PolicyPulse MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PORT | No | Port for the SSE server. Also accepts POLICYPULSE_PORT. | 8000 |
| KUBECONFIG | No | Path to kubeconfig file used in kubeconfig mode. | ~/.kube/config |
| AZURE_CLIENT_ID | No | Client ID for service principal or user-assigned managed identity. | |
| AZURE_TENANT_ID | No | Azure AD tenant ID required when using service principal authentication. | |
| POLICYPULSE_LOG | No | Log level: DEBUG, INFO, WARNING. | INFO |
| POLICYPULSE_DEMO | No | Set to 'true' to use mock data without requiring any cluster or Azure credentials. | false |
| POLICYPULSE_HOST | No | Bind address for the SSE server. | 0.0.0.0 |
| AZURE_CLIENT_SECRET | No | Client secret for service principal authentication. | |
| POLICYPULSE_CLUSTERS | No | Comma-separated list of clusters in format 'label:context' (kubeconfig mode) or 'label:resourceGroup/clusterName' (workload identity mode). | |
| AZURE_CREDENTIAL_TYPE | No | Azure credential type: 'cli', 'managed_identity', 'service_principal', or 'auto'. | auto |
| AZURE_SUBSCRIPTION_ID | No | Azure subscription ID required for Azure Policy and workload identity authentication. | |
| POLICYPULSE_TRANSPORT | No | Transport mode: 'stdio' for local clients, 'sse' for hosted deployments. | stdio |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cluster_statusA | Which policy engines are connected and whether demo mode is active. |
| list_policiesA | List all policies across connected engines, optionally filtered by engine name. |
| get_violationsA | All active violations enriched with compliance framework refs. namespace: restrict to a specific Kubernetes namespace. engine: one of gatekeeper, kyverno, azure_policy. min_severity: only return violations at or above this level (critical → info). cluster: restrict to a specific cluster label (multi-cluster mode only). |
| get_compliance_risk_summaryB | Cross-engine risk summary: severity breakdown, top risks, and regulatory impact. |
| explain_violationB | Plain-English explanation of one violation with framework mapping and remediation. |
| check_manifest_complianceA | Static policy check for a Kubernetes manifest (YAML or JSON) — no cluster needed. |
| list_controlsB | The full compliance control catalog with framework mappings and remediation guidance. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: static manifest check, cluster status, violation explanation, risk summary, violation listing, control catalog listing, and policy listing. No overlapping responsibilities.
Most tools follow a verb_noun pattern (check, explain, get, list). 'cluster_status' deviates by using a noun_noun form without a verb, but it remains clear and snake_case consistent.
7 tools is well-scoped for a policy compliance server, covering static checks, violation retrieval, explanation, summary, and catalog listing without being excessive or insufficient.
Covers core read and analysis operations (check, list, get, explain, summary, status). Minor gaps exist (no detailed policy view, no write operations) but these are likely out of scope for a read-focused compliance tool.