Kubernetes MCP server: setup, auth, production
Last verified: June 2026· Kubernetes MCP integration
Community MCP servers existYour container orchestration platform.
What is the Kubernetes MCP server?
A Kubernetes MCP server implements the Model Context Protocol and exposes Kubernetes's capabilities as typed tools an agent can discover and call in the middle of a task. Your container orchestration platform.
Cloud and orchestration access is the highest-stakes MCP connection and the one to lock down hardest: read-mostly IAM/RBAC, a firm boundary on anything destructive, and a human gate on state changes. Done right, agents become excellent at diagnosis without being able to cause an outage.
A real Kubernetes workflow
A pod is crash-looping. The agent reads the deployment, recent events, and logs, identifies the failed readiness probe or the missing config, and drafts the manifest change — diagnosis at the speed of kubectl, without the write access.
What an agent can do with Kubernetes
- Let an agent inspect pod, deployment, and event state
- Investigate a crash-looping service
- Draft a manifest change for review
Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.
Setting up the Kubernetes MCP server
Bind a service account to a read-mostly ClusterRole (get/list/watch), namespaced where possible. Keep it out of secrets unless a workflow needs them, and never grant it apply/delete on production.
Auth: A scoped service account with read-mostly RBAC. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.
The risk to watch with Kubernetes
An agent with write RBAC on a production cluster can delete a Deployment as easily as read one. Read-mostly RBAC, no standing write to prod, and secrets access only where justified.
More broadly, a production-grade Kubernetes integration needs rBAC scoping and preventing accidental writes to production clusters. The MCP security checklist applies to every integration — we build servers with these controls baked in.
Troubleshooting
If the Kubernetes tools don't appear after setup, it's almost always auth or transport. See MCP server not connecting for the step-by-step fix — and note that hosted servers often need OAuth, not a plain API key. To understand how MCP relates to ordinary tool use, see MCP vs function calling.
Frequently asked questions
Is there an official MCP server for Kubernetes?
Community MCP servers exist. Whichever you use, a production setup needs rbac scoping and preventing accidental writes to production clusters.
How does authentication work for Kubernetes over MCP?
A scoped service account with read-mostly RBAC. Credentials should never live in the sandbox or the repo; route them through your client's secret handling or a vaulted credential.
What can an agent actually do with Kubernetes?
Let an agent inspect pod, deployment, and event state; Investigate a crash-looping service; Draft a manifest change for review. Start read-only and add write access deliberately, behind audit logging.
Is it safe to give agents access to Kubernetes?
Yes, when scoped correctly: least-privilege credentials, read-only by default, audit logs on every call, and human approval for any high-impact action. RBAC scoping and preventing accidental writes to production clusters.