How to Deploy a Kubernetes MCP Server for AI Platform DevOps

When an AI agent is given cluster-admin credentials to debug a Kubernetes namespace, a single hallucinated delete flag can wipe out an entire production control plane before a human operator can intervene. The challenge of agentic DevOps is not teaching models to write kubectl commands, it is constructing a secure API bridge that restricts their access to read-only diagnostic resources while preserving real-time troubleshooting capabilities.

In a typical DevOps setting, engineers spend hours logging into clusters, running port-forwards, and querying resources to diagnose issues. Introducing AI agents like Claude Code, Codex, or Cursor to these environments can accelerate debugging, but doing so without boundaries is dangerous. A traditional shell-execution tool gives the model access to the entire terminal. If the model runs a script with an incorrect namespace parameter or a destructive command, the system state is corrupted. Local agent instances also store context in memory, meaning that when the session crashes, all troubleshooting history is lost, leaving human teammates with no visibility into what the agent did.

To solve this coordination and safety problem, DevOps teams are moving toward remote, shared workspaces where agents and humans collaborate on the same file systems. In a persistent Fast.io workspace, the agent writes diagnostic reports, deployment logs, and configuration drafts to specific folders. This neutral ground ensures that the agent's work is persisted, auditable, and accessible to other team members. However, the agent must still query the Kubernetes cluster itself to get the raw logs and resource states. This is where the Model Context Protocol (MCP) and a dedicated Kubernetes MCP server are required.

The Model Context Protocol (MCP) is an open standard designed by Anthropic to establish secure, structured communication between AI models and external data sources. A Kubernetes MCP server acts as an API bridge, translating these protocol requests into secure Kubernetes API queries. Instead of granting an agent raw shell access to execute arbitrary kubectl commands, the MCP server exposes a consolidated MCP toolset. The agent can only execute the specific tools defined by the server, such as listing pods, reading logs, and describing deployments.

The npm package mcp-server-kubernetes is a widely used implementation that allows developers to run an MCP gateway for Kubernetes clusters. In May 2026, version 3.7.0 was released to address critical security vulnerabilities found in earlier versions. Specifically, CVE-2026-47250 was identified in the kubectl_generic tool, where user-supplied flags were passed to the kubectl binary without proper validation, enabling potential privilege escalation. In version 3.7.0, this tool was replaced with strict API-bound tools that do not accept arbitrary command-line flags. In addition, version 3.6.0 fixed CVE-2026-46519, which involved a bug where security environment variables like ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, and ALLOWED_TOOLS were not properly enforced during tool execution.

By deploying the latest version of the Kubernetes MCP server, DevOps teams ensure that the AI model cannot bypass tool constraints. The server exposes a set of deterministic API tools:

• list_pods: Queries the Kubernetes API to return a list of pods in a given namespace.
• get_pod_logs: Retrieves container log streams for troubleshooting.
• describe_pod: Fetches detailed status and event logs for a pod.
• list_deployments: Returns deployment configurations and replica counts.

Because the server interacts directly with the Kubernetes API server using standard client libraries rather than executing raw bash commands, it prevents command-injection attacks. This structural constraint isolates the agent's execution scope to query-only operations, neutralizing the risk of accidental resource deletion.

Secure your Kubernetes agent workflows

Deploy your MCP server, connect it to Fast.io workspaces, and manage your DevOps files securely in a collaborative environment. Start your organization's 14-day free trial today.

Start 14-Day Trial

Deploying the MCP server securely requires configuring a dedicated Kubernetes ServiceAccount with restricted Role-Based Access Control (RBAC) permissions. You must avoid using cluster-admin credentials, as doing so defeats the safety boundaries of the MCP gateway. Restricting the agent's ServiceAccount to the get, list, and watch verbs ensures that even if the AI agent is compromised or hallucinates a write command, the Kubernetes API server itself rejects the request. The security boundary lives in RBAC, not in the model's behavior.

To implement this, apply the following YAML manifest to your cluster. It creates a dedicated ServiceAccount named mcp-agent-sa and binds it to a read-only ClusterRole that permits get, list, and watch operations on core resources:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: mcp-agent-sa
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mcp-agent-read-only
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "services", "configmaps", "namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mcp-agent-read-only-binding
subjects:
- kind: ServiceAccount
  name: mcp-agent-sa
  namespace: default
roleRef:
  kind: ClusterRole
  name: mcp-agent-read-only
  apiGroup: rbac.authorization.k8s.io

Save this file as mcp-rbac.yaml and apply it to your cluster using the command kubectl apply -f mcp-rbac.yaml. This configuration creates a strict security perimeter. For more details on configuring roles, refer to the official Kubernetes RBAC documentation. The ServiceAccount token generated by Kubernetes will be used by the MCP server to authenticate with the API server, ensuring that all API calls initiated by the agent are constrained to read-only diagnostics.

Once the RBAC configuration is applied, you can connect the MCP server to your local AI clients or remote workspaces. The Kubernetes MCP server reads the cluster context using a standard kubeconfig file. If you are running the server locally, it automatically detects your active context at ~/.kube/config.

To configure Claude Desktop to use the server, open your configuration file located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS and add the kubernetes server configuration under the mcpServers block:

{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": ["-y", "mcp-server-kubernetes"]
    }
  }
}

If you need to connect a remote agent or a workspace to a remote cluster, you must generate a long-lived token for the ServiceAccount. In Kubernetes 1.24 and later, tokens are not created automatically. You must apply a Secret manifest to bind a token to the ServiceAccount:

apiVersion: v1
kind: Secret
metadata:
  name: mcp-agent-token
  namespace: default
  annotations:
    kubernetes.io/service-account.name: mcp-agent-sa
type: kubernetes.io/service-account-token

After applying this manifest, retrieve the generated token using the command kubectl get secret mcp-agent-token -n default -o jsonpath='{.data.token}' | base64 --decode. You can then construct a scoped kubeconfig file using this token and place it in the environment where the MCP server runs, setting the KUBECONFIG environment variable to its path.

This setup enables efficient diagnostic workflows. Instead of manually running kubectl logs and kubectl describe commands across multiple terminals, the engineer can ask the agent: "Check the default namespace for any failing pods and summarize their recent log errors." The agent calls the MCP tools, analyzes the logs, and presents the root cause in a structured format. For hosting coding agents with persistent memory, check out Fast.io storage for agents.

While the MCP server handles active cluster queries, a persistent cloud workspace is required to manage the artifacts generated during troubleshooting. When an agent identifies a pod crash, it should write the log bundle, the post-mortem analysis, and the draft deployment manifests to a shared workspace folder. This step preserves the context that would otherwise be lost when the agent process terminates.

In a Fast.io workspace, developers and agents operate on the same files. Every upload, modification, and version restoration is recorded in the append-only audit log. This immutable record acts as a chain of custody, ensuring that humans can verify every file edit the agent made. If the agent drafts a deployment update to fix a crash, it saves the file as deployment-patch.yaml in the workspace. A human engineer can review the patch, run a dry-run test, and apply it to the cluster, maintaining a safe human-in-the-loop workflow.

To start building these shared agent workspaces, a team member creates an organization, configures the workspace, and connects their coding agents. To transition the workspace to production, the creator can transfer organization ownership to a human manager via a claim link. Every organization runs on a paid subscription. After the 14-day free trial, which requires a credit card, teams can choose from three paid plans: Starter plan at 29 USD monthly, Business plan at 99 USD monthly, or Growth plan at 299 USD monthly. These plans provide the persistent storage, hybrid search, and audit trails necessary to coordinate DevOps teams and AI agents safely.