How to add kubectl-mcp-server to Windsurf

Control your entire Kubernetes infrastructure through natural language conversations with AI. Paste the config into ~/.codeium/windsurf/mcp_config.json and restart Windsurf.

Last updated June 14, 2026 · 913★ · stdio · no auth

Windsurf config for kubectl-mcp-server

npx -y kubectl-mcp-server

{
  "mcpServers": {
    "kubectl-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "kubectl-mcp-server"
      ]
    }
  }
}

Setup steps

1Open Windsurf → Cascade → the hammer/MCP icon → Configure (or edit ~/.codeium/windsurf/mcp_config.json).
2Paste the kubectl-mcp-server config below.
3Fill in placeholder secrets, then save.
4Click Refresh in the MCP panel.
5kubectl-mcp-server's tools become available to Cascade.

Before you start

Python 3.9+ (for pip installation)
Node.js 14+ (for npx installation)
kubectl installed and configured
Access to a Kubernetes cluster

What kubectl-mcp-server can do in Windsurf

get_pods

List pods in a namespace (accepts namespace and optional context).

get_logs

Retrieve logs from a pod.

diagnose_pod_crash

AI-powered crash diagnosis with logs, events, and resource analysis.

get_deployments

List deployments in the cluster.

create_deployment

Create a deployment with best-practice defaults.

scale_deployment

Scale a deployment to a target replica count.

kubectl_rollout

Manage deployment rollouts (status, undo, restart).

diagnose_network_connectivity

Diagnose network connectivity issues including DNS resolution and service chain tracing.

Security

Mounts your kubeconfig and operates against live clusters. Use --disable-destructive (or --non-destructive) to allow create/update but block delete, or --read-only to block all writes. Secrets are masked in output (e.g. manifest://secrets data is masked). Optional OAuth 2.1 authentication (RFC 9728) can be enabled via MCP_AUTH_ENABLED for multi-tenant/compliance environments.

kubectl-mcp-server + Windsurf FAQ

Where is the Windsurf config file?

Windsurf reads MCP servers from ~/.codeium/windsurf/mcp_config.json. Paste the kubectl-mcp-server config there under the "mcpServers" key and restart the client.

Is kubectl-mcp-server safe to use with Windsurf?

How do I install and run it?

Run it with no install via `npx -y kubectl-mcp-server`, or install globally with `npm install -g kubectl-mcp-server`. A Python distribution is also available via `pip install kubectl-mcp-server` (add the `[ui]` extra for interactive dashboards), plus Docker images on Docker Hub and GHCR.

Which AI assistants does it work with?

It works with any MCP-compatible client, with documented native configs for Claude Desktop, Claude Code, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Goose, Roo Code, Kilo Code, and others.

Is it safe to run against production clusters?

It supports safety modes: `--disable-destructive` allows create/update but blocks delete, and `--read-only` blocks all write operations. Secrets are masked in output, and OAuth 2.1 authentication can be enabled for enterprise/multi-tenant use.

View repo Full kubectl-mcp-server page