kubeleash

Point it at your over-privileged kubeconfig — it still can't nuke prod.

Guardrails for AI agents on your cluster. kubeleash is a local MCP server for Kubernetes whose differentiator is RBAC-style, context-scoped access control. Point it at a kubeconfig — even a cluster-admin one — and a local policy file constrains what the agent can actually do, per kube context, with destructive actions gated before any call reaches the cluster.

Why

Most Kubernetes MCP servers inherit the kubeconfig's permissions wholesale — whatever the credentials grant, the agent can do. kubeleash adds three things native RBAC can't express for this use case:

• Constrain the agent independently of the credentials. Effective access is always kubeconfig-grants ∩ policy-allows — kubeleash only ever subtracts.
• Context-aware guardrails. Policy varies by context (prod vs staging vs dev); native RBAC is per-cluster.
• Block destructive verbs (delete/exec/…) as a safety net against agent mistakes and prompt injection.

What kubeleash enforces

kubeleash governs only the calls routed through it. It provides a hard guarantee when it is the agent's sole path to the cluster. An agent that also has shell access (raw kubectl, oc, the API) can step around it, so in a shell-enabled assistant kubeleash is advisory — pair it with the using-kubeleash skill, which instructs the agent to stop (not reach for kubectl) when the leash is unavailable.

Policy in 10 seconds

policies:
  - contexts: ".*prod.*"          # regex over the active context name
    allow:
      resources: ["*"]
      verbs: [get, list, watch]   # read-only in prod
    deny:
      verbs: [exec]               # never, regardless of credentials

Deny wins. Default deny. A broken policy refuses to start — it never fails open.

See [examples/policy.yaml](examples/polic

... View full README on GitHub