Kubernetes MCP Server

Red Hat's Kubernetes MCP server provides AI agents with native cluster orchestration tools to inspect namespaces, manage pods, monitor services, and apply deployment manifests. It empowers agents to diagnose pod crashes, analyze cluster resource allocations, and automate containerized workload management.

Start for free

Benefits with Ory + Kubernetes MCP Server

Red Hat's Kubernetes MCP server lets your agents work with Kubernetes and OpenShift clusters: listing resources, reading pod logs and events, running commands in pods, and creating, updating, or deleting resources. The server uses the cluster credentials it's given, so every connected agent shares that access. Ory Agent Security gives each agent its own answer, letting an on-call agent read logs while changes stay with the release agents you approve.

View on GitHub

Use Cases

— 01 use case

Agent IAM

Troubleshooters read logs at Read, incident agents scale at Write, exec, deletes and Helm installs stay at Admin, and you set Block for anyone outside the platform team.

Explore Agent IAM

Core Functionality

— 04 capabilities

Read, write, admin, or no access
Ory Agent Security classifies every tool on Red Hat's Kubernetes MCP server as read, write, or admin, so you can give each user, team, or agent type only the level it needs: read for on-call agents, write for agents that scale workloads, admin for release agents, and no access for agents with no cluster role.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied command in a pod stops before it reaches your cluster, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents read logs and which try to change workloads without blocking anything, so you can apply Ory's pre-built policy for Red Hat's Kubernetes MCP server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on Red Hat's Kubernetes MCP server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show which agent ran a command in a container and for whom.