kubectl-ro

[](https://github.com/soyvural/kubectl-ro/actions/workflows/ci.yaml) [](https://go.dev) [](LICENSE) [](https://pkg.go.dev/github.com/soyvural/kubectl-ro) [](https://modelcontextprotocol.io) [](https://kubernetes.io) [](https://goreportcard.com/report/github.com/soyvural/kubectl-ro)

Read-only Kubernetes access for AI agents and humans.

When you let an LLM explore your cluster, you don't want it running kubectl delete or leaking your secrets. kubectl-ro prevents that.

git clone https://github.com/soyvural/kubectl-ro.git
cd kubectl-ro
go build -o kubectl-ro .

Or install directly:

go install github.com/soyvural/kubectl-ro@latest

# allowed
kubectl-ro get pods -n kube-system
kubectl-ro logs deployment/my-app --tail=100
kubectl-ro describe svc my-service

# blocked
kubectl-ro delete pod nginx          # BLOCKED: 'delete' is a mutating command
kubectl-ro get secret -o yaml        # BLOCKED: would expose secret values
kubectl-ro exec -it pod -- bash      # BLOCKED: 'exec' is a mutating command

Start the server:

kubectl-ro serve

Or add to Claude Code settings (`.claude/