8 safe-by-default MCP servers for infra — and the governance model behind them

A developer has released a family of safe-by-default Model Context Protocol (MCP) servers for infrastructure management, designed to give AI agents graduated access to production systems. The servers implement a layered policy engine with read-only, read-write, and admin modes, plus typed confirmations for destructive operations, and are available as MIT-licensed TypeScript packages on npm.

Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of Model Context Protocol https://modelcontextprotocol.io servers that share one safe-by-default governance model. MCP lets an agent call tools. For infra, those tools can be delete topic , DROP TABLE , delete resource group . The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you do need them. I wanted graduated, explicit control instead. Every server shares the same layered policy engine: read-only → read-write → admin . Tools above the current mode are system DB, internal Kafka topics, the master realm are readable but never mutable. ALLOW DELETE flag on top of admin mode. confirm value that echoes the exact target name. A boolean isn't enough.All MIT-licensed, TypeScript, published on npm as @dockndevai/mcp- : npx -y @dockndevai/mcp-kubernetes Or in Claude Code: claude mcp add kubernetes -e KUBECONFIG PATH=~/.kube/config -e K8S MODE=read-only -- npx -y @dockndevai/mcp-kubernetes Every repo has per-client setup for Claude, Cursor, Codex, VS Code, and Windsurf. Repos: https://github.com/dockndevai https://github.com/dockndevai I'd love feedback — especially on whether the mode + typed-confirmation split is the right default for infrastructure MCP servers.