# ocm-mcp-server

Lets an AI agent work across several Kubernetes clusters through an Open Cluster Management hub. Reads go through freely, changes wait for policy checks and a human signature.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 17
- Author: ocm-mcp-server
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/ocm-mcp-server/ocm-mcp-server
- Updated: 2026-10-10
- HTML: https://affpapa.org/en/nevibecode/mcp/ocm-mcp-server

## What it does

The model never gets its own kubeconfig. It asks the hub, and the server decides what reaches the clusters: reads are open, writes are checked against Kyverno policy, signed off by a person and logged for audit. That keeps a bad guess from turning into a delete.

You need Python 3.11+ and the `ocm-mcp-server` package, installable with `pip` or runnable straight through `uvx`. Configuration lives in three environment variables: `KUBECONFIG`, the hub context `OCM_MCP_HUB_CONTEXT`, and the `OCM_MCP_READ_ONLY` switch. Set the last one while the agent is only diagnosing — write attempts then stop before the policy stage.

The hub is picked by its kubeconfig context, so without that name the server has nowhere to connect. The policy layer matters just as much: an empty rule set in the hub makes the write check cosmetic.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `KUBECONFIG`, `OCM_MCP_HUB_CONTEXT`, `OCM_MCP_READ_ONLY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> --transport stdio ocm-mcp-server -- uvx ocm-mcp-server
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>

### Codex

**Platform CLI**
```bash
codex mcp add ocm-mcp-server --env KUBECONFIG=<KUBECONFIG> --env OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> --env OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> -- uvx ocm-mcp-server
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "ocm-mcp-server": {
            "command": "uvx",
            "args": [
                "ocm-mcp-server"
            ],
            "env": {
                "KUBECONFIG": "<KUBECONFIG>",
                "OCM_MCP_HUB_CONTEXT": "<OCM_MCP_HUB_CONTEXT>",
                "OCM_MCP_READ_ONLY": "<OCM_MCP_READ_ONLY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "ocm-mcp-server": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "ocm-mcp-server"
            ],
            "env": {
                "KUBECONFIG": "<KUBECONFIG>",
                "OCM_MCP_HUB_CONTEXT": "<OCM_MCP_HUB_CONTEXT>",
                "OCM_MCP_READ_ONLY": "<OCM_MCP_READ_ONLY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e KUBECONFIG=<KUBECONFIG> -e OCM_MCP_HUB_CONTEXT=<OCM_MCP_HUB_CONTEXT> -e OCM_MCP_READ_ONLY=<OCM_MCP_READ_ONLY> ocm-mcp-server uvx ocm-mcp-server
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from ocm-mcp-server <command>

## When to use it
- trace a degraded workload across the whole fleet
- stage a fix as a ManifestWork and hold it for approval
- inspect cluster state without handing out kubeconfig
- rebuild an incident timeline from the audit log
- test an agent's change against Kyverno before it lands

## Example prompts
- Find which workloads are unhealthy across the fleet and propose a fix
- Draft the ManifestWork for that limit change and wait for my approval token
- Switch to read-only and summarize the hub's current state

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md