Skip to content

kubernetes-mcp-server: read-only agent access to the cluster

AI tools · Kubernetes
Not studied

Added 2026-10-29.

Problem

The AI agent gets your own kubeconfig with admin rights. Cluster logs and resources can contain instructions for the model — and an agent with write access will carry them out.

Solution

kubernetes-mcp-server is "a powerful and flexible Kubernetes Model Context Protocol (MCP) server implementation with support for Kubernetes and OpenShift". It's a native Go implementation talking to the Kubernetes API, not a wrapper around kubectl. Connect the agent through it with read_only mode, Secrets denied, and a dedicated ServiceAccount with the view role.

Example

A ServiceAccount with read access in one namespace and a short-lived token:

kubectl create namespace mcp
kubectl create serviceaccount mcp-viewer -n mcp
kubectl create rolebinding mcp-viewer-rb -n mcp \
  --clusterrole=view --serviceaccount=mcp:mcp-viewer
TOKEN="$(kubectl create token mcp-viewer --duration=2h -n mcp)"
kubectl auth can-i delete pods -n mcp --as=system:serviceaccount:mcp:mcp-viewer   # expect "no"

view is a built-in ClusterRole, so the RoleBinding needs --clusterrole.

The server's config.toml:

read_only = true
toolsets = ["core"]

[[denied_resources]]
group = ""
version = "v1"
kind = "Secret"

kubernetes-mcp-server --config config.toml

When to use

For AI-assisted troubleshooting in a cluster — only on a test environment or with read-only rights.

Limitations

Version 0.0.x — the interface keeps changing. The view role doesn't allow reading Secrets, but it does allow reading logs and ConfigMaps — and those can hold sensitive data too.

Source

How to apply it yourself

  1. Bring up a kind cluster and the ServiceAccount from the example.
  2. Connect the agent with read_only = true.
  3. Make sure write attempts and reading Secrets are rejected.
  4. Mark it "Studied" after troubleshooting one real problem through the agent.