Direct API access is better than wrapping kubectl, and more dangerous
kubernetes-mcp-server is a Go implementation that talks directly to the Kubernetes API. It does not require kubectl, Helm, Node, or Python when installed as a native binary. The core toolset lists and reads resources, examines events and logs, shows resource usage, executes commands inside pods, runs images, applies manifests, scales workloads, and deletes objects. Optional groups add Helm, Tekton, KubeVirt, Kiali, NetObserv, and kcp operations.
That native design avoids parsing terminal output and waiting for child processes. It also gives an MCP client a direct path to the cluster under the identity configured for the server. A language model can make a syntactically valid but operationally bad request just as easily as a human can. The safety case therefore comes from Kubernetes RBAC, server flags, denied resources, tool selection, and approval policy, never from the model choosing the right verb.
Read-only RBAC is the sensible first deployment
The repository includes a production guide that creates an mcp-viewer ServiceAccount, binds the built-in view role, mints a time-bound token, and writes a dedicated kubeconfig. Namespace-scoped binding is offered as the tighter option. This separates the agent from a developer's personal admin context and makes the allowed API calls visible through normal Kubernetes authorization.
Server configuration adds another layer. --read-only blocks writes. --disable-destructive blocks delete and update operations while allowing other behavior. TOML can deny specific resource kinds such as Secrets, select toolsets, set telemetry, and restrict cluster-provider behavior. Multi-cluster support is enabled by default, so a server reading a kubeconfig with several contexts can expose a context argument on applicable tools. Disable it when one cluster is the intended boundary.
The distinction between read-only and safe is still important. Pod logs, events, resource definitions, and kubeconfig details may contain internal names or data. The config toolset can view Kubernetes configuration. Node log and pod exec features are especially powerful. Grant only the API verbs and namespaces the workflow needs, then keep sensitive resource kinds denied even if the server itself claims to redact credentials in MCP logs.
What happened when we ran it
Our sandbox installed 393 Go packages in 72 seconds. The build completed in 129 seconds. Tests finished in 102 seconds, with go test reporting 36 passed and zero failed out of 36. At commit 5574998, the checkout held 710 files, roughly 71,323 lines of source, and occupied 27.2 MB. The repository also had 13 CI workflow files, a Dockerfile, and a tests directory.
This batch's only clean measured test command supports confidence in the checked-out Go build path. Our unprivileged sandbox had no secrets, so it did not authenticate to a real cluster or prove that a particular RBAC policy, Helm release, HTTP identity provider, or multi-cluster setup works. Those require deployment-specific acceptance tests.
A useful production check should cover denied Secrets, read-only rejection of apply and delete, namespace boundaries, context selection, token expiry, and log redaction. For write-enabled trials, create a disposable namespace and assert the exact changes after every tool. The 36 passing tests are a good baseline, not permission to skip cluster-level policy tests.
Full desired-state apply can remove omitted fields
The generic resources_create_or_update tool uses Server-Side Apply. Its input is the complete desired YAML or JSON resource, not a partial patch. The README warns that a field previously set by this tool may be removed when a later manifest omits it. An agent editing an existing object should fetch the resource, modify the intended section, and send back the full desired state.
That behavior makes casual auto-approval risky. A generated manifest can look plausible while dropping an environment variable, probe, label, or security setting that was not in the model's context. GitOps remains the safer production change path: let the agent propose a file, review it, then allow Argo CD or another controller to reconcile it. The MCP server is strongest for diagnosis and bounded repair, not as an invisible replacement for change review.
Toolsets help reduce both context and authority. Enabling only core read operations gives the model fewer schemas to compare and fewer ways to act. Helm, KubeVirt, Tekton, and network-observability tools should appear only for users who work with those systems. A smaller tool list also makes an approval dialog more meaningful because the operator can understand what the client is capable of invoking.
Version 0.0.66 needs a long-session memory check
The latest release is v0.0.66 from July 31, 2026. Open issue 1363 reports that three HTTP deployments with 512 MiB limits showed continuing RSS growth after upgrading, while v0.0.65 plateaued after rollback. The reporter associates the change with the transport and session layer, but that cause is not confirmed. Treat the observed growth and successful rollback as the finding, not the proposed explanation.
The repository was pushed on August 25, and recent pull requests cover token exchange, Argo CD evaluation, client connectivity, observability tests, and configuration. The GitHub open count of 92 includes issues and pull requests. Activity is strong enough that a July release date does not suggest neglect. It also means teams should pin versions and exercise both stdio and Streamable HTTP paths they plan to operate.
Use it as a constrained operator, not a cluster administrator
This server earns a serious trial for Kubernetes troubleshooting. The single binary, direct API client, detailed tool schemas, OpenShift support, multiple distribution formats, and clean test run are all practical strengths. It can give an assistant the information needed to connect events, logs, resources, and metrics without copying terminal output into chat.
The recommended configuration is deliberately boring: one cluster, a dedicated read-only ServiceAccount, short-lived credentials, denied sensitive kinds, and only the required toolsets. Expand authority for a disposable environment before considering a production namespace. If routine changes already flow through Git, keep them there. kubernetes-mcp-server is most useful when it helps an operator understand a cluster faster while Kubernetes remains the final permission system.