PlugWiki
kubefwd logo

kubefwd MCP Server: Setup for Claude, Cursor and Other Apps

OfficialLocal

Lets your assistant forward Kubernetes services to your computer, give you connection details and debug pods.

kubefwd is a command-line tool that forwards Kubernetes services to your computer by name, and its kubefwd mcp command lets an assistant drive it. You ask for a database or an API, and the assistant forwards it and hands back the connection details.

kubefwd itself needs sudo to edit your hosts file, so you start it in a terminal first. The part your assistant runs needs no sudo and talks to kubefwd with a shared API key.

Good for

  • Developers who run code locally against services in a Kubernetes cluster
  • Teams who want "forward the staging database" to just work
  • Engineers debugging failing pods, logs and events
  • People who work across several clusters

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install kubefwd MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the kubefwd MCP server to Claude Code. Run this command:
    
    claude mcp add --transport stdio kubefwd -e KUBEFWD_API_KEY=<your-api-key> -- kubefwd mcp
    
    Ask me for KUBEFWD_API_KEY and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires kubefwd installed, kubefwd running with sudo (sudo -E kubefwd).

Read-only mode: There is no read-only mode. Forwarding tools change /etc/hosts and network aliases through the running kubefwd.

Two parts must run. First start kubefwd itself in a terminal with sudo, for example sudo -E kubefwd, which also turns on its local API. Set the same KUBEFWD_API_KEY in that terminal and in the config below, because without a matching key every tool call fails with 401. The kubefwd mcp command your app starts needs no sudo. Install kubefwd with Homebrew, winget or scoop (see the links on this page). Claude Desktop also offers a one-click .mcpb bundle on the GitHub releases page. ChatGPT cannot reach localhost, so it needs a public tunnel, which the kubefwd docs advise using only in development.

Built from the package data we hold. Not yet tested by us.

Tools

  • Lists namespaces you could forward

    Shows the Kubernetes namespaces in your cluster and whether each is already being forwarded.

    Try: “Which namespaces can I forward?”

    Network · list_k8s_namespaces

  • Lists a namespace's services

    Shows the services in one namespace with their type, ports and whether they are forwarded.

    Try: “What services are in the dev namespace?”

    Network · list_k8s_services

  • Forwards one service to your computer

    Starts forwarding a single service. It returns the local IP, the hostnames added to /etc/hosts and the mapped ports.

    Try: “Forward the postgres service in staging.”

    Write · add_service

  • Forwards every service in a namespace

    Starts forwarding all services in a namespace, adds a hosts entry for each and returns how to connect.

    Try: “Forward everything in the dev namespace.”

    Write · add_namespace

  • Gives connection details for a forwarded service

    Returns the IP, hostnames, ports and environment variables for a service you forwarded, ready to paste into your setup.

    Try: “What is the connection string for postgres?”

    Network · get_connection_info

  • Lists everything being forwarded

    Shows each forwarded service with its namespace, context, forward count and any error.

    Try: “What am I forwarding right now?”

    Network · list_services

  • Shows one forwarded service in detail

    Returns its port forwards, pods, hostnames, traffic and error state.

    Try: “Show me the details for the api service.”

    Network · get_service

  • Searches your forwarded services

    Finds forwarded services by name pattern, port or namespace.

    Try: “Which forwarded service uses port 5432?”

    Network · find_services

  • Lists the hosts entries kubefwd added

    Shows the hostname-to-IP entries that kubefwd wrote to /etc/hosts.

    Try: “What hostnames did kubefwd add?”

    Read · list_hostnames

  • Stops forwarding a service

    Ends a service forward, removes its hosts entries and frees its local IP.

    Try: “Stop forwarding postgres.”

    Write · remove_service

  • Stops forwarding a whole namespace

    Ends all forwards in a namespace and cleans up its hosts entries and network aliases.

    Try: “Stop forwarding the dev namespace.”

    Write · remove_namespace

  • Lists your Kubernetes clusters

    Shows the clusters (contexts) in your kubeconfig.

    Try: “Which clusters can I use?”

    Read · list_contexts

Read from the source code

Permissions

medium risk · 4 things to watch

Medium risk

It can start and stop port forwards, which changes your hosts file and network aliases, and it can read pod logs and events from your cluster. kubefwd runs with sudo, so start it yourself and check what it forwards.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • kubefwd runs with sudo and edits your hosts file

    The forwarding process needs elevated rights to change /etc/hosts and add network aliases. The MCP part does not, so keep sudo for kubefwd only. kubefwd.com

  • Forwards open cluster services on your machine

    Anything the assistant forwards, such as a database, becomes reachable from your computer. Ask it to remove forwards when you are done. kubefwd.com

  • Pod logs and events can contain sensitive data

    The log and event tools return what your cluster writes. Review them before sharing the chat. github.com

  • ChatGPT needs a public tunnel

    ChatGPT cannot reach localhost, so the docs suggest exposing the API through a tunnel. They advise doing this only in development. kubefwd.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Talks toYour Kubernetes API server. The local kubefwd API on a loopback address
Sign-in and keysThe API key is set as KUBEFWD_API_KEY in the environment of kubefwd and in your app config. Cluster access comes from your kubeconfig.
Scopes
  • Whatever your kubeconfig user can reach in Kubernetes

  • /etc/hosts and loopback IPs through the sudo kubefwd process

Questions

Is the kubefwd MCP server official?

Yes for kubefwd. It is the mcp command inside kubefwd itself, shipped from the txn2/kubefwd repository. It is not made by the Kubernetes project.

Do I need sudo?

Yes for kubefwd, which must be started with sudo to edit your hosts file. The kubefwd mcp command your assistant runs does not need sudo.

Why does every tool return 401?

The assistant and the running kubefwd use different API keys. Set the same KUBEFWD_API_KEY before starting kubefwd and in your app config.

Can I make it read-only?

No. The docs describe no read-only mode, and the forwarding tools change your hosts file and network aliases.

Which apps does it work with?

Apps that start local programs, such as Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Zed, Cline, JetBrains IDEs and Gemini CLI. ChatGPT needs a public tunnel because it cannot reach localhost.

Does it run locally or in the cloud?

Locally. kubefwd and the MCP command both run on your computer, and the API listens on a loopback address.

Does it need cluster credentials?

It uses your existing kubeconfig. The docs say no cluster credentials are passed through MCP.

Information

updated Nov 2, 2026

Publisher
Official
Transport
stdio
Auth
token in env
Version
1.25.18
License
Apache-2.0
Last commit
Oct 27, 2026
Open issues
1
Listed in
Official MCP registry

WebsiteGitHubOfficial MCP RegistryChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 4
  1. tools.go · github.com
  2. https://kubefwd.com/mcp-integration/ · kubefwd.com
  3. README.md · github.com
  4. mcp.go · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.