Kubernetes Read Only MCP Server

What is Kubernetes Read Only MCP Server?

A read-only MCP server that gives Claude access to Kubernetes clusters. Built in Go, it communicates over stdio using the MCP protocol and is designed for safe, production‑grade debugging.

How to use Kubernetes Read Only MCP Server?

Build the binary with make build or pull the Docker image from ghcr.io/your-ko/mcp-k8s-ro. Add it as a stdio MCP server in your Claude Desktop or CLI configuration, pointing to a kubeconfig file via the KUBECONFIG environment variable.

Key features of Kubernetes Read Only MCP Server

• Read‑only operations: get, describe, logs, top only – no mutations.
• Secret values are masked before being sent to the model.
• Token‑efficient responses include only relevant fields, not raw API objects.
• Every response includes the active context and cluster name.
• Locks to the active kubeconfig context at startup; no runtime context switching.
• Runs as a local binary or Docker container with no extra infrastructure.

Use cases of Kubernetes Read Only MCP Server

• Safe on‑call debugging: Claude can inspect workloads without risking accidental mutations.
• Quickly list and describe resources (pods, deployments, CRDs) across namespaces.
• Fetch pod logs, including crashed container logs with --previous.
• View Kubernetes events sorted by most recent.
• Monitor CPU and memory usage per pod or node (requires metrics‑server).

FAQ from Kubernetes Read Only MCP Server

Is the server truly read‑only?

Yes – all tools are restricted to get, describe, logs, and top operations. If a mutating action is needed, the server prints the equivalent kubectl command for manual execution.

Are my secrets safe?

Secret values (data, stringData) are masked before being sent to the model, preventing leaks from misconfiguration or prompt injection.

Can I switch clusters at runtime?

No – the server locks to the active kubeconfig context at startup. To target a different cluster, stop the server, switch context, and restart.

How do I work with multiple clusters?

Register a separate server instance per cluster in your MCP configuration. Each instance sees only its own cluster and Claude addresses them by name.

What are the runtime dependencies?

A valid kubeconfig file (default ~/.kube/config). The k8s_top_pods and k8s_top_nodes tools additionally require the metrics‑server to be installed in the cluster.