfig/my-dc'. cpu_percent: target CPU utilisation percentage (default 80).

Delete a HorizontalPodAutoscaler.

List VerticalPodAutoscalers with update mode and target workload.

Show VPA recommendations per container: lowerBound/target/upperBound/uncappedTarget.

Get the ClusterAutoscaler 'default' resource limits and scale-down configuration.

List MachineAutoscalers in openshift-machine-api with target MachineSet, min, max, and age.

Create a MachineAutoscaler CR targeting a MachineSet in openshift-machine-api. Requires a ClusterAutoscaler to be configured for this to take effect.

List ArgoCD Applications with sync/health status, repo, revision, destination, and age.

Get ArgoCD Application details: sync/health/repo/path/destination + resources table.

Trigger a sync on an ArgoCD Application by patching the operation field.

Get per-resource health status for an ArgoCD Application.

Force-refresh an ArgoCD Application by patching the argocd.argoproj.io/refresh annotation.

List ArgoCD AppProjects with source repos, destinations, and cluster resource access.

List ArgoCD registered clusters from Secrets with label argocd.argoproj.io/secret-type=cluster.

List Tekton Pipelines with task count and age.

Get Tekton Pipeline details: tasks with dependencies, params, and workspaces.

List Tekton PipelineRuns with pipeline name, status, duration, and age.

Get Tekton PipelineRun details: status, duration, and child task run references.

Start a Tekton PipelineRun. params is a comma-separated list of KEY=VALUE pairs.

Cancel a running Tekton PipelineRun.

List Tekton Tasks with step count and age.

List Tekton TaskRuns with task name, status, duration, and age.

List Tekton TriggerTemplates with template count and age.

List Tekton EventListeners with readiness, URL, and age.

List ServiceMeshControlPlanes with generation, version, readiness, and age.

Get ServiceMeshControlPlane status: conditions and component readiness breakdown.

List Istio VirtualServices with hosts, gateways, HTTP/TCP route counts, and age.

List Istio DestinationRules with host, subsets, TLS mode, and age.

List Istio PeerAuthentications with mTLS mode, selector, and age.

List Istio ServiceEntries with hosts, location, ports, and age.

List Istio Gateways with selector, ports, servers count, and age.

List ServiceMeshMemberRolls and the namespaces enrolled in each mesh.

Get DSCInitialization status: phase, conditions, and component enablement.

Get DataScienceCluster status: component management states.

List OpenShift AI Data Science Projects (namespaces with opendatahub.io/dashboard=true label).

List Kubeflow Notebooks with state, image, CPU/memory requests, and age.

Start a stopped Notebook by removing the kubeflow-resource-stopped annotation.

Stop a running Notebook by setting the kubeflow-resource-stopped annotation.

List ServingRuntimes and ClusterServingRuntimes with scope, formats, multi-model, and age.

List InferenceServices with readiness, model format, storage URI, URL, and age.

Create a KServe InferenceService CR.

Delete a KServe InferenceService.

List DataSciencePipelinesApplications with readiness, storage, and API endpoint.

List ModelRegistries with availability, REST port, gRPC port, and age.

Check RHOAI/OpenShift AI overall health: pods in RHOAI namespaces, DSC/DSCI status, CRD presence.

List VirtualMachines with status, vCPU, memory, and age.

Get detailed VM info: running state, resources, interfaces, disks, conditions.

Start a VirtualMachine by setting spec.running=true.

Stop a VirtualMachine by setting spec.running=false.

Restart a VirtualMachine using virtctl.

Pause a running VirtualMachine using virtctl.

Unpause a paused VirtualMachine using virtctl.

Create a VirtualMachine. Provide image_url (HTTP) or pvc_name (existing PVC).

Delete a VirtualMachine (stop it first if running).

List running VirtualMachineInstances with node, IP, and phase.

Live migrate a VirtualMachineInstance to another node.

List DataVolumes with phase, progress, capacity, and source type.

List VirtualMachineSnapshots with phase, source VM, and ready status.

Create a VirtualMachineSnapshot of a VM.

Restore a VM from a VirtualMachineSnapshot.

List Konflux Applications in a workspace namespace.

Get Konflux Application details including conditions.

List Konflux Components with source repo, branch, and build status.

Get detailed Konflux Component info including GitOps repo and nudges.

Create a Konflux Component.

List Konflux Snapshots with components and integration test status.

Get Snapshot with integration test results and component images.

List Konflux IntegrationTestScenarios.

List Konflux ReleasePlans with target workspace.

List Konflux Releases with snapshot, status, and target workspace.

List Tekton PipelineRuns associated with Konflux components.

List ACM ManagedClusters with status, OCP version, cloud provider, and region.

Get detailed ManagedCluster info: capacity, conditions, labels.

List ACM ManagedClusterSets.

List ACM ClusterClaims with pool and resolved cluster.

List ACM Placements with predicates and satisfaction status.

List PlacementDecisions for a Placement showing selected clusters.

List ACM Policies with remediation action and compliance status.

Show per-cluster compliance status for an ACM Policy.

List ManifestWorks deployed to a ManagedCluster (namespace=cluster_name).

Create a ManifestWork to deploy resources to a ManagedCluster.

List ManagedClusterAddons on a specific managed cluster.

Apply a YAML or JSON manifest to the cluster via 'oc apply -f -'. WARNING: This applies resources directly. Review manifests before applying.

Delete any Kubernetes/OpenShift resource by type and name. WARNING: Destructive operation. Confirm the resource name before proceeding.

Get any resource in YAML, JSON, or wide format. Use output='describe' for oc describe.

List any custom resource by group/version/plural — works for any CRD.

Escape hatch: run any oc command. args is a space-separated string of arguments. WARNING: Use carefully. Destructive commands should be confirmed first.

List all CustomResourceDefinitions with group, stored versions, and scope.