Static guardrails
Dangerous reads cannot be expressed: Secrets and non-OCM kinds are absent from the allow-list, so they are refused before any API call.
AgentOps for Kubernetes fleets, done safely.
An MCP server that lets AI agents operate a multi-cluster Kubernetes fleet through an Open Cluster Management hub. The agent never holds a kubeconfig. Every write is policy-checked, human-approved, and traced.
- 35MCP tools
- 10prompts
- 6resources
- 403unit tests
- 100%coverage
- 42policy cases
Four layers between the model and your clusters
Each one can refuse independently. A request has to satisfy all of them, and the two policy layers are tested against a shared fixture corpus to prove they agree.
Kyverno admission
An independent second opinion in dry-run. A parity contract asserts it reaches the same verdict as layer 1 on every fixture.
Human approval
Writes are two-phase. An Ed25519 token, minted by a person out of band, binds the exact content hash and expires.
Least-privilege RBAC
No Secret reads, no exec, no arbitrary delete — enforced by the hub itself, not by the server asking nicely.
Start here
Why it exists, how it works, and what it refuses to automate — in order.
01
Why this exists
Every platform team running Kubernetes at scale eventually hears it from leadership: can an AI agent handle our on-call
02The idea
Fleets already have a place where multi-cluster actions are observed and controlled: the hub. Open Cluster Management(ht
03How it works
The agent talks only to the server. The server holds the kubeconfig, applies static guardrails, writes an audit line and
04Implementation
What is actually in the code, so you can read it with a map in hand.
05Tools and prompts
35 tools across ten toolsets, plus ten prompts. Almost all of it is read: the whole Open Cluster Management API is safe
06Guardrails deep dive
Four independent layers stand between the model and your clusters. A change must pass all four, in order. The point of f
Run it
Architecture, deployment paths, the full tool surface, and the threat model.
REF
Architecture
Fleet operations already flow through a hub: Open Cluster Management gives us cluster inventory (ManagedCluster), schedu
REFGuardrails
Static checks (guardrails.py) - fast, local, no cluster needed. Inputs are schema-checked first (a malformed manifest is
REFDeployment
Three paths, in increasing order of seriousness: a laptop fleet for trying the pattern, a real OCM fleet, and a hardened
REFTools and prompts
The server exposes 35 tools across ten toolsets plus ten prompts. This page is the canonical reference: every tool, its
REFWorked examples
Real end-to-end flows. Commands are exact; agent turns are lightly condensed. Every one of these maps to a scenario in c
REFKubeconfig contexts
This server is configured with kubeconfig context names, like kind-hub or cluster1=kind-cluster1. If you have not seen t