Kubernetes Read-Only

You can use the Kubernetes Read-Only MCP Server to inspect Kubernetes clusters through a safe, read-only interface. It lets you list resources, view details, fetch pod logs, discover API resources, and perform base64 operations without risking unintended changes to your cluster.

How to use

Connect to your cluster using a client that understands MCP servers. You can choose a local, stdio-based setup for direct usage from your environment, or run the server via a package manager like npm/npx or as a Docker container. Your client can perform read-only operations such as listing resources, retrieving resource details, getting pod logs with filters, discovering API resources, and encoding or decoding base64 data. Use per-command contexts and namespaces to scope operations, and enable or disable tools to fit security or performance needs.

How to install

Prerequisites: a modern shell, network access to your Kubernetes cluster, and a kubeconfig file that grants read access to the resources you plan to inspect.

brew install patrickdappollonio/tap/mcp-kubernetes-ro

# Or install and run via npx
npx -y @patrickdappollonio/mcp-kubernetes-ro

# Or pull the Docker image for containerized usage
docker pull ghcr.io/patrickdappollonio/mcp-kubernetes-ro

# Basic runtime with stdio transport (local binary)
mcp-kubernetes-ro

# Advanced: run with a specific kubeconfig and namespace (if needed)
mcp-kubernetes-ro --kubeconfig ~/.kube/config --namespace default

# If you prefer to use the image directly with a mounted kubeconfig
docker run -i --rm -e KUBECONFIG=/root/.kube/config -v /path/to/kubeconfig:/root/.kube/config ghcr.io/patrickdappollonio/mcp-kubernetes-ro

Configuration and startup notes

You can tailor how the MCP server connects to your cluster by setting the kubeconfig path and default namespace. You can also control which tools are available at startup by using a flag or environment variables to disable specific tools. The server supports both stdio and Server-Sent Events (SSE) transports, and it performs a startup connectivity check to confirm API access and basic permissions.

Security and usage notes

• The server operates in read-only mode, preventing create, update, or delete actions.
• It relies on your existing kubeconfig credentials.
• RBAC permissions from your kubeconfig are respected, so access is limited to what your credentials allow.

Troubleshooting and tips

If connectivity to the Kubernetes API fails at startup, verify that your kubeconfig is valid, the cluster is reachable from your network, and your credentials are current. If metrics tools are unavailable, ensure the metrics server is installed in your cluster; the tools will then report status and guidance if needed.

Usage notes on tools and features

This MCP server exposes a set of read-only tools for inspecting clusters, including listing resources, retrieving resource details, fetching pod logs with filters, discovering API resources, and base64 encoding/decoding. You can selectively enable or disable tools to suit your needs and security policies.

Examples of common workflows

• Inspect all pods in a namespace and fetch recent logs to investigate an issue.
• Discover available API resources to understand what APIs your cluster exposes.
• Encode or decode configuration data stored in secrets for troubleshooting.

Net-new setup tips

If you are integrating with an editor or IDE, you can run the MCP server as a stdio process or expose an SSE HTTP endpoint for web-based tooling. Use per-command context to run operations against different clusters or namespaces from the same kubeconfig.

Notes on tools, transport, and context

The server supports multiple transport modes and per-command context configuration to work with different clusters or contexts within your kubeconfig. You can also set environment variables to fine-tune tool availability and behavior.

Starting conversations with AI assistants

When using AI assistants, you can guide the session by enabling only the tools you trust for the current task. If sensitive data handling is a concern, disable relevant tools such as those that access secret data or perform base64 decoding.

Available tools

list_resources

List Kubernetes resources by type with optional filtering and pagination to inspect cluster state.

get_resource

Retrieve complete details for a specific Kubernetes resource.

get_logs

Fetch pod logs with advanced filtering options including grep patterns, time ranges, and previous logs.

get_pod_containers

List containers within a pod to identify relevant log streams.

list_api_resources

Discover available Kubernetes API resources and their capabilities.

list_contexts

List available contexts from kubeconfig for multi-context workflows.

get_node_metrics

Obtain node metrics such as CPU and memory usage from the metrics server.

get_pod_metrics

Obtain pod metrics such as CPU and memory usage from the metrics server.

encode_base64

Encode text data to base64 format.

decode_base64

Decode base64 data to text format.