October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk5 min

How to Manage Kubernetes Clusters with an MCP Server

A practical guide to connecting Claude Desktop to Kubernetes through the alexei-led MCP server, with setup caveats, project status, and RBAC safeguards.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

An MCP server can let an AI client inspect and manage Kubernetes through exposed tools, but the client’s authority is the authority of its Kubernetes credentials. The setup shown in Vultr’s guide uses the Docker-based alexei-led/k8s-mcp-server project and Claude Desktop; Vultr is an example cluster provider, not a requirement. One important update: GitHub marked that project archived on September 13, 2026, so verify its image and configuration before deploying it.

What the K8s MCP server does

The Model Context Protocol (MCP) connects an AI client to tools provided by a server. In this example, alexei-led/k8s-mcp-server runs in Docker and exposes Kubernetes command-line operations—including tools such as kubectl, helm, istioctl, and argocd—to a compatible client. The client can then use those tools in response to natural-language requests.

As an Amazon Associate I earn from qualifying purchases.

This is a particular implementation, not a generic Kubernetes feature. The guide’s example connects Claude Desktop to a Kubernetes cluster using a kubeconfig context. A running cluster, valid kubeconfig, command-line tooling, Docker, and an MCP-capable client are the core pieces; Vultr Kubernetes Engine is simply the cluster used in Vultr’s walkthrough, updated May 7, 2025: Vultr’s setup guide.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check the project’s status before setup

GitHub marks alexei-led/k8s-mcp-server archived as of September 13, 2026. Archive status means the project should not be assumed to receive maintenance; it does not establish whether its container image remains available or whether a particular image has a vulnerability. Check the repository and verify the image and client configuration before using the dated Docker example: project repository and README.

#1 Best Overall

The guide uses the mutable image tag ghcr.io/alexei-led/k8s-mcp-server:latest. A latest tag does not identify an immutable version, and the available project documentation does not establish a stable current image version. Do not treat an old configuration example as proof that the current image behaves identically.

Prepare the cluster context and local tools

  1. Confirm you have a running Kubernetes cluster and a kubeconfig that can authenticate to it. Download the configuration from your cluster provider if needed.

  2. Install and configure kubectl, Docker Desktop, and Claude Desktop for the workflow in Vultr’s guide. The specific cluster provider may differ, but the kubeconfig must point to the intended cluster.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  3. List available kubeconfig contexts with kubectl config get-contexts. Identify the exact context name you intend to use; do not assume the currently selected context is the right one.

Run the Docker server and connect Claude Desktop

The following is the pattern used in the Vultr walkthrough, not a guarantee that it remains compatible with the archived project’s current image. Replace the context name with the one from your kubeconfig and substitute the real absolute path to your local .kube directory for /path/to/.kube.

docker pull ghcr.io/alexei-led/k8s-mcp-server:latest
docker run -i --rm 
  -v /path/to/.kube:/home/appuser/.kube:ro 
  -e K8S_CONTEXT=YOUR_CONTEXT_NAME 
  ghcr.io/alexei-led/k8s-mcp-server:latest

The -i option keeps standard input open for the client connection, --rm removes the container when it exits, and the mount makes the host kubeconfig directory available inside the container. The K8S_CONTEXT value tells the server which kubeconfig context to use. Because the image tag is mutable and the repository is archived, check the project’s README for any changed image or configuration requirements before relying on these commands.

Claude Desktop’s MCP configuration uses a server entry under mcpServers. In the configuration file for your operating system, add the Docker command as the server’s command and provide its arguments in order. Replace the example path and context with your actual values:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
{
  "mcpServers": {
    "k8s": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/path/to/.kube:/home/appuser/.kube:ro",
        "-e", "K8S_CONTEXT=YOUR_CONTEXT_NAME",
        "ghcr.io/alexei-led/k8s-mcp-server:latest"
      ]
    }
  }
}

Save the configuration, restart Claude Desktop, and check that the Kubernetes server is shown as running and its tools are available. Exact configuration-file locations and client labels can change; consult the client’s current MCP configuration instructions if the example does not match your installed version.

Use prompts for inspection, then verify the result

The project documentation gives prompts such as these as examples:

  • Show all pods in the default namespace
  • Get all services across all namespaces
  • Describe the failing pod and explain the error
  • Why is my deployment not starting?

Depending on the tools exposed, cluster APIs, and the identity’s permissions, the server may also support tasks such as reading logs, checking service-to-pod connectivity, deploying a Helm chart, creating a deployment, configuring Ingress, checking Istio, or creating an Argo CD application. These examples are not a promise that every operation is enabled or appropriate in every installation.

Use AI output as an operational suggestion, not authoritative cluster state. Check the relevant live objects and command results before acting; the Vultr walkthrough itself advises comparing the model’s information with the cluster’s information.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Protect the cluster with Kubernetes authorization

The Docker command mounts .kube with :ro, which restricts writes through that filesystem mount. It does not make requests to the Kubernetes API read-only. The credentials in the kubeconfig determine which authenticated identity the server uses, and Kubernetes RBAC determines which resources and actions that identity may access. The Kubernetes project describes API access control as a first line of defense in its cluster security guidance.

For read-only diagnosis

Create or choose a dedicated identity with only the read permissions needed for diagnosis, scoped to the relevant namespace where practical. Avoid granting create, update, patch, or delete verbs. Kubernetes RBAC roles and bindings provide resource- and verb-level authorization; see the RBAC documentation.

For changes and deployments

If the client must create or modify resources, grant only the verbs and resource types those tasks require. Keep human review and approval in the workflow for consequential actions, and do not give a general-purpose AI client broad cluster-admin access merely to make a demo work.

Test both allowed and denied actions

Use Kubernetes authorization checks, such as kubectl auth can-i, and test the actual operations the client needs. Also test that it cannot perform actions that should be prohibited. A read-only mount is a filesystem control; the API permissions configured for the identity are the control that limits cluster changes.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not confuse similarly named projects

containers/kubernetes-mcp-server is a separate project with a different implementation and configuration surface. Its documentation describes controls including read_only, disable_destructive, disabled tools, and denied resources. Those settings belong to that project, not to alexei-led/k8s-mcp-server; do not add them to the Docker configuration above. See its repository and configuration documentation if evaluating it separately.

Choose an implementation by operational fit

Before connecting any Kubernetes MCP server, assess the controls that matter for your environment:

  • Scope: whether access should cover one namespace or the full cluster.
  • Permissions: whether the task needs read-only inspection, narrowly limited changes, or broader management.
  • Client and transport: whether the implementation supports your chosen AI client and local or remote connection model.
  • Tool coverage: which Kubernetes and ecosystem commands are actually available and permitted.
  • Maintenance: the repository’s status, image versioning, and compatibility with your tools.
  • Operational controls: whether the implementation can restrict tools, resources, or destructive actions in a way you can verify.

The available project documentation does not establish a comparative benchmark for accuracy, latency, or reliability, so those qualities should not be inferred from the feature lists.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.