list_clustersLABSCO SUMMARY
The model's cluster rights are the operator's cluster rights.
Most Kubernetes MCP servers run with whatever the kubeconfig on the host allows. Tying MCP execution to the signed-in user's own multi-cluster authorization is what makes it safe to expose on a shared cluster — and every call is recorded.
What it is
A lightweight Kubernetes dashboard built in Go with an AMIS front end, shipped as one executable. It manages several clusters at once and doubles as an MCP server so a model can operate them.
What you get
- 49 built-in multi-cluster Kubernetes MCP tools, combinable into a much larger set of cluster operations, usable from other LLM software as well as from k8m itself
- MCP calls that inherit the caller's own cluster authorization — whoever is using the model executes with their own permissions, so a tool call cannot exceed what that person could do by hand
- A per-call record of every MCP invocation
- Multi-cluster management with InCluster detection, automatic scanning of kubeconfig files alongside the configured path, heartbeat checks and reconnection
- Per-cluster authorization for users and groups at three levels — read-only, exec, and cluster administrator — with namespace allow and deny lists
- Pod file management from a right-click file tree, live log viewing with download and highlighted search, and shell execution inside a pod
- CRD discovery listed as a tree, a Helm repository market with one-click install, uninstall and upgrade, scheduled multi-cluster inspection with Lua rule scripts, and Kubernetes Event forwarding to webhooks filtered by cluster, namespace, name or keyword
- Cross-platform builds for Linux, macOS and Windows on x86 and ARM, with SQLite, MySQL or PostgreSQL behind it
Requirements
Download a release and run ./k8m, then open http://127.0.0.1:3618 — the default username and password are both k8m, and changing them plus enabling two-step verification is the first thing to do on a shared install. --kubeconfig sets the config path, defaulting to /root/.kube/config, and --in-cluster registers the host cluster automatically. Docker Compose is the recommended path, mounting ./data for persistence. For in-cluster deployment, apply the published manifest; the single-instance service definition must not carry the leader label, and the multi-instance one must. Kubectl Shell and Node Shell pull bitnami/kubectl:latest and alpine:latest by default, and those images must contain kubectl and nsenter respectively. MIT licensed.
Setup effort
Follow the published steps — Download the latest k8m release from https://github.com/weibaohui/k8m/releases
USE CASES
01
Letting a team's models manage clusters safely
Authorization is granted per cluster and per user or group at read-only, exec or admin level, and MCP calls execute under the caller's own rights rather than the host's.
02
Managing several clusters from one place
Kubeconfig files beside the configured path are scanned and registered automatically, with heartbeat detection and reconnection when one goes away.
03
Debugging inside a pod
Browse, edit, upload and download files from a right-click tree, tail logs with highlighted search, and run a shell — without leaving the console.
04
Catching problems before someone reports them
Schedule multi-cluster inspections with your own Lua rules and forward Kubernetes Events to a webhook, filtered down to the cluster and namespace that matter.
05
Installing something from Helm
Add a repository and install, uninstall or upgrade a chart from the UI, with automatic updates available.
49 tools
Listed in project docs. Your client may show a different list.
scale_deploymentrestart_deploymentstop_deploymentrestore_deploymentupdate_tag_deploymentrollout_history_deploymentrollout_undo_deploymentrollout_pause_deploymentrollout_resume_deploymentrollout_status_deploymenthpa_list_deploymentlist_deployment_podsget_k8s_resourcedescribe_k8s_resourcedelete_k8s_resourcelist_k8s_resourcelist_k8s_eventpatch_k8s_resourcelabel_k8s_resourceannotate_k8s_resourcetaint_nodeuntaint_nodecordon_nodeuncordon_nodedrain_nodeget_node_resource_usageget_node_ip_usageget_node_pod_countlist_pod_fileslist_all_pod_filesdelete_pod_fileupload_file_to_podget_pod_logsrun_command_in_podget_pod_linked_serviceget_pod_linked_ingressget_pod_linked_endpointsget_pod_linked_pvcget_pod_linked_pvget_pod_linked_envget_pod_linked_env_from_yamlget_pod_resource_usageapply_yamldelete_yamlset_default_storageclassget_storageclass_pvc_countget_storageclass_pv_countset_default_ingressclassBEFORE YOU INSTALL
What to know first
Tools you get
49 tools named in the project's documentation.
Requires
- A k8m instance you run (the release binary, Docker or the in-cluster manifest) with its built-in MCP server enabled
- A client that can connect to an SSE URL
Where it runs
All 4 documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
Download the latest k8m release from https://github.com/weibaohui/k8m/releases
Start it with ./k8m and open http://127.0.0.1:3618 (default login k8m / k8m — change it after first sign-in)
As an admin, open 平台设置 → MCP管理 (Platform settings → MCP management) and click 启用 (Enable) on the built-in k8m MCP server
In 个人中心 → 开放MCP (Profile → Open MCP), create an access link — it looks like http://localhost:3618/mcp/k8m/sse when k8m runs on this computer, and carries your k8m server's address when it runs elsewhere
MCP Clients
Trae, Cursor, Cherrystudio
JSON
{
"mcpServers": {
"k8m": {
"url": "http://localhost:3618/mcp/k8m/sse"
}
}
}GitHub Copilot
GITHUB COPILOT · JSON
{
"mcp": {
"servers": {
"k8s-mcp": {
"url": "http://localhost:3618/mcp/k8m/sse",
"headers": {
"Authorization": "<YOUR_TOKEN>"
}
}
}
}
}<YOUR_TOKEN> in the Authorization value is your own token: in k8m open 个人中心 → 开放MCP → 创建Token (Profile → Open MCP → Create Token) and copy the Auth value. localhost is a k8m server on this computer; if yours runs elsewhere, use its address.
