Kubernetes MCP Server

The Kubernetes MCP Server connects AI assistants such as Claude Code or Cursor directly to your Kubernetes and OpenShift clusters. Kubernetes is the widely used system for running container applications across multiple machines; OpenShift is a platform built on top of it. Instead of typing every command into kubectl yourself, you ask the assistant to list pods, read logs, or narrow down an error. The project lives in the GitHub organization containers, is licensed under Apache-2.0 according to the repository, has around 2,180 stars, is not archived, and was last updated on October 23, 2026. It is an open project, not a product of a commercial vendor; the project page does not name individual maintainers.

What can the Kubernetes MCP Server do?

According to the project page the server is a native implementation written in Go that talks directly to the Kubernetes API. So it is not a wrapper around kubectl or helm and needs no additional programs. With the default features you can create, update, list, get, and delete any resource. For pods there are additionally logs, resource usage, running commands in a container, and starting new pods. Namespaces, events, and OpenShift projects come on top. Further functions are bundled in toolsets: helm installs, lists, and removes Helm releases, tekton controls pipelines, and other groups cover Istio via Kiali, virtual machines with KubeVirt, network flows, as well as logs, metrics, and traces. Several clusters from your kubeconfig file can be addressed through a context argument.

Installation and sign-in

The server runs locally. You start it with npx -y kubernetes-mcp-server@latest or with uvx kubernetes-mcp-server@latest; alternatively you download a ready-made binary for Linux, macOS, or Windows from GitHub. Access comes from the existing kubeconfig file or the in-cluster configuration. The project provides guides for Claude Desktop, Claude Code, VS Code, Cursor, and Goose. In HTTP mode the server supports OAuth and OIDC according to the project page, with guides for Keycloak and Microsoft Entra ID.

Toolsets and read-only mode

The configurability is particularly useful. With the toolsets option you enable only the tool groups you need; according to the documentation this reduces context and can improve tool selection. By default only config and core are active. With read_only = true you limit the server to read actions, and with denied_resources you block individual resource types, such as Secrets. You set options via a TOML file, the command line, or environment variables; a change can be reloaded without a restart via a signal. Optionally the server provides telemetry through OpenTelemetry.

What is it particularly useful for?

It helps most with troubleshooting and recurring operations tasks: why does a pod not start, what do the logs say, which resources does a service consume, what does a deployment configuration look like? Compared with a plain kubectl call in the terminal, the assistant understands the structure of the answers and can combine several queries on its own. Compared with cloud-specific servers it is independent of the hosting provider and works with any cluster your kubeconfig can reach.

Security: what to keep in mind

Depending on its permissions the server can delete pods, change resources, run commands in containers, and remove Helm releases. So first use it with read_only = true, use a dedicated service account with narrow rights instead of your administrator access, and block Secrets through denied_resources. Logs and resources the assistant reads enter the AI client's context and therefore reach the model provider. Apart from read-only mode and the deny list, the project page describes no separate switch concept for destructive actions.

Costs

The project is free and open source; there is no pricing page. Costs arise only for the clusters and the AI model you use.

Who is the Kubernetes MCP Server for?

It is worthwhile for developers and platform and DevOps teams who work with Kubernetes or OpenShift every day and want to involve their assistant in diagnosis and routine tasks. Start with a test cluster, enable read-only mode, and extend permissions and toolsets only once you know the behavior.

Node.js with npx, Python with uvx, or the downloaded binary, a kubeconfig file with access to a Kubernetes or OpenShift cluster, and an MCP client with stdio support.

With the Kubernetes MCP Server an AI assistant operates your Kubernetes and OpenShift clusters. This guide leads from installation to the first safe task.

Step 1: Prerequisites

You need Node.js with npx (or Python with uvx), a kubeconfig file with access to a cluster, and an MCP client with stdio support, such as Claude Code or Cursor. Use a test cluster at the start.

Step 2: Register the server

In Claude Code the command is claude mcp add kubernetes -- npx -y kubernetes-mcp-server@latest. Then check with /mcp that the server is connected. Alternatively, download the binary from GitHub.

claude mcp add kubernetes -- npx -y kubernetes-mcp-server@latest

Limit access

The server uses your kubeconfig. It is better to create a dedicated service account with narrow rights instead of using your administrator access; the project documentation includes a guide for this.

Read-only mode and toolsets

In a TOML configuration you set read_only = true, choose only the needed groups with toolsets (by default config and core), and block for example Secrets with denied_resources. Only once you know the behavior do you extend rights and toolsets such as helm.

Step 3: First tasks

Start with reads: "List the pods in the namespace shop and name those that are not running" or "Show the latest logs of pod api-1". Allow write actions such as deleting or scaling only after reviewing the plan.

The existing kubeconfig file or the in-cluster configuration; in HTTP mode optionally OAuth/OIDC (e.g. Keycloak, Microsoft Entra ID).

Access to the clusters in the kubeconfig with the rights of the account used: resources, pods, logs, events, optionally Helm, Tekton, and further toolsets. Access can be restricted with read_only and denied_resources.

Retrieved resources, logs, and configurations enter the AI client context and therefore reach the model provider. The server runs locally; the project page describes telemetry through OpenTelemetry as optional.

Deleting or changing resources, running commands in containers, and removing Helm releases with overly broad rights, exposure of secrets and logs to the model provider, and prompt injection via log or resource content.