Kubernetes MCP Servers in 2026: Kubeconfig-Based vs Hosted, Compared

To let Claude, Cursor or another AI client work on one cluster from your laptop, the two strongest open source picks in 2026 are containers/kubernetes-mcp-server (a single Go binary with read-only and non-destructive settings) and Flux159’s mcp-server-kubernetes (the quickest npx install). Each big cloud now has its own server too. AWS hosts one for EKS in preview, Google hosts one for GKE, and Microsoft’s AKS-MCP runs locally. For one endpoint that reaches every cluster through scoped tokens instead of a kubeconfig, look at Ankra’s hosted MCP server.

The real choice is less about features and more about where the server runs and whose credentials it holds. That decides what an AI can break, and who can see what it did.

Two kinds of Kubernetes MCP server

The Model Context Protocol (MCP) is the standard way an AI client calls outside tools. A Kubernetes MCP server turns operations like “list pods” or “scale this deployment” into tools the client can call. It has no AI of its own. Its power comes entirely from the credentials you give it.

Kubeconfig-based servers run on your machine, usually over stdio, the transport where the client starts the server as a local process. They act with your kubeconfig, so the AI can do whatever you can do. The spec says a stdio server should take its credentials from the environment rather than run a sign-in flow, which is exactly what these servers do.

Hosted servers run somewhere else and you reach them over Streamable HTTP. The MCP spec’s authorization rules for HTTP servers are based on OAuth 2.1, so a hosted server can ask you to sign in and hand the client a token scoped to what it needs. The cloud servers from AWS and Google work this way, and so does Ankra’s.

Neither kind is safer by default. A local server with read-only switched on is safer than a hosted one with write access. What matters is that the scope is set on purpose.

The options at a glance

Server	Made by	Runs where	Cluster credentials	Read-only setting	Clusters it reaches
kubernetes-mcp-server	containers org on GitHub, Apache-2.0	Your machine or in a pod	Kubeconfig or in-cluster service account	read_only and disable_destructive, both off by default	Every kubeconfig context
mcp-server-kubernetes	Flux159, MIT	Your machine	Kubeconfig, token or in-cluster	ALLOW_ONLY_READONLY_TOOLS, off by default	Your kubeconfig contexts
EKS MCP server (open source)	AWS Labs, Apache-2.0	Your machine	AWS IAM or kubeconfig	Read-only unless --allow-write	EKS clusters your IAM role can reach
Amazon EKS MCP Server (hosted)	AWS, in preview	AWS	IAM, signed through a local proxy	--read-only on the proxy, plus IAM policy	EKS clusters your IAM role can reach
AKS-MCP	Microsoft, MIT	Your machine	Azure CLI login and kubeconfig	readonly access level by default	AKS clusters, Azure Fleet
GKE MCP (local and remote)	Google	Your machine, or Google’s endpoint	Kubeconfig locally, OAuth and IAM remotely	Read-only endpoint on the remote server	GKE clusters in your projects
Ankra MCP server	Ankra	Ankra platform, or self-hosted on Enterprise	OAuth sign-in or a scoped token	Read-only unless the token has mcp:write	Every cluster in your Ankra organisation

kubernetes-mcp-server (containers)

kubernetes-mcp-server is an open source server for Kubernetes and OpenShift, written in Go and licensed Apache-2.0. Its README is clear that it is not a wrapper around kubectl or Helm. It talks to the Kubernetes API directly and ships as a native binary, an npx or uvx package, a Python package or a container.

What it is good at. Control. The configuration reference has read_only (only tools marked read-only are exposed), disable_destructive (tools marked destructive are removed) and denied_resources, which can hide whole kinds such as Secrets from the AI. It works with every context in your kubeconfig, or with a service account when it runs inside a pod. Optional toolsets add Helm, KubeVirt, Tekton, Kiali and more. In HTTP mode it can require OAuth and exchange tokens with Keycloak or Microsoft Entra ID, which makes it practical to run as a shared service and not only on a laptop.

Where it is a weaker fit. Both safety settings are off until you turn them on. Settings also moved from command line flags to a TOML file in October 2026, and old flags now fail with an error, so check any guide you copy from against the configuration changes. It also listens on every network interface by default in HTTP mode, and the server warns you when that happens without TLS or OAuth.

Best for teams that want one lightweight, well-maintained server, including on OpenShift, and are happy to set the safety switches themselves.

mcp-server-kubernetes (Flux159)

mcp-server-kubernetes is an MIT-licensed TypeScript server that runs kubectl and Helm for your assistant. It installs with npx or as a Claude Desktop extension, and it reads credentials from a kubeconfig file, a kubeconfig passed as text, a server URL and token, or the in-cluster service account.

What it is good at. Getting started fast, and keeping Secrets out of the chat. Secret masking is on by default and replaces the values in kubectl get secret output with asterisks. The advanced README also lists three filters, ALLOWED_TOOLS, ALLOW_ONLY_READONLY_TOOLS and ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS.

Where it is a weaker fit. All three filters are off by default. “Non-destructive” still allows apply, create, patch, scale and Helm installs, and only removes deletes, uninstalls, node management, exec and the generic kubectl tool. Masking covers Secret output, not logs or other tools that might print a credential. The HTTP transport sits behind a variable whose name starts with ENABLE_UNSAFE, which tells you it is meant for local use.

Best for a developer who wants kubectl inside Claude or Cursor in two minutes, on clusters they already have access to.

Amazon EKS MCP Server

AWS offers two. The open source EKS MCP server in the awslabs/mcp repository is a Python server you run with uvx. The hosted Amazon EKS MCP Server runs on AWS and was still in preview when we checked in October 2026.

What they are good at. Safe defaults and AWS identity. The open source server is read-only unless you pass --allow-write, and it will not read logs, events or Secrets unless you pass --allow-sensitive-data-access. It signs in with IAM by default. The hosted server checks every call against IAM and records it in CloudTrail. Its getting started guide has separate IAM actions for read-only and privileged tools, a managed read-only policy, and it replaces tokens and certificates in tool output before the AI sees them.

Where they are a weaker fit. They are for EKS. A team that also runs clusters on another cloud or on its own servers needs a second server for those. The hosted one needs a local proxy (mcp-proxy-for-aws) to sign requests, and preview terms can change.

Best for teams that live on EKS and want every AI call to go through IAM and CloudTrail like any other AWS API call.

AKS-MCP

AKS-MCP is Microsoft’s MIT-licensed Go server for Azure Kubernetes Service. It runs Azure CLI, kubectl and Helm commands and covers AKS resources, networking and Azure Fleet for several clusters.

What it is good at. Azure context. It knows about AKS node pools, networking and Fleet, not only Kubernetes objects. Its --access-level setting is readonly by default, with readwrite and admin as the steps up. The README is refreshingly honest that this is a guardrail and not a security boundary, and that running the server is like handing over a shell already signed in as its identity.

Where it is a weaker fit. Since the August 2026 release it only runs over stdio. The HTTP transports, OAuth support, container images and Helm charts were removed, so it is a local tool again. It is also Azure only.

Best for AKS teams that want an assistant that understands Azure as well as Kubernetes, on their own machine.

GKE MCP servers

Google has a local one and a hosted one. gke-mcp is an Apache-2.0 Go server that uses your kubeconfig for Kubernetes calls. Its README says it is not an officially supported Google product and not for production use, and delete tools stay off unless you enable them.

The hosted GKE remote MCP server was announced in December 2025 with Google’s other managed MCP servers. It has three endpoints, a default one without delete tools, a read-only one and one that adds deletes.

What it is good at. Google identity end to end. The remote server takes OAuth and IAM and does not accept API keys, and you grant access with an IAM role. Google also offers Model Armor in front of it, which it positions against prompt injection hidden in tool results.

Where it is a weaker fit. Like the AWS and Azure servers, it covers one cloud.

Best for GKE teams that want a hosted server they control with IAM, and a read-only endpoint they can hand out without worry.

Ankra MCP server

The Ankra MCP server is a hosted endpoint at platform.ankra.app/api/v1/mcp with more than 450 tools. It covers clusters, workloads, Helm add-ons, GitOps stacks, applications and pipelines, logs, metrics, security findings, cost and backups. It is listed in the official MCP Registry as ai.ankra/platform. Claude clients sign in with OAuth, and Cursor and other clients send a bearer token.

Ankra is a platform that builds or imports Kubernetes clusters on the cloud or servers you choose, deploys your applications from Git, and runs them afterwards. The MCP server is one way in. So an assistant connected to it reaches every cluster in your Ankra organisation, whether that is an imported EKS or GKE cluster, k3s on a server you own, or a cluster Ankra built on Hetzner, OVHcloud, UpCloud or Proxmox. One session can read a failing pod on one cluster and the pipeline that deployed it.

What it is good at. Access you can reason about, without handing out kubeconfigs. Per the MCP docs, an mcp:read token only ever sees read tools, because tools/list returns what the token allows. mcp:write adds apply, scale, restart, rollback and pull requests. Tokens and OAuth grants are bound to one organisation, and Ankra checks a cluster belongs to that organisation before a tool runs. Mutating calls whose arguments contain a literal secret are refused. Each token is rate limited to 120 read and 20 write calls a minute. Every call, refused ones included, goes to the organisation audit log.

Where it is a weaker fit. Ankra does not add a second confirmation over MCP. Your client’s approval prompt is the gate, so only give mcp:write to clients you trust. And your clusters need to be connected to Ankra first, which is a one-line Helm install for an existing cluster. If you only want to poke at one local cluster and nothing else, an open source server is less to set up.

Best for teams with several clusters, or apps as well as clusters, who want one MCP endpoint with scoped tokens and an audit trail. It works on the free tier (see pricing), and Enterprise customers can self-host it.

What to check before an AI gets write access

Read-only is a setting, not a default, on most servers. kubernetes-mcp-server and mcp-server-kubernetes start with full access. The EKS servers, AKS-MCP and Ankra start read-only. Whatever you pick, start read-only and widen it on purpose.

Tool labels are hints. MCP tools carry labels such as read-only or destructive, and some servers filter on them. The spec tells clients to treat those labels as untrusted unless they trust the server, and says a person should always be able to deny a tool call. The credential behind the server is the real limit. Give it a Kubernetes role with only the verbs it needs.

Pod logs can talk back. Logs, events and annotations are text written by whatever runs in your cluster. An AI that reads them can be steered by instructions hidden inside them. OWASP calls this indirect prompt injection and recommends least privilege and human approval for risky actions. That is a good reason to keep writes behind a prompt you actually read.

Secrets. Decide whether the AI may see them at all. You can deny the Secret kind (kubernetes-mcp-server), mask it (mcp-server-kubernetes), require an explicit flag (the EKS server) or refuse secrets in write calls (Ankra).

Where it listens. The spec says a local server in HTTP mode should listen on 127.0.0.1 and must check where each request comes from, so other websites cannot call it. A shared server needs real sign-in.

Audit. If the server runs with your kubeconfig, the trail is your cluster’s audit log, under your name. Hosted servers record calls themselves (CloudTrail for AWS, the organisation audit log for Ankra). Check that someone can answer “what did the AI change last Tuesday” before you need to.

How to choose

• If you want one open source server for clusters you already reach with kubectl, including OpenShift, pick kubernetes-mcp-server and turn on read_only.
• If you want kubectl in Claude or Cursor in two minutes on your own machine, pick mcp-server-kubernetes.
• If you only run EKS and want every call to go through IAM and CloudTrail, use the Amazon EKS MCP Server.
• If you run AKS and want Azure context too, use AKS-MCP.
• If you run GKE and want a hosted, read-only endpoint, use Google’s GKE remote MCP server.
• If you run several clusters across clouds and your own servers, or want the assistant to see your apps and pipelines too, use Ankra’s MCP server.

For the wider field of AI tools for Kubernetes, troubleshooting assistants and AI operations platforms included, see our AI tools for Kubernetes operations roundup. The story of how Ankra’s own agents propose changes for a person to approve is in drafts, approvals and GitOps.

Frequently asked questions

What is the best Kubernetes MCP server?

For a local open source server, containers/kubernetes-mcp-server is the most complete, with read-only, non-destructive and denied-resource settings and multi-cluster support through kubeconfig contexts. mcp-server-kubernetes is the quickest to install. On a single cloud, the EKS, AKS and GKE servers fit that cloud best. For a hosted server across many clusters with scoped tokens and an audit log, Ankra’s MCP server is in the official MCP Registry as ai.ankra/platform.

Is it safe to give Claude or Cursor access to my Kubernetes cluster?

It can be, if the server is read-only by default and writes need your approval. Use a credential with only the permissions the AI needs, keep Secrets out of its reach, and remember that pod logs it reads can contain instructions written to mislead it. Turn on write access only for clients you trust.

What is the difference between a local and a hosted Kubernetes MCP server?

A local server runs on your machine and acts with your kubeconfig, so the AI has your permissions and the trail is your cluster’s audit log. A hosted server runs as a service you sign in to, usually with OAuth, and hands the client a token limited to what it needs. Hosted servers can also reach clusters that are not in your kubeconfig.

Can one MCP server manage clusters on different clouds?

kubernetes-mcp-server and mcp-server-kubernetes can reach any cluster in your kubeconfig, whatever cloud it runs on. The EKS, AKS and GKE servers cover their own cloud. Ankra’s MCP server reaches every cluster connected to your Ankra organisation, including EKS, GKE and AKS imports and clusters on Hetzner, OVHcloud, UpCloud or Proxmox.