Ratatosk MCP server

ratatosk-mcp

Ratatosk reads CNCF release notes every hour. Your agents get the changes.

English · 한국어 · 日本語

In Norse myth, Ratatoskr is the squirrel that carries messages up and down the world tree. This one carries release intelligence. ratatosk.io watches 76 CNCF projects and turns every release note into typed, entity-level changes: security fixes, breaking changes, removals, deprecations, changed defaults — each one classified by how you should act on it now. Routine lines are recorded too, but kept out of the way.

This repository is the MCP server that hands those changes to your agent as tools. MCP (Model Context Protocol) is the open standard AI agents use to call external tools; any MCP-capable client — Claude Code, Claude Desktop, kagent, your own SDK agent — can connect. No account, no API key.

Two ways to connect

Hosted — nothing to install. Register https://ratatosk.io/mcp as a remote MCP server in any client that supports remote connectors. The hosted endpoint allows each caller 60 tool calls a minute, counted per caller rather than pooled — for polling or CI workloads, self-host. With the Claude Code CLI:

claude mcp add --transport http ratatosk https://ratatosk.io/mcp

Self-hosted — the same server, running as your own process. Run it with Docker, the Helm chart, or a source build. With Claude Code and Docker installed:

claude mcp add ratatosk -- docker run -i --rm ghcr.io/basphere/ratatosk-mcp:0.10.0

0.10.0 is the current release; use latest to follow new ones.

Either way, verify the connection:

claude mcp list
# ratatosk: … - ✔ Connected

Then ask your agent a question the tools can answer:

You: "We run envoy v1.36.8 and istio 1.30.1. Anything we must do before upgrading?"

Your agent calls check_stack and answers from the record: the CVEs

fixed after your version, the APIs removed on your upgrade path, the defaults

that changed — separated into what applies to everyone and what applies only

if your configuration matches. Each change carries a verbatim quote from the

release notes as evidence.

One entry from a real check_stack answer, as the agent receives it (istio, measured 2026-08-20):

{
  "severity": "high",
  "family": "security",
  "bucket": "action",
  "applies_if": "uses JWKS Resolver",
  "quote": "- CVE-2026-31837 / GHSA-v75c-crr9-733c : (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys.",
  "same_matter_also_addressed_in": ["1.28.5", "1.29.1"]
}

appliesif is a condition the agent evaluates, not prose to read: a stack that runs no JWKS resolver skips this entry without asking anyone. The answer also carries its own privacy line, verbatim: "versions were compared locally; only project slugs were sent to the server."*

Other clients (Claude Desktop, kagent, in-cluster agents) and the full setup reference: see the install guide.

Tools

Two things the tools speak in. A change is one thing a release did, taken from an official release note and tied to the exact identifiers it touches (a CVE id, a flag, a CRD, a config field), with a verbatim quote as evidence. Every change carries three axes:

Shortened. The full README is on GitHub.