mcp-kubernetes

A Model Context Protocol server for Kubernetes. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.

The design goal is safe by default: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.

Features

• Multi-cluster — every tool accepts an optional context; scope which contexts are usable with an allowlist.

• Access modes — read-only → read-write → admin, layered so a mode never exposes tools above its level.

• Security flags — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).

• Standard auth — uses your kube-config (or in-cluster service account). No credentials are stored by the server.

Related MCP server: k8s-mcp-go

Security model

The layers are independent — e.g. admin mode with all three opt-ins false can restart and scale deployments but can neither delete resources nor exec into pods.

Tools

Read (read-only+): list_contexts, list_namespaces, list_pods, get_pod, get_pod_logs, list_deployments, list_services, list_nodes, list_events, get_resource

Write (read-write+): scale_deployment, restart_deployment, set_deployment_image, create_namespace, apply_manifest (needs K8S_ALLOW_APPLY)

Admin (admin): delete_resource (needs K8S_ALLOW_DELETE), exec_in_pod (needs K8S_ALLOW_EXEC)

Use with your MCP client

Works with Claude Code, Claude Desktop, Cursor, OpenAI Codex CLI, Windsurf, VS Code (Copilot), and any other MCP client — see docs/CLIENTS.md for per-client setup.

Install

npm install
npm run build

Run with Claude Desktop / Claude Code

Add to your MCP client configuration:

{
  "mcpServers": {
    "kubernetes": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-kubernetes/dist/index.js"],
      "env": {
        "KUBECONFIG_PATH": "/Users/you/.kube/config",
        "K8S_MODE": "read-only",
        "K8S_CONTEXT_ALLOWLIST": "staging",
        "K8S_NAMESPACE_ALLOWLIST": "app,web"
      }
    }
  }
}

Bump K8S_MODE to read-write for scaling/restarts, and to admin (plus the relevant K8S_ALLOW_* flag) only when you intend to allow deletes or exec.

Develop

npm run dev        # watch mode
npm test           # unit tests for the security policy
npm run typecheck

Publishing

This server ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.

License

MIT