In-depth architectural comparison of the Finopsmcp and Kubernetes MCP Server MCP servers. Compare execution transports, security boundaries, tool capabilities, quality scores, and ready-to-paste client installation snippets for Claude, Cursor, Windsurf, and VS Code.
At a Glance & Executive Verdict
Finopsmcp
Cloud Platforms · Local stdio
Quality: 61/100 (Good) | Auth: No auth required
Kubernetes MCP Server
Cloud Platforms · Local stdio
Quality: 64/100 (Good) | Auth: other
Verdict Summary: Choose Finopsmcp if you need specialized Cloud Platforms tools running via a local process. Choose Kubernetes MCP Server if your workspace requires Cloud Platforms integration with local subprocess execution. Both servers can be configured concurrently in your client's mcpServers manifest.
Which MCP Server Should You Choose?
Choose Finopsmcp when:
You need dedicated capabilities in the Cloud Platforms domain.
You prefer local stdio subprocess transport architecture.
Your security boundary fits: No auth required (Free / Open Source).
Local-first FinOps copilot. Connect AWS, Azure, GCP, Kubernetes, and 15+ SaaS and AI bills, then ask cost questions in Claude or Cursor, find waste, and get the fix as a pull request you approve. Read-only; your credentials and bill stay on your machine. uvx nable.
A - powerful Kubernetes MCP server with additional support for OpenShift. Besides providing CRUD operations for any Kubernetes resource, this server provides specialized tools to interact with your cluster.
Category & Scope
Tools & Capabilities Breakdown
Finopsmcp Tools (10)
connect_aws
Connect an AWS account from inside your MCP client, no terminal needed.
Propose-then-confirm and local-only. It reads AWS credentials that already
exist on this machine (named profiles, environment, the default chain),
verifies each against STS, and connects the one you choose. It never creates,
modifies, or deletes anything in your AWS account, and credentials stay on
this machine.
Call it with no arguments first to see which accounts are available (nothing
is stored). Then call it again with account_id set to the one to connect.
Examples:
- "Connect my AWS account"
- "Use the credentials on this machine to connect AWS"
connect_azure
Guide connecting Azure while keeping the service-principal secret off the model.
Azure has no local credentials nable can safely auto-detect, so connecting
needs a client secret. Unlike connect_aws and connect_gcp (which read
credentials already on the machine, so nothing sensitive passes through this
conversation), an Azure secret would have to be pasted into the chat to reach
a tool argument, which routes it through the model provider. nable does not do
that. This tool returns the Cloud Shell script and has you finish the connect
in your OWN terminal with `finops setup azure`, which encrypts the secret into
your local vault. The model never sees the secret.
Examples:
- "Connect Azure"
- "How do I connect my Azure subscription?"
get_cost_summary
Ready-to-Paste Client Configurations
Paste either (or both) of these JSON server blocks into your client config file (e.g. claude_desktop_config.json or ~/.cursor/mcp.json).
Finopsmcp is categorized under Cloud Platforms and uses a local stdio subprocess. In contrast, Kubernetes MCP Server belongs to Cloud Platforms using local stdio subprocess. Select Finopsmcp when you need capabilities focused on cloud platforms and Kubernetes MCP Server when you require tools for cloud platforms.
Get total spend summarized by service, account, and region.
Examples:
- "How much did we spend last month?"
- "Give me an AWS cost summary for January"
estimate_change_cost
Cost preflight for a proposed change: what it costs and whether it fits budget.
Agent-native. Call this BEFORE applying an infrastructure change to get a machine
verdict (ok / warn / over_budget / no_budget) plus the monthly and annual cost
delta and the budget headroom. Read-only: it estimates and checks, it never applies
anything.
Describe the change one of these ways:
- terraform_plan_json / terraform_plan_file / tf_dir : a Terraform plan
- helm_diff : output of `helm diff upgrade` or a values.yaml diff
- monthly_delta_usd : a known monthly cost delta (escape hatch for any change the
estimators don't parse, e.g. "launch a db.r6g.4xlarge")
budget_name selects which budget to check against; default is the first active
budget. With no budget configured the verdict is "no_budget" and the cost delta is
still returned.
Good triggers: "will this fit my budget", "what will this terraform/helm change cost
before I apply it", "cost preflight", "can the agent afford this change".
Examples:
- "What would this change cost per month?"
- "Preflight the cost of this terraform plan"
connect_gcp
Connect a Google Cloud billing account from inside your MCP client, no terminal.
Propose-then-confirm and local-only. It reads Google Cloud credentials that
already exist on this machine (GOOGLE_APPLICATION_CREDENTIALS or gcloud
Application Default Credentials), lists the open billing accounts they can
see, and connects the one you choose. It never changes anything in GCP, and
credentials stay on this machine.
Call it with no arguments to see the billing accounts available (nothing is
stored). Then call it again with billing_account_id set to connect one.
Examples:
- "Connect my Google Cloud billing"
- "Use my gcloud login to connect GCP"
list_connected_providers
List every cloud, SaaS, and LLM provider nable knows, each marked connected or
not-configured, plus the active plan. The starting point for "what am I
connected to" and for spotting which connector still needs credentials
(each not-configured entry names the setup command to run).
Examples:
- "Which providers are connected?"
- "Is GCP set up yet?"
check_ai_budget
Advisory gate: before a big task, is the agent about to blow its AI budget?
Call this before an expensive run. Returns a verdict (ok / warn / over), the
reason, and a recommendation. Advice only, it never blocks; relay the verdict and
let the human decide. Pass estimated_next_tokens to test whether the next task
would tip a token budget over.
check_action_policy
Advisory policy gate: should a proposed remediation action proceed?
The request-path guardrail, advisory. Describe a remediation action you are
considering (action_type), optionally with the change to cost (a Terraform plan,
a helm diff, or a known monthly delta), and nable returns a machine verdict
against your human-authored policy:
- allow: reversible, allowlisted, and within budget. A human can apply it.
- escalate: a one-way door (delete, terminate, buy a commitment) or an
over-budget / large-cost change. A human must review it first.
- block: the action type is not in your allowlist.
ADVICE ONLY. nable never applies the action, a human does. This is the
propose-only guardrail; nable does not auto-execute anything.
action_type examples: rightsizing, tag_fix, stop_idle, spot_migration, ticket
(reversible); idle_cleanup, purchase_commitment, terminate_instance, delete_resource
(one-way). Policy knobs via env: FINOPS_POLICY_MAX_AUTO_USD,
FINOPS_POLICY_ALLOWED_ACTIONS (comma-separated). Read-only.
Good triggers: "can the agent do X", "is this action within policy", "should I
apply this fix", "is it safe to auto-apply this".
Examples:
- "Is this apply within policy?"
- "Check this change against our cost guardrails"
what_can_nable_do
Show everything nable can do, tailored to what you've connected.
Call this when the user asks "what can you do?", "what features do you have?",
"what should I try first?", "show me what's available", or "help". Always call
it right after a user connects their first account, so they see what just
became possible. Pass detailed=True to also list the underlying tool names.
Examples:
- "What can nable do?"
- "List your capabilities"
nable_setup_status
Agent-driven onboarding: what is connected, what credentials are already on
this machine, and the exact command to connect each remaining provider.
Call this when the user asks to connect a provider, says setup is incomplete,
or asks what they are missing. Detected ambient credentials (gcloud login,
env keys, ~/.modal.toml) mean the connect is ONE terminal command with no
secrets involved; run it for the user or hand them the command.
Rules for the agent, and they are hard rules:
- NEVER ask the user to paste an API key or secret into the chat. For
paste-a-key providers, have them run the setup command in their own
terminal; it deep-links the key page and stores the key locally.
- Prefer the zero-secret paths: `finops connect` (batch-connects everything
detected) and `finops setup gcp` / ambient AWS, where no secret ever
passes through the conversation.
Examples:
- "Connect my GCP costs"
- "What providers am I missing?"
Kubernetes MCP Server Tools (53)
configuration_contexts_list
List all available context names and associated server urls from the kubeconfig file
targets_list
List all available targets
configuration_view
Get the current Kubernetes configuration content as a kubeconfig YAML
events_list
List Kubernetes events (warnings, errors, state changes) for debugging and troubleshooting in the current cluster from all namespaces
namespaces_list
List all the Kubernetes namespaces in the current cluster
projects_list
List all the OpenShift projects in the current cluster
nodes_log
Get logs from a Kubernetes node (kubelet, kube-proxy, or other system logs). This accesses node logs through the Kubernetes API proxy to the kubelet
nodes_stats_summary
Get detailed resource usage statistics from a Kubernetes node via the kubelet's Summary API. Provides comprehensive metrics including CPU, memory, filesystem, and network usage at the node, pod, and container levels. On systems with cgroup v2 and kernel 4.20+, also includes PSI (Pressure Stall Info…
nodes_top
List the resource consumption (CPU and memory) as recorded by the Kubernetes Metrics Server for the specified Kubernetes Nodes or all nodes in the cluster
pods_list
List all the Kubernetes pods in the current cluster from all namespaces
pods_list_in_namespace
List all the Kubernetes pods in the specified namespace in the current cluster
pods_get
Get a Kubernetes Pod in the current or provided namespace with the provided name