K8s MCP Server

What the reza-gholizade/k8s-mcp-server MCP server does

The reza-gholizade/k8s-mcp-server MCP server gives MCP-compatible clients an interface to Kubernetes clusters. It covers both cluster inspection and resource operations rather than limiting access to a fixed set of Kubernetes object types.

Read-oriented capabilities include discovering the API resources available in a cluster, listing resources with optional namespace and label filters, retrieving individual resource details, and obtaining descriptions comparable to kubectl describe. Agents can also fetch logs for a pod, optionally selecting a container, and inspect node or pod CPU and memory metrics. Event queries can be scoped to a namespace or associated with a particular resource.

The server also supports creating or updating resources from YAML or JSON manifests and deleting resources using the supplied namespace and kind. The README identifies Helm operations for installing, upgrading, uninstalling, rolling back releases, and adding repositories; these operations can be disabled along with other write tools.

How it works

The reza-gholizade/k8s-mcp-server MCP server supports three transport modes: stdio for command-line clients, SSE for web applications, and streamable HTTP for clients following the MCP streamable transport. If no mode is selected, it uses stdio. HTTP transports bind to loopback by default, and MCP requests in those modes require a bearer token. The streamable HTTP endpoint is available at /mcp; an unauthenticated /healthz endpoint is provided for health checks.

Kubernetes access is selected automatically by priority. The server first checks KUBECONFIG_DATA, then an API server URL and token, then in-cluster service-account credentials, and finally a kubeconfig path or the default ~/.kube/config. Kubernetes permissions still depend on the credentials and RBAC rules provided to the process.

Setup and configuration

Building from source requires Go 1.23 or later and access to a Kubernetes cluster. The documented flow is to clone the repository, download Go dependencies with go mod download, and build the executable with go build -o k8s-mcp-server ..

Use --mode stdio, --mode sse, or --mode streamable-http to choose a transport. --port changes the HTTP port, while --host changes the bind address. Equivalent settings are available through SERVER_MODE, SERVER_PORT, and SERVER_HOST. For HTTP operation, set MCP_AUTH_TOKEN; browser clients require explicitly configured origins through MCP_ALLOWED_ORIGINS.

Kubernetes credentials can be supplied through KUBECONFIG_DATA, KUBERNETES_SERVER, and KUBERNETES_TOKEN, with optional CA certificate and TLS settings. The server also accepts KUBERNETES_CA_CERT, KUBERNETES_CA_CERT_PATH, and KUBERNETES_INSECURE. A kubeconfig can instead be selected with KUBECONFIG or the --kubeconfig flag where supported.

Tools and capabilities

Available functionality includes:

• Discovering API resources and listing objects across supported scopes.
• Filtering lists by namespace and labels.
• Reading resource details, descriptions, logs, metrics, and events.
• Creating, updating, and deleting Kubernetes resources from manifests.
• Inspecting and managing Helm releases through the documented Helm tools.
• Disabling Kubernetes or Helm tool categories with command-line flags.
• Running in read-only mode to disable resource creation and the listed Helm write operations.

Limitations and notes

The reza-gholizade/k8s-mcp-server MCP server does not provide cluster access by itself; it needs usable Kubernetes credentials and sufficient permissions. Enabling write operations can change cluster state, so --read-only is the safer setting for exploration and monitoring. Read-only mode disables createResource, Helm installation, upgrade, uninstall, rollback, and repository-addition tools, while leaving inspection features available.

HTTP exposure should be deliberate. The README recommends keeping the default loopback binding unless network access is intended, protecting every MCP request with the bearer token, and configuring allowed browser origins when needed. Setting KUBERNETES_INSECURE=true skips TLS verification and is not recommended for production.