AKS-MCP

What it is

Microsoft's own MCP server for AKS, the company's hosted service for running containerized apps. It runs only as a local process that your MCP client starts, for one trusted user; the project doesn't support putting it on a network.

What you get

• Two general tools by default: call_az takes one Azure CLI command (no pipes or redirects) and call_kubectl takes kubectl arguments
• Dedicated tools, also on by default, for the cluster's networking (virtual networks, subnets, security groups, route tables, load balancers, private endpoints), monitoring and resource health, Azure's built-in diagnostics and Advisor recommendations, node details and node logs, and Azure Fleet for managing several clusters together
• Helm, cilium and hubble commands, plus Inspektor Gadget for live tracing of DNS, TCP and process activity inside the cluster
• Older single-purpose tools in place of call_az and call_kubectl, only if you set USE_LEGACY_TOOLS=true: az_aks_operations, az_compute_operations and six kubectl_* tools. Three of the kubectl ones (diagnostics, workloads, metadata) load only at readwrite or admin
• --access-level readonly (the default), readwrite or admin sets which operations are allowed

Requirements

The Azure CLI installed and signed in (az login), with permissions on the clusters you want it to reach.

Know first

• Whoever can call it has your access. It runs every command as the identity it's signed in with and doesn't check who's asking. That includes reading Kubernetes Secrets, which the access level doesn't block, and in readwrite or admin mode deploying workloads. Sign it in with an identity that has only the permissions the work needs
• Read-only is a guardrail, not a lock. The default readonly level allows read operations only; scaling, upgrading or other changes need readwrite or admin. Microsoft describes the setting as a way to reduce accidental damage, not as a security boundary
• Local only. It's supported only as a process your MCP client starts on your machine; running it behind HTTP, a container service, a proxy or a gateway is outside what the project supports
• Telemetry collection is on by default. Set AKS_MCP_COLLECT_TELEMETRY=false in the server's environment to turn it off
• To narrow what it touches, --enabled-components limits which groups of tools load and --allow-namespaces limits which Kubernetes namespaces it can use
• Node log collection works on Linux nodes only, one collection at a time per node. Windows nodes and standalone VMs aren't supported yet
• To sign in without a browser, set the AZURE_* variables the README lists for a service principal, workload identity or managed identity; otherwise it uses your existing az login

Setup effort

Follow the published steps — Install the Azure CLI and authenticate first: az login — the server shells out to az and inherits that identity

Tools you get

21 tools named in the project's documentation. By default 13 of the 21 documented tools load, including call_az and call_kubectl. USE_LEGACY_TOOLS=true swaps those two for up to 8 older single-purpose tools: 5 at the default --access-level readonly, all 8 at readwrite or admin. Readonly refuses writes; --enabled-components loads fewer tools.

Requires

Azure CLI (az) on PATH, signed in with az login