# Kairon An MCP server that lets an agent read Kairon virtual machines, network policies and VM-edge traffic. Read-only by default. - MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 20 - Author: zyvorai - License: Apache-2.0 · policy=link-only · description only; the file stays with the author - Source: https://github.com/zyvorai/zyvor-kairon - Updated: 2026-10-22 - HTML: https://affpapa.org/en/nevibecode/mcp/kairon ## What it does The server exposes a Kairon cluster to your agent through the Kubernetes API. The agent can ask about machine state, network policies and the flows crossing each VM's edge. Writes stay off unless you grant them. It runs as the container `ghcr.io/zyvorai/kairon-mcp:v0.10.2` over stdio. Point it at the cluster with `KAIRON_KUBE_URL`, `KAIRON_KUBE_TOKEN` and `KAIRON_KUBE_CA`; `KAIRON_KUBE_INSECURE` covers a self-signed certificate, and `KAIRON_UI_URL` ties it to the dashboard. No `docker` on the host or a token without cluster access and the server simply won't start, so check both first. Your token and API address end up in the MCP client config. Create a dedicated read-only account rather than reusing an admin kubeconfig. Setup differs between clients only in the wrapper: a `claude mcp add` call in one, a JSON block in the settings of another. ## Requirements - Needs: Docker - Environment variables: `KAIRON_KUBE_URL`, `KAIRON_KUBE_TOKEN`, `KAIRON_KUBE_CA`, `KAIRON_KUBE_INSECURE`, `KAIRON_UI_URL`, `KAIRON_UI_TOKEN`, `KAIRON_UI_CA`, `KAIRON_UI_INSECURE`, `KAIRON_LLM_URL`, `KAIRON_LLM_MODEL` — keys and tokens: ask the human for the values, never commit them or put them in shared files. ## Install ### Claude Code (native platform) **Platform CLI** ```bash claude mcp add --env KAIRON_KUBE_URL= --env KAIRON_KUBE_TOKEN= --env KAIRON_KUBE_CA= --env KAIRON_KUBE_INSECURE= --env KAIRON_UI_URL= --transport stdio kairon -- docker run -i --rm -e KAIRON_KUBE_URL -e KAIRON_KUBE_TOKEN -e KAIRON_KUBE_CA -e KAIRON_KUBE_INSECURE -e KAIRON_UI_URL ghcr.io/zyvorai/kairon-mcp:v0.10.2 ``` Replace <…> with your own values. 7 more environment variables are in the server README ### Codex **Platform CLI** ```bash codex mcp add kairon --env KAIRON_KUBE_URL= --env KAIRON_KUBE_TOKEN= --env KAIRON_KUBE_CA= --env KAIRON_KUBE_INSECURE= --env KAIRON_UI_URL= -- docker run -i --rm -e KAIRON_KUBE_URL -e KAIRON_KUBE_TOKEN -e KAIRON_KUBE_CA -e KAIRON_KUBE_INSECURE -e KAIRON_UI_URL ghcr.io/zyvorai/kairon-mcp:v0.10.2 ``` Replace <…> with your own values. 7 more environment variables are in the server README ### Cursor **Config file** File `.cursor/mcp.json`: ```json { "mcpServers": { "kairon": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "KAIRON_KUBE_URL", "-e", "KAIRON_KUBE_TOKEN", "-e", "KAIRON_KUBE_CA", "-e", "KAIRON_KUBE_INSECURE", "-e", "KAIRON_UI_URL", "ghcr.io/zyvorai/kairon-mcp:v0.10.2" ], "env": { "KAIRON_KUBE_URL": "", "KAIRON_KUBE_TOKEN": "", "KAIRON_KUBE_CA": "", "KAIRON_KUBE_INSECURE": "", "KAIRON_UI_URL": "" } } } } ``` Replace <…> with your own values. 7 more environment variables are in the server README ### GitHub Copilot **Config file** File `.vscode/mcp.json`: ```json { "servers": { "kairon": { "type": "stdio", "command": "docker", "args": [ "run", "-i", "--rm", "-e", "KAIRON_KUBE_URL", "-e", "KAIRON_KUBE_TOKEN", "-e", "KAIRON_KUBE_CA", "-e", "KAIRON_KUBE_INSECURE", "-e", "KAIRON_UI_URL", "ghcr.io/zyvorai/kairon-mcp:v0.10.2" ], "env": { "KAIRON_KUBE_URL": "", "KAIRON_KUBE_TOKEN": "", "KAIRON_KUBE_CA": "", "KAIRON_KUBE_INSECURE": "", "KAIRON_UI_URL": "" } } } } ``` Replace <…> with your own values. 7 more environment variables are in the server README ### Gemini CLI **Platform CLI** ```bash gemini mcp add -e KAIRON_KUBE_URL= -e KAIRON_KUBE_TOKEN= -e KAIRON_KUBE_CA= -e KAIRON_KUBE_INSECURE= -e KAIRON_UI_URL= kairon docker run -i --rm -e KAIRON_KUBE_URL -e KAIRON_KUBE_TOKEN -e KAIRON_KUBE_CA -e KAIRON_KUBE_INSECURE -e KAIRON_UI_URL ghcr.io/zyvorai/kairon-mcp:v0.10.2 ``` Replace <…> with your own values. 7 more environment variables are in the server README ## When to use it - see what runs on Kairon machines without opening the dashboard - check cluster network policies before changing anything - trace which flows cross a single VM's edge - compare actual machine state against what the agent assumes - give an agent cluster access with no write rights ## Example prompts - List every machine in the `prod` namespace and its current state - Which network policies apply to the `web-01` machine right now? - Describe the flows at the edge of VM `db-02` over the last hour ## Similar - [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918 - [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115 - [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643 - [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727 - [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160 - [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109 --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md