🛡️ ocm-mcp-server

📖 Read the docs site → ocm-mcp-server.github.io

Star us ❤️ → 

AgentOps for Kubernetes fleets, done safely.

An MCP server that lets AI agents operate a multi-cluster Kubernetes fleet through an Open Cluster Management hub, with policy, approval, and audit between the model and your clusters.

The agent never holds a kubeconfig. Every write is policy-checked, human-approved, and traced.

📦 Get it  ·  ✨ Why  ·  🔌 Connect your agent  ·  🧭 Architecture  ·  🧰 Toolsets  ·  🛠️ Tools  ·  💬 Prompts  ·  🔭 Observability  ·  🚀 Quickstart  ·  📖 Wiki  ·  📚 Docs

_{The whole safe-remediation loop: investigate with free reads, propose a change, get rejected by the guardrails and correct it, wait for a human-signed token, apply, verify, and report from the audit log.}

Where to get it, and how it's vetted

• 📦 PyPI - ocm-mcp-server - pip install ocm-mcp-server (or run directly with uvx ocm-mcp-server). Every release is published straight from CI via OIDC trusted publishing - no long-lived tokens anywhere.
• 🗂️ Official MCP Registry - listed as io.github.ocm-mcp-server/ocm-mcp-server, so any MCP client or platform that browses the registry can discover and auto-configure this server (package, transport, and required env vars are all in the listing); the registry validates the listing against this repo and the PyPI package.
• 🐳 Container image on GHCR - docker run ghcr.io/ocm-mcp-server/ocm-mcp-server (kubeconfig mount shown in the deployment guide); built in CI with an SBOM and SLSA provenance attached, vulnerability-gated with Trivy, and signed keyless with Cosign so you can verify what you run.
• 🛡️ OpenSSF Scorecard - the repo's supply-chain security posture (pinned dependencies, branch protection, signed releases, ...) is scored automatically every week and published for anyone to inspect.

Why this exists

Your team runs many Kubernetes clusters. Sooner or later somebody asks the question: can an AI agent take the 2 a.m. page?

The quickest way to find out is to hand a model kubectl with cluster-admin and watch. In production that experiment ends badly, for three separate reasons:

• The model is non-deterministic. The same alert can produce a careful diagnosis one run and a kubectl delete the next.
• The credentials are real. There is no dry run between the model's decision and your production cluster.
• There is no record. When something breaks, you cannot reconstruct what the agent did, in what order, or on whose authority.

This project starts from a different observation: fleets already have a control point that humans trust every day, the multi-cluster hub. Open Cluster Management (a CNCF project) gives every fleet an inventory (ManagedCluster), a scheduler (Placement), and a delivery channel (ManifestWork). ocm-mcp-server exposes that hub to agents as a small set of typed MCP tools, and puts four independent layers between the model and your clusters:

None of these layers live in the system prompt, so none of them can be talked out of.

_{A write is two calls with a person between them. The token is bound to one content hash and one operation, it expires on its own, and offered a second time it is refused.}