A Model Context Protocol server for . It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.
Kubernetes monitoring & ops for AI agents — safe-by-default access modes and guards.
KUBECONFIG_PATH, K8S_MODE
마지막 확인
2026-11-09
스타
—
도구
—
가동 시간
—
Kubernetes
The design goal is safe by default: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.
Features
Multi-cluster — every tool accepts an optional context; scope which contexts are usable with an allowlist.
Access modes — read-only → read-write → admin, layered so a mode never exposes tools above its level.
Security flags — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).
Standard auth — uses your kube-config (or in-cluster service account). No credentials are stored by the server.
Security model
Concern
Flag
Default
Effect
What can the server do at all?
K8S_MODE
read-only
read-only exposes only reads; read-write adds mutations; admin adds destructive tools. Tools above the mode are never registered.
Which namespaces are in scope?
K8S_NAMESPACE_ALLOWLIST
(all)
When set, any operation on a namespace outside the list is refused.
Which namespaces are read-only forever?
K8S_PROTECTED_NAMESPACES
kube-system,kube-public,kube-node-lease
Can be read but never mutated or deleted, regardless of mode.
Which clusters are reachable?
K8S_CONTEXT_ALLOWLIST
(all)
When set, only these kube-config contexts may be targeted.
Can it delete?
K8S_ALLOW_DELETE
false
delete_resource needs this and admin mode.
Can it apply manifests?
K8S_ALLOW_APPLY
false
apply_manifest needs this and read-write mode.
Can it exec into pods?
K8S_ALLOW_EXEC
false
exec_in_pod needs this and admin mode; the tool isn't even registered otherwise.
Preview without touching the cluster
K8S_DRY_RUN
false
Write/admin tools validate + log intent, then return without calling the API.
Audit trail
K8S_AUDIT_LOG
true
Emits a JSON line to stderr per guarded operation (ALLOW / DENY / DRY_RUN).
Interactive confirmation
(automatic)
—
Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate.
The layers are independent — e.g. admin mode with all three opt-ins false can restart and scale deployments but can neither delete resources nor exec into pods.
Optional AI risk guard. Set K8S_GUARD_MODE=monitor|enforce to have delete_resource, exec_in_pod and apply_manifest consult a local laya-guard daemon (pipx install laya-guard && laya-guard) that classifies the operation allow/confirm/block before it runs. Runs after the delete/exec/apply gates; only tightens, never grants; fails closed.
Quickstart — add to your agent
Published on npm as @dockndevai/mcp-kubernetes. No clone or build needed — your MCP client runs it on demand with npx. Start in read-only mode; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.
Prefer the published package above. To run from a clone:
npm install
npm run build
node dist/index.js # with the environment variables set
Develop
npm run dev # watch mode
npm test # unit tests for the security policy
npm run typecheck
Publishing
This server ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.
