kubeview-mcp

# KubeView MCP

[![npm version](https://img.shields.io/npm/v/kubeview-mcp)](https://www.npmjs.com/package/kubeview-mcp)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Node.js](https://img.shields.io/badge/node-%3E%3D22-brightgreen)](https://nodejs.org/)
[![MCP](https://img.shields.io/badge/MCP-2026--07--28-0ea5e9)](https://modelcontextprotocol.io/specification/2026-07-28)

Read-only [Model Context Protocol](https://modelcontextprotocol.io/) server for Kubernetes diagnostics. Instead of exposing dozens of tools, it gives the agent a sandboxed TypeScript runtime: a single `run_code` call can query Kubernetes, Helm, Argo Workflows, and Argo CD, correlate the results, and return only the answer. Intermediate payloads never pass through the model's context window. Based on the [code execution with MCP](https://www.anthropic.com/engineering/code-execution-with-mcp) pattern.

> Background: [Evicting MCP tool calls from your Kubernetes cluster](https://dev.to/mikhae1/evicting-mcp-tool-calls-from-your-kubernetes-cluster-428k)

## How it works

v2 publishes exactly two public tools: `run_code` and an approval-gated `kube_pod_exec`. Everything else is discovered inside the sandbox via `tools.list()`, `tools.search()`, and `tools.help()`, following the MCP [progressive discovery and programmatic calling](https://modelcontextprotocol.io/docs/2026-07-28/develop/clients/client-best-practices) guidance.

`run_code` executes bounded TypeScript with top-level `await`. One call can list workloads, correlate events, fetch logs, and diff Helm state without shipping intermediate payloads back through the model:

```ts
const pods = await tools.kubernetes.list({ namespace: 'payments' });
const unhealthy = pods.items.filter((p) => p.status?.phase !== 'Running');

return Promise.all(
  unhealthy.map(async (pod) => ({
    pod: pod.metadata?.name,
    logs: await tools.kubernetes.logs({
      namespace: 'payments',
      podName: pod.metadata?.name,
      tailLines: 100,
    }),
  })),
);
```

- **Sensitive isolation** — `kube_pod_exec` is unreachable from sandboxed code. Top-level exec requires MCP elicitation, is bound to the argument digest, expires after 10 minutes, and fails closed. `kube_port_forward` is never a top-level tool and is denied inside code mode by default. `tools.disabled()` reports which policy blocked a capability and whether that denial is configurable.
- **API-driven discovery** — Argo Workflows and Argo CD are detected from the Kubernetes API, scoped to the active kube context, cached for 60 s. An unavailable optional API never blocks startup.
- **Native reads** — resources, metrics, logs, events, and network probes go through the Kubernetes API. Helm releases are parsed from cluster Secrets or ConfigMaps; a local `helm` binary is a fallback, not a prerequisite.

## Quick start

**Prerequisites:** Node.js ≥ 22 and access to a cluster (`KUBECONFIG` or in-cluster service account).

```bash
npx -y kubeview-mcp

# Claude Code
claude mcp add kubernetes -- npx kubeview-mcp
```

```json
{
  "mcpServers": {
    "kubeview": {
      "command": "npx",
      "args": ["-y", "kubeview-mcp"]
    }
  }
}
```

In Cursor, `/kubeview/code-mode` injects the typed API into context.

## Configuration

### Cluster

| Variable                        | Description                                                                                  | Default          |
| ------------------------------- | -------------------------------------------------------------------------------------------- | ---------------- |
| `KUBECONFIG`                    | Kubeconfig path(s); multiple files are merged like kubectl                                   | `~/.kube/config` |
| `MCP_KUBE_CONTEXT`              | Default context (name or alias); defaults to the active context                              | unset            |
| `MCP_KUBE_CONTEXTS`             | Context allowlist and aliases, e.g. `dev,staging-*,prod=arn:…/prod` ([details](#multiple-clusters)) | all contexts     |
| `MCP_K8S_SKIP_TLS_VERIFY`       | Skip TLS verification for the Kubernetes API (`true`/`1`)                                    | `false`          |
| `MCP_TIMEOUT`                   | Default operation timeout in ms                                                              | plugin default   |
| `MCP_HIDE_SENSITIVE`            | Mask sensitive data globally                                                                 | `false`          |
| `MCP_DISABLE_KUBERNETES_PLUGIN` | Disable the Kubernetes plugin (`true`/`1`)                                                   | unset            |
| `MCP_DISABLE_HELM_PLUGIN`       | Disable the Helm plugin (`true`/`1`)                                                         | unset            |

### Mode and capabilities

| Variable                       | Description                                          | Default      |
| ------------------------------ | ---------------------------------------------------- | ------------ |
| `MCP_MODE`                     | `code` (default), `all` (alias), or `tools`          | `code`       |
| `MCP_CODE_MODE_DISABLED_TOOLS` | Comma-separated code-mode denials; empty enables all | JSON/default |
| `MCP_ARGO_TOOLS`               | Argo override: `auto`, `on`, `off`                   | `auto`       |
| `MCP_ARGOCD_TOOLS`             | Argo CD override: `auto`, `on`, `off`                | `auto`       |
| `MCP_LOG_LEVEL`                | `error`, `warn`, `info`, `debug`                     | `info`       |
| `KUBE_MCP_FORCE_VM_SANDBOX`    | Force `node:vm` in the standalone runtime            | unset        |

### HTTP transport

| Variable                    | Description                                                 | Default           |
| --------------------------- | ----------------------------------------------------------- | ----------------- |
| `MCP_TRANSPORT`             | `stdio` or `http`                                           | `stdio`           |
| `MCP_HTTP_HOST` / `_PORT`   | HTTP bind (when `MCP_TRANSPORT=http`)                       | `127.0.0.1:3000`  |
| `MCP_HTTP_PATH`             | Streamable HTTP endpoint path                               | `/mcp`            |
| `MCP_HTTP_JSON_RESPONSE`    | Prefer JSON over SSE (drops mid-call notifications)         | `false`           |
| `MCP_ALLOWED_HOSTS`         | Host allowlist (required when binding to `0.0.0.0`/`::`)    | local defaults    |
| `MCP_ALLOWED_ORIGINS`       | Origin allowlist for HTTP                                   | unset             |
| `MCP_APPROVAL_STATE_SECRET` | Shared 32+ byte signing secret; required for HTTP approvals | ephemeral (stdio) |
| `MCP_APPROVAL_REPLAY_DIR`   | Absolute shared-volume directory for one-time HTTP approvals | unset             |

```bash
mkdir -p /tmp/kubeview-mcp-approvals
MCP_APPROVAL_STATE_SECRET='replace-with-at-least-32-random-bytes' \
MCP_APPROVAL_REPLAY_DIR=/tmp/kubeview-mcp-approvals \
MCP_TRANSPORT=http MCP_HTTP_HOST=127.0.0.1 MCP_HTTP_PORT=3000 npx -y kubeview-mcp
```

Endpoint: `http://127.0.0.1:3000/mcp`. HTTP follows the [MCP 2026-07-28 stateless core](https://blog.modelcontextprotocol.io/posts/2026-07-28/): a fresh server per request, no `initialize`, no `Mcp-Session-Id`. Each request carries protocol version, client identity, and capabilities in `_meta`; modern requests add `Mcp-Method`/`Mcp-Name` for gateway routing. 2025-era clients use the SDK's stateless fallback on the same endpoint. State that must survive across calls has to be passed as tool arguments or handles.

HTTP mode refuses to start without both approval variables. Multi-replica deployments need the same secret and a shared writable replay directory; the `/tmp` example is for a single process only. The published MCP registry entry still targets `stdio`.

## Tool surfaces

| `MCP_MODE`             | Exposed tools                                                                                    |
| ---------------------- | ------------------------------------------------------------------------------------------------ |
| unset / `code` / `all` | `run_code`, `kube_pod_exec`                                                                      |
| `tools`                | `kube_list`, `kube_get`, `kube_logs`, `kube_contexts`, `helm`, `kube_pod_exec`, plus detected `argo` and `argocd` |

Domain tools use an `operation` discriminator:

- `helm` — `list` \| `get` \| `debug`
- `argo` — `list` \| `get` \| `logs` \| `cron_list` (when `Workflow` or `CronWorkflow` is discoverable)
- `argocd` — `list` \| `get` \| `resources` \| `logs` \| `history` \| `status` (when `Application` is discoverable, or with `ARGOCD_SERVER` + `ARGOCD_AUTH_TOKEN`)

Discovery is cached per kube context for 60 s. Missing optional APIs are omitted, not fatal. `argo` and `argocd` are registered when the API exists in the default context or in any exact context name listed in `MCP_KUBE_CONTEXTS`.

## Multiple clusters

Every cluster tool accepts an optional `context` argument (a kubeconfig context name or an `MCP_KUBE_CONTEXTS` alias); `kube_contexts` lists the contexts you can target. Without it, calls behave as before: `MCP_KUBE_CONTEXT`, then the kubeconfig current-context. Context is per call rather than per session, which keeps HTTP mode stateless and lets one script query several clusters concurrently.

`MCP_KUBE_CONTEXTS` is a comma-separated list. Plain entries are context names with optional `*` wildcards; `alias=context` entries map a short name to a real context. Once set, only matching contexts, alias targets, and `MCP_KUBE_CONTEXT` are reachable, including for Helm/Argo/Argo CD CLI fallbacks, which receive `--kube-context`/`--context` for the resolved context. Add `*` to keep every context while defining aliases.

```bash
MCP_KUBE_CONTEXT=dev \
MCP_KUBE_CONTEXTS='dev,staging-*,prod=arn:aws:eks:eu-west-1:123456789012:cluster/prod' \
npx -y kubeview-mcp
```

In `run_