Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of Model Context Protocol servers that share one safe-by-default governance model.
MCP lets an agent call tools. For infra, those tools can be delete_topic
, DROP TABLE
, delete_resource_group
. The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you do need them. I wanted graduated, explicit control instead.
Every server shares the same layered policy engine:
read-only
→ read-write
→ admin
. Tools above the current mode are system
DB, internal Kafka topics, the master realm) are readable but never mutable.ALLOW_DELETE
flag on top of admin mode.confirm
value that echoes the exact target name. A boolean isn't enough.All MIT-licensed, TypeScript, published on npm as @dockndevai/mcp-*
:
npx -y @dockndevai/mcp-kubernetes
Or in Claude Code:
claude mcp add kubernetes -e KUBECONFIG_PATH=~/.kube/config -e K8S_MODE=read-only -- npx -y @dockndevai/mcp-kubernetes
Every repo has per-client setup for Claude, Cursor, Codex, VS Code, and Windsurf.
Repos: https://github.com/dockndevai
I'd love feedback — especially on whether the mode + typed-confirmation split is the right default for infrastructure MCP servers.