
kubefwd MCP Server: Setup for Claude, Cursor and Other Apps
Lets your assistant forward Kubernetes services to your computer, give you connection details and debug pods.
kubefwd is a command-line tool that forwards Kubernetes services to your computer by name, and its kubefwd mcp command lets an assistant drive it. You ask for a database or an API, and the assistant forwards it and hands back the connection details.
kubefwd itself needs sudo to edit your hosts file, so you start it in a terminal first. The part your assistant runs needs no sudo and talks to kubefwd with a shared API key.
Good for
- Developers who run code locally against services in a Kubernetes cluster
- Teams who want "forward the staging database" to just work
- Engineers debugging failing pods, logs and events
- People who work across several clusters
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install kubefwd MCP
Claude Code
- 1
Copy this prompt.
Add the kubefwd MCP server to Claude Code. Run this command: claude mcp add --transport stdio kubefwd -e KUBEFWD_API_KEY=<your-api-key> -- kubefwd mcp Ask me for KUBEFWD_API_KEY and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires kubefwd installed, kubefwd running with sudo (sudo -E kubefwd).
Read-only mode: There is no read-only mode. Forwarding tools change /etc/hosts and network aliases through the running kubefwd.
Two parts must run. First start kubefwd itself in a terminal with sudo, for example sudo -E kubefwd, which also turns on its local API. Set the same KUBEFWD_API_KEY in that terminal and in the config below, because without a matching key every tool call fails with 401. The kubefwd mcp command your app starts needs no sudo. Install kubefwd with Homebrew, winget or scoop (see the links on this page). Claude Desktop also offers a one-click .mcpb bundle on the GitHub releases page. ChatGPT cannot reach localhost, so it needs a public tunnel, which the kubefwd docs advise using only in development.
Built from the package data we hold. Not yet tested by us.
Tools
Lists namespaces you could forward
Shows the Kubernetes namespaces in your cluster and whether each is already being forwarded.
Try: “Which namespaces can I forward?”
Network ·
list_k8s_namespacesLists a namespace's services
Shows the services in one namespace with their type, ports and whether they are forwarded.
Try: “What services are in the dev namespace?”
Network ·
list_k8s_servicesForwards one service to your computer
Starts forwarding a single service. It returns the local IP, the hostnames added to /etc/hosts and the mapped ports.
Try: “Forward the postgres service in staging.”
Write ·
add_serviceForwards every service in a namespace
Starts forwarding all services in a namespace, adds a hosts entry for each and returns how to connect.
Try: “Forward everything in the dev namespace.”
Write ·
add_namespaceGives connection details for a forwarded service
Returns the IP, hostnames, ports and environment variables for a service you forwarded, ready to paste into your setup.
Try: “What is the connection string for postgres?”
Network ·
get_connection_infoLists everything being forwarded
Shows each forwarded service with its namespace, context, forward count and any error.
Try: “What am I forwarding right now?”
Network ·
list_servicesShows one forwarded service in detail
Returns its port forwards, pods, hostnames, traffic and error state.
Try: “Show me the details for the api service.”
Network ·
get_serviceSearches your forwarded services
Finds forwarded services by name pattern, port or namespace.
Try: “Which forwarded service uses port 5432?”
Network ·
find_servicesLists the hosts entries kubefwd added
Shows the hostname-to-IP entries that kubefwd wrote to /etc/hosts.
Try: “What hostnames did kubefwd add?”
Read ·
list_hostnamesStops forwarding a service
Ends a service forward, removes its hosts entries and frees its local IP.
Try: “Stop forwarding postgres.”
Write ·
remove_serviceStops forwarding a whole namespace
Ends all forwards in a namespace and cleans up its hosts entries and network aliases.
Try: “Stop forwarding the dev namespace.”
Write ·
remove_namespaceLists your Kubernetes clusters
Shows the clusters (contexts) in your kubeconfig.
Try: “Which clusters can I use?”
Read ·
list_contextsLists pods with their status
Shows pods in a namespace with status, readiness, restarts and age, filtered by label or service if you like.
Try: “Which pods back the payments service?”
Network ·
list_podsShows one pod in detail
Returns a pod's containers, status, conditions, resources and events.
Try: “Why is the payments pod not ready?”
Network ·
get_podReads a pod's recent logs
Returns recent log lines from a pod's container.
Try: “Show the last logs from the payments pod.”
Network ·
get_pod_logsShows Kubernetes events
Returns scheduling, pulling, starting and killing events, filtered by resource kind and name.
Try: “Why did my pod fail to start?”
Network ·
get_eventsShows which pods back a service
Lists a service's endpoints and whether each pod is ready, to debug routing.
Try: “Does the api service have any ready pods?”
Network ·
get_endpointsQuick health check of kubefwd
Returns ok, issues or error with a short message. Meant as a first check before acting.
Try: “Is kubefwd healthy?”
Read ·
get_quick_statusReports kubefwd's health and uptime
Returns healthy, degraded or unhealthy, with the version, uptime and counts of services and errors.
Try: “How is kubefwd doing?”
Read ·
get_healthAnalyzes issues and suggests fixes
Classifies current problems by priority and names the actions that fix them. The docs call it the best place to start troubleshooting.
Try: “What is wrong with my forwards?”
Read ·
get_analysisExplains why forwards are failing
Gives the error types, affected pods and suggested fixes for the current errors.
Try: “Why is the redis forward failing?”
Read ·
diagnose_errorsShows bandwidth use
Returns bytes in and out, transfer rates and a breakdown per service.
Try: “Which service uses the most bandwidth?”
Read ·
get_metricsShows HTTP requests through the forwards
Lists requests passing through forwarded services, with method, path, status and response time.
Try: “Show the last requests to the payments API.”
Read ·
get_http_trafficReads kubefwd's own log
Returns kubefwd log entries, filtered by level or search text.
Try: “Show recent error messages from kubefwd.”
Read ·
get_logsShows the history of events and errors
Returns events, errors and reconnections over time.
Try: “What happened to the forwards in the last hour?”
Read ·
get_historyReconnects an errored service
Forces an immediate new attempt to connect one service to its pods.
Try: “Reconnect the api service.”
Write ·
reconnect_serviceReconnects all errored services
Triggers a reconnect for every service that is in an error state and returns how many.
Try: “Reconnect everything that failed.”
Write ·
reconnect_all_errorsRe-discovers a service's pods
Looks for pod changes and updates the forwards, for example after a deployment or pod restart.
Try: “Re-sync the api service after the deploy.”
Write ·
sync_service
Read from the source code
Permissions
medium risk · 4 things to watch
Medium risk
It can start and stop port forwards, which changes your hosts file and network aliases, and it can read pod logs and events from your cluster. kubefwd runs with sudo, so start it yourself and check what it forwards.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only mode
Watch out for
kubefwd runs with sudo and edits your hosts file
The forwarding process needs elevated rights to change /etc/hosts and add network aliases. The MCP part does not, so keep sudo for kubefwd only. kubefwd.com
Forwards open cluster services on your machine
Anything the assistant forwards, such as a database, becomes reachable from your computer. Ask it to remove forwards when you are done. kubefwd.com
Pod logs and events can contain sensitive data
The log and event tools return what your cluster writes. Review them before sharing the chat. github.com
ChatGPT needs a public tunnel
ChatGPT cannot reach localhost, so the docs suggest exposing the API through a tunnel. They advise doing this only in development. kubefwd.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Talks to | Your Kubernetes API server. The local kubefwd API on a loopback address |
|---|---|
| Sign-in and keys | The API key is set as KUBEFWD_API_KEY in the environment of kubefwd and in your app config. Cluster access comes from your kubeconfig. |
| Scopes |
|
Questions
Is the kubefwd MCP server official?
Yes for kubefwd. It is the mcp command inside kubefwd itself, shipped from the txn2/kubefwd repository. It is not made by the Kubernetes project.
Do I need sudo?
Yes for kubefwd, which must be started with sudo to edit your hosts file. The kubefwd mcp command your assistant runs does not need sudo.
Why does every tool return 401?
The assistant and the running kubefwd use different API keys. Set the same KUBEFWD_API_KEY before starting kubefwd and in your app config.
Can I make it read-only?
No. The docs describe no read-only mode, and the forwarding tools change your hosts file and network aliases.
Which apps does it work with?
Apps that start local programs, such as Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Zed, Cline, JetBrains IDEs and Gemini CLI. ChatGPT needs a public tunnel because it cannot reach localhost.
Does it run locally or in the cloud?
Locally. kubefwd and the MCP command both run on your computer, and the API listens on a loopback address.
Does it need cluster credentials?
It uses your existing kubeconfig. The docs say no cluster credentials are passed through MCP.
Information
updated Nov 2, 2026
- Publisher
- Official
- Transport
- stdio
- Auth
- token in env
- Version
- 1.25.18
- License
- Apache-2.0
- Last commit
- Oct 27, 2026
- Open issues
- 1
- Listed in
- Official MCP registry
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 4Hide
- tools.go · github.com
- https://kubefwd.com/mcp-integration/ · kubefwd.com
- README.md · github.com
- mcp.go · github.com