MCP K8S Go
An MCP server in Go: an agent reads pods, logs and events of a Kubernetes cluster, changes resources and runs commands in pods
- 382 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Without the `--readonly` flag the agent creates and changes cluster resources and runs commands inside pods
- Access comes with your kubeconfig permissions, and secrets show up when masking is turned off
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mcp-k8s-goDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Without the `--readonly` flag the agent creates and changes cluster resources and runs commands inside pods
- Access comes with your kubeconfig permissions, and secrets show up when masking is turned off
This is third-party code. Review the repository files before installing.
What it does
MCP K8S Go connects to Kubernetes clusters through your kubeconfig and gives an agent a set of tools, plus MCP resources and prompts. The server is a single Go binary and installs through npm, GitHub Releases, Docker or `go install`. The agent gets the kubeconfig contexts and namespaces, the node and pod lists, cluster events and pod logs. Generic tools can list, get, create and modify any Kubernetes resource. Pods, services and deployments have custom mappings. A separate tool runs a command inside a pod. Startup flags limit the behavior. `--allowed-contexts=dev,prod` leaves the agent only the listed contexts, `--readonly` disables every tool that writes to the cluster, and `--mask-secrets` hides secret values in responses by default. You can try the server without a client through MCP Inspector with `npx @modelcontextprotocol/inspector npx @strowk/mcp-k8s`.
Who it is for. For DevOps engineers and developers who debug applications in Kubernetes and want to question a cluster from Claude Desktop or another MCP client.
Good fit when
- A pod in the kube-system namespace keeps failing and you need errors from its logs and events
- You want a quick view of which pods, services and deployments exist in a chosen context
- The agent should apply a small resource change in a test cluster with your confirmation
- You need a diagnostic command run inside a pod without a manual kubectl exec
- You want safe cluster browsing: start with `--readonly` and a list of allowed contexts
Not a fit when
- You need metrics, dashboards and alerts: the server reads resources, events and logs and has no monitoring
- The cluster is production and running without `--readonly` and an allowed-contexts list breaks team rules
- You need Helm chart installs or release management: the feature list has no such tools
- You need a remote server with team authorization: this one runs locally and takes access from your kubeconfig
Example request
Pick the dev context, find pods with restarts in the kube-system namespace and show errors from their logs over the last hour.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
KUBECONFIG- Path to the kubeconfig file, ~/.kube/config by default.
Limitations
The server uses your kubeconfig permissions in full: the path comes from the KUBECONFIG variable or `~/.kube/config`. Every context is available to the agent until you restrict them with `--allowed-contexts`. Without `--readonly` the agent can create and change resources and run commands in pods, so for production clusters start in read-only mode.
Secret masking is on by default, and the `--mask-secrets=false` flag turns it off. In Docker you mount the config into the container, and in Git Bash on Windows the path to `.kube/config` must be written as `//c/Users/<name>/.kube/config`.
Installing through Smithery and mcp-get configures Claude Desktop automatically, while the other methods require editing the config by hand. The last commit dates from December 2025. Availability of the install from Russia was not checked when this card was prepared.
How to disable. Delete the mcp_k8s block from `claude_desktop_config.json` or your client's other config file and restart the client. If you installed through npm, also run `npm uninstall -g @strowk/mcp-k8s`.
FAQ
How do I connect MCP K8S Go to Claude Desktop?
Run `npm install -g @strowk/mcp-k8s`, then add a server with the `mcp-k8s` command to `claude_desktop_config.json`. Or set the `npx` command with the argument `@strowk/mcp-k8s`. Through Smithery and mcp-get the setup is automatic.
How do I stop the agent from changing the cluster?
Add the `--readonly` flag: it disables any tool that writes to the cluster. The `--allowed-contexts=dev,prod` flag additionally limits the list of kubeconfig contexts.
Can the agent see Kubernetes secret values?
Not by default: masking is on through `--mask-secrets` set to true. It is turned off explicitly with `--mask-secrets=false`.
How do I run MCP K8S Go in Docker?
Use the `mcpk8s/server:latest` image and mount the config: `docker run -i -v ~/.kube/config:/home/nonroot/.kube/config --rm mcpk8s/server:latest`. Images are published for linux/amd64 and linux/arm64 since release 0.3.1-beta.2.
How does MCP K8S Go differ from other Kubernetes servers?
It is written in Go and ships as a ready binary instead of a package built on the spot. Its features include MCP resources and prompts for contexts and namespaces, a read-only mode and an allowed-contexts filter.
Discussion
No questions or reviews yet.
Related
MCP serversA Go MCP server for Kubernetes and OpenShift: resources, pods, logs, Helm and Tekton straight through the cluster API
A Go MCP server for Kubernetes: read any cluster resource and pod logs, with apply and exec in write mode
MCP server for Kubernetes: the agent reads cluster state, diagnoses pod failures and runs operations through kubectl
K8M MCP gives an agent conversational access to Kubernetes resources, pod logs and operations across multiple connected clusters.
A CLI and Kubernetes controller for developing, building and deploying MCP servers. For platform teams, written in Go
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| MCP K8S Go (this card) | no | not required | 382 | |
| Kubernetes MCP Server | no | not required | 2,228 | a Go server for Kubernetes and OpenShift that talks to the cluster API directly and handles Helm and Tekton |
| Kubernetes MCP | no | not required | 1,610 | manages a cluster through kubectl and Helm and has a mode without destructive operations |
| kubectl-mcp-server | no | not required | 968 | reads cluster state, diagnoses pod failures and runs operations through kubectl |
README in short
The README opens with a feature list marking each as a tool, prompt or MCP resource. It then shows browsing with Inspector, a Claude Desktop demo and six install methods in a table with their requirements. It closes with the KUBECONFIG variable and command-line flags with a sample config.