Kubernetes MCP Server
A Go MCP server for Kubernetes and OpenShift: resources, pods, logs, Helm and Tekton straight through the cluster API
- 2,200 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Can modify and delete cluster resources and exec into pods
- Uses kubeconfig credentials
Install
- Works in
Manual install
claude mcp add-json kubernetes-mcp-server \
'{"command":"npx","args":["-y","kubernetes-mcp-server@latest","--read-only"],"env":{"KUBECONFIG":"'${HOME}'/.kube/mcp-viewer.kubeconfig"}}' \
-s userExample from the Claude Code guide: read-only mode and a dedicated kubeconfig.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Can modify and delete cluster resources and exec into pods
- Uses kubeconfig credentials
This is third-party code. Review the repository files before installing.
What it does
The server gives the agent access to a Kubernetes or OpenShift cluster through kubeconfig or in-cluster config. The agent can create, read, update and delete any resource, inspect pods, logs, events and resource usage, and exec into containers. Optional toolsets add Helm, Tekton, KubeVirt, Kiali and kcp. It talks to the cluster API directly instead of shelling out to kubectl or helm, and handles several contexts at once.
Who it is for. For DevOps engineers and developers who troubleshoot clusters together with an agent.
Good fit when
- You need to find out why a pod crashes from its logs and events
- You need a quick look at resources across several clusters
- You want to manage Helm releases or Tekton pipelines from an agent chat
Not a fit when
- You have no Kubernetes cluster access
- The agent must not write to a production cluster and read-only mode is not enough
Example request
Check events in the payments namespace and explain why the deployment will not come upMCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
KUBECONFIGsecret- Path to a kubeconfig; without it the server resolves configuration itself.
Limitations
The agent gets exactly the permissions of the kubeconfig account. The authors recommend a dedicated ServiceAccount and the --read-only flag; --disable-destructive and denied resource types such as Secret are also available. HTTP mode with OAuth/OIDC needs extra setup.
How to disable. Remove the kubernetes block from the MCP client config or run claude mcp remove kubernetes-mcp-server.
FAQ
Do I need kubectl installed?
No. The server talks to the cluster API itself; the native binary does not even need Node or Python.
How do I stop the agent from deleting resources?
Run the server with --read-only or --disable-destructive; the TOML config can also deny specific resource types.
Discussion
No questions or reviews yet.
Related
MCP serversKubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
A Go MCP server for Kubernetes: read any cluster resource and pod logs, with apply and exec in write mode
MCP server for Kubernetes: the agent reads cluster state, diagnoses pod failures and runs operations through kubectl
A CLI and Kubernetes controller for developing, building and deploying MCP servers. For platform teams, written in Go
An open-source Kubernetes UI with a built-in MCP server: the agent inspects the cluster, diagnoses breakages and operates it with RBAC in mind
Google Cloud's MCP server and Gemini CLI extension for GKE clusters: resources, logs, deploys, costs and upgrade risks
README in short
The README lists capabilities for resources, pods, namespaces, events and OpenShift projects, plus Helm, Tekton, KubeVirt, Kiali, NetObserv and kcp toolsets. The server ships as a binary, an npm package, a PyPI package and a container image. Setup examples cover Claude Desktop, VS Code, Cursor and Goose, with a separate Claude Code guide. It is configured with CLI flags and TOML files and supports Streamable HTTP and OpenTelemetry. Apache-2.0 licensed.