CLUSTER OPERATIONS / containers project
Kubernetes MCP Server
Exposes Kubernetes and OpenShift resource inspection and management using kubeconfig or in-cluster credentials.
“Kubernetes MCP Server”
01 / THE REASONING
Why this made the selection.
- Supports generic Kubernetes resources, making its role broader than a fixed set of pod commands.
- Documents toolsets, read-only configuration and a restricted service-account setup.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md (installation, capability and permission sections)
- go.mod
- cmd/kubernetes-mcp-server/main.go
- LICENSE
- pkg/http/http.go
- docs/configuration.md
Our findings
- The Go entrypoint and manifest establish the implementation language despite npx/uvx launchers.
- HTTP authentication has dedicated OAuth/OIDC guidance; local kubeconfig access remains a separate credential boundary.
- The current HTTP implementation serves Streamable HTTP at /mcp; legacy SSE was not established and is not listed.
- Runtime restrictions are TOML settings. The shown command now requires an explicit configuration file rather than launching the write-capable default silently.
Not established by this review
- Server startup, authentication and tool execution were not tested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
npx kubernetes-mcp-server@latest --config ./mcp-config.tomlCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Create mcp-config.toml containing read_only = true for exploration, and select a kubeconfig/service account restricted to the intended cluster resources. read_only and toolsets are TOML settings, not launch flags.
- Start the documented launcher with --config pointing to that file; use an absolute file path in client configurations when their working directory differs.
- For HTTP mode, explicitly set bind_address = "127.0.0.1" for local access or configure the documented OAuth/TLS and network controls before sharing the listener.
Before you start
- Node.js for the launcher and Kubernetes/OpenShift access through kubeconfig or in-cluster configuration.
- A prepared mcp-config.toml at the command’s path; its read_only = true setting is recommended for the shown exploration setup.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Official documentation ↗Checked
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/README.md
Supports: summary, whySelected, bestFor, limitations, install, access, compatibility, transports
- Applicable source licence ↗Checked
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/LICENSE
Supports: license
- Implementation: go.mod ↗Checked
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/go.mod
Supports: language, review
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/cmd/kubernetes-mcp-server/main.go
Supports: language, review
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/pkg/http/http.go
Supports: review, transports
https://github.com/containers/kubernetes-mcp-server/blob/6fd66fb432d393ad662714e7baad5bdce5369870/docs/configuration.md
Supports: review, limitations, transports, install, access