A Model Context Protocol server for . It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.
Kubernetes monitoring & ops for AI agents — safe-by-default access modes and guards.
KUBECONFIG_PATH, K8S_MODE
Последняя проверка
2026-11-09
Звёзды
—
Инструменты
—
Аптайм
—
Kubernetes
The design goal is safe by default: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.
Features
Multi-cluster — every tool accepts an optional context; scope which contexts are usable with an allowlist.
Access modes — read-only → read-write → admin, layered so a mode never exposes tools above its level.
Security flags — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).
Standard auth — uses your kube-config (or in-cluster service account). No credentials are stored by the server.
Security model
Concern
Flag
Default
Effect
What can the server do at all?
K8S_MODE
read-only
read-only exposes only reads; read-write adds mutations; admin adds destructive tools. Tools above the mode are never registered.
Which namespaces are in scope?
K8S_NAMESPACE_ALLOWLIST
(all)
When set, any operation on a namespace outside the list is refused.
Which namespaces are read-only forever?
K8S_PROTECTED_NAMESPACES
kube-system,kube-public,kube-node-lease
Can be read but never mutated or deleted, regardless of mode.
Which clusters are reachable?
K8S_CONTEXT_ALLOWLIST
(all)
When set, only these kube-config contexts may be targeted.
Can it delete?
K8S_ALLOW_DELETE
false
delete_resource needs this and admin mode.
Can it apply manifests?
K8S_ALLOW_APPLY
false
apply_manifest needs this and read-write mode.
Can it exec into pods?
K8S_ALLOW_EXEC
false
exec_in_pod needs this and admin mode; the tool isn't even registered otherwise.
Preview without touching the cluster
K8S_DRY_RUN
false
Write/admin tools validate + log intent, then return without calling the API.
Audit trail
K8S_AUDIT_LOG
true
Emits a JSON line to stderr per guarded operation (ALLOW / DENY / DRY_RUN).
Interactive confirmation
(automatic)
—
Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate.
The layers are independent — e.g. admin mode with all three opt-ins false can restart and scale deployments but can neither delete resources nor exec into pods.
Optional AI risk guard. Set K8S_GUARD_MODE=monitor|enforce to have delete_resource, exec_in_pod and apply_manifest consult a local laya-guard daemon (pipx install laya-guard && laya-guard) that classifies the operation allow/confirm/block before it runs. Runs after the delete/exec/apply gates; only tightens, never grants; fails closed.
Quickstart — add to your agent
Published on npm as @dockndevai/mcp-kubernetes. No clone or build needed — your MCP client runs it on demand with npx. Start in read-only mode; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.
Prefer the published package above. To run from a clone:
npm install
npm run build
node dist/index.js # with the environment variables set
Develop
npm run dev # watch mode
npm test # unit tests for the security policy
npm run typecheck
Publishing
This server ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.
Списка инструментов пока нет. У удалённых серверов он появляется после первой проверки состояния.
FAQ
Вопросы
Как установить MCP Kubernetes?
Скопируйте на этой странице конфигурацию stdio для Cursor, Claude Desktop, Claude Code или VS Code. Она использует установку издателя, а не прокси PlugMCP.
Нужен ли API-ключ для MCP Kubernetes?
Издатель указывает следующие переменные окружения: KUBECONFIG_PATH, K8S_MODE.
Какой транспорт использует MCP Kubernetes?
MCP Kubernetes работает локально через stdio.
Когда MCP Kubernetes проверялся в последний раз?
Последняя проверка: 2026-11-09. Kubernetes monitoring & ops for AI agents — safe-by-default access modes and guards.
