RepoAI
Browse MCPs
Verified

Microk8s MCP Server

Inspect MicroK8s workloads, logs, and cluster state from your AI assistant.

Data last scanned today · Reviewed today

481 dangerous tool16 tools★ 2PythonMIT

Overview

Microk8s MCP Server bridges your AI environment with MicroK8s clusters, facilitating tasks like workload inspection, log retrieval, and failure triage. It provides two distinct backends: one interacting with the Kubernetes API via kubeconfig for general operations, and a node-specific backend for snap-level status and addon management. The server operates in a read-only mode by default but allows for expanded control including manifest application and rollout restarts. Users can toggle mutating capabilities, though caution is required regarding cluster-wide permissions if the provided `rbac.yaml` is deployed.

Our verdict

This server carries a high-risk score of 38/100, largely because it is community-maintained and has not yet undergone an editorial or external security review. Users should be aware that the included rbac.yaml grants extensive cluster-wide write access by default, which creates a significant security surface area. Given the lack of independent verification, this tool is best suited for isolated development environments rather than production clusters.

  • Supports both local node access and remote API connectivity
  • Zero direct dependencies reduce potential supply-chain vulnerability
  • Allows granular control over mutating actions via configuration switches
  • Default RBAC configuration grants broad cluster-wide write privileges
  • Not an official vendor-maintained project
  • Low community signal with only 2 GitHub stars

Tools

ToolDescriptionRisk
cluster_overviewRead cluster overview information.low
list_resourcesList Kubernetes resources.low
get_resourceGet a specific Kubernetes resource.low
describe_resourceDescribe a Kubernetes resource.low
get_logsGet logs from a resource.low
get_eventsGet cluster events.low
topShow metrics for resources.low
api_resourcesList available API resources.low
rollout_statusCheck the rollout status of a resource.low
microk8s_statusGet MicroK8s status.low

Compatibility

ClientLocalDockerRemoteRead-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Is the server read-only by default?

Yes, the server is read-only by default, and all mutating capabilities require explicit configuration to unlock.

›Does the server provide cluster-wide write access?

The provided rbac.yaml file grants cluster-wide write permissions, including workload management and node operations, though it excludes secrets. You can narrow this scope by replacing the ClusterRoleBinding with a RoleBinding limited to specific namespaces.

›What happens if kubectl is not available on the PATH?

The server will fall back to using microk8s kubectl, which runs under the MicroK8s admin credential. Note that this bypasses scoped kubeconfig restrictions and the bundled reader role, so it is recommended to install kubectl locally.

›How do I choose between topology A and topology B?

Topology A runs the server on your workstation and is the recommended default, while topology B runs the server directly on the MicroK8s node. If you do not configure SSH for topology A, the server will still function for standard kubectl tasks but will lack the ability to manage addons or report microk8s status.

›What is the difference between an editable and non-editable installation?

An editable install links the virtual environment to your git repository, meaning code changes are applied live. Using the non-editable mode copies the package to a stable location, requiring a reinstall if you make changes to the source code.

›How can I verify the actual permissions granted to the server?

You can audit the effective permissions of the server by running the command: kubectl --kubeconfig ~/.kube/claude-mcp.kubeconfig auth can-i --list.

Changelog

Badge

Microk8s MCP Server security score, rated on RepoAI

Maintain this server? Add the live badge to your README.