kubernetes-mcp-server by containers: safety score
C 65 Provisional Not reviewed Not tested
kubernetes-mcp-server by containers is a community MCP server for Kubernetes with 47 read, 6 write and 16 destructive tools. It does not have a read-only mode and needs to run locally; its provisional OpsMCP grade is C (65%), last checked 16 Oct 2026.
A Model Context Protocol (MCP) server for Kubernetes and OpenShift
Tool capability partly scored. Access partly scored. 2 of 4 factors scored.
Can it change or delete things?
Yes. The extracted tools include at least one destructive tool, so it can change or delete things.
| Tool | Class |
|---|---|
check_events Include recent warning/error events (true/false, default: true)
from the name | Unknown |
configuration_contexts_list List all available context names and associated server urls from the kubeconfig file
from the name (list) | Read |
configuration_view Get the current Kubernetes configuration content as a kubeconfig YAML
from the description (get) | Read |
events_list List Kubernetes events (warnings, errors, state changes) for debugging and troubleshooting in the current cluster from all namespaces
from the name (list) | Read |
execute_instant_query Execute a PromQL instant query to get current/point-in-time values. PREREQUISITE: You MUST call list_metrics first to verify the metric exists WHEN TO USE: - Current state questions: "What is the current error rate?" - Point-in-time snapshots: "How many pods are running?" - La...
from the name (execute) | Destructive |
execute_range_query Execute a PromQL range query to get time-series data over a period. PREREQUISITE: You MUST call list_metrics first to verify the metric exists WHEN TO USE: - Trends over time: "What was CPU usage over the last hour?" - Rate calculations: "How many requests per second?" - Histo...
from the name (execute) | Destructive |
get_alerts Get alerts from Alertmanager. WHEN TO USE: - START HERE when investigating issues: if the user asks about things breaking, errors, failures, outages, services being down, or anything going wrong in the cluster - When the user mentions a specific alert name - use this tool to g...
from the name (get) | Read |
get_label_names Get all label names (dimensions) available for filtering a metric. WHEN TO USE (after calling list_metrics): - To discover how to filter metrics (by namespace, pod, service, etc.) - Before constructing label matchers in PromQL queries The 'metric' parameter should use a metric...
from the name (get) | Read |
get_label_values Get all unique values for a specific label. WHEN TO USE (after calling list_metrics and get_label_names): - To find exact label values for filtering (namespace names, pod names, etc.) - To see what values exist before constructing queries The 'metric' parameter should use a me...
from the name (get) | Read |
get_series Get time series matching selectors and preview cardinality. WHEN TO USE (optional, after calling list_metrics): - To verify label filters match expected series before querying - To check cardinality and avoid slow queries CARDINALITY GUIDANCE: - <100 series: Safe - 100-1000: U...
from the name (get) | Read |
get_silences Get silences from Alertmanager. WHEN TO USE: - To see which alerts are currently silenced - To check active, pending, or expired silences - To investigate why certain alerts are not firing notifications FILTERING: - Use 'filter' to apply label matchers to find specific silence...
from the name (get) | Read |
helm_install Install (deploy) a Helm chart to create a release in the current or provided namespace
from the description (create) | Write |
helm_list List all the Helm releases in the current or provided namespace (or in all namespaces if specified)
from the name (list) | Read |
helm_uninstall Uninstall a Helm release in the current or provided namespace
from the name | Unknown |
kcp_workspace_describe Get detailed information about a specific kcp workspace
from the description (get) | Read |
kcp_workspaces_list List all available kcp workspaces in the current cluster
from the name (list) | Read |
kiali_get_logs Get the logs of a Kubernetes Pod (or workload name that will be resolved to a pod) in a namespace. Output is plain text, matching kubernetes-mcp-server pods_log. The line_count field tells you the total number of log lines returned. Analyze ALL of them, but summarize the resul...
from the name (get) | Read |
kiali_get_mesh_status Retrieves the high-level health, topology, and environment details of the Istio service mesh. Returns multi-cluster control plane status (istiod), data plane namespace health (including ambient mesh status), observability stack health (Prometheus, Grafana...), and component co...
from the name (get) | Read |
kiali_get_mesh_traffic_graph Returns service-to-service traffic topology, dependencies, and network metrics (throughput, response time, mTLS) for the specified namespaces. Use this to diagnose routing issues, latency, or find upstream/downstream dependencies.
from the name (get) | Read |
kiali_get_metrics Returns a compact JSON summary of Istio metrics (latency quantiles, traffic trends, throughput, payload sizes) for the given resource.
from the name (get) | Read |
kiali_get_pod_performance Returns a human-readable text summary with current Pod CPU/memory usage (from Prometheus) compared to Kubernetes requests/limits (from the Pod spec). Useful to answer questions like 'Is this workload using too much memory?'
from the name (get) | Read |
kiali_get_resource_details Fetches a list of resources OR retrieves detailed data for a specific resource. If 'resourceName' is omitted, it returns a list. If 'resourceName' is provided, it returns details for that specific resource.
from the name (get) | Read |
kiali_get_trace_details Fetches a single distributed trace by trace_id and returns its call hierarchy (service tree with duration, status, and nested calls). Use this after list_traces to drill into a specific trace.
from the name (get) | Read |
kiali_list_mesh_clusters Returns the list of Istio mesh clusters that Kiali can access. Each entry includes its name and whether it is the home cluster (where Kiali is deployed). Call this tool before using meshCluster on other Kiali tools when the target cluster is unknown.
from the name (list) | Read |
kiali_list_traces Lists distributed traces for a service in a namespace. Returns a summary (namespace, service, total_found, avg_duration_ms) and a list of traces with id, duration_ms, spans_count, root_op, slowest_service, has_errors. Use get_trace_details with a trace id to get full hierarchy.
from the name (list) | Read |
kiali_manage_istio_config Create, patch, or delete Istio, Gateway API, and Inference API config. Supports Istio resources (networking.istio.io, security.istio.io), Gateway API resources (gateway.networking.k8s.io), and Inference API resources (inference.networking.k8s.io) when installed on the cluster....
from the description (delete) | Destructive |
kiali_manage_istio_config_read Read Istio, Gateway API, and Inference API config. 'list' groups by namespace→'group/version/kind'→{valid:[...],invalid:[...]} where valid/invalid arrays contain resource names; omit group/kind to retrieve ALL config types in a single call. Supports Istio (networking.istio.io,...
from the name | Unknown |
list_metrics MANDATORY FIRST STEP: List all available metric names in Prometheus. YOU MUST CALL THIS TOOL BEFORE ANY OTHER QUERY TOOL This tool MUST be called first for EVERY observability question to: 1. Discover what metrics actually exist in this environment 2. Find the EXACT metric nam...
from the name (list) | Read |
loki_label_names List available Loki label names for a time range. Use this before writing LogQL queries.
from the description (list) | Read |
loki_label_values List possible values for a Loki label key. Use this to build precise label matchers in LogQL.
from the description (list) | Read |
loki_list_instances List LokiStack instances available in the Kubernetes cluster. Call this first when using Loki Operator managed stacks so you can pass lokiNamespace and lokiName to other Loki tools.
from the name (list) | Read |
loki_query_range Execute a Loki LogQL range query and return matching log streams and lines. Use precise label matchers and a short time window first.
from the description (execute) | Destructive |
namespace annotation disagrees Optional namespace to limit health check scope (default: all namespaces)
from the name | Unknown |
namespaces Comma-separated list of namespaces to include in the graph, or 'all' to include all accessible mesh namespaces
from the description (list) | Read |
namespaces_list List all the Kubernetes namespaces in the current cluster
from the name (list) | Read |
nodes_log Get logs from a Kubernetes node (kubelet, kube-proxy, or other system logs). This accesses node logs through the Kubernetes API proxy to the kubelet
from the description (get) | Read |
nodes_stats_summary Get detailed resource usage statistics from a Kubernetes node via the kubelet's Summary API. Provides comprehensive metrics including CPU, memory, filesystem, and network usage at the node, pod, and container levels. On systems with cgroup v2 and kernel 4.20+, also includes PS...
from the description (get) | Read |
nodes_top List the resource consumption (CPU and memory) as recorded by the Kubernetes Metrics Server for the specified Kubernetes Nodes or all nodes in the cluster
from the description (list) | Read |
otelcol_get_component_schema Get the JSON schema for an OpenTelemetry Collector component's configuration options.
from the name (get) | Read |
otelcol_get_versions List available OpenTelemetry Collector versions and identify the latest.
from the name (get) | Read |
otelcol_list_components List available OpenTelemetry Collector components (receivers, processors, exporters, extensions, connectors) for a given version.
from the name (list) | Read |
otelcol_validate_config Validate an OpenTelemetry Collector component configuration against its JSON schema.
from the name | Unknown |
pipelineVersion Pipeline version (default: latest). Use specific version like 0.25.0 if needed
from the name | Unknown |
pods_delete Delete a Kubernetes Pod in the current or provided namespace with the provided name
from the name (delete) | Destructive |
pods_exec Execute a command in a Kubernetes Pod (shell access, run commands in container) in the current or provided namespace with the provided name and command
from the name (exec) | Destructive |
pods_get Get a Kubernetes Pod in the current or provided namespace with the provided name
from the name (get) | Read |
pods_list List all the Kubernetes pods in the current cluster from all namespaces
from the name (list) | Read |
pods_list_in_namespace List all the Kubernetes pods in the specified namespace in the current cluster
from the name (list) | Read |
pods_log Get the logs of a Kubernetes Pod in the current or provided namespace with the provided name
from the description (get) | Read |
pods_run Run a Kubernetes Pod in the current or provided namespace with the provided container image and optional name
from the name (run) | Destructive |
pods_top List the resource consumption (CPU and memory) as recorded by the Kubernetes Metrics Server for the specified Kubernetes Pods in the all namespaces, the provided namespace, or the current namespace
from the description (list) | Read |
projects_list List all the OpenShift projects in the current cluster
from the name (list) | Read |
resources_create_or_update Create or update a Kubernetes resource via Server-Side Apply. The manifest is the complete desired state: any field this tool previously set and the new manifest omits is removed. To edit an existing resource, fetch it with resources_get, modify it, then re-apply the full reso...
from the name (create) | Write |
resources_delete Delete a Kubernetes resource in the current cluster by providing its apiVersion, kind, optionally the namespace, and its name (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)
from the name (delete) | Destructive |
resources_get Get a Kubernetes resource in the current cluster by providing its apiVersion, kind, optionally the namespace, and its name (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)
from the name (get) | Read |
resources_list List Kubernetes resources and objects in the current cluster by providing their apiVersion and kind and optionally the namespace and label selector (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshi...
from the name (list) | Read |
resources_scale Get or update the scale of a Kubernetes resource in the current cluster by providing its apiVersion, kind, name, and optionally the namespace. If the scale is set in the tool call, the scale will be updated to that value. Always returns the current scale of the resource
from the description (update) | Write |
service Name of the service to troubleshoot
from the name | Unknown |
show_timeseries Display the results as an interactive timeseries chart. This tool works like execute_range_query but renders the results as a visual chart in the UI clients. Use it when the user wants to see a graph or visualization of time-series data and to use visuals to provide the answer...
from the description (execute) | Destructive |
targets_list List all available targets
from the name (list) | Read |
tekton_pipeline_start Start a Tekton Pipeline by creating a PipelineRun that references it
from the description (run) | Destructive |
tekton_pipelinerun_lifecycle Manage a Tekton PipelineRun lifecycle by restarting it with the same spec or cancelling it by setting spec.status to Cancelled.
from the description (run) | Destructive |
tekton_pipelinerun_logs Get logs for all TaskRuns owned by a Tekton PipelineRun. Use this to inspect PipelineRun execution output without locating pods manually.
from the description (runs) | Destructive |
tekton_task_start Start a Tekton Task by creating a TaskRun that references it
from the description (run) | Destructive |
tekton_taskrun_logs Get the logs from a Tekton TaskRun by resolving its underlying pod
from the description (run) | Destructive |
tekton_taskrun_restart Restart a Tekton TaskRun by creating a new TaskRun with the same spec
from the description (run) | Destructive |
tempo_get_trace_by_id Retrieve a single distributed trace by its trace ID from Tempo. Returns the full trace with all its spans, including service names, operation names, durations, and attributes. Use this tool when you already have a specific trace ID, e.g. from search results or logs.
from the name (get) | Read |
tempo_list_instances List all Tempo instances available in the Kubernetes cluster. Call this tool first to discover available Tempo instances before using other Tempo tools, as the returned namespace, name, and tenant values are required parameters for all other Tempo tools. Always print the outpu...
from the name (list) | Read |
tempo_search_tag_values List the known values for a specific tag (attribute key) in Tempo. Use this tool to discover what values exist for a given tag, e.g. to find all service names (values of "resource.service.name") or all HTTP methods (values of "span.http.request.method"). This is useful for bui...
from the name (search) | Read |
tempo_search_tags List available tag names (attribute keys) in Tempo, grouped by scope. Use this tool to discover which attributes are available for building TraceQL queries with tempo_search_traces. For example, this tool may reveal tag names like "service.name" (in the "resource" scope) or "h...
from the name (search) | Read |
tempo_search_traces Search for distributed traces in Tempo using TraceQL. Use this tool to find traces matching specific criteria such as service name, HTTP status code, duration, or other span or resource attributes. IMPORTANT — "slow" or "long" trace requests: Do NOT guess a duration threshold....
from the name (search) | Read |
vm_clone Clone a VirtualMachine on KubeVirt by creating a VirtualMachineClone resource. This creates a copy of the source VM with a new name using the KubeVirt Clone API
from the description (creates) | Write |
vm_console_screenshot Capture a screenshot of the graphical (VNC) console of a VirtualMachine on KubeVirt as a PNG image. Use this to see what is currently displayed on the VM's screen (for example firmware, a bootloader, or a login prompt). Read-only: it never sends input to the guest.
from the name | Unknown |
vm_create Create a VirtualMachine on KubeVirt with the specified configuration, automatically resolving instance types, preferences, and container disk images. VM will be created in Halted state by default; use autostart parameter to start it immediately.
from the name (create) | Write |
vm_create_from_template Create a VirtualMachine from a VirtualMachineTemplate (virt-template) on KubeVirt. Processes the template server-side to substitute parameters (required values, defaults, and auto-generated values like passwords), then creates the resulting VirtualMachine in the same namespace...
from the name (create) | Write |
vm_guest_info Get guest operating system information from a VirtualMachine's QEMU guest agent. Requires the guest agent to be installed and running inside the VM. Provides detailed information about the OS, filesystems, network interfaces, and logged-in users.
from the description (get) | Read |
vm_lifecycle Manage KubeVirt VirtualMachine lifecycle: start, stop, restart, pause, or unpause a VM
from the name | Unknown |
vm_troubleshoot Diagnose KubeVirt VirtualMachine issues with automated root-cause detection. Collects VM status, VMI status, volumes, DataVolume/PVC state, cloud-init configuration, pod state, logs, and events, then runs heuristic checks to identify specific problems and suggest fixes. Return...
from the description (runs) | Destructive |
windowsVersion Windows version: 10, 11, 2k22 (default), or 2k25
from the name | Unknown |
winImageDownloadURL Microsoft Windows ISO download URL (must be https://)
from the name | Unknown |
workload Optional workload or pod name to fetch logs from (if omitted, uses the service name)
from the name | Unknown |
Score
65 of 100 points (65%). A factor that was not scored counts as 0 of its full weight.
| Factor | Points | Full weight | Status |
|---|---|---|---|
| Tool capability | 22 | 35 | Partly scored |
| Access | 6 | 25 | Partly scored |
| Maintenance | 20 | 20 | Scored |
| Publisher | 17 | 20 | Scored |
Tool capability
47 read, 6 write, 16 destructive, 12 unknown.
Access
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Scope | unknown | unknown | unknown |
| Where it runs | Local process | 6 of 8 | Registry package transport is stdio. |
| Credentials | unknown | unknown | unknown |
Maintenance
| Part | Value | Points |
|---|---|---|
| Last commit | 0 days | 8 of 8 |
| Releases | 28 days | 6 of 6 |
| Issues | 193 closed / 256 issues (0.75) | 6 of 6 |
Publisher
| Part | Value | Points | Where this came from |
|---|---|---|---|
| Who publishes it | Organization | 5 of 8 | GitHub owner type is Organization (containers). Not on the vendor allowlist. |
| Registry listing | Listed | 5 of 5 | Official registry server io.github.containers/kubernetes-mcp-server (status active). |
| License | Apache-2.0 | 4 of 4 | GitHub SPDX license Apache-2.0. |
| Stars | 2162 | 2 of 2 | 2162 GitHub stars. |
| Repository age | 612 days | 1 of 1 | Repository created 2025-02-11T02:57:36Z. |
What this score does not cover
This score is not a code audit and it is not a human review. It has not been hands-on tested. Nothing on this page is a certification.
Access needed
Environment variables: unknown. The registry entry does not list any.
Maintenance
- Archived
- no
- Last commit
- 16 Oct 2026 · 5ce4c1b
- Latest release
- v0.0.67 · 18 Sep 2026
- Issues
- 63 open · 193 closed
- Stars
- 2,162
- License
- Apache-2.0
- Repository created
- 11 Feb 2025
npm and PyPI
- npm
- kubernetes-mcp-server · version 0.0.67 · downloads last month 56,751 · published 18 Sep 2026
- PyPI
- kubernetes-mcp-server · version 0.0.67 · downloads last month 7,912 · published 18 Sep 2026
- Maintainers
- manusa
Install
npx -y [email protected]
uvx kubernetes-mcp-server==0.0.67
docker run ghcr.io/containers/kubernetes-mcp-server:v0.0.67Other Kubernetes servers
Badge
Sources for this listing
registry:kubernetesgithub:kubernetes mcp in:name