mcp-openshift
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENSHIFT_AUTH | No | Authentication mode: 'token' or 'password'. Default is auto-detected. | auto |
| OPENSHIFT_MODE | No | Server mode: read-only (default), read-write, admin. Controls which tools are registered. | read-only |
| OPENSHIFT_TOKEN | No | Your OpenShift token (bearer). Get it from the web console or `oc whoami -t`. | |
| OPENSHIFT_SERVER | Yes | Your cluster's API URL, e.g. https://api.cluster.example.com:6443 | |
| OPENSHIFT_CA_CERT | No | Path to a CA bundle for clusters using a private CA. | |
| OPENSHIFT_DRY_RUN | No | Set to 'true' to send writes with dryRun=All (validate without persisting). | false |
| OPENSHIFT_PASSWORD | No | Your OpenShift password for password authentication. | |
| OPENSHIFT_USERNAME | No | Your OpenShift username for password authentication. | |
| OPENSHIFT_AUDIT_LOG | No | File path to write JSON audit lines for guarded operations. | |
| OPENSHIFT_ALLOW_APPLY | No | Set to 'true' to allow apply_resource (requires read-write mode). | false |
| OPENSHIFT_NSECURE_TLS | No | Set to 'true' to skip TLS verification (dev only). | false |
| OPENSHIFT_ALLOW_DELETE | No | Set to 'true' to allow delete_resource (requires admin mode). | false |
| OPENSHIFT_NAMESPACE_ALLOWLIST | No | Comma-separated list of namespaces where writes are allowed. | |
| OPENSHIFT_PROTECTED_NAMESPACES | No | Comma-separated list of namespaces that are protected from writes. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| whoamiA | Return the authenticated user (name and groups) — confirm which identity the server is using. |
| list_projectsA | List the projects (namespaces) you can see, with name, display name and phase. Start here to find a namespace to work in. |
| list_resourcesA | List resources of a kind, optionally in a namespace and filtered by a label selector. Returns the raw Kubernetes/OpenShift list (secret values are redacted). Works for core and OpenShift kinds (pods, deployments, deploymentconfigs, routes, services, builds, imagestreams, …). |
| get_resourceA | Fetch a single resource by kind + name (+ namespace for namespaced kinds), with its full spec/status. Secret values are redacted. |
| pod_logsB | Read a pod's container logs (most recent lines). Optionally a specific container or the previous instance. |
| list_eventsA | List recent events in a namespace — the fastest way to see why something is failing to schedule/start. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
The six tools each target a distinct concern: identity, project discovery, generic resource listing, single-resource retrieval, logs, and events. The only mild overlap is list_projects vs list_resources with kind='projects', but the specialized project listing is clearly differentiated by its friendlier return format and explicit 'start here' intent.
Most tools follow a verb_noun pattern (list_projects, list_resources, get_resource, list_events), but whoami and pod_logs break that pattern, one being a bare command and the other a noun_noun compound. The names are still readable, but the conventions are mixed.
Six tools is well-scoped for a read-only OpenShift inspection server. Each tool earns its place and together they form a compact workflow without unnecessary bloat.
The set covers the main diagnostic lifecycle: confirm identity, discover projects, list and fetch resources, read pod logs, and inspect events. It lacks mutating operations like create/update/delete, but the described surface appears intentionally read-only, so the gaps are minor for that purpose.