How to add Kubernetes MCP Server to Windsurf

Go-native MCP server for Kubernetes and OpenShift — manage pods, resources, Helm, Tekton, and more. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.

Last updated June 14, 2026 · 1.7k★ · stdio · no auth

Windsurf config for Kubernetes MCP Server

npx -y kubernetes-mcp-server@latest

{
  "mcpServers": {
    "kubernetes-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "kubernetes-mcp-server@latest"
      ]
    }
  }
}

Setup steps

1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
2Paste the Kubernetes MCP Server config below.
3Fill in placeholder secrets, then save.
4Click Refresh in the MCP panel.
5Kubernetes MCP Server's tools become available to Cascade.

Before you start

Access to a Kubernetes cluster
A kubeconfig file or in-cluster configuration
npm/Node.js (only if running via npx) or uv/Python (only if running via uvx); not required when using the native binary

What Kubernetes MCP Server can do in Windsurf

configuration_contexts_list

List all available context names and associated server URLs from the kubeconfig file.

targets_list

List all available targets.

configuration_view

Get the current Kubernetes configuration content as a kubeconfig YAML (minified by default).

events_list

List Kubernetes events (warnings, errors, state changes) for debugging and troubleshooting across all namespaces or a specific namespace.

namespaces_list

List all the Kubernetes namespaces in the current cluster.

projects_list

List all the OpenShift projects in the current cluster.

nodes_log

Get logs from a Kubernetes node (kubelet, kube-proxy, or other system logs) through the Kubernetes API proxy to the kubelet.

nodes_stats_summary

Get detailed resource usage statistics from a node via the kubelet's Summary API (CPU, memory, filesystem, network, and PSI metrics where available).

Security

Has full access to your Kubernetes cluster via your kubeconfig credentials. Supports `--read-only` mode (blocks all write operations) and `--disable-destructive` mode (blocks delete/update). For HTTP mode, OAuth/OIDC authentication is supported (Keycloak, Microsoft Entra ID). TOML config can restrict access to sensitive resources via `denied_resources` (e.g. Secrets). Sensitive data (tokens, keys, passwords, cloud credentials) is automatically redacted before being sent to clients. For production, the docs recommend a dedicated ServiceAccount with read-only access.

Kubernetes MCP Server + Windsurf FAQ

Where is the Windsurf config file?

Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the Kubernetes MCP Server config there under the "mcpServers" key and restart the client.

Is Kubernetes MCP Server safe to use with Windsurf?

Is this just a wrapper around kubectl or helm?

No. It is a Go-based native implementation that interacts directly with the Kubernetes API server, so there is no need for external CLIs or for Node/Python to be installed when using the native binaries.

How do I limit what the server can do?

Use --read-only to block all write operations, or --disable-destructive to block delete/update operations. You can also use a TOML config with denied_resources to restrict access to sensitive resource types like Secrets, and enable only the toolsets you need via --toolsets.

Does it support OpenShift?

Yes. It supports both Kubernetes and OpenShift, including OpenShift-specific operations such as listing Projects and Routes.

View repo Full Kubernetes MCP Server page