Radar Kubernetes MCP Server: Setup for Claude, Cursor and Other Apps

• Lists what is broken in the cluster right now

  Returns a ranked list of live problems such as failing pods and workloads, failed Helm releases, dangling references and pods that cannot start.

  Try: “What is broken in my cluster right now?”

  Network · issues

• Gathers evidence on one failing workload

  Collects a point-in-time bundle of evidence about one workload or similar resource. It does not name a root cause by itself. On the full endpoint it can also start short-lived probe pods to test connectivity.

  Try: “Why did the checkout rollout fail?”

  Write · diagnose

• Gives a health overview of the cluster

  Summarizes resource counts, failing pods, unhealthy workloads, grouped warning events and Helm status for the cluster or one namespace.

  Try: “Give me a health overview of the prod namespace.”

  Network · get_dashboard

• Lists resources of one kind

  Lists things like pods, deployments or services in short form, with a health note and issue count for each row.

  Try: “List the deployments in the payments namespace.”

  Network · list_resources

• Shows one resource in detail

  Returns a trimmed view of one resource with its status and how it relates to other resources.

  Try: “Show me the checkout deployment.”

  Network · get_resource

• Finds resources by what they contain

  Searches config keys, environment references, images, labels and status messages across the cluster. Secret values are never indexed.

  Try: “Which workloads use the image nginx:1.21?”

  Network · search

• Maps how resources connect

  Returns the graph of resources and their links for a namespace or the whole cluster, or the traffic view.

  Try: “Show how services connect in the shop namespace.”

  Network · get_topology

• Shows what surrounds one resource

  Expands outward from one resource to the things it routes to, selects or is owned by, up to two steps.

  Try: “What is connected to the cart service?”

  Network · get_neighborhood

• Lists recent Kubernetes events

  Returns recent events with duplicates merged, warnings first, and can be filtered by resource or type.

  Try: “Show me warning events from the last hour.”

  Network · get_events

• Shows what changed recently

  Lists recent changes from the cluster timeline and Helm release history, to help work out what changed before an incident.

  Try: “What changed in prod before the outage?”

  Network · get_changes

• Reads a pod's logs

  Returns logs from one pod with secrets scrubbed. By default it favors errors and warnings, or it returns only lines that match a pattern you give.

  Try: “Show me the error logs from the checkout pod.”

  Network · get_pod_logs

• Reads logs for a whole workload

  Combines the logs of all pods of a deployment, stateful set, daemon set, rollout or job, filtered for relevance or by a pattern.

  Try: “Show errors across all checkout pods.”

  Network · get_workload_logs

• Ranks pods, workloads or nodes by CPU or memory

  Shows live usage ranked like kubectl top, with status, restarts and limits alongside.

  Try: “Which pods use the most memory?”

  Network · top_resources

• Lists all namespaces

  Returns every namespace with its status.

  Try: “List all namespaces.”

  Network · list_namespaces

• Checks the cluster against best practices

  Returns security, reliability and efficiency findings with fixes. Zero findings does not prove everything was checked.

  Try: “Run an audit on the prod namespace.”

  Network · get_cluster_audit

• Checks if the cluster is ready to upgrade

  Analyzes the impact of moving to a target Kubernetes version, including removed APIs, version skew and webhook readiness. The result is not a guarantee.

  Try: “Are we ready to upgrade to the next Kubernetes version?”

  Network · get_cluster_upgrade_readiness

• Shows which runtime versions are running

  Lists which running workloads use which language or runtime version, useful when a runtime vulnerability is announced.

  Try: “Which workloads run an affected PHP version?”

  Network · get_runtime_versions

• Lists installed packages and their health

  Combines Helm releases, label-managed workloads, CRDs, Argo applications and Flux releases with their versions and health.

  Try: “What is installed in this cluster?”

  Network · list_packages

• Lists Helm releases

  Returns releases with status, health and a trail of failed upgrades or rollbacks.

  Try: “Which Helm releases are unhealthy?”

  Network · list_helm_releases

• Shows one Helm release in detail

  Returns the release, the resources it owns, hooks, recent history and its values with secrets redacted.

  Try: “Show the history of the ingress-nginx release.”

  Network · get_helm_release

• Shows what a user or service account can do

  Returns the effective Kubernetes permissions of a service account, user or group.

  Try: “What can the deploy service account do?”

  Network · get_subject_permissions

• Runs a PromQL query

  Runs a query against the cluster's Prometheus, found automatically or given by a flag, or a compatible backend.

  Try: “Show CPU use of the checkout pods over the last hour.”

  Network · query_prometheus

• Finds metric names in Prometheus

  Looks up exact metric names, with type and help text, or the values of one label, before you write a query.

  Try: “What metrics exist for HTTP requests?”

  Network · discover_metrics

• Lists alert and recording rules

  Returns Prometheus rules with their state, labels and active alerts.

  Try: “Which alerts are firing?”

  Network · get_prometheus_rules

• Shows estimated cost

  Returns estimated cost from OpenCost or Kubecost by namespace, workload or node, or as a trend.

  Try: “What does the payments namespace cost?”

  Network · get_cost

• Suggests CPU and memory requests

  Recommends resource requests based on seven days of usage.

  Try: “Which workloads are over-provisioned?”

  Network · get_rightsizing

• Waits for a change to take effect

  Waits up to 45 seconds for a rollout, pod readiness, job completion, deletion or status condition, then reports.

  Try: “Wait until the checkout rollout is done.”

  Network · wait_for

• Creates or updates resources from YAML

  Applies one or more YAML documents, with a dry-run preview and a check of the live state afterwards. Only on the full endpoint.

  Try: “Apply this deployment YAML to the staging namespace.”

  Write · apply_resource

• Edits one field of a resource

  Changes one existing resource with a JSON patch, merge patch or strategic merge patch. Only on the full endpoint.

  Try: “Set the replica count of checkout to 3.”

  Write · patch_resource

• Restarts, scales or rolls back a workload

  Restarts, scales or rolls back a deployment, stateful set, daemon set or Argo rollout. Only on the full endpoint.

  Try: “Restart the checkout deployment.”

  Write · manage_workload

• Controls an Argo Rollout

  Aborts, retries, promotes or fully promotes a progressive Argo rollout. Only on the full endpoint.

  Try: “Abort the checkout rollout.”

  Write · manage_rollout

• Triggers, suspends or resumes a cron job

  Runs a cron job now, or pauses or resumes its schedule. Only on the full endpoint.

  Try: “Suspend the nightly-report cron job.”

  Write · manage_cronjob

• Controls Argo CD and Flux

  Syncs, refreshes, suspends, resumes, reconciles or rolls back Argo CD and Flux resources. Only on the full endpoint.

  Try: “Sync the payments app in Argo CD.”

  Write · manage_gitops

• Cordons, uncordons or drains a node

  Marks a node unschedulable or schedulable again, or drains it by evicting its pods. Only on the full endpoint.

  Try: “Drain node-3 so I can upgrade it.”

  Write · manage_node

• Deletes a Kubernetes resource

  Deletes a resource after a preview that shows the impact and a signed confirmation valid for five minutes. Only on the full endpoint.

  Try: “Delete the old staging deployment.”

  Delete · delete_resource

Watch out for

• The full address can change and delete cluster resources

  The /mcp address is on by default and has write and delete tools. Use /mcp-readonly, or start Radar with the read-only flag. github.com

• Optional command tool returns raw output

  A pod command tool is off by default and can return credentials. Leave it off unless you need it. github.com

• Without sign-in, every caller shares one identity

  Radar runs in no-auth mode by default, so any client that can reach the port uses Radar's access. It listens on 127.0.0.1 unless you change the address. github.com

• Secret scrubbing is not perfect

  Secret values are withheld and known patterns are scrubbed from logs and values, but Radar says this cannot catch everything. github.com

Security advisories