Atlas / MCP servers / rohitg00 / Kubectl

KubectlBLOCK

Name: Kubectl
Author: rohitg00

mcp/rohitg00/kubectl

MCP server by rohitg00 · ai · deployment · devops · Audited 2026-09-26

⚑ Report / re-scan Source ↗

Published in CNCF Landscape: A MCP server for Kubernetes.

Verdict

BLOCK

Grade

Trust score

49 /100

Exposed tools

12 10r · 1w · 1d

Transport

stdio · streamable-http

License

MIT

Stars

960

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

kubectl-mcp-server

Control your entire Kubernetes infrastructure through natural language conversations with AI. Talk to your clusters like you talk to a DevOps expert. Debug crashed pods, optimize costs, deploy applications, audit security, manage Helm charts, and visualize dashboards, all through natural language. Part of CNCF Landscape, Next to Terraform

Read from source at commit 7486dd044ac8OBSERVED · 2026-09-26

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add kubectl-mcp-server --env KIALI_PASSWORD=${KIALI_PASSWORD} --env KIALI_TOKEN=${KIALI_TOKEN} --env MCP_AUTH_AUDIENCE=${MCP_AUTH_AUDIENCE} --env MCP_AUTH_ENABLED=${MCP_AUTH_ENABLED} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "kubectl-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "KIALI_PASSWORD": "${KIALI_PASSWORD}",
        "KIALI_TOKEN": "${KIALI_TOKEN}",
        "MCP_AUTH_AUDIENCE": "${MCP_AUTH_AUDIENCE}",
        "MCP_AUTH_ENABLED": "${MCP_AUTH_ENABLED}"
      }
    }
  }
}

Exposed tools (12)

10 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`get_deployments`	read	Get deployments
`get_pods`	read	Get pods
`k8s-3d-topology`	read	Real-time 3D interactive Kubernetes cluster topology viewer with resource relationships, traffic visualization, and click-to-inspect details
`k8s-cluster`	read	Cluster health summary with node status, resource allocation, namespace quotas, and storage overview
`k8s-cost`	read	Resource utilization analysis with waste detection, right-sizing recommendations, and savings calculator
`k8s-deploy`	write	Deployment management with rollout status, scaling, restart, rollback, and revision history
`k8s-events`	read	Event timeline visualization with type filtering, resource grouping, and time range selection
`k8s-helm`	destructive	Helm release management with upgrade, rollback, uninstall, values diff, and release notes
`k8s-logs`	read	Real-time log viewer with syntax highlighting, search, filtering by level, and multi-container support
`k8s-network`	read	Network topology graph showing Services, Pods, Ingress connections with click-to-inspect details
`k8s-pods`	read	Interactive pod viewer with filtering, sorting, status indicators, and quick actions (logs, delete, exec)
`k8s-proxy`	read	Proxy any kubectl-mcp-server tool call

Trust audit

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (8 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

evals/claude-code/eval.yaml:58

# Global timeout for the entire eval (seconds)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

evals/openai-agent/eval.yaml:58

# Global timeout for the entire eval (seconds)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

kubectl_mcp_tool/k8s_config.py:149

kubeconfig_env = os.environ.get('KUBECONFIG', '~/.kube/config')