Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
Install
claude mcp add kubernetes -- npx mcp-server-kubernetesThis is third-party code. Review the repository files before installing.
What it does
The server connects to the cluster using the current kubeconfig and gives the agent a unified kubectl toolset: get, describe, apply, create, patch, scale, rollout, logs, delete and context management. It supports installing and uninstalling Helm charts, port forwarding, cleaning up broken pods and cordoning or draining nodes. The k8s-diagnose prompt walks the agent through step-by-step pod troubleshooting. Secrets are masked in kubectl get secrets output, and OpenTelemetry tracing is opt-in.
Who it is for. DevOps engineers and developers working with Kubernetes who want to troubleshoot clusters with an agent.
Good fit when
- You need to find out why a pod is in CrashLoopBackOff
- You want a manifest applied or a Helm chart upgraded from a description
- You need a quick look at logs and resources across namespaces
- You want the agent to read and update the cluster but not delete anything
Not a fit when
- A production cluster without restricted permissions or non-destructive mode
- You need to add clusters to kubectx: that is not planned
Example request
Find out why the payments pods in the prod namespace keep restarting and suggest a fixLimitations
Requires kubectl and a working kubeconfig, plus Helm v3 for Helm operations. The server acts with the permissions of the current kubectl context. Secret masking does not apply to logs. ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS disables deletion, pod cleanup, node management and kubectl_generic.
How to disable. Remove it with claude mcp remove kubernetes or delete the kubernetes block from your MCP config. To restrict actions, set ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true.
MCP
- Transport
- stdio, sse
- Authentication
- not required
| Environment variables | |
|---|---|
| ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS | Disables deletion and other destructive operations |
| ENABLE_TELEMETRY | Enables OpenTelemetry tracing |
| OTEL_EXPORTER_OTLP_ENDPOINT | OTLP collector endpoint for traces |
Security check
- Acts with the permissions of the current kubectl context
- Can delete resources, drain nodes and run arbitrary kubectl commands
- Logs may contain sensitive data
README in short
MCP Server Kubernetes connects to and manages a cluster, loading kubeconfig from several sources in priority order. The README covers installation in Claude Code, Codex, Claude Desktop, VS Code and Cursor, plus an mcpb extension for Claude Desktop. It lists kubectl and Helm tools, the diagnostics prompt, non-destructive mode and OpenTelemetry integration. A request flow diagram shows stdio and SSE transports.
FAQ
Where does the server get cluster access?
From ~/.kube/config by default. Other options, including environment variables and custom paths, are in ADVANCED_README.md.
What stays available in non-destructive mode?
Reads, apply, create, scale, patch, rollout, Helm install and upgrade, port forwarding and context management.
Related
HashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
CLI for full-cycle CI/CD to Kubernetes: image builds, Helm-based deploys and container registry cleanup
Terraform Skill
Terraform & OpenTofu Skill for AI Agents
A Terraform and OpenTofu best-practices skill: tests, modules, state, CI/CD and security scanning for AWS, Azure and GCP
A Helm alternative for deploying charts to Kubernetes with release plans, resource tracking and encrypted secrets