Potencia tu agente
El comando propio del publicador. No es un endpoint de PlugMCP.
Host a copy with our keys and logs.
uvx rancher-mcp==1.59.0Claude Code no tiene enlace de instalación para un comando local. Copia el comando de abajo y ejecútalo en una terminal.
RANCHER_URL=<value> RANCHER_TOKEN=<secret> RANCHER_VERIFY_SSL=<value> RANCHER_INSTANCES_JSON=<secret> claude mcp add io.github.rex-rancher-mcp -- uvx rancher-mcp==1.59.0Ejecútalo en una terminal.
{ "mcpServers": { "io.github.rex-rancher-mcp": { "command": "uvx", "args": [ "rancher-mcp==1.59.0" ], "env": { "RANCHER_URL": "<value>", "RANCHER_TOKEN": "<secret>", "RANCHER_VERIFY_SSL": "<value>", "RANCHER_INSTANCES_JSON": "<secret>" } } }}claude_desktop_config.json
¿URL remota o un comando en tu máquina? En qué se diferencian las dos instalaciones
Ejecutar en PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
AbrirDel publicador
Rancher is how real fleets run Kubernetes — and it speaks two APIs (the legacy
Norman /v3 plane and the modern Steve /v1 plane), varies by version, and wraps
every cluster behind its own proxy. Pointing a generic Kubernetes MCP server at it
misses everything Rancher-specific; pointing an agent at raw gives up
auditability, guardrails, and the management-plane view entirely.
Capability-aware MCP server for Rancher-managed Kubernetes: discovery, resources, workflows.
kubectlMCP Rancher is built for that reality:
read_only: true and every mutation is refused at the config layer, before any
guard even has to fire.206 tools: 178 read-only · 28 writes · 5 destructive — counted from the
registry itself, not by hand. docs/tool-manifest.json
is generated from the live FastMCP registry (make tool-manifest) and a CI
gate fails the build if it ever drifts from the code. Per-tool descriptions,
safety annotations, and parameters all live there; the narrative registry with
slice tracking is docs/tool-catalog.md.
Domains covered: clusters & nodes · projects & namespaces · workloads · pods & services · storage · networking · config & secrets (values masked) · certificates (keys masked) · RBAC · auth & identity · apps & catalogs · logging pipeline · Prometheus monitoring · policy reports · CIS compliance · backup operator · etcd backups · Longhorn · Fleet · provisioning · settings & features · alerts & notifiers.
All 206 stay exposed by default — every tool schema is deferred behind
Claude Code's own search, so a small default would only help other hosts at
the good host's expense. A constrained host (a small local model, a tight
context budget) can opt into a smaller surface via RANCHER_TOOLSETS; see
Toolset profiles under Configuration.
# From source
git clone https://github.com/rex/mcp-rancher.git
cd mcp-rancher
make setup # deps, .env scaffold, pre-commit hooks
cp .env.example .env # set RANCHER_URL + RANCHER_TOKEN
make dev # run the MCP server (stdio)
Once published to PyPI, it's one line: uvx rancher-mcp.
claude mcp add rancher \
-e RANCHER_URL=https://rancher.example.com \
-e RANCHER_TOKEN=token-xxxxx:yyyyyyyyy \
-- uv run --directory /path/to/mcp-rancher rancher-mcp
{
"mcpServers": {
"rancher": {
"command": "uv",
"args": ["run", "--directory", "/path/to/mcp-rancher", "rancher-mcp"],
"env": {
"RANCHER_URL": "https://rancher.example.com",
"RANCHER_TOKEN": "token-xxxxx:yyyyyyyyy"
}
}
}
}
RANCHER_INSTANCES_JSON='{
"production": {"url": "https://rancher.prod.example.com", "token": "token-a:xxx", "verify_ssl": true, "read_only": true},
"lab": {"url": "https://rancher.lab.example.com", "token": "token-b:yyy", "verify_ssl": false, "read_only": false}
}'
RANCHER_DEFAULT_INSTANCE=production
Every tool takes an optional instance argument. Instances flagged
read_only: true refuse all mutations at the settings layer.
flowchart LR
A[MCP client<br/>Claude Code · Claude Desktop · any] -- stdio --> S
subgraph S[rancher-mcp]
direction TB
L1[Discovery & schema<br/>planes · schemas · capabilities]
L2[Generic engine<br/>any resource · both planes<br/>CRUD · actions · links · watch]
L3[Curated tools<br/>typed models · shaped output<br/>next-step hints]
G[Safety layer<br/>read-only guard · confirmation phrases<br/>audit log · rate limit · masking]
L1 --> L2 --> L3
L3 --> G
L2 --> G
end
G -- Norman /v3 --> R1[(Rancher<br/>instance A)]
G -- Steve /v1 + k8s proxy --> R1
G -- Norman + Steve --> R2[(Rancher<br/>instance B)]
Three layers, deliberately separate: discovery tells you what an instance can
do, the generic engine can touch anything it exposes, and curated tools
make the common paths typed, shaped, and self-describing (every response carries
suggested_next_steps). Most curated tools are generated from YAML descriptors
(catalog/curated_tools/) with a drift gate — the editorial decisions live in
descriptors, not boilerplate.
Built for the day an agent is pointed at the cluster that pays your salary:
Capability detection bridges version differences at runtime — no version-pinned builds, no "works on my Rancher." Both targets are exercised by the same test suite, and read paths have been validated live against both a 2.6.5 lab and a 2.9.3 production fleet (validation report).
The default is all: every tool stays exposed. Claude Code, the primary
host, defers every tool schema behind its own search, so a small default
would only help other hosts at the cost of making the good host worse — this
is a deliberate choice, not an oversight.
RANCHER_TOOLSETS opts a constrained host (a small local model, or a context
budget) into a smaller surface. Values are either a family name — one per
src/rancher_mcp/tools/ module (storage, workloads, pods_services,
rbac, …; see rancher_mcp.toolsets.FAMILY_REGISTRARS for the full list) —
or the cross-family core profile: a ~32-tool triage/orientation set
(rancher_find_*, the health/summary rollups, core list/get pairs, and the
generic rancher_{steve,norman}_resource_{list,get} escape hatches). core
cuts the tools/list payload from 206 tools / ~401 KB to 32 tools / ~78 KB
(~80% smaller). Profiles compose: RANCHER_TOOLSETS=core,storage gives the
triage set plus everything storage-related.
RANCHER_TOOLSETS=core # small triage surface
RANCHER_TOOLSETS=core,storage,workloads # triage + two full families
RANCHER_TOOLS=rancher_secret_get # add one extra tool on top
RANCHER_EXCLUDE_TOOLS=rancher_secret_create # remove one, wins over the above
An unknown profile name fails loudly at startup rather than silently
producing an empty or shrunken surface. Calling a real tool that exists but
isn't in the active profile returns a structured TOOLSET_NOT_ENABLED error
naming the tool, the toolset that would enable it, and the env var to set —
never a bare "unknown tool", which would make a disabled tool indistinguishable
from a typo.
Shipping and stable for read, triage, and guarded write operations. Honest ledger of what's beyond that:
Work is tracked to the tool level: docs/tool-catalog.md
(every tool has a row, every gap a slice ID) and ROADMAP.md.
make help # every target, documented
make validate # codegen drift + manifest drift + architecture + lint + typecheck + tests
make tool-manifest # regenerate docs/tool-manifest.json from the registry
make lab-up # local Rancher 2.6.5 lab (kind + helm), fully scripted
make integration-current # isolated Rancher 2.14.3 end-to-end test run
make live-read-matrix # read-only validation probes against configured instances
make mock-rancher # fixture-backed mock Rancher for provider-config testing
9443; run it serially with make integration-current to avoid
overlapping Docker resource demand with the legacy lab.tests/fixtures/; respx pins the HTTP boundary in tests.catalog/curated_tools/*.yml
descriptors; make check-codegen fails on drift.Stack: Python 3.12 · FastMCP · httpx · Pydantic v2 · structlog · uv
See SECURITY.md for the threat model, token guidance, and how to report vulnerabilities.
Capability-aware MCP server for Rancher-managed Kubernetes: discovery, resources, workflows.
{ "mcpServers": { "io.github.rex-rancher-mcp": { "command": "uvx", "args": [ "rancher-mcp==1.59.0" ], "env": { "RANCHER_URL": "<value>", "RANCHER_TOKEN": "<secret>", "RANCHER_VERIFY_SSL": "<value>", "RANCHER_INSTANCES_JSON": "<secret>" } } }}Herramientas
Aún no hay lista de herramientas. Los servidores remotos la reciben tras la primera comprobación de estado.
Preguntas frecuentes
Copia en esta página la configuración stdio para Cursor, Claude Desktop, Claude Code o VS Code. Usa la instalación del publicador, no un proxy de PlugMCP.
El publicador indica estas variables de entorno: RANCHER_URL, RANCHER_TOKEN, RANCHER_VERIFY_SSL, RANCHER_INSTANCES_JSON.
Rancher se ejecuta localmente por stdio.
Última comprobación: 2026-11-10. Capability-aware MCP server for Rancher-managed Kubernetes: discovery, resources, workflows.