Kubernetes Troubleshoot MCP
A read-only MCP server exposing 16 diagnostic tools over stdio to let an AI assistant diagnose a Kubernetes cluster. It queries the Kubernetes API using a scoped ServiceAccount token with get/list/watch permissions only. Tools include getting pod status, logs, events, listing pods and nodes, and checking node conditions. It is designed to connect to clients like Claude Desktop, VS Code, or Kiro.
Package and access
Local package with source-attributed installation metadata. Koskamo does not execute packages during review.
What you can do with it
- Diagnose why a pod is crash-looping
- Retrieve recent log lines from a pod container
- Identify nodes that are not Ready and their taints
- Check if an HPA is scaling and view current metrics
Source and maintenance
- Last repository push
- Maintenance checked
Packages and installation
Source-provided package data. Koskamo has not executed or live-probed this package.
docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0
{
"transport": "stdio",
"identifier": "docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0",
"runtimeHint": "docker",
"registryType": "oci",
"runtimeArguments": [
{
"name": "--mount",
"type": "named",
"value": "type=bind,src={kubeconfig_path},dst=/kubeconfig,readonly",
"variables": {
"kubeconfig_path": {
"format": "filepath",
"isRequired": true,
"description": "Absolute path on the host to a kubeconfig scoped to the diagnostic ServiceAccount. Generate it with scripts/generate-kubeconfig.sh — do not mount an admin kubeconfig. The file must be readable by UID 10001, which the container runs as."
}
},
"isRequired": true,
"description": "Mount the kubeconfig read-only. This server performs no writes of any kind, so a writable mount would grant privilege it has no use for."
}
],
"environmentVariables": [
{
"name": "KUBECONFIG",
"default": "/kubeconfig",
"isRequired": true,
"description": "Path to the kubeconfig inside the container. Must match the mount destination. There is no fallback to ~/.kube/config and no in-cluster config: a missing, unreadable or malformed file is a startup failure rather than a silent downgrade to an ambient credential."
},
{
"name": "ALLOWED_NAMESPACES",
"format": "string",
"isRequired": true,
"description": "Comma-separated namespaces the server may read, e.g. staging,production. Wildcards (* and all) are rejected at startup, and kube-system and kube-public are stripped even if listed. This is defense-in-depth, not the security boundary — the boundary is the ServiceAccount's RBAC bindings."
},
{
"name": "LOG_LEVEL",
"default": "INFO",
"description": "DEBUG, INFO, WARNING or ERROR. All logging goes to stderr; stdout carries the JSON-RPC stream exclusively."
},
{
"name": "API_TIMEOUT_SECONDS",
"default": "30",
"description": "Kubernetes API request timeout. Must be a positive integer."
},
{
"name": "MAX_LOG_LINES",
"default": "200",
"description": "Maximum log lines any single get_pod_logs call may return. Must be a positive integer; clamped to a hard ceiling of 1000 with a warning."
}
]
}Tools
Reported by the attributed source; not independently observed by Koskamo.
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · repository · passed · metadata changed · updated
- · backfill · recorded · Pre-expansion baseline; unobserved rich metadata remains unknown
Connect from your client
Each snippet configures the same source-provided package; replace placeholders before use.
Cursor
{
"mcpServers": {
"kubernetes-troubleshoot-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"KUBECONFIG=<YOUR_KUBECONFIG>",
"-e",
"ALLOWED_NAMESPACES=<YOUR_ALLOWED_NAMESPACES>",
"-e",
"LOG_LEVEL=<YOUR_LOG_LEVEL>",
"-e",
"API_TIMEOUT_SECONDS=<YOUR_API_TIMEOUT_SECONDS>",
"-e",
"MAX_LOG_LINES=<YOUR_MAX_LOG_LINES>",
"docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0"
],
"env": {
"KUBECONFIG": "<YOUR_KUBECONFIG>",
"ALLOWED_NAMESPACES": "<YOUR_ALLOWED_NAMESPACES>",
"LOG_LEVEL": "<YOUR_LOG_LEVEL>",
"API_TIMEOUT_SECONDS": "<YOUR_API_TIMEOUT_SECONDS>",
"MAX_LOG_LINES": "<YOUR_MAX_LOG_LINES>"
}
}
}
}Cline
{
"mcpServers": {
"kubernetes-troubleshoot-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"KUBECONFIG=<YOUR_KUBECONFIG>",
"-e",
"ALLOWED_NAMESPACES=<YOUR_ALLOWED_NAMESPACES>",
"-e",
"LOG_LEVEL=<YOUR_LOG_LEVEL>",
"-e",
"API_TIMEOUT_SECONDS=<YOUR_API_TIMEOUT_SECONDS>",
"-e",
"MAX_LOG_LINES=<YOUR_MAX_LOG_LINES>",
"docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0"
],
"env": {
"KUBECONFIG": "<YOUR_KUBECONFIG>",
"ALLOWED_NAMESPACES": "<YOUR_ALLOWED_NAMESPACES>",
"LOG_LEVEL": "<YOUR_LOG_LEVEL>",
"API_TIMEOUT_SECONDS": "<YOUR_API_TIMEOUT_SECONDS>",
"MAX_LOG_LINES": "<YOUR_MAX_LOG_LINES>"
}
}
}
}VS Code
{
"servers": {
"kubernetes-troubleshoot-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"KUBECONFIG=<YOUR_KUBECONFIG>",
"-e",
"ALLOWED_NAMESPACES=<YOUR_ALLOWED_NAMESPACES>",
"-e",
"LOG_LEVEL=<YOUR_LOG_LEVEL>",
"-e",
"API_TIMEOUT_SECONDS=<YOUR_API_TIMEOUT_SECONDS>",
"-e",
"MAX_LOG_LINES=<YOUR_MAX_LOG_LINES>",
"docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0"
],
"env": {
"KUBECONFIG": "<YOUR_KUBECONFIG>",
"ALLOWED_NAMESPACES": "<YOUR_ALLOWED_NAMESPACES>",
"LOG_LEVEL": "<YOUR_LOG_LEVEL>",
"API_TIMEOUT_SECONDS": "<YOUR_API_TIMEOUT_SECONDS>",
"MAX_LOG_LINES": "<YOUR_MAX_LOG_LINES>"
}
}
}
}Claude Desktop
{
"mcpServers": {
"kubernetes-troubleshoot-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"KUBECONFIG=<YOUR_KUBECONFIG>",
"-e",
"ALLOWED_NAMESPACES=<YOUR_ALLOWED_NAMESPACES>",
"-e",
"LOG_LEVEL=<YOUR_LOG_LEVEL>",
"-e",
"API_TIMEOUT_SECONDS=<YOUR_API_TIMEOUT_SECONDS>",
"-e",
"MAX_LOG_LINES=<YOUR_MAX_LOG_LINES>",
"docker.io/yawgyamfiprem32/k8s-troubleshoot-mcp:1.0.0"
],
"env": {
"KUBECONFIG": "<YOUR_KUBECONFIG>",
"ALLOWED_NAMESPACES": "<YOUR_ALLOWED_NAMESPACES>",
"LOG_LEVEL": "<YOUR_LOG_LEVEL>",
"API_TIMEOUT_SECONDS": "<YOUR_API_TIMEOUT_SECONDS>",
"MAX_LOG_LINES": "<YOUR_MAX_LOG_LINES>"
}
}
}
}Let your agent find its tools
Find servers like Kubernetes Troubleshoot MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.