MCP Openshift

Name: MCP Openshift
Author: dockndevai

作者：dockndevai版本 0.2.0i★ –i在你的电脑上运行

注册名称io.github.dockndevai/mcp-openshift

安装

概览

作者提供的说明（英文原文）

Safe-by-default MCP for OpenShift / Kubernetes: projects, pods, logs, deployments, routes.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i尚未统计★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 开发者工具
你需要填写：OPENSHIFT_SERVER, OPENSHIFT_TOKEN, OPENSHIFT_PASSWORD

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： OPENSHIFT_SERVER, OPENSHIFT_TOKEN, OPENSHIFT_USERNAME, OPENSHIFT_PASSWORD, OPENSHIFT_CA_CERT, OPENSHIFT_MODE

标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。

你需要

npm已安装 Node.js（用于 npx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "openshift": {
      "command": "npx",
      "args": [
        "-y",
        "@dockndevai/mcp-openshift"
      ],
      "env": {
        "OPENSHIFT_SERVER": "your-value",
        "OPENSHIFT_TOKEN": "your-value",
        "OPENSHIFT_USERNAME": "your-value",
        "OPENSHIFT_PASSWORD": "your-value",
        "OPENSHIFT_CA_CERT": "your-value",
        "OPENSHIFT_MODE": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add openshift --env OPENSHIFT_SERVER=your-value --env OPENSHIFT_TOKEN=your-value --env OPENSHIFT_USERNAME=your-value --env OPENSHIFT_PASSWORD=your-value --env OPENSHIFT_CA_CERT=your-value --env OPENSHIFT_MODE=your-value -- npx -y @dockndevai/mcp-openshift

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "openshift": {
      "command": "npx",
      "args": [
        "-y",
        "@dockndevai/mcp-openshift"
      ],
      "env": {
        "OPENSHIFT_SERVER": "your-value",
        "OPENSHIFT_TOKEN": "your-value",
        "OPENSHIFT_USERNAME": "your-value",
        "OPENSHIFT_PASSWORD": "your-value",
        "OPENSHIFT_CA_CERT": "your-value",
        "OPENSHIFT_MODE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "openshift": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@dockndevai/mcp-openshift"
      ],
      "env": {
        "OPENSHIFT_SERVER": "your-value",
        "OPENSHIFT_TOKEN": "your-value",
        "OPENSHIFT_USERNAME": "your-value",
        "OPENSHIFT_PASSWORD": "your-value",
        "OPENSHIFT_CA_CERT": "your-value",
        "OPENSHIFT_MODE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

OPENSHIFT_SERVER 必填 env
Cluster API server URL, e.g. https://api.cluster.example.com:6443.
OPENSHIFT_TOKEN 机密 env
Bearer token (console → user menu → Copy login command → Display Token, or `oc whoami -t`).
OPENSHIFT_USERNAME env
Username for the cluster's local identity provider (alternative to a token).
OPENSHIFT_PASSWORD 机密 env
Password for the local identity provider. Sent only to the cluster's OAuth server.
OPENSHIFT_CA_CERT env
Path to the cluster CA bundle (PEM) for TLS verification.
OPENSHIFT_MODE env
Access mode: read-only | read-write | admin. Starts read-only; writes need read-write.

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 dockndevai 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“开发者工具”中的其他服务器比较i

星标数多于此分类中其他 1393 个服务器的 0%
发布到注册中心的时间比此分类中其他 1393 个服务器的 58% 更新
基础检查结果等于或优于此分类中其他 1393 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

MCP Openshift 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：OPENSHIFT_SERVER, OPENSHIFT_TOKEN, OPENSHIFT_PASSWORD

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.2.0）于40天前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。

有什么可以替代它？

同一分类中有：GitHub, Desktop Commander, Cloudflare MCP

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

GitHub

作者：github

Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.

电脑或云端★ 34,245MIT3天前更新

安装

Desktop Commander

作者：wonderwhy-er

MCP server for terminal commands, file operations, and process management

在你的电脑上运行★ 10,225MIT15天前更新

安装

Cloudflare MCP

作者：cloudflare

Cloudflare MCP servers

在云端运行★ 4,446Apache-2.014个月前更新

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

mcp-openshift

A safe-by-default Model Context Protocol server for OpenShift / Kubernetes. It lets an agent explore and operate a cluster — projects, pods and logs, deployments and deploymentconfigs, routes, services, builds, imagestreams, and any resource by kind — and, in higher modes, scale workloads, restart deployments, apply manifests, and delete.

Connect with a token from the web console you already use, or your username/password against the cluster's local identity provider.

Part of the dockndevai MCP server suite — one governance model across all of them.

What it gives an agent

Starts read-only (see Safe by default); higher-capability tools are only registered when you raise the mode.

Tool	For	Needs mode
`whoami`	confirm the authenticated identity	read-only
`list_projects`	projects/namespaces you can see	read-only
`list_resources`	list any kind (± namespace, label selector)	read-only
`get_resource`	one resource with full spec/status	read-only
`pod_logs`	a pod's container logs	read-only
`list_events`	recent events in a namespace	read-only
`scale`	set replicas on a Deployment/DeploymentConfig	read-write
`rollout_restart`	restart a Deployment	read-write
`apply_resource`	create/update from a manifest (SSA)	read-write + `OPENSHIFT_ALLOW_APPLY`
`delete_resource`	delete a resource	admin + `OPENSHIFT_ALLOW_DELETE`

Install

npx -y @dockndevai/mcp-openshift

You need your cluster's API URL and a credential. The quickest, since you use the browser console:

In the OpenShift web console, click your username (top-right) → Copy login command → Display Token. Copy the value after --token= (sha256~…) and the URL after --server=.

Then set OPENSHIFT_SERVER + OPENSHIFT_TOKEN. (Console tokens are short-lived; grab a fresh one when it expires, or use username/password below, which re-logs in automatically.)

Configure

"mcpServers": { "openshift": { "command": "npx", "args": ["-y", "@dockndevai/mcp-openshift"], "env": { "OPENSHIFT_SERVER": "https://api.cluster.example.com:6443", "OPENSHIFT_TOKEN": "sha256~...", "OPENSHIFT_MODE": "read-only" } } } }

See docs/CLIENTS.md for Claude Code / Cursor / Codex / VS Code / Windsurf, and .env.example for every variable.

Authentication

Auth mode is chosen automatically (override with OPENSHIFT_AUTH):

token — OPENSHIFT_TOKEN (bearer). From the console (above) or oc whoami -t.
password — OPENSHIFT_USERNAME + OPENSHIFT_PASSWORD against the cluster's built-in OAuth server (HTPasswd / LDAP / any challenge-capable local IdP). The server runs the same request-token flow oc login -u … -p … uses, caches the token at ~/.mcp-openshift/token.json (0600), and re-logs in on expiry. The password is sent only to your cluster's OAuth endpoint and is never logged or written to disk.

TLS: clusters usually use a private CA — set OPENSHIFT_CA_CERT to the CA bundle, or (dev only) OPENSHIFT_INSECURE_TLS=true to skip verification.

Safe by default

Enforced by src/security.ts — defence in depth on top of your account's cluster RBAC:

`OPENSHIFT_MODE` — read-only (default) → read-write → admin. Tools above the mode aren't registered.
`OPENSHIFT_NAMESPACE_ALLOWLIST` / `OPENSHIFT_PROTECTED_NAMESPACES` — confine writes to named namespaces; system namespaces (kube-*, openshift, openshift-*, default) are readable but never mutable.
`OPENSHIFT_ALLOW_APPLY` — creating/updating resources needs this flag on top of read-write, plus a human confirmation.
`OPENSHIFT_ALLOW_DELETE` — deletes need admin mode plus this flag, plus confirmation.
`OPENSHIFT_DRY_RUN` — sends writes with Kubernetes dryRun=All: validated and admission-checked, but nothing persists.
Human-in-the-loop — apply, delete, and scale-to-zero pause and ask a person to approve via MCP elicitation.
`OPENSHIFT_AUDIT_LOG` — a JSON audit line per guarded op on stderr; Secret values are redacted from all output.

Optional AI risk guard. Set OPENSHIFT_GUARD_MODE=monitor|enforce to have apply_resource / delete_resource consult a local laya-guard daemon (pipx install laya-guard && laya-guard) that classifies the operation allow/confirm/block before it runs. Runs *after* the apply/delete gates; only tightens, never grants; fails closed.

There is a bundled skill, openshift-safe-operations, that teaches an agent how to authenticate (including from the browser console), the safety rules, and the standard triage/operate workflows. See also SECURITY.md.

Developing

npm install

npm run build

list the tools without a live cluster:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | OPENSHIFT_SERVER=https://x:6443 OPENSHIFT_TOKEN=x node dist/index.js npm test

Licence

MIT