MKP MCP
A Go MCP server for Kubernetes: read any cluster resource and pod logs, with apply and exec in write mode
- 59 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- In write mode it changes cluster resources and runs commands in pods
- Runs with the permissions of the supplied kubeconfig
Install
- Works in
Manual install
git clone https://github.com/StacklokLabs/mkp.git
cd mkp
task install
task build
task runRequires Go 1.24 and Task. For another kubeconfig: KUBECONFIG=/path/to/kubeconfig task run-with-kubeconfig. Set the port with MCP_PORT.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- In write mode it changes cluster resources and runs commands in pods
- Runs with the permissions of the supplied kubeconfig
This is third-party code. Review the repository files before installing.
What it does
MKP connects the agent to a Kubernetes cluster directly through the API, without kubectl or helm. The agent lists available resource types, reads clustered and namespaced resources along with subresources such as status, scale and logs, and filters annotations. It uses the unstructured client, so CRDs work too. By default the server is read-only; the --read-write flag enables applying and deleting resources and running commands in pods with a timeout. Rate limiting is built in.
Who it is for. For DevOps engineers and developers who inspect cluster state with an agent.
Good fit when
- You want the agent to find why a pod fails from status and logs
- The agent needs access to custom resources without dedicated handlers
- You need a read-only mode so the agent cannot break anything
Not a fit when
- You need helm operations or complex kubectl workflows
- Context is tight in a large cluster and you will not disable resource serving
Example request
Check the status of the api deployment in the prod namespace and show recent logs from its podsMCP
- Transport
- http, sse
- Authentication
- not required
Environment variables
KUBECONFIGsecret- Path to a kubeconfig other than the default.
MCP_PORT- Server port.
MCP_TRANSPORT- Transport: streamable HTTP by default, or sse.
MKP_RATE_LIMIT_READ- Read operations per minute limit.
MKP_RATE_LIMIT_WRITE- Write operations per minute limit.
Limitations
There is no ready package: the README builds from source with Go 1.24 and Task, or runs via ToolHive. It needs a kubeconfig with cluster access, and the agent gets that kubeconfig's permissions. Exec is capped at 60 seconds. By default all cluster resources are served as MCP resources; disable this with --serve-resources=false in large clusters.
How to disable. Stop the mkp-server process and remove the server entry from your MCP client config or ToolHive.
FAQ
Can the agent delete anything in the cluster?
Only if the server runs with --read-write=true. By default apply, delete and post tools are unavailable.
Which transport does it use?
Streamable HTTP by default; SSE is available for older clients via --transport=sse.
Discussion
No questions or reviews yet.
Related
MCP serversA Go MCP server for Kubernetes and OpenShift: resources, pods, logs, Helm and Tekton straight through the cluster API
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
MCP server for Kubernetes: the agent reads cluster state, diagnoses pod failures and runs operations through kubectl
A CLI and Kubernetes controller for developing, building and deploying MCP servers. For platform teams, written in Go
An open-source Kubernetes UI with a built-in MCP server: the agent inspects the cluster, diagnoses breakages and operates it with RBAC in mind
Google Cloud's MCP server and Gemini CLI extension for GKE clusters: resources, logs, deploys, costs and upgrade risks
README in short
The README documents the get_resource, list_resources, apply_resource, delete_resource and post_resource tools with argument examples, including log parameters and annotation filters. Installation is clone, task install, task build and task run, with a link to running via ToolHive. It also covers transport, disabling resource serving, write mode and rate limits via environment variables. Apache 2.0 licensed.