ocm-mcp-server — Claude Code MCP server: guarded Kubernetes fleet ops
Lets an AI agent work across several Kubernetes clusters through an Open Cluster Management hub. Reads go through freely, changes wait for policy checks and a human signature.
claude mcp add --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> --transport stdio ocm-mcp-server -- uvx ocm-mcp-serverWhat ocm-mcp-server does
The model never gets its own kubeconfig. It asks the hub, and the server decides what reaches the clusters: reads are open, writes are checked against Kyverno policy, signed off by a person and logged for audit. That keeps a bad guess from turning into a delete.
You need Python 3.11+ and the ocm-mcp-server package, installable with pip or runnable straight through uvx. Configuration lives in three environment variables: KUBECONFIG, the hub context OCM_MCP_HUB_CONTEXT, and the OCM_MCP_READ_ONLY switch. Set the last one while the agent is only diagnosing — write attempts then stop before the policy stage.
The hub is picked by its kubeconfig context, so without that name the server has nowhere to connect. The policy layer matters just as much: an empty rule set in the hub makes the write check cosmetic.
What it helps with
- trace a degraded workload across the whole fleet
- stage a fix as a ManifestWork and hold it for approval
- inspect cluster state without handing out kubeconfig
- rebuild an incident timeline from the audit log
- test an agent's change against Kyverno before it lands
Example prompts for the agent
- Find which workloads are unhealthy across the fleet and propose a fix
- Draft the ManifestWork for that limit change and wait for my approval token
- Switch to read-only and summarize the hub's current state
How to install ocm-mcp-server
Platform CLI
claude mcp add --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> --transport stdio ocm-mcp-server -- uvx ocm-mcp-serverReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>
Platform CLI
codex mcp add ocm-mcp-server --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> -- uvx ocm-mcp-serverReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>
Config file
{
"mcpServers": {
"ocm-mcp-server": {
"command": "uvx",
"args": [
"ocm-mcp-server"
],
"env": {
"KUBECONFIG": "<KUBECONFIG>",
"OCM_MCP_HUB_CONTEXT": "<OCM_MCP_HUB_CONTEXT>",
"OCM_MCP_READ_ONLY": "<OCM_MCP_READ_ONLY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>
Config file
{
"servers": {
"ocm-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": [
"ocm-mcp-server"
],
"env": {
"KUBECONFIG": "<KUBECONFIG>",
"OCM_MCP_HUB_CONTEXT": "<OCM_MCP_HUB_CONTEXT>",
"OCM_MCP_READ_ONLY": "<OCM_MCP_READ_ONLY>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>
Platform CLI
gemini mcp add -e KUBECONFIG=<KUBECONFIG> -e OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> -e OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> ocm-mcp-server uvx ocm-mcp-serverReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ocm-mcp-server
How do I install ocm-mcp-server in Claude Code?
Run claude mcp add ocm-mcp-server -e KUBECONFIG=<KUBECONFIG> -- uvx ocm-mcp-server. To pass the hub context and read-only flag as well, use `claude mcp add --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> --transport stdio ocm-mcp-server -- uvx ocm-mcp-server`.
What does ocm-mcp-server do?
It exposes an Open Cluster Management hub to an agent: reading cluster state, preparing changes, running them past Kyverno policy and waiting for a person to approve the write.
Which environment variables does it need?
KUBECONFIG for hub access, OCM_MCP_HUB_CONTEXT to name the hub context, and OCM_MCP_READ_ONLY to run without writes.
