# 8 safe-by-default MCP servers for infra — and the governance model behind them

> Source: <https://dev.to/dockndevai/8-safe-by-default-mcp-servers-formcp-ai-devops-opensource-infra-and-the-governance-model-4gi8>
> Published: 2026-08-23 16:26:47+00:00

Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of [Model Context Protocol](https://modelcontextprotocol.io) servers that share one safe-by-default governance model.

MCP lets an agent call tools. For infra, those tools can be `delete_topic`

, `DROP TABLE`

, `delete_resource_group`

. The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you *do* need them. I wanted graduated, explicit control instead.

Every server shares the same layered policy engine:

`read-only`

→ `read-write`

→ `admin`

. Tools above the current mode are `system`

DB, internal Kafka topics, the master realm) are readable but never mutable.`ALLOW_DELETE`

flag on top of admin mode.`confirm`

value that echoes the exact target name. A boolean isn't enough.All MIT-licensed, TypeScript, published on npm as `@dockndevai/mcp-*`

:

```
npx -y @dockndevai/mcp-kubernetes
```

Or in Claude Code:

```
claude mcp add kubernetes -e KUBECONFIG_PATH=~/.kube/config -e K8S_MODE=read-only -- npx -y @dockndevai/mcp-kubernetes
```

Every repo has per-client setup for Claude, Cursor, Codex, VS Code, and Windsurf.

Repos: [https://github.com/dockndevai](https://github.com/dockndevai)

I'd love feedback — especially on whether the mode + typed-confirmation split is the right default for infrastructure MCP servers.