Kubernetes MCP server

Every cluster in your AI client. One command.

A hosted MCP endpoint with 450+ tools for pods, logs, events, Helm, GitOps, pipelines, security and cost across every cluster in your Ankra organisation. Nothing to install or run. Read-only unless you grant mcp:write.

Start free MCP docs

Connect Claude Code to every cluster in one line

$ claude mcp add --transport http ankra https://platform.ankra.app/api/v1/mcp

Run /mcp in Claude Code to sign in. Cursor and other clients use a token.MCP docs CLI docs CLI on GitHub

claude code · ankra mcp

$ claude mcp add --transport http ankra https://platform.ankra.app/api/v1/mcp$ claude> /mcp  Authenticate opens the browser. Sign in, pick the organisation, approve.  ✓ ankra connected > why is checkout-api crashlooping on prod-eu?  ● list_clusters                    3 clusters, prod-eu found  ● get_pods           ns checkout   checkout-api  CrashLoopBackOff  14 restarts  ● get_pod_logs       previous      OOMKilled, exit code 137  ● get_events         checkout-api  Back-off restarting failed container  ● get_stack_history  checkout      2h ago  memory limit 512Mi -> 256Mi  checkout-api is being OOMKilled. A stack change two hours ago cut its
  memory limit from 512Mi to 256Mi. Rolling the add-on back restores 512Mi. > roll it back  ? Allow ankra · rollback_addon for checkout-api on prod-eu  › Yes  ● rollback_addon     checkout-api  operation started  ● wait_for_execution               succeeded in 41s  ● get_pods           ns checkout   checkout-api  Running  0 restarts  Done. checkout-api is Running with 512Mi again.  ↗ Open checkout-api in the Ankra portal

Sample session with example data. Green dots are read tools, amber needs mcp:write and your approval.

Connect

Same endpoint, any client.

Claude, Claude Desktop and Claude Code sign in with OAuth. No token to copy.
Cursor and other clients send a Bearer token from the portal or ankra tokens create.
Check it works by asking for your clusters. The client calls list_clusters.
Streamable HTTP, listed in the official MCP Registry as ai.ankra/platform.

# Register once, then sign in with OAuth

$ claude mcp add --transport http ankra \
    https://platform.ankra.app/api/v1/mcp
$ claude
> /mcp                  # ankra, Authenticate
> list my ankra clusters

Add --scope user to use it in every project. The OAuth grant lasts seven days, then run /mcp again.

# A read-only token, then your user-level MCP config

$ ankra tokens create cursor --scopes mcp:read

# ~/.cursor/mcp.json
{
  "mcpServers": {
    "ankra": {
      "url": "https://platform.ankra.app/api/v1/mcp",
      "headers": { "Authorization": "Bearer <ankra-token>" }
    }
  }
}

Use --scopes mcp:read,mcp:write only when the client should change resources. Keep the token out of files you commit.

# Claude web and desktop, as a custom connector

Settings › Connectors › Add › Add custom connector

  Name   Ankra
  URL    https://platform.ankra.app/api/v1/mcp

Connect › sign in to Ankra › pick the organisation › Approve

Custom connectors need a paid Claude plan. Leave the OAuth client fields empty.

Tools

450+ tools. Not just kubectl.

The same tool registry runs Ankra's own AI. Cluster tools take a cluster_id from list_clusters, so one session covers the whole fleet.

Workloads

get_pods
get_pod_logs
get_events
describe_resource
restart_deployment
scale_deployment

Clusters and nodes

list_clusters
get_nodes
cordon_node
upgrade_cluster
create_hetzner_cluster

Stacks, Helm and GitOps

get_stack_details
get_stack_history
get_gitops_status
update_addon_configuration
rollback_addon

Metrics and logs

query_prometheus
query_prometheus_range
query_logs
get_cluster_attention_summary

Applications and pipelines

list_applications
watch_pipeline_run
deploy_application
promote_application
rerun_application_workflow

Security, cost and backups

list_security_findings
get_compliance_reports
get_cluster_cost
list_backup_vaults
create_stack_restore_point

mcp:readmcp:write

All 457 tools with their scopes

Access

You pick the scope. The token enforces it.

mcp:read

Every read-only tool. Pods, logs, events, metrics, stacks, findings and cost. Changes nothing.

mcp:write

Adds apply, scale, restart, rollback, upgrades and pull requests. Your client's approval prompt is the gate, so give it to clients you trust.

One organisation: Tokens and OAuth grants are bound to the organisation chosen when they were created.
Filtered tool list: tools/list returns only the tools the token's scope allows.
Checked before dispatch: Ankra verifies the cluster belongs to the token's organisation before a cluster tool runs.
No secrets in arguments: Mutating calls whose parameters contain literal secrets are refused.
Rate limited: 120 read calls and 20 write calls per minute, per token.
Audited: Every resolved call, refused ones included, lands in the organisation audit log.

Compared

A kubeconfig MCP server, or a hosted one.

Open source servers that wrap your kubeconfig are a good fit for one cluster on one laptop. This is where the two differ.

	MCP server you run	Ankra MCP server
Where it runs	Your laptop or your cluster	Hosted by Ankra, or self-hosted on Enterprise
Credentials	Your kubeconfig	OAuth or a token scoped to mcp:read or mcp:write
Reach	Clusters in your kubeconfig	Every cluster in your Ankra organisation
Tools	The Kubernetes API	450+ across Kubernetes, Helm, GitOps, pipelines, security, cost and backups
Audit trail	Whatever you build	Every call in the organisation audit log

FAQ

What is a Kubernetes MCP server?

A Model Context Protocol server that exposes Kubernetes operations as tools an AI client can call. Instead of pasting kubectl output into a chat, the assistant lists pods, reads logs and events, and with permission makes the change itself.

How do I connect Claude Code to Kubernetes?

Run claude mcp add --transport http ankra https://platform.ankra.app/api/v1/mcp, start Claude Code, run /mcp and authenticate in the browser. Then ask it to list your Ankra clusters.

Can it change my clusters?

Only with mcp:write. With mcp:read the client sees read-only tools and cannot change anything. Ankra adds no second confirmation over MCP, so your client's approval prompt is the gate. Only grant mcp:write to clients you trust.

Which clients work with it?

Any client that supports remote MCP servers over streamable HTTP. Claude web, desktop and Claude Code sign in with OAuth. Cursor and other clients send a Bearer token from the Ankra portal or ankra tokens create.

What does it cost?

The MCP server is part of the Ankra platform and works on the free tier. Ankra bills on worker vCPUs only, every plan includes 30 worker vCPUs free, and the free tier needs no credit card.

Connect a cluster. Ask it anything.

Free tier with 30 worker vCPUs included and no credit card.

Start free Read the MCP docs

Claude and Claude Code are products of Anthropic. Cursor is a product of Anysphere. Ankra is not affiliated with or endorsed by either. Product details were checked against the Ankra documentation in October 2026.