
K8scortex Mcp
A production-grade MCP server that wraps the Kubernetes API with 75+ tools spanning workloads, deployments, observability, RBAC, and GitOps operations across GKE, AKS, and EKS. It includes multi-cluster routing with a single cluster parameter, Entra ID OIDC authentication with five-tier role hierarchy, structured audit logging for every tool call, and Azure Key Vault integration for credential management. Supports both SSE/HTTP for programmatic clients and stdio for Claude Desktop. Ships with generic read tools for arbitrary resource kinds alongside curated, role-gated write operations that default to dry-run mode. Built for platform teams who need governed AI access to Kubernetes with proper authentication, authorization, and audit trails rather than unrestricted cluster access.
- GitHub stars
- 1
- tools
- 75
- transport
- STDIO
- env vars
- 3
- last updated
- Oct 27, 2026
Tools
75 toolsPublic tool metadata for what this MCP can expose to an agent.
list_podsLists pods in a specific namespace.2 params
Lists pods in a specific namespace.
clusterstringnamespacestringget_pod_logsRetrieves logs for a specific pod.5 params
Retrieves logs for a specific pod.
clusterstringcontainerNamestringnamespacestringpodNamestringtailLinesnumberdescribe_podShows detailed pod status including container states, conditions, resource settings, and recent events.3 params
Shows detailed pod status including container states, conditions, resource settings, and recent events.
clusterstringnamespacestringpodNamestringdescribe_deploymentShows details of a deployment.3 params
Shows details of a deployment.
clusterstringdeploymentNamestringnamespacestringlist_nodesLists cluster nodes.1 params
Lists cluster nodes.
clusterstringlist_statefulsetsLists StatefulSets in a specific namespace.2 params
Lists StatefulSets in a specific namespace.
clusterstringnamespacestringdescribe_statefulsetShows details of a StatefulSet.3 params
Shows details of a StatefulSet.
clusterstringnamespacestringstatefulSetNamestringlist_daemonsetsLists DaemonSets in a specific namespace.2 params
Lists DaemonSets in a specific namespace.
clusterstringnamespacestringdescribe_daemonsetShows details of a DaemonSet.3 params
Shows details of a DaemonSet.
clusterstringdaemonSetNamestringnamespacestringscale_deploymentScales replicas for a deployment.5 params
Scales replicas for a deployment.
clusterstringdeploymentNamestringdryRunbooleannamespacestringreplicasnumberrollout_statusChecks deployment rollout status (complete, in-progress, or stalled).3 params
Checks deployment rollout status (complete, in-progress, or stalled).
clusterstringdeploymentNamestringnamespacestringrollout_undoRolls a deployment back to the previous ReplicaSet template.4 params
Rolls a deployment back to the previous ReplicaSet template.
clusterstringdeploymentNamestringdryRunbooleannamespacestringrestart_podDeletes a pod to force a restart. Usually managed by a deployment/replicaset.4 params
Deletes a pod to force a restart. Usually managed by a deployment/replicaset.
clusterstringdryRunbooleannamespacestringpodNamestringget_configmapReads data from a ConfigMap.3 params
Reads data from a ConfigMap.
clusterstringconfigMapNamestringnamespacestringdescribe_namespace_quotaReads resource quotas for a namespace.2 params
Reads resource quotas for a namespace.
clusterstringnamespacestringlist_eventsLists recent cluster events for a namespace.2 params
Lists recent cluster events for a namespace.
clusterstringnamespacestringlist_persistent_volume_claimsLists PersistentVolumeClaims in a specific namespace with binding and capacity details.2 params
Lists PersistentVolumeClaims in a specific namespace with binding and capacity details.
clusterstringnamespacestringget_effective_permissionsEvaluates effective Kubernetes API permissions for a ServiceAccount using SubjectAccessReview checks.3 params
Evaluates effective Kubernetes API permissions for a ServiceAccount using SubjectAccessReview checks.
clusterstringnamespacestringserviceAccountNamestringget_hpa_statusRetrieves Horizontal Pod Autoscaler metrics and status.3 params
Retrieves Horizontal Pod Autoscaler metrics and status.
clusterstringhpaNamestringnamespacestringlist_warning_eventsFilters cluster events for warnings in a namespace.2 params
Filters cluster events for warnings in a namespace.
clusterstringnamespacestringget_node_pressureAnalyzes node resource pressure for a specific node.2 params
Analyzes node resource pressure for a specific node.
clusterstringnodeNamestringlist_clustersLists all registered Kubernetes clusters managed by KubeNexus.
Lists all registered Kubernetes clusters managed by KubeNexus.
No parameter schema in public metadata yet.
get_cluster_infoReturns API server URL, Kubernetes version, node count, and cloud metadata for a given cluster.1 params
Returns API server URL, Kubernetes version, node count, and cloud metadata for a given cluster.
clusterstringlist_jobsLists Jobs in a specific namespace.2 params
Lists Jobs in a specific namespace.
clusterstringnamespacestringcreate_jobCreates a new Job. Use either basic configuration or provide a raw YAML manifest.7 params
Creates a new Job. Use either basic configuration or provide a raw YAML manifest.
clusterstringcommandarraydryRunbooleanimagestringjobNamestringnamespacestringyamlManifeststringlist_cronjobsLists CronJobs in a specific namespace.2 params
Lists CronJobs in a specific namespace.
clusterstringnamespacestringsuspend_cronjobSuspends an active CronJob.4 params
Suspends an active CronJob.
clusterstringcronJobNamestringdryRunbooleannamespacestringresume_cronjobResumes a suspended CronJob.4 params
Resumes a suspended CronJob.
clusterstringcronJobNamestringdryRunbooleannamespacestringcreate_configmapCreates a new ConfigMap. Use either basic key-value data or provide a raw YAML manifest.6 params
Creates a new ConfigMap. Use either basic key-value data or provide a raw YAML manifest.
clusterstringconfigMapNamestringdataobjectdryRunbooleannamespacestringyamlManifeststringupdate_configmapUpdates an existing ConfigMap by patching its data.5 params
Updates an existing ConfigMap by patching its data.
clusterstringconfigMapNamestringdataobjectdryRunbooleannamespacestringcreate_secretCreates a new Opaque Secret. Use either basic stringData or provide a raw YAML manifest. stringData values will be base64-encoded automatically.6 params
Creates a new Opaque Secret. Use either basic stringData or provide a raw YAML manifest. stringData values will be base64-encoded automatically.
clusterstringdryRunbooleannamespacestringsecretNamestringstringDataobjectyamlManifeststringupdate_secretUpdates an existing Secret by patching its stringData. KNOWN LIMITATION: The Kubernetes API never returns stringData on read (it is write-only); the API server stores values as base64 in the data field. This means the client-side merge only contains the keys passed in args.str...5 params
Updates an existing Secret by patching its stringData. KNOWN LIMITATION: The Kubernetes API never returns stringData on read (it is write-only); the API server stores values as base64 in the data field. This means the client-side merge only contains the keys passed in args.str...
clusterstringdryRunbooleannamespacestringsecretNamestringstringDataobjectcreate_deploymentCreates a new Deployment. Use either basic configuration or provide a raw YAML manifest.8 params
Creates a new Deployment. Use either basic configuration or provide a raw YAML manifest.
clusterstringdeploymentNamestringdryRunbooleanimagestringnamespacestringportnumberreplicasnumberyamlManifeststringdelete_deploymentDeletes an existing Deployment.4 params
Deletes an existing Deployment.
clusterstringdeploymentNamestringdryRunbooleannamespacestringcreate_namespaceCreates a new Kubernetes Namespace.3 params
Creates a new Kubernetes Namespace.
clusterstringdryRunbooleannamespaceNamestringdelete_namespaceDeletes an existing Kubernetes Namespace.3 params
Deletes an existing Kubernetes Namespace.
clusterstringdryRunbooleannamespaceNamestringcreate_horizontal_pod_autoscalerCreates an HPA for a Deployment. Use either basic configuration or provide a raw YAML manifest.9 params
Creates an HPA for a Deployment. Use either basic configuration or provide a raw YAML manifest.
clusterstringdryRunbooleanhpaNamestringmaxReplicasnumberminReplicasnumbernamespacestringtargetCPUUtilizationPercentagenumbertargetDeploymentstringyamlManifeststringcreate_serviceCreates a new Service. Use either basic configuration or provide a raw YAML manifest.9 params
Creates a new Service. Use either basic configuration or provide a raw YAML manifest.
clusterstringdryRunbooleannamespacestringportnumberselectorobjectserviceNamestringtargetPortnumbertypestringyamlManifeststringlist_ingressesLists Ingress resources in a namespace.2 params
Lists Ingress resources in a namespace.
clusterstringnamespacestringget_service_endpointsShows endpoint addresses backing a Service.3 params
Shows endpoint addresses backing a Service.
clusterstringnamespacestringserviceNamestringupdate_ingressUpdates an existing Ingress. Merges new rules or annotations into the existing Ingress.6 params
Updates an existing Ingress. Merges new rules or annotations into the existing Ingress.
annotationsobjectclusterstringdryRunbooleaningressNamestringnamespacestringrulesarraycreate_network_policyCreates a new NetworkPolicy. Use either basic configuration or provide a raw YAML manifest.7 params
Creates a new NetworkPolicy. Use either basic configuration or provide a raw YAML manifest.
clusterstringdryRunbooleannamespacestringpodSelectorobjectpolicyNamestringpolicyTypesarrayyamlManifeststringset_resource_limitsSets CPU and Memory requests and limits for a specific container in a Deployment.9 params
Sets CPU and Memory requests and limits for a specific container in a Deployment.
clusterstringcontainerNamestringcpuLimitstringcpuRequeststringdeploymentNamestringdryRunbooleanmemoryLimitstringmemoryRequeststringnamespacestringget_resource_recommendationsSuggests optimal resource requests/limits based on current metrics heuristically.3 params
Suggests optimal resource requests/limits based on current metrics heuristically.
clusterstringdeploymentNamestringnamespacestringget_cluster_resource_utilisationReturns CPU and Memory usage vs capacity across all nodes.1 params
Returns CPU and Memory usage vs capacity across all nodes.
clusterstringcordon_nodeMarks a node as unschedulable.3 params
Marks a node as unschedulable.
clusterstringdryRunbooleannodeNamestringuncordon_nodeMarks a node as schedulable.3 params
Marks a node as schedulable.
clusterstringdryRunbooleannodeNamestringdrain_nodeCordons the node and evicts/deletes non-daemonset pods.4 params
Cordons the node and evicts/deletes non-daemonset pods.
clusterstringdryRunbooleanforcebooleannodeNamestringtaint_nodeAdds a taint to a node.6 params
Adds a taint to a node.
clusterstringdryRunbooleaneffectstringkeystringnodeNamestringvaluestringremove_taintRemoves a specific taint from a node by key.4 params
Removes a specific taint from a node by key.
clusterstringdryRunbooleankeystringnodeNamestringget_gitops_app_statusGets the health and sync status of an ArgoCD Application or Flux Kustomization.4 params
Gets the health and sync status of an ArgoCD Application or Flux Kustomization.
appNamestringclusterstringenginestringnamespacestringget_gitops_diffGets out-of-sync resources (ArgoCD) or managed resource inventory with revision drift (Flux Kustomization).4 params
Gets out-of-sync resources (ArgoCD) or managed resource inventory with revision drift (Flux Kustomization).
appNamestringclusterstringenginestringnamespacestringsync_gitops_appForces a sync/reconciliation of an ArgoCD Application, Flux Kustomization, or Flux HelmRelease.6 params
Forces a sync/reconciliation of an ArgoCD Application, Flux Kustomization, or Flux HelmRelease.
appNamestringclusterstringdryRunbooleanenginestringnamespacestringresourceTypestringcompare_clustersCompares the running version/state of an application across two clusters.5 params
Compares the running version/state of an application across two clusters.
appNamestringclusterAstringclusterBstringenginestringnamespacestringlist_flux_kustomizationsLists all Flux Kustomizations in a namespace with their ready/suspended/revision status.2 params
Lists all Flux Kustomizations in a namespace with their ready/suspended/revision status.
clusterstringnamespacestringlist_flux_helm_releasesLists all Flux HelmReleases in a namespace with chart name, version, and ready/suspended status.2 params
Lists all Flux HelmReleases in a namespace with chart name, version, and ready/suspended status.
clusterstringnamespacestringget_flux_helm_releaseGets detailed status of a Flux HelmRelease including chart version, values, and condition history.3 params
Gets detailed status of a Flux HelmRelease including chart version, values, and condition history.
clusterstringnamestringnamespacestringlist_flux_sourcesLists Flux source objects (GitRepository, HelmRepository, OCIRepository, Bucket) with their URL, ref, and ready status.3 params
Lists Flux source objects (GitRepository, HelmRepository, OCIRepository, Bucket) with their URL, ref, and ready status.
clusterstringnamespacestringsourceTypestringsuspend_flux_resourceSuspends reconciliation of a Flux Kustomization or HelmRelease to pause automated deployments.5 params
Suspends reconciliation of a Flux Kustomization or HelmRelease to pause automated deployments.
clusterstringdryRunbooleannamestringnamespacestringresourceTypestringresume_flux_resourceResumes reconciliation of a suspended Flux Kustomization or HelmRelease.5 params
Resumes reconciliation of a suspended Flux Kustomization or HelmRelease.
clusterstringdryRunbooleannamestringnamespacestringresourceTypestringlist_flux_alertsLists Flux Notification Alert objects showing which events trigger which providers.2 params
Lists Flux Notification Alert objects showing which events trigger which providers.
clusterstringnamespacestringlist_k8s_resourcesGeneric read: list Kubernetes resources by group/version/resource.7 params
Generic read: list Kubernetes resources by group/version/resource.
apiGroupstringclusterstringlabelSelectorstringnamespacestringnamespacedbooleanresourcestringversionstringget_k8s_resourceGeneric read: get a single Kubernetes resource by group/version/resource/name.7 params
Generic read: get a single Kubernetes resource by group/version/resource/name.
apiGroupstringclusterstringnamestringnamespacestringnamespacedbooleanresourcestringversionstringlist_node_poolsGroups nodes by managed-cloud node pool labels (AKS/EKS/GKE) and reports pool health.1 params
Groups nodes by managed-cloud node pool labels (AKS/EKS/GKE) and reports pool health.
clusterstringget_node_pool_detailReturns detailed node, spot/preemptible, and optional metrics view for a specific node pool.2 params
Returns detailed node, spot/preemptible, and optional metrics view for a specific node pool.
clusterstringpoolNamestringget_workload_identity_configReturns workload identity annotation configuration for a ServiceAccount (AKS/EKS/GKE conventions).3 params
Returns workload identity annotation configuration for a ServiceAccount (AKS/EKS/GKE conventions).
clusterstringnamespacestringserviceAccountNamestringvalidate_workload_identityValidates identity chain from ServiceAccount annotation to pods using that ServiceAccount.3 params
Validates identity chain from ServiceAccount annotation to pods using that ServiceAccount.
clusterstringnamespacestringserviceAccountNamestringlist_pod_disruption_budgetsLists PodDisruptionBudgets in a namespace with budget satisfaction status.2 params
Lists PodDisruptionBudgets in a namespace with budget satisfaction status.
clusterstringnamespacestringget_pdb_statusReturns detailed status and covered pods for a PodDisruptionBudget.3 params
Returns detailed status and covered pods for a PodDisruptionBudget.
clusterstringnamespacestringpdbNamestringlist_vpasLists VerticalPodAutoscaler objects in a namespace and their update mode/recommendation state.2 params
Lists VerticalPodAutoscaler objects in a namespace and their update mode/recommendation state.
clusterstringnamespacestringget_vpa_recommendationReturns VPA recommendation lower/target/upper bounds for a workload when available.3 params
Returns VPA recommendation lower/target/upper bounds for a workload when available.
clusterstringnamespacestringvpaNamestringlist_storage_classesLists StorageClasses and indicates default class.1 params
Lists StorageClasses and indicates default class.
clusterstringget_storage_classReturns details for a specific StorageClass.2 params
Returns details for a specific StorageClass.
clusterstringstorageClassNamestringget_addon_healthChecks health of common kube-system addons (CoreDNS, metrics-server, kube-proxy, CNI).1 params
Checks health of common kube-system addons (CoreDNS, metrics-server, kube-proxy, CNI).
clusterstringlist_limit_rangesLists LimitRange objects in a namespace and default resource constraints.2 params
Lists LimitRange objects in a namespace and default resource constraints.
clusterstringnamespacestringSponsors
Configuration
KUBECONFIGPath to your kubeconfig file. Each context becomes a cluster. Defaults to ~/.kube/config.
CLUSTERS_CONFIGOptional path to a cluster registry JSON file mixing kubeconfig, EKS, GKE and Key Vault clusters.
K8SCORTEX_STDIO_ROLESRoles for the local session, e.g. 'developer' for read-only tools. Defaults to platform-engineer.
Readme
K8sCortex — Kubernetes MCP Server
Give your AI agents Kubernetes access your security team will sign off on. K8sCortex is one governed MCP gateway for GKE, EKS, AKS, OpenShift and local clusters: SSO on every request, role tiers, per-cluster policies, dry-run by default, and an audit log of who asked for what.
Most Kubernetes MCP servers hand an agent your kubeconfig. K8sCortex sits in between: it decides, per person and per cluster, which of its 75 tools may run, and records every call. Clusters from different clouds live in one registry, with credentials minted on demand.
Details
- Repository
- github.com/apatilgtn/k8scortex-mcp
- Category
- Cloud & Infrastructure
- Package
k8scortex-mcp- Transport
- STDIO
- Registry
- MCP registry, active