# reza-gholizade/k8s-mcp-server [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/reza-gholizade/k8s-mcp-server  
**GitHub Stars:** 180  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/reza-gholizade-k8s-mcp-server

## Description
/🏠 - A Kubernetes Model Context Protocol (MCP) server that provides tools for interacting with Kubernetes clusters through a standardized interface, including API resource discovery, resource management, pod logs, metrics, and events.

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "k8s-mcp-server": {
    "url": "https://fronteir.ai/mcp/reza-gholizade-k8s-mcp-server"
  }
}
```

## Documentation

## What the reza-gholizade/k8s-mcp-server MCP server does

The reza-gholizade/k8s-mcp-server MCP server gives MCP-compatible clients an interface to Kubernetes clusters. It covers both cluster inspection and resource operations rather than limiting access to a fixed set of Kubernetes object types.

Read-oriented capabilities include discovering the API resources available in a cluster, listing resources with optional namespace and label filters, retrieving individual resource details, and obtaining descriptions comparable to `kubectl describe`. Agents can also fetch logs for a pod, optionally selecting a container, and inspect node or pod CPU and memory metrics. Event queries can be scoped to a namespace or associated with a particular resource.

The server also supports creating or updating resources from YAML or JSON manifests and deleting resources using the supplied namespace and kind. The README identifies Helm operations for installing, upgrading, uninstalling, rolling back releases, and adding repositories; these operations can be disabled along with other write tools.

## How it works

The reza-gholizade/k8s-mcp-server MCP server supports three transport modes: stdio for command-line clients, SSE for web applications, and streamable HTTP for clients following the MCP streamable transport. If no mode is selected, it uses stdio. HTTP transports bind to loopback by default, and MCP requests in those modes require a bearer token. The streamable HTTP endpoint is available at `/mcp`; an unauthenticated `/healthz` endpoint is provided for health checks.

Kubernetes access is selected automatically by priority. The server first checks `KUBECONFIG_DATA`, then an API server URL and token, then in-cluster service-account credentials, and finally a kubeconfig path or the default `~/.kube/config`. Kubernetes permissions still depend on the credentials and RBAC rules provided to the process.

## Setup and configuration

Building from source requires Go 1.23 or later and access to a Kubernetes cluster. The documented flow is to clone the repository, download Go dependencies with `go mod download`, and build the executable with `go build -o k8s-mcp-server .`.

Use `--mode stdio`, `--mode sse`, or `--mode streamable-http` to choose a transport. `--port` changes the HTTP port, while `--host` changes the bind address. Equivalent settings are available through `SERVER_MODE`, `SERVER_PORT`, and `SERVER_HOST`. For HTTP operation, set `MCP_AUTH_TOKEN`; browser clients require explicitly configured origins through `MCP_ALLOWED_ORIGINS`.

Kubernetes credentials can be supplied through `KUBECONFIG_DATA`, `KUBERNETES_SERVER`, and `KUBERNETES_TOKEN`, with optional CA certificate and TLS settings. The server also accepts `KUBERNETES_CA_CERT`, `KUBERNETES_CA_CERT_PATH`, and `KUBERNETES_INSECURE`. A kubeconfig can instead be selected with `KUBECONFIG` or the `--kubeconfig` flag where supported.

## Tools and capabilities

Available functionality includes:

- Discovering API resources and listing objects across supported scopes.
- Filtering lists by namespace and labels.
- Reading resource details, descriptions, logs, metrics, and events.
- Creating, updating, and deleting Kubernetes resources from manifests.
- Inspecting and managing Helm releases through the documented Helm tools.
- Disabling Kubernetes or Helm tool categories with command-line flags.
- Running in read-only mode to disable resource creation and the listed Helm write operations.

## Limitations and notes

The reza-gholizade/k8s-mcp-server MCP server does not provide cluster access by itself; it needs usable Kubernetes credentials and sufficient permissions. Enabling write operations can change cluster state, so `--read-only` is the safer setting for exploration and monitoring. Read-only mode disables `createResource`, Helm installation, upgrade, uninstall, rollback, and repository-addition tools, while leaving inspection features available.

HTTP exposure should be deliberate. The README recommends keeping the default loopback binding unless network access is intended, protecting every MCP request with the bearer token, and configuring allowed browser origins when needed. Setting `KUBERNETES_INSECURE=true` skips TLS verification and is not recommended for production.

_Full upstream README: https://allmcps.com/mcp/reza-gholizade-k8s-mcp-server/readme_