kube-noob

No AI inside. Works with yours. kube-noob is a Kubernetes, OpenShift, ROSA HCP, Helm and RHACS/StackRox expert in a box: audit rules, read-only-first playbooks, cited docs and graded exercises. Claude, OpenShift Lightspeed or any MCP client calls it as tools; the CLI runs it with no AI at all. No network calls unless enabled.

• Audit: 77 rules plus strict schemas (Kubernetes 1.35, Routes, SCCs, EgressFirewall, Gateway API, StackRox), removed-API checks, safe auto-fixes, attack paths, 9 red-team scenarios, RHACS policy comparison, Containerfiles; scanner and SAST findings ranked by reachability (VEX, KEV); STRIDE threat models.

• Generate: hardened manifests and Helm charts, re-audited; admission policies (VAP, Kyverno) and webhook; CI gate.

• Debug: 67 offline playbooks, read-only steps first; must-gathers triaged into a case draft; OpenShift bugs with fix versions; policy denials explained (Kyverno, Gatekeeper, Pod Security, SCC, RBAC); NetworkPolicy reachability; cluster evidence (never Secrets); CI build failures.

• Learn: 5 tracks, 16 lessons, graded exercises; your team's fixes as code.

• Cite: answers cite local knowledge as [kn:<doc>#<n>].

Design requests run a 7-step protocol: Clarify, Validate, Research, Audit, Calibrate, Generate, Red Team.

Who does the thinking

Related MCP server: kubeview-mcp

Quick start

brew tap aashishmahajan/kube-noob https://github.com/aashishmahajan/kube-noob
brew trust --formula aashishmahajan/kube-noob/kube-noob
brew install kube-noob
kube-noob demo --list
kube-noob audit -f k8s/ --platform openshift --version 4.22
kube-noob insight 'paste anything'
kube-noob doctor
kube-noob selftest

No Homebrew: uv tool install kube-noob (Python 3.11+); install help.

Use with Claude or any MCP client

Claude plugin, in Claude Code (needs uv):

/plugin marketplace add aashishmahajan/kube-noob
/plugin install kube-noob@kube-noob

Desktop app: Customize > Plugins > Add > Add marketplace, aashishmahajan/kube-noob. claude.ai chat: upload the Agent Skill under Customize > Skills.

Any MCP client:

{"mcpServers": {"kube-noob": {"command": "uvx", "args": ["--from", "kube-noob==0.6.0", "kube-noob", "mcp"]}}}

Run on OpenShift

As a token-protected service, loopback-only sidecar or Lightspeed tool: docs/openshift.md. The chart ships NetworkPolicies and runs under restricted-v2.

Safe by default

kube-noob doctor shows what it can reach. Config never comes from the current directory. All keys: kube-noob.example.yaml.

Docs

• Use cases and learning

• Enterprise roadmap

• Architecture

• Training and measured accuracy

• Operations

• Guidance traceability and release readiness

• Privacy, security policy and contributing

Credits

Notices: THIRD_PARTY_NOTICES.md. Kubernetes, Helm, OpenShift, ROSA, RHACS, StackRox, OpenShift Lightspeed, Claude, Anthropic, GitHub and AWS are trademarks of their respective owners; kube-noob is independent and not endorsed by them. License: Apache-2.0.