Kubernetes MCP server

mcp-kubernetes

A Model Context Protocol server for Kubernetes. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.

The design goal is safe by default: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.

Features

• Multi-cluster — every tool accepts an optional context; scope which contexts are usable with an allowlist.
• Access modes — read-only → read-write → admin, layered so a mode never exposes tools above its level.
• Security flags — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).
• Standard auth — uses your kube-config (or in-cluster service account). No credentials are stored by the server.

Security model

The layers are independent — e.g. admin mode with all three opt-ins false can restart and scale deployments but can neither delete resources nor exec into pods.

Tools

Read (read-only+): listcontexts, listnamespaces, listpods, getpod, getpodlogs, listdeployments, listservices, listnodes, listevents, get_resource

Write (read-write+): scaledeployment, restartdeployment, setdeploymentimage, createnamespace, applymanifest (needs K8SALLOWAPPLY)

Admin (admin): deleteresource (needs K8SALLOWDELETE), execinpod (needs K8SALLOW_EXEC)

Quickstart — add to your agent

Shortened. The full README is on GitHub.