Validate Kubernetes manifests, Helm charts, and ArgoCD applications
kube-lint-mcp
mcp-name: io.github.sophotechlabs/kube-lint-mcp
MCP server that validates Kubernetes manifests, Helm charts, and ArgoCD applications before you commit — preventing deployment and GitOps reconciliation failures.
Works with Claude Code, Claude Desktop, and any MCP-compatible client.
How it works
You: "Validate the flux manifests in ./k8s/infrastructure/"
Claude: calls list_kube_contexts → presents list → you confirm "staging"
calls select_kube_context → flux_dryrun
FluxCD Dry-Run Validation
Context: staging
================================================
File: infrastructure/redis.yaml
Client dry-run: PASS
Server dry-run: PASS
File: infrastructure/postgres.yaml
Client dry-run: PASS
Server dry-run: FAIL
Error: namespace "db" not found
================================================
Summary: 1 passed, 1 failed
DO NOT COMMIT - Fix errors first!
No flags, no CLI args — the AI agent picks the right tool automatically.
Prerequisites
- Python 3.12+
- kubectl configured with cluster access
- helm (for Helm chart validation)
- flux (for Flux operations)
- argocd (for ArgoCD operations — uses
--coremode, no server auth needed)
Installation
pip (requires CLI tools installed separately)
pip install kube-lint-mcp
Docker (batteries included)
The Docker image ships with kubectl, helm, flux, kubeconform, and argocd — no local installs needed.
docker pull ghcr.io/sophotechlabs/kube-lint-mcp:latest
Note: If your kubeconfig uses external auth plugins (e.g.
gke-gcloud-auth-plugin,aws-iam-authenticator), those binaries are not included in the image. Use the pip install method for those clusters, or embed tokens directly in your kubeconfig.
Configuration
Claude Code (pip)
Add to your project's .mcp.json:
{
"mcpServers": {
"kube-lint": {
"command": "python",
"args": ["-m", "kube_lint_mcp"]
}
}
}
Claude Code (Docker)
{
"mcpServers": {
"kube-lint": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-v", "${HOME}:${HOME}:ro",
"-e", "KUBECONFIG=${HOME}/.kube/config",
"ghcr.io/sophotechlabs/kube-lint-mcp:latest"
]
}
}
}
The $HOME:$HOME:ro mount preserves absolute paths that MCP clients send to the server. The read-only flag ensures the container cannot modify your files.
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%/Claude/claude_desktop_config.json (Windows):
{
"mcpServers": {
"kube-lint": {
"command": "python",
"args": ["-m", "kube_lint_mcp"]
}
}
}
Tools
select_kube_context
Pick a cluster context. Stored in memory only — never mutates your kubeconfig. Must be called before any validation tool.
| Parameter | Type | Required | Description |
|---|---|---|---|
context |
string | yes | Name of the kubectl context to use |
list_kube_contexts
Show available kubectl contexts with markers for the current (kubeconfig default) and selected (in-memory) context. No parameters.
flux_dryrun
Validate FluxCD YAML files with both client-side and server-side kubectl dry-run. Catches schema errors, missing CRDs, namespace issues, and deprecated API versions.
| Parameter | Type | Required | Description |
|---|---|---|---|
path |
Tools (3)
select_kube_contextPick a cluster context for validation operations.list_kube_contextsShow available kubectl contexts with markers for current and selected contexts.flux_dryrunValidate FluxCD YAML files with client-side and server-side kubectl dry-run.Environment Variables
KUBECONFIGPath to the kubeconfig file for cluster accessConfiguration
{"mcpServers": {"kube-lint": {"command": "python", "args": ["-m", "kube_lint_mcp"]}}}