MKP
A Go MCP server for Kubernetes: read any cluster resource and pod logs, with apply and exec in write mode
Install
git clone https://github.com/StacklokLabs/mkp.git
cd mkp
task install
task build
task runRequires Go 1.24 and Task. For another kubeconfig: KUBECONFIG=/path/to/kubeconfig task run-with-kubeconfig. Set the port with MCP_PORT.
This is third-party code. Review the repository files before installing.
What it does
MKP connects the agent to a Kubernetes cluster directly through the API, without kubectl or helm. The agent lists available resource types, reads clustered and namespaced resources along with subresources such as status, scale and logs, and filters annotations. It uses the unstructured client, so CRDs work too. By default the server is read-only; the --read-write flag enables applying and deleting resources and running commands in pods with a timeout. Rate limiting is built in.
Who it is for. For DevOps engineers and developers who inspect cluster state with an agent.
Good fit when
- You want the agent to find why a pod fails from status and logs
- The agent needs access to custom resources without dedicated handlers
- You need a read-only mode so the agent cannot break anything
Not a fit when
- You need helm operations or complex kubectl workflows
- Context is tight in a large cluster and you will not disable resource serving
Example request
Check the status of the api deployment in the prod namespace and show recent logs from its podsLimitations
There is no ready package: the README builds from source with Go 1.24 and Task, or runs via ToolHive. It needs a kubeconfig with cluster access, and the agent gets that kubeconfig's permissions. Exec is capped at 60 seconds. By default all cluster resources are served as MCP resources; disable this with --serve-resources=false in large clusters.
How to disable. Stop the mkp-server process and remove the server entry from your MCP client config or ToolHive.
MCP
- Transport
- http, sse
- Authentication
- not required
| Environment variables | |
|---|---|
| KUBECONFIG secret | Path to a kubeconfig other than the default. |
| MCP_PORT | Server port. |
| MCP_TRANSPORT | Transport: streamable HTTP by default, or sse. |
| MKP_RATE_LIMIT_READ | Read operations per minute limit. |
| MKP_RATE_LIMIT_WRITE | Write operations per minute limit. |
Security check
- In write mode it changes cluster resources and runs commands in pods
- Runs with the permissions of the supplied kubeconfig
README in short
The README documents the get_resource, list_resources, apply_resource, delete_resource and post_resource tools with argument examples, including log parameters and annotation filters. Installation is clone, task install, task build and task run, with a link to running via ToolHive. It also covers transport, disabling resource serving, write mode and rate limits via environment variables. Apache 2.0 licensed.
FAQ
Can the agent delete anything in the cluster?
Only if the server runs with --read-write=true. By default apply, delete and post tools are unavailable.
Which transport does it use?
Streamable HTTP by default; SSE is available for older clients via --transport=sse.
Related
An MCP server built into the Netdata agent: metrics, logs, alerts and live process, service and container data for an AI assistant
GitHub's official MCP server: code, issues, pull requests, Actions and security alerts straight from the agent
AWS's official MCP server suite: docs, IaC, containers, serverless, databases, cost and monitoring
A GitHub Action that runs Claude Code in pull requests and issues: answers mentions, reviews and makes changes