ocm-mcp-server
An MCP server that lets AI agents operate a multi-cluster Kubernetes fleet through an Open Cluster Management hub, with policy, approval, and audit between the model and your clusters.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
ocm-mcp-server
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
OCM_MCP_METRICS_PORTGET /metrics (OCM_MCP_METRICS_PORT, localhost by default). This server's own counters only - it does not scrape or proxy Prometheus on managed/HCP clusters; fleet state comes from the Kubernetes APIsOCM_MCP_HOMEState directory (approval keypair, pending proposals, audit.jsonl, spent-token ids). Default ~/.ocm-mcp.BENCH_HUB_CLUSTERSBENCH_KWOK_SPOKESBENCH_REPSBENCH_PODS_PER_SPOKEBENCH_KWOK_RUNTIMEOCM_MCP_HUB_CONTEXTThe kubeconfig context that points at the OCM hub cluster, where ManagedCluster and ManifestWork live. After make bootstrap this is kind-hub. Empty = current context.OCM_MCP_SPOKE_CONTEXTSComma-separated <managed-cluster-name>=<kubeconfig-context> pairs mapping each cluster as the hub names it (kubectl --context kind-hub get managedclusters) to a context holding read-only spoke credentials. Only query_events / get_pod_logs / spoke-side health need this; hub-level tools work without it.OCM_MCP_FANOUT_WORKERSConcurrent spoke scans during get_fleet_health. Default 8 (floor 1).OCM_MCP_MAX_PROPOSAL_BYTESReject a proposal larger than this many bytes. Default 262144 (256 KiB).OCM_MCP_MAX_HPA_REPLICASReject a HorizontalPodAutoscaler whose maxReplicas exceeds this. Default 100.KUBECONFIGKubeconfig file path(s); defaults to ~/.kube/config.OTEL_EXPORTER_OTLP_ENDPOINTSet (e.g. http://localhost:4318) to emit a trace span per tool call (needs the [tracing] extra; see the [tracing guide](docs/deployment.md#tracing-with-opentelemetry-and-jaeger)). Unset = tracing off, audit log still on.OCM_MCP_APPROVAL_TTLApproval-token lifetime in seconds. Default 3600.OCM_MCP_ISSUERBind approval tokens to this deployment so a token minted elsewhere is refused. Defaults ocm-mcp / ocm-mcp-server.OCM_MCP_AUDIENCEBind approval tokens to this deployment so a token minted elsewhere is refused. Defaults ocm-mcp / ocm-mcp-server.OCM_MCP_REQUIRE_DIGESTSet to 1 to require @sha256 digest-pinned images (stricter than tag-pinning). Default off.OCM_MCP_READ_ONLYdestructiveHint and enforced by the gate. Setting =1 turns offOCM_MCP_STRICTSet to 1/true to make the deployment preconditions layer 3 rests on a startup failure rather than a stderr warning: a signer private key readable next to the server, or OCM_MCP_ISSUER/OCM_MCP_AUDIENCE left at their defaults. Recommended in production. Default off, so a laptop bootstrap still works with one shared home.OCM_MCP_AUDIT_ECHOSet to 1 to also echo each audit line to stderr as JSON, so a container log collector can forward the audit stream to a SIEM. Free-form values (manifests, summaries, reasons, error text) are redacted ("[redacted]") in the echo; the audit file itself keeps full fidelity. Default off.OCM_MCP_SIGNER_KEYPath to the private Ed25519 signing key. Point this off the server (a separate account/device) so a compromised server cannot mint tokens. Default OCM_MCP_HOME/approval_ed25519.OCM_MCP_VERIFIER_KEYPath to the public verifier key the server loads. Mount read-only. Default OCM_MCP_HOME/approval_ed25519.pub.OCM_MCP_CLIENT_TTLSeconds before the cached Kubernetes API client is rebuilt, so rotated/refreshed credentials are picked up. Default 600.OCM_MCP_METRICS_HOSTInterface the metrics endpoint binds. Default 127.0.0.1 (localhost only); set 0.0.0.0 for a remote scraper.OCM_MCP_SPOKE_TIMEOUTRead timeout (seconds) for spoke health/event/log calls, so one large cluster cannot hang a tool. Default 30.OCM_MCP_HEALTH_LIMITMax pods/deployments get_cluster_health fetches per cluster; the result notes truncation. Default 500.OCM_MCP_LIST_PAGE_SIZEOCM_MCP_LIST_MAX_ITEMSTool annotations
36/42 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
42/42 tools missing one or more hints — list_clusters (missing: idempotentHint); get_cluster (missing: idempotentHint); list_cluster_sets (missing: idempotentHint), +39 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/ocm-mcp-server/ocm-mcp-server)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check