k8s-troubleshoot-mcp

A read-only MCP (Model Context Protocol) server that lets an AI assistant diagnose a Kubernetes cluster. Ask why a pod is crash-looping instead of running six kubectl commands and correlating the output by hand.

Read-only is a structural property, not a promise. There are no write tools, and the RBAC manifests grant no write verbs. See Security model.

What It Does

The server exposes 16 diagnostic tools over stdio. Connect it to Claude Desktop, VS Code, or Kiro, and you can ask things like:

• "Why is the checkout pod in staging not ready?"
• "Show me the last 50 lines of logs from the api container"
• "Which nodes are not Ready, and what are their taints?"
• "Is the web HPA scaling, and what does its current metric say?"
• "What events fired in production in the last few minutes?"

The assistant calls the tools, the server queries the Kubernetes API with a scoped ServiceAccount token, and every response comes back as a structured dict — including errors, which are never raised as exceptions into the MCP layer.

Architecture

┌──────────────────┐    stdio (JSON-RPC)   ┌──────────────────────────┐
│   MCP Client     │◄─────────────────────►│   MCP Server             │
│  Claude Desktop  │                       │   (this project)         │
│  VS Code / Kiro  │                       │                          │
└──────────────────┘                       │  config.py   ─ validate  │
                                           │  server.py   ─ 16 tools  │
                                           │  tools/*.py  ─ read+shape│
                                           │  response.py ─ escape +  │
                                           │                structure │
                                           └───────────┬──────────────┘
                                                       │ HTTPS, explicit
                                                       │ KUBECONFIG only
                                           ┌───────────▼──────────────┐
                                           │  Kubernetes API server   │
                                           │  ── RBAC boundary ──     │
                                           │  ServiceAccount:         │
                                           │  get/list/watch only     │
                                           └──────────────────────────┘

Configuration is validated once at startup. If anything is wrong — KUBECONFIG unset, the file unreadable or malformed, ALLOWED_NAMESPACES missing or containing a wildcard — the process writes one line to stderr and exits 1. It never starts in a partially-valid state.

Available Tools

Arguments marked ? are optional.

... View full README on GitHub