MCP Directory

How to add K8s MCP Server to Windsurf

Run kubectl, helm, istioctl, and argocd against your clusters from Claude in a secure Docker sandbox. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.

Last updated June 14, 2026 · 210★ · stdio · no auth

Windsurf config for K8s MCP Server

docker run -i --rm -v ~/.kube:/home/appuser/.kube:ro ghcr.io/alexei-led/k8s-mcp-server:latest
{
  "mcpServers": {
    "k8s-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-v",
        "/Users/YOUR_USER_NAME/.kube:/home/appuser/.kube:ro",
        "ghcr.io/alexei-led/k8s-mcp-server:latest"
      ]
    }
  }
}

Requires Docker to be installed and running.

Setup steps

  1. 1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
  2. 2Paste the K8s MCP Server config below.
  3. 3Fill in placeholder secrets, then save.
  4. 4Click Refresh in the MCP panel.
  5. 5K8s MCP Server's tools become available to Cascade.

Before you start

  • Docker installed and running
  • A Kubernetes kubeconfig at ~/.kube (mounted read-only into the container)
  • Claude Desktop (or another MCP client)
  • For cloud clusters: AWS/GCP/Azure credentials mounted as additional volumes (see Cloud Provider Support docs)

What K8s MCP Server can do in Windsurf

kubectl

Run kubectl commands to inspect, create, update, and manage Kubernetes resources (pods, deployments, services, namespaces, logs, etc.).

helm

Manage Helm charts and releases, e.g. deploying charts like bitnami/wordpress and configuring values.

istioctl

Operate the Istio service mesh, e.g. checking mesh status and configuring traffic routing such as canary deployments.

argocd

Interact with Argo CD, e.g. creating and managing GitOps Applications for your repositories.

Security

Runs as a non-root user with strict command validation. Your kubeconfig is mounted read-only (`:ro`) into the container. A permissive security mode is available via the `K8S_MCP_SECURITY_MODE=permissive` environment variable; see the project's Security Documentation for custom rules and modes.

K8s MCP Server + Windsurf FAQ

Where is the Windsurf config file?

Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the K8s MCP Server config there under the "mcpServers" key and restart the client.

Is K8s MCP Server safe to use with Windsurf?

Runs as a non-root user with strict command validation. Your kubeconfig is mounted read-only (`:ro`) into the container. A permissive security mode is available via the `K8S_MCP_SECURITY_MODE=permissive` environment variable; see the project's Security Documentation for custom rules and modes.

How does Claude connect to my cluster?

You add a docker run command to your Claude Desktop config under mcpServers. The container mounts your ~/.kube directory read-only and uses your existing kubeconfig credentials and contexts.

Which transports are supported?

Three transports, selected via the K8S_MCP_TRANSPORT environment variable: stdio (default, used by Claude Desktop), streamable-http (recommended for remote/web clients), and sse (deprecated, use streamable-http instead).

How do I connect to a managed cloud cluster?

Mount the relevant cloud credentials as an extra read-only volume and set provider environment variables — e.g. ~/.aws with AWS_PROFILE/AWS_REGION for EKS, ~/.config/gcloud with CLOUDSDK_CORE_PROJECT for GKE, or ~/.azure with AZURE_SUBSCRIPTION for AKS. See the Cloud Provider Support guide.

View repo Full K8s MCP Server page