Summary

A Kubernetes SDK first, an MCP server second.

kom is a Go package, so the install story is code: you register clusters in your own program and the MCP server comes up inside it. What that buys you is one endpoint that reaches about as far as kubectl does, across every cluster you registered, with the cluster named per call instead of switched between. What it costs you is that the credential is the only boundary — the write tools are on by default, so the role you register decides how far a bad call travels.

What it is

A Go library that wraps kubectl and client-go, with an MCP server built into it. You start the server from your own program — `mcp.RunMCPServer("kom mcp server", "0.0.1", 9096)` — and it serves both transports at once: the compiled binary is the stdio entry point that Claude Desktop needs, and `http://IP:9096/sse` is the SSE endpoint for Cursor, Windsurf and Cherry Studio. Every tool takes a cluster, namespace and name, so one server front-ends every cluster you registered, self-managed or AWS EKS.

What you get

Cluster registry — `list_k8s_clusters`, and in SSE mode `register_k8s_cluster` and `unregister_k8s_cluster` at runtime, so a new kubeconfig does not mean a restart
Any resource, custom ones included — `get_k8s_resource`, `describe_k8s_resource`, `list_k8s_resource`, `delete_k8s_resource`, `patch_k8s_resource`, `label_k8s_resource`, `annotate_k8s_resource`
The whole Deployment lifecycle — `scale_k8s_deployment`, `restart_k8s_deployment`, `stop_k8s_deployment`, `restore_k8s_deployment`, `update_k8s_deployment_image_tag`, `get_k8s_deployment_hpa_list`
Rollouts as separate calls rather than one blunt apply — `get_k8s_deployment_rollout_history`, `undo_k8s_deployment_rollout`, `pause_k8s_deployment_rollout`, `resume_k8s_deployment_rollout`, `get_k8s_deployment_rollout_status`
Pod inspection and Pod insides — `list_k8s_pod`, `describe_k8s_pod`, `get_k8s_top_pod`, `GetPodLogsTool`, `run_command_in_k8s_pod`, and file work with `list_files_in_k8s_pod`, `list_pod_all_files`, `UploadPodFileTool`, `DeletePodFileTool`
What a Pod is wired to — `get_k8s_pod_linked_services`, `get_pod_linked_ingresses`, `get_pod_linked_endpoints`, `get_k8s_pod_linked_env`, `get_pod_linked_env_from_yaml`
Node scheduling and capacity — `cordon_k8s_node`, `uncordon_k8s_node`, `drain_k8s_node`, `taint_k8s_node`, `untaint_k8s_node`, `get_k8s_node_resource_usage`, `get_k8s_node_ip_usage`, `get_k8s_top_node`, `get_k8s_pod_count_running_on_node`
Manifests in and out — `apply_k8s_yaml`, `delete_k8s_yaml`
Storage and Ingress defaults — `set_k8s_default_storageclass`, `get_k8s_storageclass_pvc_count`, `get_k8s_storageclass_pv_count`, `set_default_k8s_ingressclass`
Events where you need them — `list_k8s_event`, `list_k8s_deploy_event`, `list_k8s_pod_event`, plus `restart_k8s_daemonset`

Requirements

Go, and cluster credentials. This is a library rather than a published binary: you write a Go `main`, register your clusters and call `RunMCPServer`, then `go build main.go`. `KUBECONFIG` is the default source of credentials; `RegisterInCluster()` picks up in-cluster credentials, `RegisterByPathWithID` takes a kubeconfig path plus an ID, `RegisterByTokenWithServerAndID` takes a bearer token, API server address and cluster ID with the CA certificate as an optional register-time option, and `RegisterAWSCluster` takes an `aws.EKSAuthConfig` carrying `AccessKey`, `SecretAccessKey`, `Region` and `ClusterName`. In SSE mode kubeconfigs can instead be listed in `mcp.ServerConfig` or auto-discovered from a directory with `LoadKubeconfigsFromDirectory`. Whatever RBAC the credential carries is what the tools can do, and the set includes `delete_k8s_resource`, `drain_k8s_node` and `run_command_in_k8s_pod` — scope the service account to the namespaces you want reachable before you register it.

Setup effort

One command — npx -y mcp-remote http://IP:9096/sse

weibaohui/kom