Devops MCP

devops-mcp

Unified MCP server for DevOps engineers — query and manage Kubernetes, ArgoCD, Prometheus, and PagerDuty from any MCP-compatible AI agent.

---

What is this?

devops-mcp is an open source Model Context Protocol server that gives AI agents (Claude, etc.) real-time read and write access to your infrastructure stack — all from a single install.

Instead of copy-pasting kubectl output into a chat window, you can ask:

*"Why is the payments deployment in CrashLoopBackOff?"*

*"What changed in the last ArgoCD sync for the auth app?"*

*"Show me the p99 latency for the API gateway over the last hour."*

*"Who's on call right now and what incidents are open?"*

*"Debug the payments service - what's wrong with it?"*

...and get live answers, sourced directly from your cluster and tooling.

Providers included:

---

Quick start

Claude Desktop (stdio — recommended)

Add this to ~/.config/claude/claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{

"mcpServers": { "devops": { "command": "npx", "args": ["-y", "@notharshhaa/devops-mcp@latest"], "env": { "KUBECONFIG": "/home/you/.kube/config", "ARGOCD_SERVER": "https://argocd.company.com", "ARGOCD_TOKEN": "your-argocd-token", "PROMETHEUS_URL": "http://prometheus.monitoring:9090", "PAGERDUTY_TOKEN": "your-pd-api-token", "PAGERDUTY_USER_EMAIL": "you@company.com", "LOKI_URL": "http://loki.monitoring:3100", "LOKI_TOKEN": "your-loki-token" } } } }

Restart Claude Desktop. The devops server will appear in the tools list.

Claude Code (CLI)

claude mcp add devops-mcp -e KUBECONFIG=$HOME/.kube/config \

-e ARGOCD_SERVER=https://argocd.company.com \ -e ARGOCD_TOKEN=... \ -e PROMETHEUS_URL=http://prometheus:9090 \ -e PAGERDUTY_TOKEN=... \ -e LOKI_URL=http://loki.monitoring:3100 \ -e LOKI_TOKEN=... \ -- npx -y @notharshhaa/devops-mcp@latest

Local dev / test

Requires Node.js 20 or newer.

npx @notharshhaa/devops-mcp

or clone and run:

git clone https://github.com/NotHarshhaa/devops-mcp cd devops-mcp npm install cp .env.example .env # fill in your values npm run dev

---

Configuration

All config is via environment variables. Only set the ones for providers you actually use — providers with missing config are silently skipped.

# ── Kubernetes ────────────────────────────────────────────────

KUBECONFIG=/home/user/.kube/config # omit to use in-cluster service account K8S_CONTEXT=my-prod-context # optional: pin a specific context K8S_ALLOWED_NAMESPACES=default,backend # optional: restrict namespace access

── ArgoCD ───────────────────────────────────────────────────

ARGOCD_SERVER=https://argocd.company.com ARGOCD_TOKEN=eyJhbGci... # argocd account generate-token

── Prometheus ───────────────────────────────────────────────

PROMETHEUS_URL=http://prometheus:9090 PROMETHEUS_BEARER_TOKEN= # optional: for authenticated Prometheus

── PagerDuty ────────────────────────────────────────────────

PAGERDUTY_TOKEN=your-api-v2-token PAGERDUTY_USER_EMAIL=you@company.com # required for PagerDuty incident mutations (From header)

── Loki ───────────────────────────────────────────────────

LOKI_URL=http://loki.monitoring:3100 LOKI_TOKEN=your-loki-token

── Stateless Streamable HTTP ────────────────────────────────

For stdio mode (default): no transport config needed

MCP_HTTP_HOST=127.0.0.1 # use 0.0.0.0 inside a container PORT=3000 MCP_AUTH_TOKEN=shared-secret # optional static Bearer token MCP_REQUEST_STATE_SECRET=32+-byte-secret # optional MRTR signing key shared by all replicas MCP_ALLOWED_HOSTS=localhost,127.0.0.1 # required with non-loopback binding MCP_ALLOWED_ORIGINS= # optional browser Origin hostname allowlist MCP_CACHE_TTL_MS=60000 # discovery/tools catalog TTL; 0 disables caching

── Safety ───────────────────────────────────────────────────

DEVOPS_MCP_DRY_RUN=false # true = block all mutations globally DEVOPS_MCP_AUDIT_LOG=/var/log/devops-mcp-audit.jsonl

---

Tool reference

All tools follow a three-tier safety model:

• Read — safe, no side effects, no confirmation needed
• Mutate — defaults to dry_run: true; set dry_run: false to execute
• Destructive — requires confirm: true, or a 2026-07-28 client can complete the server's interactive MRTR confirmation

Kubernetes (k8s__*)

ArgoCD (argo__*)

Prometheus (prom__*)

Example usage:

# Get a human-readable health summary

prom__summarize_service_health(service="payments", timeframeMinutes=30, sloThreshold=0.05)

What it outputs:

• Latency: "Latency increased: 120ms → 480ms (+300%)" or "Latency stable: 125ms"
• Error rate: "Error rate crossed SLO (5%): 7.2%" or "Error rate within SLO: 2.1%"
• Traffic: "Traffic dropped: 500 → 350 req/s (-30%)" or "Traffic spike detected (+150%)"
• Overall assessment: Summary of issues and positive indicators

Why this matters: Instead of raw PromQL numbers that require interpretation, this tool provides actionable insights that AI agents can use directly in responses, making monitoring data actually useful for incident investigation and communication.

Loki (logs__*)

Example usage:

# Get recent error logs

logs__get_recent_errors(service="payments", namespace="default", minutes=30, limit=50)

Search logs with custom query

logs__search(query='{service="payments"} |= level="error"', limit=100)

Why this matters:

• Metrics tell what: Prometheus shows you that latency increased or error rate crossed SLO
• Logs tell why: Loki shows you the actual error messages, stack traces, and context around failures
• Complete debugging: Without logs, you can see that something is broken but not understand the root cause

Output format:

• Structured log entries with timestamp, message, service, namespace, and extracted log levels
• Error count summaries and filtering
• Raw LogQL results for detailed analysis

This makes incident investigation complete by combining the "what" (metrics) with the "why" (logs).

PagerDuty (pd__*)

| pd__escalate_incident | destructive | Escalate to a different policy — requires direct or interactive confirmation