# @patrickdappollonio/mcp-kubernetes-ro [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/patrickdappollonio/mcp-kubernetes-ro  
**GitHub Stars:** 24  
**npm Downloads (last month):** 467  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/patrickdappollonio-mcp-kubernetes-ro

## Description
A read-only Kubernetes MCP server: list resources, get resource details, retrieve pod logs, discover API resources, and perform base64 encoding/decoding operations - all while maintaining security through read-only access.

## Tools
Capabilities this server exposes over MCP:

- **list_resources**
- **metadata.managedFields**
- **get_resource**
- **get_logs**
- **get_pod_containers**
- **list_api_resources**
- **list_contexts**
- **get_node_metrics**
- **get_pod_metrics**
- **encode_base64**
- **decode_base64**
- **save_secret_to_file**
- **get_secret_encrypted**
- **start_port_forward**
- **stop_port_forward**
- **list_port_forwards**

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-kubernetes-ro": {
    "command": "npx",
    "args": ["-y","@patrickdappollonio/mcp-kubernetes-ro"]
  }
}
```

## Documentation

## What @patrickdappollonio/mcp-kubernetes-ro does

The @patrickdappollonio/mcp-kubernetes-ro MCP server gives an AI assistant read-only access to Kubernetes cluster data. It uses the Kubernetes configuration available on the local machine, typically from `~/.kube/config`, and does not need the `kubectl` executable installed.

As a 💻 Developer Tools option, it fits workflows where an agent needs to inspect workloads, investigate failures, or understand cluster capabilities without being allowed to change resources. The server blocks destructive operations and can further restrict access to resource types such as Secrets and ConfigMaps.

## How it works

The server exposes MCP tools over stdio, Server-Sent Events, or stateless Streamable HTTP. It can use a selected namespace, operate on cluster-wide resources, and accept a Kubernetes context for individual commands. A startup check validates connectivity and basic permissions unless that behavior is disabled.

Resource queries support label selectors, field selectors, pagination, and newest-first sorting. Managed fields are excluded from resource output by default and can be requested when needed. Secret values are not included in ordinary tool responses. Depending on the transport and configuration, a requested secret can be written to a file or returned through encrypted access intended for the local machine.

## Setup and configuration

Install a release binary, the Homebrew package, the npm package with `npx`, or the published container image. Configure an MCP client to launch the binary, invoke `npx -y @patrickdappollonio/mcp-kubernetes-ro`, or run the Docker image. Container use requires mounting the kubeconfig and passing its path through `KUBECONFIG` or `--kubeconfig`.

The `KUBECONFIG` environment variable selects the configuration file. Command-line options can set the kubeconfig, namespace, transport, port, disabled tools, disabled resources, and startup behavior. The same restrictions can be configured with `MCP_KUBERNETES_RO_DISABLED_TOOLS`, `DISABLED_TOOLS`, and `MCP_KUBERNETES_RO_DISABLED_RESOURCES`. Docker environment variables must be supplied to the container with `-e`.

## Tools and capabilities

The @patrickdappollonio/mcp-kubernetes-ro MCP server includes tools for:

- Listing resources with namespace and selector filters.
- Reading individual resource details while hiding Secret values.
- Retrieving pod logs, including previous logs, time filters, and grep patterns.
- Finding containers within pods for targeted log requests.
- Discovering available Kubernetes API resources and capabilities.
- Listing Kubernetes contexts.
- Encoding and decoding base64 data.
- Reading node and pod metrics when Metrics Server is installed.
- Accessing secret values through the transport-appropriate protected method.

Optional port forwarding can create tunneled connections to pod ports and supports multiple ports per session. The feature must be enabled before its additional tools become available.

## Limitations and notes

The cluster identity and permissions come from the supplied Kubernetes configuration and credentials, so the account still needs appropriate RBAC permissions for read operations. Metrics tools require Metrics Server in the target cluster. Access to sensitive resource types and individual tools can be disabled, and insecure secret access can remove the secret-reading tool. Docker cannot write files to the host through the container, so encrypted secret access is enabled by default there.

_Full upstream README: https://allmcps.com/mcp/patrickdappollonio-mcp-kubernetes-ro/readme_