giantswarm/mcp-kubernetes

mcp-kubernetes

A Model Context Protocol (MCP) server that provides tools for interacting with Kubernetes clusters.

Features

• Resource Management: Get, list, describe, create, apply, delete, and patch Kubernetes resources
• Pod Operations: Get logs, execute commands, and set up port forwarding
• Context Management: List, get, and switch between Kubernetes contexts
• Cluster Information: Get API resources and cluster health status
• Multiple Authentication Modes: Support for kubeconfig, in-cluster, OAuth 2.1, and federated multi-cluster authentication
• Multi-Cluster Support: Federation with Cluster API (CAPI) for managing workload clusters from a management cluster
• Multiple Transport Types: Support for stdio and streamable HTTP
• Safety Features: Non-destructive mode, dry-run capability, and operation restrictions
• OAuth 2.1 Support: Secure token-based authentication with Dex OIDC (default) and Google OAuth providers
• Production-Grade Observability: OpenTelemetry instrumentation with Prometheus metrics and distributed tracing

Installation

go install github.com/giantswarm/mcp-kubernetes@latest

Usage

Basic Usage

# Start the MCP server with default settings (stdio transport, kubeconfig authentication)
mcp-kubernetes serve

# Start with debug logging
mcp-kubernetes serve --debug

# Start with in-cluster authentication (when running as a pod in Kubernetes)
mcp-kubernetes serve --in-cluster

Authentication Modes

The server supports multiple authentication modes:

Kubeconfig Authentication (Default)

Uses standard kubeconfig file authentication. The server will look for kubeconfig in the default locations (~/.kube/config) or use the KUBECONFIG environment variable.

# Use default kubeconfig
mcp-kubernetes serve

# Use specific kubeconfig (via environment variable)
KUBECONFIG=/path/to/kubeconfig mcp-kubernetes serve

In-Cluster Authentication

Uses service