Kubeleash MCP server

kubeleash Point it at your over-privileged kubeconfig — it still can't nuke prod.

Guardrails for AI agents on your cluster. kubeleash is a local MCP server for Kubernetes whose differentiator is RBAC-style, context-scoped access control. Point it at a kubeconfig — even a cluster-admin one — and a local policy file constrains what the agent can actually do, per kube context, with destructive actions gated before any call reaches the cluster.

Add kubeleash to your AI client

   

Install launches the local kubeleash binary — get it via brew, go install, or the container (see Install). VS Code installs in one click; Cursor & Claude open the setup steps (GitHub strips the cursor:// one-click link, so it lives there as copy-paste).

Why

Most Kubernetes MCP servers inherit the kubeconfig's permissions wholesale — whatever the credentials grant, the agent can do. kubeleash adds three things native RBAC can't express for this use case:

always kubeconfig-grants ∩ policy-allows — kubeleash only ever subtracts.

• Constrain the agent independently of the credentials. Effective access is

dev); native RBAC is per-cluster.

• Context-aware guardrails. Policy varies by context (prod vs staging vs

mistakes and prompt injection.

• Block destructive verbs (delete/exec/…) as a safety net against agent

What kubeleash enforces

kubeleash governs only the calls routed through it. It provides a hard guarantee when it is the agent's sole path to the cluster. An agent that also has shell access (raw kubectl, oc, the API) can step around it, so in a shell-enabled assistant kubeleash is advisory — pair it with the using-kubeleash skill, which instructs the agent to stop (not reach for kubectl) when the leash is unavailable.

Policy in 10 seconds

policies:
  - contexts: ".*prod.*"          # regex over the active context name
    allow:
      resources: ["*"]
      verbs: [get, list, watch]   # read-only in prod
    deny:
      verbs: [exec]               # never, regardless of credentials

Deny wins. Default deny. A broken policy refuses to start — it never fails open.

Shortened. The full README is on GitHub.