mcp-kubernetes is a Model Context Protocol (MCP) server for Kubernetes, allowing MCP-capable clients (such as Claude Desktop, Claude Code, etc.) to inspect and operate multiple Kubernetes cluster contexts. Its design goal is secure by default: it starts in read-only mode, can be restricted to an allowlist of namespaces and contexts, protects system namespaces from modification, and places dangerous operations (delete, apply, exec) behind explicitly enabled switches.
Main capabilities and security layers:
- Multi-cluster: every tool accepts an optional context parameter, and an allowlist can restrict which contexts are available.
- Access modes: read-only → read-write → admin, a layered design where a given mode does not expose tools above its level.
- Safety flags: namespace allowlist, protected namespaces, context allowlist, as well as independent enable switches for delete / apply / exec, dry-run, and JSON audit logs.
- Standard authentication: uses your kube-config (or in-cluster service account). The server does not store any credentials.
The layers are independent of one another—for example, in admin mode with all three switches set to false, Deployments can still be restarted and scaled, but resources cannot be deleted and exec into Pods is not possible.
Tools are divided by access mode:
- Read (read-only and above): list_contexts, list_namespaces, list_pods, get_pod, get_pod_logs, list_deployments, list_services, list_nodes, list_events, get_resource.
- Write (read-write and above): scale_deployment, restart_deployment, set_deployment_image, create_namespace, apply_manifest (requires K8S_ALLOW_APPLY).
- Admin (admin): delete_resource (requires K8S_ALLOW_DELETE), exec_in_pod (requires K8S_ALLOW_EXEC).
Optional AI risk guard: after setting K8S_GUARD_MODE=monitor|enforce, delete_resource, exec_in_pod, and apply_manifest will first consult the local laya-guard daemon (pipx install laya-guard && laya-guard), which classifies the operation as allow/confirm/block before execution. This guard runs after the delete/exec/apply gating; it only tightens, never loosens; on failure it fails closed.
Usage: this server is published on npm as @dockndevai/mcp-kubernetes. No cloning or building is required—MCP clients run it on demand via npx. It is recommended to start in read-only mode; .env.example lists all variables, and docs/CLIENTS.md provides a complete per-client guide.
How to connect the main clients (the same configuration block can be used for claude_desktop_config.json, .cursor/mcp.json, or ~/.codeium/windsurf/mcp_config.json): Claude Code (CLI), Claude Desktop, Cursor, Windsurf. OpenAI Codex CLI uses ~/.codex/config.toml; VS Code (GitHub Copilot, Agent mode) uses .vscode/mcp.json. It can also be run from source (for development purposes), but the published package above is preferred.
The server includes server.json for the official MCP registry and mcpName for npm ownership verification. PUBLISHING.md explains how to publish to npm and list on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.
The current material does not provide the specific installation command code block contents, complete snippets of each client configuration example, pricing or billing information, etc., so these are not provided for now.。
