kubernetes-mcp-serverBLOCK
Model Context Protocol (MCP) server for Kubernetes and OpenShift
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/containers/kubernetes-mcp-server/blob/main/LICENSE) [](https://www.npmjs.com/package/kubernetes-mcp-server) [](https://pypi.org/project/kubernetes-mcp-server/) [](https://github.com/containers/kubernetes-mcp-server/releases/latest) [](https://github.com/containers/kubernetes-mcp-server/actions/workflows/build.yaml)
✨ Features | 🚀 Getting Started | 🎥 Demos | ⚙️ Configuration | 🛠️ Tools | 💬 Community | 🧑💻 Development
https://github.com/user-attachments/assets/be2b67b3-fc1c-4d11-ae46-93deba8ed98e
✨ Features
A powerful and flexible Kubernetes Model Context Protocol (MCP) server implementation with support for Kubernetes and OpenShift.
- ✅ Configuration:
- Automatically detect changes in the Kubernetes configuration and update the MCP server.
- View and manage the current Kubernetes `.kube/config` or in-cluster configuration.
- ✅ Generic Kubernetes Resources: Perform operations on any Kubernetes or OpenShift resource.
- Any CRUD operation (Create or Update, Get, List, Delete).
- ✅ Pods: Perform Pod-specific operations.
- List pods in all namespaces or in a specific namespace.
- Get a pod by name from the specified namespace.
- Delete a pod by name from the specified
aa7102d7ff4aOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add kubernetes-mcp-server -- npx -y [email protected]
claude mcp add kubernetes-mcp-server -- uvx kubernetes-mcp-server==0.0.0
claude mcp add kubernetes-mcp-server:0.0.0 -- docker run -i --rm ghcr.io/containers/kubernetes-mcp-server:0.0.0:None
Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
disabled-toolset | read | Disabled toolset |
empty-slice-toolset | read | Toolset with empty prompts slice |
empty-toolset | read | Toolset with no prompts |
enabled-toolset | read | Enabled toolset |
test-toolset | read | Test toolset with prompts |
toolset1 | read | First toolset |
toolset2 | read | Second toolset |
Trust audit
BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
regexp.MustCompile(`(-----BEGIN RSA PRIVATE KEY-----)`),
regexp.MustCompile(`(-----BEGIN EC PRIVATE KEY-----)`),
regexp.MustCompile(`(-----BEGIN OPENSSH PRIVATE KEY-----)`),
ssh_authorized_keys:
"ssh_authorized_keys",
.claude/skills
evals/core-eval-testing/acp-anthropic/eval-all.yaml
evals/core-eval-testing/acp-anthropic/eval-argo.yaml
evals/core-eval-testing/acp-anthropic/eval-core.yaml
evals/core-eval-testing/acp-anthropic/eval-helm.yaml
if curl --cacert "$$cert" -fsS https://127.0.0.1:$(BROWSER_MCP_PORT)/healthz >/dev/null; then break; fi; \
curl --cacert "$$cert" -fsS https://127.0.0.1:$(BROWSER_MCP_PORT)/healthz >/dev/null || { echo "MCP server did not become ready"; exit 1; }; \MCP_SERVER_URL="https://127.0.0.1:$(BROWSER_MCP_PORT)/mcp" ./test/browser/run.sh
' server: https://127.0.0.1:6443' \
@echo "Port-forwarding netobserv-plugin to http://127.0.0.1:$(NETOBSERV_PORT)..."
msg := "key: sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ABCDEFGHIJKLMNOPQRSTUVWXYZabcde" // notsecret
s.NotContains(sanitized, "sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ABCDEFGHIJKLMNOPQRSTUVWXYZabcde") // notsecret
msg := "MONGO_URI=mongodb+srv://dbuser:[email protected]/mydb"
msg := "token: ghp_1234567890abcdefghijklmnopqrstuv1234" // notsecret
s.NotContains(sanitized, "ghp_1234567890abcdefghijklmnopqrstuv1234") // notsecret
msg := `Failed to connect: {"password": "dbpass", "token": "ghp_1234567890abcdefghijklmnopqrstuv1234", "api_key": "sk-proj-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv"}`s.NotContains(sanitized, "ghp_1234567890abcdefghijklmnopqrstuv1234")
msg := "key: -----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA"
s.NotContains(sanitized, "-----BEGIN RSA PRIVATE KEY-----")
.mcpbignore
Gates applied: critical_finding, no_behavioural_pass.
aa7102d7ff4afull audit observations/trust-audit/mcp-server/containers__kubernetes-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | aa7102d7ff4a | BLOCK | F | 43 | first audit |
Questions
What is the kubernetes-mcp-server MCP server?
Model Context Protocol (MCP) server for Kubernetes and OpenShift
What tools does kubernetes-mcp-server expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is kubernetes-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (43/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does kubernetes-mcp-server need?
It reads BROWSER_PROXY_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does kubernetes-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as kubernetes-mcp-server-browser-tests at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (aa7102d7ff4a), read on 2026-10-12. The repository is watched and re-audited when it changes.