MCP servers for infrastructure

# server.py: read-only Kubernetes diagnostics over MCP (Python SDK, FastMCP)
from kubernetes import client, config
from mcp.server.fastmcp import FastMCP

config.load_kube_config()          # uses a read-only context (see RBAC below)
core = client.CoreV1Api()
mcp = FastMCP("k8s-readonly")

MAX_ITEMS = 200

@mcp.tool()
def list_problem_pods(namespace: str = "") -> list[dict]:
    """List pods that are not Running/Succeeded or have restarts, optionally in one namespace."""
    pods = (core.list_namespaced_pod(namespace) if namespace
            else core.list_pod_for_all_namespaces()).items
    out = []
    for p in pods:
        restarts = sum(cs.restart_count for cs in (p.status.container_statuses or []))
        if p.status.phase not in ("Running", "Succeeded") or restarts > 0:
            out.append({"namespace": p.metadata.namespace, "pod": p.metadata.name,
                        "phase": p.status.phase, "restarts": restarts})
    return out[:MAX_ITEMS]

@mcp.tool()
def recent_events(namespace: str, limit: int = 50) -> list[dict]:
    """Return the most recent events in a namespace (warnings first)."""
    events = core.list_namespaced_event(namespace).items
    events.sort(key=lambda e: (e.type != "Warning",
                               -(e.last_timestamp or e.event_time or e.metadata.creation_timestamp).timestamp()))
    return [{"type": e.type, "reason": e.reason, "object": f"{e.involved_object.kind}/{e.involved_object.name}",
             "message": (e.message or "")[:300]} for e in events[:min(limit, MAX_ITEMS)]]

if __name__ == "__main__":
    mcp.run()                        # stdio transport by default

$ pip install "mcp[cli]" kubernetes
$ claude mcp add k8s-ro -- python server.py

apiVersion: v1
kind: ServiceAccount
metadata:
  name: mcp-readonly
  namespace: ops-tools
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mcp-readonly-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view                  # built-in: read most objects, no Secrets, no writes
subjects:
  - kind: ServiceAccount
    name: mcp-readonly
    namespace: ops-tools