# mcp-devops-server

An MCP (Model Context Protocol) server that gives AI agents access to DevOps tools — kubectl, terraform, helm, docker, and AWS cost analysis.

Works with Claude Desktop, Cursor, GitHub Copilot, and any MCP-compatible client.

## Tools

| Tool | Description |
|------|-------------|
| `kubectl_get` | Get Kubernetes resources |
| `kubectl_describe` | Describe a Kubernetes resource |
| `kubectl_logs` | Get pod logs |
| `terraform_plan` | Run terraform plan |
| `terraform_show` | Show terraform state |
| `helm_list` | List Helm releases |
| `helm_diff` | Preview Helm upgrade changes |
| `docker_ps` | List Docker containers |
| `docker_logs` | Get container logs |
| `aws_cost_summary` | Get AWS cost summary (last 7/30 days) |
| `aws_resource_inventory` | List AWS resources by service |

## Installation

### Using npx (no install)

```bash
npx @basel5001/mcp-devops-server
```

### Global install

```bash
npm install -g @basel5001/mcp-devops-server
mcp-devops-server
```

### From source

```bash
git clone https://github.com/basel5001/mcp-devops-server.git
cd mcp-devops-server
npm install
npm run build
npm start
```

## Configuration

### Claude Desktop

Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "devops": {
      "command": "npx",
      "args": ["-y", "@basel5001/mcp-devops-server"]
    }
  }
}
```

### Cursor

Add to `.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "devops": {
      "command": "npx",
      "args": ["-y", "@basel5001/mcp-devops-server"]
    }
  }
}
```

## Security Considerations

- **Command allowlist**: Only `kubectl`, `terraform`, `helm`, `docker`, and `aws` commands can be executed.
- **Argument sanitization**: Shell metacharacters (`;`, `&`, `|`, `` ` ``, `$`) and path traversal (`..`) are rejected.
- **No shell execution**: Commands run via `execFile` (not `exec`), preventing shell injection.
- **Timeouts**: All commands have configurable timeouts (default 30s) to prevent hanging.
- **Read-only by design**: No destructive operations (delete, apply, destroy) are exposed.

## Development

```bash
npm install
npm run dev    # watch mode
npm run build  # compile
npm run lint   # lint
```

## License

MIT