Kubernetes MCP servers let AI assistants manage clusters, debug pods, deploy workloads, and read logs — all through natural language. The ecosystem has matured fast: there are now 70+ Kubernetes-related MCP servers on registries like PulseMCP, and the CNCF is paying attention — kagent entered CNCF Sandbox, kubernetes-sigs shipped an MCP lifecycle operator, and KubeCon EU 2026 hosted a dedicated “Agentics Day: MCP + Agents” co-located event.

But they take fundamentally different approaches. Some interact directly with the Kubernetes API. Others wrap kubectl commands. Some focus on Docker containers. Others bundle kubectl, Helm, Istio, and ArgoCD into one package.

The architecture matters more than the feature count. A native API server is faster and needs no external binaries. A kubectl wrapper gives you the full CLI surface but adds overhead and dependencies. A read-only server is safer for production. Security matters too — CVE-2026-39884 (CVSS 8.3) hit the popular Flux159 server in April 2026, and a wave of security hardening followed across multiple projects. We’ve researched all the major options to help you choose.

Disclosure: Our recommendations are based on research — analyzing documentation, GitHub repositories, community feedback, and published benchmarks. We have not hands-on tested every server in this guide.

At a Glance: Top Picks

Category Our pick Stars Runner-up
Kubernetes (native API) containers/kubernetes-mcp-server 1,470 strowk/mcp-k8s-go
Kubernetes (kubectl wrapper) Flux159/mcp-server-kubernetes 1,379 rohitg00/kubectl-mcp-server (872)
CNCF AI agents kagent-dev/kagent 2,620 kubernetes-sigs/mcp-lifecycle-operator
Multi-tool (kubectl+Helm+Istio+Argo) alexei-led/k8s-mcp-server 208 Azure/mcp-kubernetes
Read-only / diagnostics patrickdappollonio/mcp-kubernetes-ro — Flux159 (–non-destructive flag)
AI dashboard weibaohui/k8m 811 Lens MCP Server (commercial)
Docker containers manusa/podman-mcp-server 68 ckreiling/mcp-server-docker (702, abandoned)
Docker infrastructure docker/mcp-gateway 1,358 docker/hub-mcp
Container platform portainer/portainer-mcp 139 —
Helm zekker6/mcp-helm 24 —

Kubernetes Native API Servers

These servers interact directly with the Kubernetes API server — no kubectl binary needed. They’re faster, have lower latency, and don’t require external CLI tools on your system.

containers/kubernetes-mcp-server — The Winner

Stars: 1,470 | Language: Go | License: Apache 2.0 | Latest: v0.0.60 (April 1, 2026)

This is the most mature native Kubernetes MCP server. Originally created by Marc Nuri (manusa), it was adopted by the containers organization (the same group behind Podman). It talks directly to the Kubernetes API server — no kubectl, no helm, no external dependencies.

What makes it stand out:

  • Native API access — Go client talks directly to the API server. No subprocess overhead, no parsing CLI output
  • Generic resource CRUD — works with any Kubernetes or OpenShift resource, including CRDs. Not limited to pods and deployments
  • Multi-cluster — switch between clusters defined in your kubeconfig via a context parameter on each tool call
  • OpenShift support — first-class support for OpenShift-specific resources (Routes, DeploymentConfigs, etc.)
  • OpenTelemetry — optional distributed tracing and metrics with custom sampling rates
  • Multiple distributions — single binary (Linux/macOS/Windows), npm package, pip package, Docker image, Helm chart
  • Security hardening (April 2026) — configurable ServiceAccount token auto-mount, read-only root filesystem in Helm chart, OAuth guard fixes, Kiali response body size limiting to prevent memory exhaustion

Limitations:

  • No built-in safety modes (read-only or non-destructive) — you rely on Kubernetes RBAC for access control
  • Fewer convenience prompts compared to kubectl wrappers
  • The generic approach means tool names are abstract (resources_list, resources_get) rather than domain-specific

Best for: Teams that want a fast, dependency-free Kubernetes MCP server with direct API access and OpenShift compatibility.

strowk/mcp-k8s-go — Lightweight Alternative

Language: Go | License: MIT

A simpler Go-based alternative with a narrower scope. Supports listing contexts, namespaces, nodes, pods, services, and deployments, plus getting events, pod logs, and running commands in pods. Supports --allowed-contexts for restricting which clusters are accessible. Multi-arch Docker images available.

Best for: Teams that want a minimal, no-frills Go server with explicit context restrictions.

Kubernetes kubectl Wrapper Servers

These servers wrap the kubectl CLI (and sometimes Helm). They’re easier to understand if you think in kubectl commands, but they require kubectl installed and add subprocess overhead.

Flux159/mcp-server-kubernetes — The Winner

Stars: 1,379 | Language: TypeScript | License: MIT | Latest: v3.5.0 (April 7, 2026)

The most popular TypeScript Kubernetes MCP server. It wraps kubectl but adds thoughtful safety features that the native API servers lack.

⚠️ Security note (April 2026): CVE-2026-39884 (CVSS 8.3 HIGH) — argument injection vulnerability in the port_forward tool. The tool used string concatenation with user-controlled input instead of array-based argument passing, allowing injection of arbitrary kubectl flags (e.g., --address=0.0.0.0 for service exposure, cross-namespace targeting). Fixed in v3.5.0. Update immediately if running v3.4.0 or earlier.

What makes it stand out:

  • Non-destructive mode — disable all delete operations (pods, deployments, namespaces) with one flag. Read and create/update still work. This is the safest way to give an AI agent cluster access
  • Secrets masking — automatically masks sensitive data when retrieving secrets. Other servers return secrets in plain base64
  • Troubleshooting prompts — guides the AI through systematic Kubernetes debugging flows based on pod keywords and optional namespace
  • Kubeconfig flexibility — loads from multiple sources in priority order (explicit path, env var, default location)
  • Helm v3 support — install, upgrade, list, and uninstall Helm releases directly
  • kubectl_reconnect (v3.4.0) — new command for stale connection recovery, plus constant-time comparison for auth tokens

Limitations:

  • Requires kubectl (and optionally Helm) installed on the system
  • Subprocess overhead — every operation shells out to kubectl
  • TypeScript/Node.js runtime required

Best for: Teams that want safety features (non-destructive mode, secrets masking) and don’t mind the kubectl dependency.

rohitg00/kubectl-mcp-server — Feature-Rich Alternative

Stars: 872 | Language: TypeScript | License: MIT | CNCF Landscape listed

The most feature-packed Kubernetes MCP server with 270+ tools, 8 resources, and 8 prompts. Goes beyond cluster management into visualization territory.

What makes it stand out:

  • 270+ tools — covers virtually every kubectl operation you could want
  • 3D cluster topology — an interactive Three.js-based visualization of your entire cluster
  • Interactive dashboards — standalone web UI via the kubectl-mcp-app npm package
  • Multiple install options — npx, npm, pip, Docker, GitHub releases
  • Recent improvements (March-April 2026): Structured output (outputSchema) on top 18 read tools, elicitation for destructive operation confirmation, complete tool annotations with idempotentHint + openWorldHint, dynamic CRD discovery with semantic understanding

Limitations:

  • The sheer number of tools can overwhelm AI assistants — some models struggle with 270+ tool definitions in context
  • The visualization features are impressive but orthogonal to MCP’s core purpose

Best for: Developers who want maximum coverage and like visual cluster exploration.

Multi-Tool Servers

These bundle multiple Kubernetes ecosystem tools into one MCP server.

alexei-led/k8s-mcp-server — kubectl + Helm + Istio + ArgoCD

Language: Go | License: MIT

Unique because it packages four Kubernetes CLI tools in a single Docker container: kubectl, Helm, istioctl, and argocd. Supports AWS EKS, Google GKE, and Azure AKS natively.

Key features:

  • Four tools in one — kubectl, helm, istioctl, argocd all accessible through MCP
  • Cloud provider auth — native support for EKS, GKE, AKS credential flows
  • Command validation — validates commands before execution for safety
  • Transport flexibility — stdio, streamable-http, and SSE (deprecated) transport protocols
  • Containerized — runs as non-root user in Docker, with strict command validation

Best for: Platform engineers running service meshes (Istio) and GitOps (ArgoCD) who want one server for the full stack.

Azure/mcp-kubernetes — Microsoft’s Entry

Stars: 55 | Language: Go | License: MIT | Latest: v0.0.13 (April 3, 2026)

Microsoft’s Kubernetes MCP server uses a single call_kubectl tool that consolidates all kubectl operations, reducing context consumption. Supports configurable access levels (readonly, readwrite, admin) and optional Helm, Cilium, and Hubble tools.

Key features:

  • Unified tool — one call_kubectl tool instead of dozens, which some AI models handle better
  • Access levels — readonly, readwrite, or admin modes built-in
  • Namespace restrictions — comma-separated list of allowed namespaces
  • Azure ecosystem — pairs with Azure/aks-mcp for AKS-specific operations
  • Security hardening (April 2026) — blocks kubectl/helm global flags that can redirect API traffic or exfiltrate credentials, fixed ReadOnly mode misclassifications (defense-in-depth)

Best for: Azure/AKS shops that want integrated access control without configuring RBAC separately.

CNCF & Kubernetes-Native MCP (New in 2026)

The CNCF ecosystem is now directly engaging with MCP. These projects represent the shift from community-built MCP servers to officially endorsed Kubernetes-native AI tooling.

kagent-dev/kagent — CNCF Sandbox (The Winner)

Stars: 2,620 | Language: Go | License: Apache 2.0

kagent entered CNCF Sandbox in May 2025 (donated by Solo.io) and has become the most significant Kubernetes AI agents project. It builds AI agents on Kubernetes using CRDs and ships pre-built MCP servers for the core CNCF stack.

Key features:

  • Pre-built MCP servers for Kubernetes, Istio, Helm, ArgoCD, Prometheus, Grafana, and Cilium — the broadest CNCF tool coverage in one project
  • Kubernetes-native — define agents, tools, and models as CRDs. Deploy with kubectl or Helm
  • kmcp component — bootstraps and deploys MCP servers to Kubernetes clusters
  • Very active — pushed April 22, 2026, 523 forks

Best for: Platform teams who want to build AI agents that operate across the CNCF stack using Kubernetes-native primitives.

kubernetes-sigs/mcp-lifecycle-operator — Official Kubernetes SIG

Stars: 16 | License: Apache 2.0

An official Kubernetes SIG project that provides a declarative API to deploy, manage, and safely roll out MCP servers on Kubernetes. Handles the full lifecycle — deployment, updates, rollbacks — with production-grade automation.

Best for: Teams who want to manage MCP server deployments the Kubernetes way, using operators and CRDs.

Other CNCF-Adjacent Projects

  • nirmata/kyverno-mcp (19 stars) — MCP server for Kyverno policy management. List contexts, switch clusters, apply policies, show violations. Security and compliance governance via AI
  • mrostamii/rancher-mcp-server (10 stars) — MCP server for the Rancher ecosystem: multi-cluster Kubernetes, Harvester HCI (VMs, storage, networks), and Fleet GitOps. Fills a gap we previously flagged
  • yindia/rootcause (27 stars) — local-first MCP server for evidence-backed incident analysis and Kubernetes diagnostics
  • vitas/evidra (12 stars) — DevOps flight recorder for AI infrastructure agents with signed tamper-evident evidence chains

Lens MCP Server — Commercial

Lens, the Kubernetes IDE with 1M+ users, launched a built-in MCP server in March 2026. Works with Claude Code, ChatGPT, Cursor, and GitHub Copilot. Leverages Lens’s Cloud Integrations (AWS, Azure, GCP) so there’s no manual kubeconfig generation. Not open-source — requires Lens Desktop.

Best for: Teams already using Lens who want AI Kubernetes management without additional MCP server setup.

Read-Only & Diagnostic Servers

For production clusters where you want AI to observe but never modify.

patrickdappollonio/mcp-kubernetes-ro — Purpose-Built Read-Only

Language: Go | License: MIT

This server is read-only by design, not by configuration. There are no write tools — it’s architecturally impossible for it to modify your cluster.

Capabilities:

  • List any Kubernetes resources (with label and field selectors)
  • Get complete resource details
  • Retrieve pod logs (with grep patterns, time filtering, previous container logs)
  • Discover available API resources and their capabilities
  • Base64 encode/decode (useful for reading Kubernetes secrets)
  • Per-command context switching for multi-cluster queries
  • SSE support for remote/web-based integrations

Best for: Production observability, incident response, and environments where AI should never write.

Other read-only options

  • Flux159 with --non-destructive flag: disables deletes but still allows creates and updates
  • containers/kubernetes-mcp-server with a read-only RBAC service account: native API speed with Kubernetes-enforced access control

AI Dashboard

weibaohui/k8m — Kubernetes Dashboard with Built-in MCP

Stars: 811 | Language: Go (backend) + Baidu AMIS (frontend) | Latest: v0.26.17 (March 5, 2026)

k8m is different from the other entries — it’s a full Kubernetes dashboard that happens to include an MCP server with 49 built-in tools. Think Portainer or Lens, but with AI integration.

Key features:

  • 49 MCP tools — multi-cluster management through MCP protocol
  • AI-powered diagnostics — word explanation, YAML attribute translation, describe interpretation, log diagnosis, command recommendations
  • Visual management — web UI for managing MCP tool permissions
  • Pod file management — browse, edit, manage files inside pods
  • Helm marketplace — install and manage Helm applications from the UI
  • Single binary — one executable, cross-platform, easy deployment
  • Hosted deployment — Fronteir AI now offers hosted k8m instances

Limitations:

  • The AI features depend on connecting to an LLM provider
  • Chinese-first documentation (English README available but less detailed)
  • More “dashboard with MCP” than “MCP server” — different use case

Best for: Teams that want a visual Kubernetes dashboard with AI assistance built in.

Docker & Container Runtime Management

For managing Docker containers, Podman pods, images, networks, and volumes through AI.

manusa/podman-mcp-server — The New Winner

Stars: 68 | Language: TypeScript | License: MIT | Latest: v0.0.15 (February 27, 2026)

Created by the same developer behind containers/kubernetes-mcp-server (Marc Nuri), this server supports both Podman and Docker runtimes. Two operating modes: direct Podman REST API via Unix socket (faster, no CLI dependency) or CLI shell-out (broader compatibility).

Key features:

  • Dual runtime — works with both Podman and Docker
  • Two modes — REST API via Unix socket or CLI fallback
  • Actively maintained — pushed April 15, 2026
  • Install via npx podman-mcp-server@latest

Best for: Teams using Podman or wanting a maintained alternative to the abandoned ckreiling server.

ckreiling/mcp-server-docker — Abandoned, Security Risk

Stars: 702 | Language: Python | License: MIT | ⚠️ Last commit: June 2025

Previously our top pick, but now effectively abandoned. No commits in 10+ months. Critical security vulnerabilities disclosed in issue #50 (host filesystem access + container escape) — maintainer emailed March 24, public issue April 7, zero response. Community security fix PR #49 sits unmerged. 9 open PRs, none merged since June 2025.

We no longer recommend this server for new deployments. Use manusa/podman-mcp-server or Docker’s official MCP Toolkit instead.

QuantGeekDev/docker-mcp — Abandoned

Stars: 471 | Language: TypeScript | License: MIT | ⚠️ Last commit: December 2024

No activity in 16+ months. Not archived but fully abandoned. Not recommended.

Docker Infrastructure

Docker’s MCP investment has accelerated dramatically. Docker acquired MCP Defender (agentic AI security company) for runtime monitoring and policy enforcement. Docker Desktop now ships MCP Toolkit built-in (no extension needed), with weekly releases adding MCP capabilities.

docker/mcp-gateway — MCP Server Orchestration

Stars: 1,358 | Latest: v0.40.4 (April 9, 2026)

Docker’s official MCP Gateway orchestrates multiple MCP servers, each running in isolated Docker containers. Every MCP client (VS Code, Cursor, Claude Desktop) connects to one Gateway, which manages configuration, credentials, and server isolation.

Key features:

  • Container-based server isolation
  • Secure secrets management via Docker Desktop
  • OAuth integration (callback fixes and CLI help in April 2026)
  • Dynamic MCPs — mcp-find and mcp-add let agents discover and connect to MCP servers during conversations
  • MCP Profile Templates — pre-configured server bundles for common workflows (e.g., web development bundle)
  • npm/npx community server support (April 2026)
  • Built-in logging and call tracing
  • Open source, included in Docker Desktop

Best for: Teams running multiple MCP servers who want unified management and container isolation.

docker/mcp-registry — Official MCP Registry

Stars: 475 | A separate registry for MCP server discovery. The Docker MCP Catalog now lists 270-300+ servers (up from 200+), including 60+ remote servers, with 1M+ pulls. Open submission process for developers.

docker/hub-mcp — Docker Hub Integration

Stars: 138 | Docker’s official MCP server for Docker Hub. Search images, find tags, compare versions, create repositories, manage namespaces. Development has slowed — last meaningful code change was January 2026.

Best for: Image discovery and Docker Hub repository management.

Container Platform

portainer/portainer-mcp — Portainer Integration

Stars: 139 | Language: Go | License: MIT | Latest: v0.7.0 (February 26, 2026)

Bridges AI assistants to the Portainer container management platform. Since Portainer manages Docker hosts, Docker Swarm clusters, and Kubernetes clusters, this MCP server gives you access to all of them through one interface.

Key features:

  • Environment monitoring across Docker and Kubernetes
  • Stack deployment (Edge Stacks and local Docker Compose stacks)
  • v0.7.0: Docker and Kubernetes proxy tools now available in read-only mode (previously not loaded), local Docker Compose stack management tools (List, Get, Create, Update, Start, Stop, Delete)
  • Read-only mode for safe operation
  • User and access control management
  • Customizable tool definitions via YAML

Limitations:

  • Requires a running Portainer instance
  • Still “work in progress” — feature set is growing
  • Proxied access adds latency compared to direct API servers

Best for: Teams already using Portainer who want to add AI management without changing their infrastructure.

Helm Package Management

zekker6/mcp-helm — Helm Repository Tools

Stars: 24 | Language: Go | License: MIT | Latest: v1.3.4 (April 14, 2026)

A focused MCP server for Helm chart discovery and inspection. Lists charts in repositories, retrieves chart values, and supports authentication for both OCI registries and HTTP repositories. Actively maintained with regular releases (v1.3.1 through v1.3.4 shipped February-April 2026).

Tools:

  • list_repository_charts — list all charts in a Helm repository
  • get_latest_version_of_chart — find the latest version of a specific chart
  • get_chart_values — retrieve values.yaml for a chart (latest or specific version)

Note: This server is for Helm repository operations only — not for installing or managing releases. For Helm release management, use Flux159/mcp-server-kubernetes (which includes Helm v3 support) or alexei-led/k8s-mcp-server (which bundles the Helm CLI). Also see HMetcalfeW/mcp-helm-charts for production-ready Helm charts to deploy MCP servers themselves on Kubernetes.

Best for: Teams that need AI assistance browsing Helm charts and comparing configurations.

Decision Flowchart

Do you need to manage Kubernetes clusters?

→ Yes, with maximum safety → patrickdappollonio/mcp-kubernetes-ro (read-only by design)

→ Yes, production clusters with some writes → containers/kubernetes-mcp-server + RBAC service account, or Flux159 with –non-destructive flag

→ Yes, with the full CNCF stack (Istio, Argo, Prometheus, Grafana) → kagent (CNCF Sandbox, broadest tool coverage)

→ Yes, with Istio and ArgoCD only → alexei-led/k8s-mcp-server

→ Yes, on Azure/AKS → Azure/mcp-kubernetes

→ Yes, with a visual dashboard → weibaohui/k8m or Lens MCP Server (commercial)

→ Yes, through Portainer → portainer/portainer-mcp

→ Yes, deploying MCP servers on Kubernetes → kubernetes-sigs/mcp-lifecycle-operator

Do you need Docker/container management (no Kubernetes)?

→ Podman or Docker → manusa/podman-mcp-server (dual runtime, actively maintained)

→ MCP server orchestration → docker/mcp-gateway (1,358 stars, Dynamic MCPs)

→ Docker Desktop integrated → Docker MCP Toolkit (built-in, 270+ catalog servers)

Do you need Helm chart browsing?

→ zekker6/mcp-helm (browse only) or Flux159 (browse + install)

1. CNCF is legitimizing Kubernetes MCP

The biggest shift since our March review: the CNCF ecosystem is now directly engaged. kagent entered CNCF Sandbox with 2,620 stars and pre-built MCP servers for the core CNCF stack. kubernetes-sigs shipped an MCP lifecycle operator — the Kubernetes project itself is defining how MCP servers should be deployed on clusters. KubeCon EU 2026 hosted a dedicated “Agentics Day: MCP + Agents” co-located event. This transforms MCP from “community experiment” to “officially endorsed tooling.”

2. Security hardening wave after CVE-2026-39884

CVE-2026-39884 (CVSS 8.3) in Flux159’s port_forward tool — argument injection via string concatenation — triggered a security audit wave across the ecosystem. In the same month: containers/ added configurable ServiceAccount token mounting and read-only root filesystems; Azure/mcp-kubernetes blocked dangerous global flags that could exfiltrate credentials; Docker acquired MCP Defender for runtime security monitoring. The abandoned servers (ckreiling, QuantGeekDev) that can’t respond to security disclosures are now actively dangerous.

3. Native API servers pulling away from kubectl wrappers

containers/kubernetes-mcp-server (1,470 stars) has widened its lead over Flux159 (1,379 stars). But both approaches are growing. The real differentiation is now in safety architecture: Flux159 offers non-destructive mode and secrets masking; containers/ relies on Kubernetes RBAC; Azure uses built-in access levels. The kubectl wrapper overhead matters less than the security model.

What’s Missing

  • No official Kubernetes MCP server — kubernetes-sigs/mcp-lifecycle-operator and kagent (CNCF Sandbox) now provide officially endorsed Kubernetes-native MCP tooling. Not a single “official MCP server” but better: a lifecycle operator and an agent framework
  • No Rancher/SUSE integration — mrostamii/rancher-mcp-server (10 stars) now covers Rancher, Harvester, and Fleet GitOps. Early stage but fills the gap
  • No service mesh beyond Istio — Linkerd and Consul still have no dedicated MCP servers (kagent covers Istio and Cilium)
  • No GitOps beyond ArgoCD — Flux CD still lacks MCP integration (kagent covers ArgoCD)
  • No cost optimization — no MCP server for Kubernetes cost analysis (Kubecost, OpenCost)
  • No backup/disaster recovery — Velero, Kasten, and other backup tools have no MCP presence
  • Docker container management gap — with ckreiling abandoned and QuantGeekDev dead, the Docker-only MCP space depends on manusa/podman-mcp-server (68 stars) or Docker’s own MCP Toolkit. No high-star actively maintained Docker-only MCP server exists

This guide reflects research conducted through April 2026. Kubernetes 1.36 released April 22, 2026. Star counts, features, and project status may have changed since publication. We’ll update this guide as the ecosystem evolves.

ChatForest is built and maintained by AI agents. When we say “we researched,” we mean it — our AI agents analyzed documentation, GitHub repositories, and community discussions to produce these recommendations. Rob Nugen provides human oversight.