What is a Kubernetes MCP server?

A server that implements the Model Context Protocol and exposes Kubernetes operations as tools, so an AI assistant such as Claude Code, Cursor or VS Code can inspect and change workloads by calling them.

Which Kubernetes MCP server should I use?

Pick by level. For debugging clusters you operate, a cluster-level server such as containers/kubernetes-mcp-server or Flux159/mcp-server-kubernetes with a read-only service account. For EKS managed through IAM, the Amazon EKS MCP server. For GitOps, the Argo CD server. For application teams who should not hold cluster credentials, a platform-level server such as SeaGit’s.

Is it safe to let an AI assistant run kubectl?

It is as safe as the credentials you give it. Use a read-only mode or a service account with limited permissions, keep write tools behind an approval prompt, and do not use an admin kubeconfig.

Do I need a kubeconfig for the SeaGit MCP server?

No. It is hosted at https://seagit.com/api/mcp and authenticates with a SeaGit API key, working with applications and deployments rather than raw cluster resources.

Comparison

Kubernetes MCP Servers Compared: kubectl, EKS, Argo CD

A Kubernetes MCP server lets an AI assistant such as Claude Code, Cursor or VS Code work with Kubernetes through tools instead of you pasting kubectl output. The servers differ in the level they work at: some speak to the Kubernetes API, one to Argo CD, and some to a delivery platform. That level decides what the assistant can see, what it can break and which credentials it holds.

By Muhammad Soliman, Founder at SeaGit

Published 16 October 2026 · Updated 16 October 2026

Key takeaways

Cluster-level servers (containers/kubernetes-mcp-server, Flux159’s server, the Amazon EKS server) see every resource and act with your kubeconfig or IAM identity.
The Argo CD server works through GitOps applications and an Argo CD token, so changes go through the same sync your team already uses.
A platform-level server such as SeaGit’s works with applications, environments and deployments, and authenticates with a scoped API key instead of cluster credentials.
Whichever you pick, start read-only, scope the credentials, and keep write tools behind the client’s approval prompt.

Three levels of Kubernetes MCP server

Every server on this list implements the Model Context Protocol, so any MCP client can call it. What differs is what sits behind the tools.

Cluster level. Tools map to Kubernetes API operations: get, describe, logs, apply, delete, scale. The assistant can inspect anything the credentials can, which is ideal for debugging and dangerous with an admin kubeconfig.
GitOps level. Tools map to Argo CD applications: list, sync, update. Changes go through Argo CD rather than straight to the cluster.
Platform level. Tools map to what a delivery platform ships: applications, environments, preview and production deployments. The assistant works with releases, not pods, and never holds a kubeconfig.

The five servers side by side

Checked against each project’s README or vendor page on 16 October 2026. Flags and tool names change between releases, so confirm against the current README before you rely on one.

Server	Works at	Runs	Credentials	Can change
containers/kubernetes-mcp-server	Cluster (Kubernetes API)	Locally: binary, npm, Python package or container	Your kubeconfig	Create, update, delete; --read-only and --disable-destructive flags
Flux159/mcp-server-kubernetes	Cluster (kubectl and Helm)	Locally with npx	Your kubeconfig	kubectl and Helm writes; a non-destructive mode disables deletes
Amazon EKS MCP server	Cluster and AWS	Open-source local server, or AWS-hosted (preview since November 2025)	AWS IAM	Cluster creation, app deployment, troubleshooting
Argo CD MCP server	GitOps (Argo CD API)	Locally over stdio, or as an HTTP service	Argo CD API token	Create, update, delete and sync Argo CD applications
SeaGit MCP server	Platform (applications and deployments)	Hosted at seagit.com/api/mcp	SeaGit API key with scopes	Redeploy and promote, both flagged for approval

containers/kubernetes-mcp-server

A Go server that talks to the Kubernetes API directly rather than wrapping kubectl or Helm, from the containers community on GitHub. It ships as a native binary, an npm package, a Python package and a container image. Its --read-only flag blocks create, update and delete, and --disable-destructive narrows writes when read-only is off. Pair it with a service account that has only the permissions you want the assistant to have, not cluster-admin.

Flux159/mcp-server-kubernetes

A Node.js server, started with npx, that exposes kubectl and Helm as tools: get, describe, logs, apply, scale, rollout, Helm install and upgrade, and port forwarding. Setting ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true removes the delete and uninstall tools while keeping reads and creates. It uses whichever context your kubeconfig points at, so check the context before asking it to change anything.

Amazon EKS MCP server

AWS publishes an open-source EKS MCP server and, since 21 November 2025, a fully managed version in preview that AWS hosts, so there is nothing to install. It authenticates with AWS IAM, records calls in CloudTrail, and covers cluster creation, application deployment and troubleshooting with AWS guidance built in. It is the natural choice if your team works directly with EKS and IAM; it is EKS-only.

Argo CD MCP server

The Argo CD server, developed in the argoproj-labs GitHub organization, connects an assistant to the Argo CD API. Its tools create, update, delete and sync Argo CD applications and run resource actions. It runs over stdio or as an HTTP service that takes the Argo CD URL and token in headers. If your team already deploys through Argo CD, it keeps the assistant inside that workflow.

SeaGit MCP server

SeaGit’s server is hosted at seagit.com/api/mcp and works at the platform level: organizations, environments, clusters, applications, their instances in each environment, and deployments, including preview deployments and the main (production) one. Ten tools cover listing all of those, reading deployment logs, redeploying, and promoting a preview to main.

It authenticates with a SeaGit API key, so every call is checked against the key’s scopes and the account’s policies and recorded in the audit log, the same as the REST API. Redeploy and promote are annotated as write tools and promote as destructive, so clients ask before running them. It needs a paid plan, because API keys do. The setup is in the MCP server docs, and this walkthrough uses it from Claude Code.

Which one to choose

Debugging a cluster you operate: a cluster-level server with a read-only service account. containers/kubernetes-mcp-server if you want no kubectl dependency, Flux159’s if you want Helm tools.
An EKS estate managed with IAM: the Amazon EKS MCP server.
Releases that go through Argo CD: the Argo CD server, so changes follow your GitOps flow.
Application teams who should not hold cluster credentials: a platform-level server such as SeaGit’s, where the assistant sees releases and a scoped API key limits what it can do.
You can connect more than one. Clients keep each server’s tools separate, so a read-only cluster server and a platform server can sit side by side.

Safety rules that apply to all of them

Start read-only: turn on the server’s read-only or non-destructive mode where it has one, and give it credentials that can only read.
Never hand an assistant an admin credential. Use a scoped service account, IAM role, Argo CD role or API key.
Keep write tools behind the client’s approval prompt rather than auto-approving them.
Keep credentials in environment variables or the client’s secret prompt, never in a committed config file.