The coverage goes past reading: it will cordon and drain a node, port-forward a service, roll a deployment and apply a manifest — and where it has no specific tool, raw YAML gets you to any resource kind including your own CRDs.
A Go binary that exposes Kubernetes operations as MCP tools against your current kubectl context. It covers the resource types you touch day to day plus the escape hatch of applying raw YAML, so anything it does not model directly is still reachable.
- Workloads — pods with log streaming, deployments, jobs and cronjobs: create, list, describe, update, delete
- Networking — services, and ingress with HTTP/HTTPS routing and TLS configuration
- Configuration — configmaps, secrets and namespaces, full create through delete
- Cluster operations — switch, list, rename and delete contexts; list, cordon, uncordon and drain nodes; cluster health with node and pod metrics
- Storage — persistent volumes and claims, plus storage classes
- Security — roles, role bindings, cluster roles, cluster role bindings and service accounts, read-side
- Utilities — port forwarding to pods and services, with sessions you can start, stop and list
- Escape hatches — `apply_yaml` and `delete_yaml` for multi-document raw YAML or JSON of any kind including CRDs, custom resource operations, event listing filtered by namespace, type or involved object, and `list_api_resources` for API discovery
Access to a cluster configured for kubectl — it uses `~/.kube/config` and the current context by default, or `-kubeconfig` and `-context` to point elsewhere. Install with `go install github.com/basebandit/kai/cmd/kai@latest`, or pull the multi-arch image `cyclon/kai:v1.0.0`. Defaults to stdio; `-transport` also accepts streamable-http and the deprecated sse-legacy, with `-sse-addr` setting the listen address and `-tls-cert`/`-tls-key` enabling HTTPS. `-request-timeout` caps Kubernetes API calls, default 30s. Running inside the cluster uses `-in-cluster` and the pod's service account, whose RBAC decides what the tools can actually do — the checked-in kagent example grants cluster-admin and says plainly that it is test-only.
One command — go install github.com/basebandit/kai/cmd/kai@latest