kubectlLABSCO SUMMARY
Give an assistant the cluster read-only, or all of it — your call at launch.
The four switches are the design decision that matters: the same server can be a safe investigative tool on production and a full operator on a dev cluster, without maintaining two setups or trusting a prompt to hold the line.
What it is
A bridge between an AI assistant and a Kubernetes cluster that translates requests into kubectl commands or direct API calls and returns structured results. What sets it apart is the shape of its permissions: reads, writes, deletes, kubectl and helm are four separate switches you set when you launch it.
What you get
- Command tools —
kubectlandhelm, each running an arbitrary command and returning its output - Read tools —
k8s_get,k8s_describe,k8s_logswith container, tail, since and previous options,k8s_events,k8s_apis,k8s_crds,k8s_top_nodes,k8s_top_pods,k8s_rollout_status,k8s_rollout_history,k8s_auth_can_iandk8s_auth_whoami - Write tools —
k8s_createandk8s_applyfrom YAML or JSON content,k8s_run,k8s_expose,k8s_scale,k8s_autoscale,k8s_patch,k8s_label,k8s_set_image,k8s_set_env,k8s_set_resources, the rollout family (k8s_rollout_undo,k8s_rollout_restart,k8s_rollout_pause,k8s_rollout_resume), node operations (k8s_cordon,k8s_uncordon,k8s_drain,k8s_taint,k8s_untaint) and access paths (k8s_exec_command,k8s_port_forward,k8s_cp) - Delete tools —
k8s_deleteby name, label selector or across a namespace, with force and grace period
Requirements
A working cluster and a kubeconfig that reaches it, with kubectl and helm on the PATH when you run it directly rather than through Docker; Python >= 3.11 for the uvx mcp-kubernetes-server path, and KUBECONFIG pointing at your config. The Docker route mounts your kubeconfig into the container instead. Four flags decide what an assistant can do: --disable-kubectl, --disable-helm, --disable-write and --disable-delete — a disabled operation returns a clear message rather than failing obscurely. --transport selects stdio, sse or streamable-http, with --host and --port for the network ones. Whatever the flags allow, the kubeconfig's own credentials still bound it, so test with kubectl first when a call is refused.
Setup effort
One command — uvx mcp-kubernetes-server
USE CASES
01
Diagnosing a failing pod
Describe it, read its logs with a tail limit, and list the events for the object involved — three calls in one question.
02
Handing production to an assistant safely
Start it with writes and deletes disabled, so investigation is possible and change is not.
03
Rolling back a bad deploy
Check the rollout status and history, then undo to the revision you want.
04
Working out why a permission is missing
Ask who the connection is authenticated as, then whether that subject can perform the verb on the resource.
05
Taking a node out of service
Cordon it, drain it with the daemonset and local-data handling you want, then uncordon afterwards.
06
Reaching anything the tools do not model
Run the kubectl or helm command directly and get its output back, without leaving the conversation.
39 tools
Listed in project docs. Your client may show a different list.
helmk8s_getk8s_describek8s_logsk8s_eventsk8s_apisk8s_crdsk8s_top_nodesk8s_top_podsk8s_rollout_statusk8s_rollout_historyk8s_auth_can_ik8s_auth_whoamik8s_createk8s_applyk8s_exposek8s_runk8s_set_resourcesk8s_set_imagek8s_set_envk8s_rollout_undok8s_rollout_restartk8s_rollout_pausek8s_rollout_resumek8s_scalek8s_autoscalek8s_cordonk8s_uncordonk8s_draink8s_taintk8s_untaintk8s_exec_commandk8s_port_forwardk8s_cpk8s_patchk8s_labelk8s_annotatek8s_deleteBEFORE YOU INSTALL
What to know first
Tools you get
39 tools named in the project's documentation.
Requires
Python >= 3.11
Where it runs
All 3 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
uvx mcp-kubernetes-serverMCP Clients
Claude Desktop, Cursor, GitHub Copilot
JSON
{
"mcpServers": {
"kubernetes": {
"command": "uvx",
"args": [
"mcp-kubernetes-server"
],
"env": {
"KUBECONFIG": "<YOUR_KUBECONFIG>"
}
}
}
}
