Kubernetes MCP Server

Pods, logs, events and resources from your current kubeconfig context.

Started in our test
★ 2.2K GitHub stars
Last commit 26 Oct 2026

At a glance

This server talks to the Kubernetes API directly (it is a native Go binary, not a wrapper around kubectl) using whatever context your kubeconfig points at. The assistant can list and describe resources, pull logs, check events and, unless you stop it, create or delete things.

Keep it read-only on any cluster you care about. Since version 0.0.68 (October 2026) that setting lives in a small TOML file instead of a --read-only flag, and the old flag stops it from starting. The project lives under the containers organisation on GitHub now.

Made by: Marc Nuri and the containers community (Red Hat)
Licence: Apache-2.0
Latest version: 0.0.69 (23 Oct 2026)
npm package: kubernetes-mcp-server
GitHub stars: 2.2K
Last commit: 26 Oct 2026
Tools: 14
Runs on: Your computer

Our check: We ran this exact config on 26 Oct 2026: it started and answered with 14 tools.

What's in the pod: its tools

We found 14 tools when we started it on 26 Oct 2026. Every one of them only reads, so nothing changes unless you act on what it finds.

How we tested it: Started v0.0.69 with a TOML file containing read_only = true and a kubeconfig. It lists its tools without reaching a live cluster. The old --read-only flag made it exit.

Only reads14 tools · Looks things up and changes nothing.

Tool	What it is for
`configuration_view`	Shows the current kubeconfig, optionally trimmed to the active context.
`events_list`	Lists recent warnings, errors and state changes, the first stop when something breaks.
`namespaces_list`	Lists the namespaces in the cluster.
`nodes_log`	Reads system logs from a node, such as the kubelet's.
`nodes_stats_summary`	Shows detailed resource use on one node.
`nodes_top`	Shows CPU and memory use per node from the metrics server.
`pods_get`	Fetches one pod's full details.
`pods_list`	Lists pods across all namespaces, with label and field filters.
`pods_list_in_namespace`	Lists pods in one namespace.
`pods_log`	Reads a pod's logs, including from a crashed previous run.
`pods_top`	Shows CPU and memory use per pod.
`projects_list`	Lists OpenShift projects.
`resources_get`	Fetches any resource, including custom ones.
`resources_list`	Lists resources of any kind, including custom resources.

Tool groups

config: On by default. Read the kubeconfig and list clusters.
core: On by default. Pods, nodes, events, namespaces and any resource type.
helm: Install, list and remove Helm releases.
kubevirt: Create, start, stop and troubleshoot virtual machines.
tekton: Start and follow Tekton pipelines and tasks.
observability/metrics: Query Prometheus and Alertmanager. Sister sets cover Loki logs, Tempo traces and the OpenTelemetry Collector.
kiali: Service mesh traffic, health and Istio config.
kcp and netobserv: kcp workspaces, and network flow data from NetObserv.

Grouped and described by us. The README on GitHub lists the inputs each tool takes.

Set it up

Make a text file, for example ~/.config/kubernetes-mcp/read-only.toml, containing one line: read_only = true
Put that file's full path in the config below in place of /path/to/read-only.toml.

Pick your app for the exact snippet and where it goes.

Where it goes: claude_desktop_config.json (Settings → Developer → Edit Config)

Claude Desktop

{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": [
        "-y",
        "kubernetes-mcp-server@latest",
        "--config",
        "/path/to/read-only.toml"
      ]
    }
  }
}

Where it goes: Your terminal, in the project folder

Claude Code

claude mcp add-json kubernetes '{"command":"npx","args":["-y","kubernetes-mcp-server@latest","--config","/path/to/read-only.toml"]}'

Where it goes: ~/.cursor/mcp.json, or .cursor/mcp.json in a project

Cursor

{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": [
        "-y",
        "kubernetes-mcp-server@latest",
        "--config",
        "/path/to/read-only.toml"
      ]
    }
  }
}

Where it goes: .vscode/mcp.json in your project

VS Code

{
  "servers": {
    "kubernetes": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "kubernetes-mcp-server@latest",
        "--config",
        "/path/to/read-only.toml"
      ]
    }
  }
}

Where it goes: ~/.codeium/windsurf/mcp_config.json

Windsurf

{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": [
        "-y",
        "kubernetes-mcp-server@latest",
        "--config",
        "/path/to/read-only.toml"
      ]
    }
  }
}

Change the file to read_only = false only for clusters where you are happy for the assistant to change resources. The --read-only flag from older guides no longer works.

New to this? See the setup guides for Claude Code, Cursor, Claude Desktop and ChatGPT.

Settings

Names are exactly as the project spells them. Required ones are marked.

Setting	What it does
`--config`Command line flag	Path to a TOML settings file. Most options live there rather than in flags.`--config /etc/kubernetes-mcp-server/config.toml`
`read_only`Config	In the TOML file, set to true and only tools that look but never change anything are offered.`read_only = true`
`toolsets`Config	Which groups of tools to load. Defaults to config and core.`toolsets = ["core", "config", "helm"]`
`denied_resources`Config	Resource kinds the agent may never touch, such as Secrets.
`--config-dir`Command line flag	A folder of extra .toml files merged on top of the main one.

What it can touch

It can read

Any cluster in your kubeconfig, or the cluster it runs in, with the rights of that identity
Pod and node logs, events and metrics

It can change

Creates, updates, scales and deletes resources
Runs commands inside containers and starts new pods
Installs and removes Helm charts if that set is on

Safer setup: Set read_only = true, deny Secrets in denied_resources, and run it with a dedicated ServiceAccount that only has view rights.

Before you start

A working kubeconfig
Node.js 18 or newer (the npm package downloads the binary)

If it does not work

It cannot reach the cluster: It uses your kubeconfig. Check kubectl get pods works in the same environment the client starts it from.
Helm or Tekton tools are missing: Only config and core load by default. Add the others to toolsets in the TOML file.
Old command line flags are ignored: Most runtime settings moved to TOML. The project's configuration changes page maps old flags to new keys.
Top commands return nothing: pods_top and nodes_top need the Kubernetes metrics server installed in the cluster.

Peas in a pod: similar servers

How Kubernetes MCP Server lines up against other developer tools servers on the shelf.

Server	Tools	Runs on	Licence	Stars
Kubernetes MCP Server	14	Your computer	Apache-2.0	2.2K
IDA Pro MCP	48	Your computer	–	13.2K
Desktop Commander	25	Your computer	MIT	10.1K
Serena	3	Your computer	–	30.7K
Context7	2	Your computer or hosted	MIT	63.7K