manusa/Kubernetes MCP Server

MCP Developer Tools

A native Go‑based Kubernetes Model Context Protocol (MCP) server that directly interacts with the Kubernetes API for CRUD, Helm, Tekton and observability operations across multiple clusters.

Track releases GitHub

Go Latest v0.0.65 · 12d ago Security brief →

Features

Direct low‑latency interaction with Kubernetes/OpenShift APIs via a single native binary
Supports generic resource CRUD, Pod exec/logs/top/delete, Namespace listing, Event viewing, OpenShift Project handling
Built‑in Helm chart install/list/uninstall and Tekton Pipeline/Task execution
Optional OpenTelemetry tracing/metrics with a live `/stats` endpoint
Multi‑cluster management from a single kubeconfig

Recent releases

View all 27 releases →

No immediate action

v0.0.65 Mixed 12d

mcpchecker update + NetObserv + fixes

Open

Review required

v0.0.64 Breaking risk 16d

Auth Dependencies

Kiali refactor, structuredContent API, dependency bumps, logging

Open

Review required

v0.0.63 Breaking risk 1mo

Auth Dependencies

kubevirt, config, auth, logging, tests, CI, deps

Open

v0.0.62 Breaking risk 2mo

Breaking changes

fix(validation)!: reject kubeconfig auth mode with require_oauth at startup

Notable features

add MCP resource
make ReloadConfiguration fully transactional

Full changelog

What's Changed

fix(http): complete hot-reload surface for HTTP middleware config by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1107
fix(auth): propagate certificate_authority to token exchange HTTP client by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1109
build(deps): bump github.com/google/jsonschema-go from 0.4.2 to 0.4.3 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1112
feat(api): add MCP resource by @swghosh in https://github.com/containers/kubernetes-mcp-server/pull/1091
build(deps): bump mcpchecker/mcpchecker from 0.0.16 to 0.0.17 in the github-actions group by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1118
fix(http): fall back to openid-configuration when well-known endpoint returns empty body by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1117
build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1120
build(deps): bump mcpchecker/mcpchecker from 0.0.17 to 0.0.18 in the github-actions group by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1127
build(deps): bump github.com/modelcontextprotocol/go-sdk from 1.5.0 to 1.6.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1123
fix(mcp): harden resources surface for hot reload by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1114
fix(validation)!: reject kubeconfig auth mode with require_oauth at startup by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1122
build(deps): bump github.com/tektoncd/pipeline from 1.11.1 to 1.12.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1133
build(deps): bump github.com/fsnotify/fsnotify from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1134
refactor(mcp): make ReloadConfiguration fully transactional (#1128) by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1130

New Contributors

@swghosh made their first contribution in https://github.com/containers/kubernetes-mcp-server/pull/1091

Full Changelog: https://github.com/containers/kubernetes-mcp-server/compare/v0.0.61...v0.0.62

View release on GitHub

v0.0.61 New feature 3mo

Security fixes

Helm chart: enable read-only root filesystem (security)
Helm chart: make ServiceAccount token auto‑mount configurable (security)

Notable features

Multi-arch Kubernetes MCP Server build support
Cross‑compile hook for GitHub Actions in the build pipeline
Gateway API HTTPRoute support in helm-charts

Full changelog

What's Changed

test(mcp): add integration tests for prompt target parameter in multi-cluster by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/996
refactor(evals): migrate llmJudge to builtin.llm-agent format by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1001
feat(http): Fine-tune HTTP server settings by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/991
feat(helm): add backend storage driver support by @difrost in https://github.com/containers/kubernetes-mcp-server/pull/998
build(deps): bump mcpchecker/mcpchecker from 0.0.12 to 0.0.14 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1003
fix(cmd): cluster provider validation to include all possible strategies by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1007
fix(python): bump requires-python, portable sed, and signal forwarding by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1005
refactor(helm): resolve config in constructor following Kiali pattern by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1006
test(validation): add bypass coverage and fallback config validation by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/994
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1013
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1014
build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.64.0 to 0.65.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1021
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1015
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1022
test(mcp): resolve kiali toolset name dynamically in require_tls tests by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1025
chore: update mcpchecker evaluation results by @github-actions[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1023
feat(tekton): add Tekton toolset with pipeline and task management by @ksimon1 in https://github.com/containers/kubernetes-mcp-server/pull/892
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1028
build(deps): bump github.com/modelcontextprotocol/go-sdk from 1.4.1 to 1.5.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1027
build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1030
build(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1031
feat(build): multi-arch kubernetes mcp server by @modassarrana89-new in https://github.com/containers/kubernetes-mcp-server/pull/1029
feat(kiali): Setup tracing in Kiali environment by @josunect in https://github.com/containers/kubernetes-mcp-server/pull/1024
build(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1035
feat(build): Adding cross-compile hook for gh actions by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1032
fix(build): restore ARCHS variable, simplify multi-arch, and enable s390x/ppc64le container images by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1036
chore: update mcpchecker evaluation results by @github-actions[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1038
build(deps): bump mcpchecker/mcpchecker from 0.0.14 to 0.0.15 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1041
test(config): tool override tests are compatible with downstream changes by @Cali0707 in https://github.com/containers/kubernetes-mcp-server/pull/1040
feat(evals): add mcpchecker diff to compare PR results against baseline by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1034
feat(auth): add Microsoft Entra ID support with On-Behalf-Of token exchange by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/953
fix(evals): do not use docker images, add core-eval-testing evals by @mvinkler in https://github.com/containers/kubernetes-mcp-server/pull/1037
Entra ID / OBO test follow-ups and dead code cleanup by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1046
fix(core): replace unsafe type assertions with safe parameter helpers by @xingyug in https://github.com/containers/kubernetes-mcp-server/pull/1039
fix(test): call resp.Body.Close() instead of referencing method value by @xingyug in https://github.com/containers/kubernetes-mcp-server/pull/1048
refactor(auth): deduplicate OIDC config fetches and simplify token exchange by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1047
fix(api): migrate tool handlers to WrapParams sticky-error pattern by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1049
fix(evals): Replace unmaintained bitnami helm charts by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1052
ci(evals): add helm option to mcpchecker runner by @Cali0707 in https://github.com/containers/kubernetes-mcp-server/pull/1053
feat(http): add per-session rate limiting via MCP middleware by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1051
build(deps): bump mcpchecker/mcpchecker from 0.0.15 to 0.0.16 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1056
build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1055
fix(config): enforce all Validate() checks on SIGHUP reload (#989) by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1058
fix(pods): resolve default container for multi-container pods (KEP-2227) by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1060
fix(config): auto-select kubeconfig context when current-context is empty by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1062
build(deps): bump k8s.io/kubectl from 0.35.3 to 0.35.4 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1065
build(deps): bump k8s.io/apiextensions-apiserver from 0.35.3 to 0.35.4 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1067
fix(config): validate token exchange fields at config load (#1057) by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1072
fix(config): normalize whitespace for token exchange fields before validation by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1074
fix(config): validate confirmation fields at config load (#1071) by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1075
feat(helm-charts): add Gateway API HTTPRoute support by @muroed in https://github.com/containers/kubernetes-mcp-server/pull/1059
feat(config): add skip_jwt_verification to enforce OIDC verification by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1078
chore: update mcpchecker evaluation results by @github-actions[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1076
fix(helm-charts): address HTTPRoute follow-ups from #1059 by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1082
fix(evals): fix kubevirt eval task namespace races and setup failures by @lyarwood in https://github.com/containers/kubernetes-mcp-server/pull/1054
fix(evals): fix kubernetes/scale-deployment cleanup script by @difrost in https://github.com/containers/kubernetes-mcp-server/pull/1073
build(deps): bump github.com/tektoncd/pipeline from 1.11.0 to 1.11.1 by @dependabot[bot] in https://github.com/containers/kubernetes-mcp-server/pull/1085
fix(auth): restore default passthrough of Authorization header to cluster by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1084
fix(auth): restore Derived() require_oauth guard and broaden raw-token coverage by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1088
fix(evals): rename tasksets: kubernetes to core by @mvinkler in https://github.com/containers/kubernetes-mcp-server/pull/1081
fix(helm-charts): enable read-only root filesystem in Helm chart (security) by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1090
fix(helm-charts): make ServiceAccount token auto-mount configurable on Helm chart (security) by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1093
chore(ci): group dependabot updates for k8s, otel, and golang.org/x by @manusa in https://github.com/containers/kubernetes-mcp-server/pull/1101
feat(kiali): refactor from v2.25 (code + evals) by @aljesusg in https://github.com/containers/kubernetes-mcp-server/pull/969
fix(kiali): use dynamic toolset name in tests to avoid downstream conflicts by @matzew in https://github.com/containers/kubernetes-mcp-server/pull/1103
fix(auth): propagate config reload to HTTP authorization middleware by @nader-ziada in https://github.com/containers/kubernetes-mcp-server/pull/1105

New Contributors

@modassarrana89-new made their first contribution in https://github.com/containers/kubernetes-mcp-server/pull/1029
@xingyug made their first contribution in https://github.com/containers/kubernetes-mcp-server/pull/1039
@muroed made their first contribution in https://github.com/containers/kubernetes-mcp-server/pull/1059

Full Changelog: https://github.com/containers/kubernetes-mcp-server/compare/v0.0.60...v0.0.61

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.