dockndevai/mcp-kubernetes

A Model Context Protocol server for **Kubernetes**. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.
The design goal is **safe by default**: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.
Features
- **Multi-cluster** — every tool accepts an optional context; scope which contexts are usable with an allowlist.
- **Access modes** — read-only → read-write → admin, layered so a mode never exposes tools above its level.
- **Security flags** — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).
- **Standard auth** — uses your kube-config (or in-cluster service account). No credentials are stored by the server.
Security model
| Concern | Flag | Default | Effect |
| --- | --- | --- | --- |
| What can the server do at all? | K8S_MODE | read-only | read-only exposes only reads; read-write adds mutations; admin adds destructive tools. Tools above the mode are **never registered**. |
| Which namespaces are in scope? | K8S_NAMESPACE_ALLOWLIST | *(all)* | When set, any operation on a namespace outside the list is refused. |
| Which namespaces are read-only forever? | K8S_PROTECTED_NAMESPACES | kube-system,kube-public,kube-node-lease | Can be read but never mutated or deleted, regardless of mode. |
| Which clusters are reachable? | K8S_CONTEXT_ALLOWLIST | *(all)* | When set, only these kube-config contexts may be targeted. |
| Can it delete? | K8S_ALLOW_DELETE | false | delete_resource needs this **and** admin mode. |
| Can it apply manifests? | K8S_ALLOW_APPLY | false | apply_manifest needs this **and** read-write mode. |
| Can it exec into pods? | K8S_ALLOW_EXEC | false | exec_in_pod needs this **and** admin mode; the tool isn't even registered otherwise. |
| Preview without touching the cluster | K8S_DRY_RUN | false | Write/admin tools validate + log intent, then return without calling the API. |
| Audit trail | K8S_AUDIT_LOG | true | Emits a JSON line to stderr per guarded operation (ALLOW / DENY / DRY_RUN). |
| Interactive confirmation | *(automatic)* | — | Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate. |
The layers are independent — e.g. admin mode with all three opt-ins false can restart and scale deployments but can neither delete resources nor exec into pods.
Tools
**Read** (read-only+): list_contexts, list_namespaces, list_pods, get_pod, get_pod_logs, list_deployments, list_services, list_nodes, list_events, get_resource
**Write** (read-write+): scale_deployment, restart_deployment, set_deployment_image, create_namespace, apply_manifest (needs K8S_ALLOW_APPLY)