{"id":"43daf9d1-8a2a-4c79-afc2-48958535ea1e","slug":"mcp-kubernetes","kind":"mcp","name":"mcp-kubernetes","summary":"A Model Context Protocol (MCP) server that enables AI assistants to interact with Kubernetes clusters. It serves as a bridge between AI tools (like Claude, Cursor, and GitHub Copilot) and Kubernetes","owner":"Azure","repoUrl":"https://github.com/Azure/mcp-kubernetes","license":"MIT","licenseTier":"permissive","trust":"official","stars":61,"match":null,"fewStars":false,"format":"mcp","createdAt":"2025-04-25T01:33:00.000Z","addedAt":"2026-10-14T03:46:07.379Z","logoUrl":"https://avatars.githubusercontent.com/u/6844498?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","memory-knowledge","developer-tools"],"tags":["kubernetes"],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-15T02:24:34.661Z","sample":false,"url":"https://conduits.dev/tools/mcp-kubernetes","language":"Go","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# mcp-kubernetes\n\nThe mcp-kubernetes is a Model Context Protocol (MCP) server that enables AI assistants to interact with Kubernetes clusters. It serves as a bridge between AI tools (like Claude, Cursor, and GitHub Copilot) and Kubernetes, translating natural language requests into Kubernetes operations and returning the results in a format the AI tools can understand.\n\nIt allows AI tools to:\n\n- Query Kubernetes resources\n- Execute kubectl commands\n- Manage Kubernetes clusters through natural language interactions\n- Diagnose and interpret the states of Kubernetes resources\n\n## How it works\n\n![](assets/mcp-kubernetes-server.png)\n\n## How to install\n\nContainer images are no longer produced or supported. Install a released binary locally and configure your MCP client to run it as a stdio subprocess.\n\n### Local\n\n<details>\n\n<summary>Install kubectl</summary>\n\nInstall [kubectl](https://kubernetes.io/docs/tasks/tools/) if it's not installed yet and add it to your PATH, e.g.\n\n```bash\n# For Linux\ncurl -LO \"https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl\"\n\n# For MacOS\ncurl -LO \"https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl\"\n```\n\n</details>\n\n<details>\n<summary>Install helm</summary>\n\nInstall [helm](https://helm.sh/docs/intro/install/) if it's not installed yet and add it to your PATH, e.g.\n\n```bash\ncurl -sSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash\n```\n\n</details>\n\n<br/>\n\nConfig your MCP servers in [Claude Desktop](https://claude.ai/download), [Cursor](https://www.cursor.com/), [ChatGPT Copilot](https://marketplace.visualstudio.com/items?itemName=feiskyer.chatgpt-copilot), [Github Copilot](https://github.com/features/copilot) and other supported AI clients, e.g.\n\n```json\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"<path of binary 'mcp-kubernetes'>\",\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"KUBECONFIG\": \"<your-kubeconfig-path>\"\n      }\n    }\n  }\n}\n```\n\n### Options\n\nEnvironment variables:\n\n- `KUBECONFIG`: Path to your kubeconfig file, e.g. `/home/<username>/.kube/config`.\n- `USE_LEGACY_TOOLS`: Set to `true` to use multiple specialized kubectl tools instead of the unified `call_kubectl` tool (default: `false`).\n\nCommand line arguments:\n\n```sh\nUsage of ./mcp-kubernetes:\n      --access-level string       Access level (readonly, readwrite, or admin) (default \"readonly\")\n      --additional-tools string   Comma-separated list of additional tools to support (kubectl is always enabled). Available: helm,cilium,hubble\n      --allow-namespaces string   Comma-separated list of namespaces to allow (empty means all allowed)\n      --otlp-endpoint string      OTLP endpoint for OpenTelemetry traces (e.g. localhost:4317, default \"\")\n      --timeout int               Timeout for command execution in seconds, default is 60s (default 60)\n      --transport string          Transport mechanism to use (stdio only) (default \"stdio\")\n```\n\n### Unified vs Legacy Tools\n\nBy default, mcp-kubernetes uses a single unified `call_kubectl` tool that consolidates all kubectl operations into one tool interface. This significantly reduces context consumption while maintaining full functionality.\n\nTo use the legacy mode with multiple specialized tools (6-7 separate tools), set the environment variable:\n\n```json\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"mcp-kubernetes\",\n      \"env\": {\n        \"USE_LEGACY_TOOLS\": \"true\"\n      }\n    }\n  }\n}\n```\n\n### Access Levels\n\nThe `--access-level` flag controls what operations are allowed:\n\n- **`readonly`** (default): Only read operations are allowed (get, describe, logs, etc.)\n- **`readwrite`**: Read and write operations are allowed (create, delete, apply, etc.)\n- **`admin`**: All operations are allowed, including admin operations (cordon, drain, taint, etc.)\n\nTools and operations are filtered at registration time based on the access level, so AI assistants only see operations they can actually use.\n\nExample configurations:\n\n```json\n// Read-only access (default)\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"mcp-kubernetes\"\n    }\n  }\n}\n\n// Read-write access\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"mcp-kubernetes\",\n      \"args\": [\"--access-level\", \"readwrite\"]\n    }\n  }\n}\n\n// Admin access\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"mcp-kubernetes\",\n      \"args\": [\"--access-level\", \"admin\"]\n    }\n  }\n}\n```\n\n## Usage\n\nAsk any questions about Kubernetes cluster in your AI client. The MCP tools make it easier for AI assistants to understand and use kubectl operations.\n\n### Example Queries\n\n```txt\nWhat is the status of my Kubernetes cluster?\n\nWhat is wrong with my nginx pod?\n\nShow me all deployments in the production namespace\n\nScale my web deployment to 5 replicas\n\nCheck if I have permission to create pods\n\nWhat is my current kubectl context?\n\nList all available kubectl contexts\n\nSwitch to the production context\n```\n\n## Available Tools\n\n### Unified Tool (Default)\n\nBy default, mcp-kubernetes uses a single unified `call_kubectl` tool that handles all kubectl operations. This approach significantly reduces context consumption compared to the legacy multi-tool approach.\n\n**call_kubectl** - Execute kubectl commands\n- **Available in**: All access levels (operations filtered by access level)\n- **Parameters**:\n  - `command`: The full kubectl command to execute including 'kubectl' prefix (e.g., \"kubectl get pods -n default\", \"kubectl apply -f deployment.yaml\")\n- **Examples**:\n  ```bash\n  # Get pods\n  command: \"kubectl get pods -n default\"\n\n  # Apply configuration\n  command: \"kubectl apply -f deployment.yaml\"\n\n  # Scale deployment\n  command: \"kubectl scale deployment nginx --replicas=3\"\n  ```\n\n### Legacy Tools (Optional)\n\nWhen `USE_LEGACY_TOOLS=true`, the mcp-kubernetes server provides multiple specialized kubectl tools that group related operations together. Tools are automatically filtered based on your access level.\n\n#### Kubectl Tools\n\n<details>\n<summary><b>kubectl_resources</b> - Manage Kubernetes resources</summary>\n\n**Available in**: readonly, readwrite, admin\n\nHandles CRUD operations on Kubernetes resources and node management. In readonly mode, only supports `get` and `describe` operations. Node operations (cordon, uncordon, drain, taint) are available in admin mode only.\n\n**Parameters:**\n\n- `operation`: The operation to perform (get, describe, create, delete, apply, patch, replace, cordon, uncordon, drain, taint)\n- `resource`: The resource type (e.g., pods, deployments, services, nodes) or empty for file-based operations\n- `args`: Additional arguments like resource names, namespaces, and flags\n\n**Examples:**\n\n```bash\n# Get all pods\noperation: \"get\"\nresource: \"pods\"\nargs: \"--all-namespaces\"\n\n# Apply a configuration\noperation: \"apply\"\nresource: \"\"\nargs: \"-f deployment.yaml\"\n\n# Drain a node (admin only)\noperation: \"drain\"\nresource: \"node\"\nargs: \"worker-1 --ignore-daemonsets\"\n\n# Add a taint (admin only)\noperation: \"taint\"\nresource: \"nodes\"\nargs: \"worker-1 key=value:NoSchedule\"\n```\n\n</details>\n\n<details>\n<summary><b>kubectl_workloads</b> - Manage workload deployments</summary>\n\n**Available in**: readwrite, admin\n\nManages deployment lifecycle operations including scaling and rollouts.\n\n**Parameters:**\n\n- `operation`: The operation to perform (run, expose, scale, autoscale, rollout)\n- `resource`: For rollout operations, the subcommand (status, history, undo, restart, pause, resume)\n- `args`: Additional arguments\n\n**Examples:**\n\n```bash\n# Scale a deployment\noperation: \"scale\"\nresource: \"deployment\"\nargs: \"nginx --replicas=3\"\n\n# Check rollout status\noperation: \"rollout\"\nresource: \"status\"\nargs: \"deployment/nginx\"\n```\n\n</details>\n\n<details>\n<summary><b>kubectl_metadata</b> - Manage resource metadata</summary>\n\n**Available in**: readwrite, admin\n\nUpdates labels, annotations, and other metadata on resources.\n\n**Parameters:**\n\n- `operation`: The operation to perform (label, annotate, set)\n- `resource`: The resource type\n- `args`: Resource name and metadata changes\n\n**Examples:**\n\n```bash\n# Add a label\noperation: \"label\"\nresource: \"pods\"\nargs: \"nginx-pod app=web\"\n\n# Set image\noperation: \"set\"\nresource: \"image\"\nargs: \"deployment/nginx nginx=nginx:latest\"\n```\n\n</details>\n\n<details>\n<summary><b>kubectl_diagnostics</b> - Debug and monitor resources</summary>\n\n**Available in**: readonly, readwrite, admin\n\nProvides debugging and monitoring capabilities.\n\n**Parameters:**\n\n- `operation`: The operation to perform (logs, events, top, exec, cp)\n- `resource`: The resource type or specific resource\n- `args`: Additional arguments\n\n**Examples:**\n\n```bash\n# View logs\noperation: \"logs\"\nresource: \"\"\nargs: \"nginx-pod -f\"\n\n# Execute command in pod\noperation: \"exec\"\nresource: \"\"\nargs: \"nginx-pod -- ls /app\"\n```\n\n</details>\n\n<details>\n<summary><b>kubectl_cluster</b> - View cluster information</summary>\n\n**Available in**: readonly, readwrite, admin\n\nProvides cluster-level information and API discovery.\n\n**Parameters:**\n\n- `operation`: The operation to perform (cluster-info, api-resources, api-versions, explain)\n- `resource`: For explain operation, the resource to document\n- `args`: Additional flags\n\n**Examples:**\n\n```bash\n# Get cluster info\noperation: \"cluster-info\"\nresource: \"\"\nargs: \"\"\n\n# Explain pod spec\noperation: \"explain\"\nresource: \"pod.spec\"\nargs: \"--recursive\"\n```\n\n</details>\n\n\n<details>\n<summary><b>kubectl_config</b> - Configuration and security</summary>\n\n**Available in**: readonly, readwrite, admin\n\nHandles configuration validation, security operations, and kubectl context management. In readonly mode, supports `diff`, `auth can-i`, and read-only config operations.\n\n**Parameters:**\n\n- `operation`: The operation to perform (diff, auth, certificate, config)\n- `resource`: Subcommand for auth/certificate/config operations\n- `args`: Operation-specific arguments\n\n**Examples:**\n\n```bash\n# Check permissions\noperation: \"auth\"\nresource: \"can-i\"\nargs: \"create pods\"\n\n# Approve certificate\noperation: \"certificate\"\nresource: \"approve\"\nargs: \"csr-name\"\n\n# Get current context\noperation: \"config\"\nresource: \"current-context\"\nargs: \"\"\n\n# List all contexts\noperation: \"config\"\nresource: \"get-contexts\"\nargs: \"\"\n\n# Switch context (readwrite/admin only)\noperation: \"config\"\nresource: \"use-context\"\nargs: \"my-cluster-context\"\n```\n\n**Config Operations:**\n- `current-context`: Display the current context (readonly, readwrite, admin)\n- `get-contexts`: List all available contexts (readonly, readwrite, admin)\n- `use-context`: Switch to a different context (readwrite, admin only)\n\n</details>\n\n#### Additional Tools\n\n<details>\n<summary><b>call_helm</b> - Helm package manager</summary>\n\n**Available when**: `--additional-tools=helm` is specified\n\nRun Helm commands for managing Kubernetes applications.\n\n**Parameters:**\n\n- `command`: The helm command to execute\n\n**Example:**\n\n```bash\ncommand: \"list --all-namespaces\"\n```\n\n</details>\n\n<details>\n<summary><b>call_cilium</b> - Cilium CNI commands</summary>\n\n**Available when**: `--additional-tools=cilium` is specified\n\nRun Cilium commands for network policies and observability.\n\n**Parameters:**\n\n- `command`: The cilium command to execute\n\n**Example:**\n\n```bash\ncommand: \"status\"\n```\n\n</details>\n\n<details>\n<summary><b>call_hubble</b> - Hubble observability commands</summary>\n\n**Available when**: `--additional-tools=hubble` is specified\n\nRun Hubble commands for network monitoring and debugging in Cilium-enabled clusters.\n\n**Parameters:**\n\n- `command`: The hubble command to execute\n\n**Example:**\n\n```bash\ncommand: \"status\"\ncommand: \"observe observe --namespace backend-jobs  --from-label 'app=web'\"\ncommand: \"list nodes\"\n```\n\n</details>\n\n## Telemetry\n\nTelemetry collection is on by default.\n\nTo opt out, set the environment variable `KUBERNETES_MCP_COLLECT_TELEMETRY=false`.\n\n### OpenTelemetry Support\n\nThe mcp-kubernetes server supports exporting telemetry data using OpenTelemetry Protocol (OTLP). You can configure an OTLP endpoint to send traces to any OpenTelemetry-compatible backend:\n\n```json\n{\n  \"mcpServers\": {\n    \"kubernetes\": {\n      \"command\": \"mcp-kubernetes\",\n      \"args\": [\"--otlp-endpoint\", \"localhost:4317\"]\n    }\n  }\n}\n```\n\n## Development\n\nHow to inspect MCP server requests and responses:\n\n```sh\nnpx @modelcontextprotocol/inspector <path of binary 'mcp-kubernetes'>\n```\n\n## Contributing\n\nThis project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.\n\nWhen you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.\n\nThis project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.\n\n## Trademarks\n\nThis project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.\n"}