ACK MCP Server
alibabacloud-ack-mcp-server
The official Alibaba Cloud MCP server for ACK clusters: kubectl, Prometheus metrics, SLS logs and diagnostics.
- 121 ★ on the repository
- Last commit
Broad access
Why this level
- `ack_kubectl` can change cluster resources when writes are allowed.
- The AccessKey opens the cloud resources of the RAM account.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/alibabacloud-ack-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- `ack_kubectl` can change cluster resources when writes are allowed.
- The AccessKey opens the cloud resources of the RAM account.
This is third-party code. Review the repository files before installing.
What it does
ACK MCP Server brings Alibaba Cloud Container Service for Kubernetes cluster work into one agent toolset. `list_clusters` lists clusters, `ack_kubectl` runs kubectl operations with controllable read and write permissions, and `query_prometheus` finds metrics, including from a natural-language request. Control plane and audit logs are read with `query_controlplane_logs` and `query_audit_log`. `diagnose_resource` runs resource diagnostics and `query_inspect_report` returns an inspection report. Credentials are injected per request or taken from the environment. The server runs over stdio through `uvx`, and for shared access it is deployed with Helm in a cluster or in Docker with the SSE transport.
Who it is for. Alibaba Cloud ACK cluster administrators who investigate pod failures and load through Claude Code, Codex or Gemini CLI.
Good fit when
- A pod dies from lack of memory and you must find the cause and fix the manifest.
- A cluster behaves oddly after an upgrade and an inspection report is needed.
- Load has grown and Prometheus metrics should be queried in plain words.
- You need to find who changed a resource from the audit log.
Not a fit when
- The clusters are not on Alibaba Cloud; general Kubernetes servers fit better.
- The agent must not write to the cluster and read-only mode is not configured.
- No RAM account with minimal permissions is available.
Example request
Show ACK clusters, find failed pods in the prod namespace and explain the cause from events and logs.MCP
- Transport
- stdio, sse, http
- Authentication
- API key
Environment variables
ACCESS_KEY_IDrequired, secret- AccessKey ID of the Alibaba Cloud RAM account.
ACCESS_KEY_SECRETrequired, secret- AccessKey secret of the Alibaba Cloud RAM account.
Limitations
Python 3.12 or newer, a RAM account AccessKey and read-only permissions for `cs`, `log` and `arms` are required; the cluster RBAC is granted by an administrator. Cluster lifecycle management (create, delete, upgrade) is marked as future work in the README. The Docker example enables the `--allow-write` flag, so omit it for safe read-only use. The documentation is in Chinese, and the last commit dates from July 2026.
How to disable. Remove the MCP entry with your client command, for example `claude mcp remove ack-mcp-server`. Stop the container or uninstall the Helm release, and revoke the AccessKey in the RAM console.
FAQ
What permissions does the service need?
Read access needs the `cs`, `log` and `arms` permissions from the README policy. A dedicated RAM account with minimal permissions plus cluster RBAC from an administrator is recommended.
How do I connect ACK MCP Server to Claude Code?
Run `claude mcp add` with `uvx alibabacloud-ack-mcp-server@latest` and the `ACCESS_KEY_ID` and `ACCESS_KEY_SECRET` variables. The HTTP variant uses `--transport http`.
Can writing to the cluster be disabled?
Yes, `ack_kubectl` read and write permissions are controllable. In the Docker example the `--allow-write` flag enables writes, so without it the server reads only.
How do I expose the server to several agents?
Deploy it in a cluster with Helm using `transport=sse` and expose the service through a load balancer. A single developer is fine with a local stdio run.
What data can the agent read?
Kubernetes clusters and resources, Prometheus metrics, control plane logs in SLS and the audit log. Access is bounded by the RAM policy and RBAC permissions.
Discussion
No questions or reviews yet.
Related
MCP serversA Kubernetes panel with an MCP server: Claude Code reads pod logs, edits resources and rolls back releases in connected clusters.
A Go MCP server for Kubernetes and OpenShift: resources, pods, logs, Helm and Tekton straight through the cluster API
MCP server for Kubernetes: the agent reads cluster state, diagnoses pod failures and runs operations through kubectl
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
K8M MCP gives an agent conversational access to Kubernetes resources, pod logs and operations across multiple connected clusters.
An MCP server for Prometheus: the agent runs PromQL queries, discovers metrics and checks scrape targets
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| ACK MCP Server (this card) | yes | API key | 121 | |
| Kubernetes MCP Server | no | not required | 2,228 | a general Kubernetes and OpenShift server; ACK MCP Server adds Prometheus metrics, SLS logs and Alibaba Cloud diagnostics |
| Kubernetes MCP | no | not required | 1,610 | manages a cluster through kubectl and Helm; this one adds ACK cloud and observability tools |
README in short
The server capabilities are integrated into the Alibaba Cloud Container Service assistant. The repository holds benchmarks with kubectl-ai and Qwen Code covering OOM, resource diagnostics and cluster health checks.