Ankra

npx add-mcp 'https://platform.ankra.app/api/v1/mcp'

A hosted MCP endpoint with 450+ tools for pods, logs, events, Helm, GitOps, pipelines, security and cost across every cluster in your Ankra organisation. Nothing to install or run. Read-only unless you grant mcp:write.

$ claude mcp add --transport http ankra https://platform.ankra.app/api/v1/mcp
$ claude
> /mcp
  Authenticate opens the browser. Sign in, pick the organisation, approve.
  ✓ ankra connected
 
> why is checkout-api crashlooping on prod-eu?
  ● list_clusters                    3 clusters, prod-eu found
  ● get_pods           ns checkout   checkout-api  CrashLoopBackOff  14 restarts
  ● get_pod_logs       previous      OOMKilled, exit code 137
  ● get_events         checkout-api  Back-off restarting failed container
  ● get_stack_history  checkout      2h ago  memory limit 512Mi -> 256Mi
  checkout-api is being OOMKilled. A stack change two hours ago cut its
  memory limit from 512Mi to 256Mi. Rolling the add-on back restores 512Mi.
 
> roll it back
  ? Allow ankra · rollback_addon for checkout-api on prod-eu  › Yes
  ● rollback_addon     checkout-api  operation started
  ● wait_for_execution               succeeded in 41s
  ● get_pods           ns checkout   checkout-api  Running  0 restarts
  Done. checkout-api is Running with 512Mi again.
  ↗ Open checkout-api in the Ankra portal

Sample session with example data. Green dots are read tools, amber needs mcp:write and your approval.

Connect

Same endpoint, any client.

• Claude, Claude Desktop and Claude Code sign in with OAuth. No token to copy.
• Cursor and other clients send a Bearer token from the portal or ankra tokens create.
• Check it works by asking for your clusters. The client calls list_clusters.
• Streamable HTTP, listed in the official MCP Registry as ai.ankra/platform.

$ claude mcp add --transport http ankra \
    https://platform.ankra.app/api/v1/mcp
$ claude
> /mcp                  # ankra, Authenticate
> list my ankra clusters

Add --scope user to use it in every project. The OAuth grant lasts seven days, then run /mcp again.

Tools

450+ tools. Not just kubectl.

The same tool registry runs Ankra's own AI. Cluster tools take a cluster_id from list_clusters, so one session covers the whole fleet.

Workloads

• get_pods
• get_pod_logs
• get_events
• describe_resource
• restart_deployment
• scale_deployment

Clusters and nodes

• list_clusters
• get_nodes
• cordon_node
• upgrade_cluster
• create_hetzner_cluster

Stacks, Helm and GitOps

• get_stack_details
• get_stack_history
• get_gitops_status
• update_addon_configuration
• rollback_addon

Metrics and logs

• query_prometheus
• query_prometheus_range
• query_logs
• get_cluster_attention_summary

Applications and pipelines

• list_applications
• watch_pipeline_run
• deploy_application
• promote_application
• rerun_application_workflow

Security, cost and backups

• list_security_findings
• get_compliance_reports
• get_cluster_cost
• list_backup_vaults
• create_stack_restore_point

mcp:readmcp:write

All 457 tools with their scopes

Access

You pick the scope. The token enforces it.

mcp:read

Every read-only tool. Pods, logs, events, metrics, stacks, findings and cost. Changes nothing.

mcp:write

Adds apply, scale, restart, rollback, upgrades and pull requests. Your client's approval prompt is the gate, so give it to clients you trust.

One organisation

Tokens and OAuth grants are bound to the organisation chosen when they were created.

Filtered tool list

tools/list returns only the tools the token's scope allows.

Checked before dispatch

Ankra verifies the cluster belongs to the token's organisation before a cluster tool runs.

No secrets in arguments

Mutating calls whose parameters contain literal secrets are refused.

Rate limited

120 read calls and 20 write calls per minute, per token.

Audited

Every resolved call, refused ones included, lands in the organisation audit log.

Compared

A kubeconfig MCP server, or a hosted one.

Open source servers that wrap your kubeconfig are a good fit for one cluster on one laptop. This is where the two differ.

	MCP server you run	Ankra MCP server
Where it runs	Your laptop or your cluster	Hosted by Ankra, or self-hosted on Enterprise
Credentials	Your kubeconfig	OAuth or a token scoped to mcp:read or mcp:write
Reach	Clusters in your kubeconfig	Every cluster in your Ankra organisation
Tools	The Kubernetes API	450+ across Kubernetes, Helm, GitOps, pipelines, security, cost and backups
Audit trail	Whatever you build	Every call in the organisation audit log

FAQ

What is a Kubernetes MCP server?

A Model Context Protocol server that exposes Kubernetes operations as tools an AI client can call. Instead of pasting kubectl output into a chat, the assistant lists pods, reads logs and events, and with permission makes the change itself.

How do I connect Claude Code to Kubernetes?

Run claude mcp add --transport http ankra https://platform.ankra.app/api/v1/mcp, start Claude Code, run /mcp and authenticate in the browser. Then ask it to list your Ankra clusters.

Can it change my clusters?

Only with mcp:write. With mcp:read the client sees read-only tools and cannot change anything. Ankra adds no second confirmation over MCP, so your client's approval prompt is the gate. Only grant mcp:write to clients you trust.

Which clients work with it?

Any client that supports remote MCP servers over streamable HTTP. Claude web, desktop and Claude Code sign in with OAuth. Cursor and other clients send a Bearer token from the Ankra portal or ankra tokens create.

What does it cost?

The MCP server is part of the Ankra platform and works on the free tier. Ankra bills on worker vCPUs only, every plan includes 30 worker vCPUs free, and the free tier needs no credit card.

Connect a cluster. Ask it anything.

Free tier with 30 worker vCPUs included and no credit card.

Claude and Claude Code are products of Anthropic. Cursor is a product of Anysphere. Ankra is not affiliated with or endorsed by either. Product details were checked against the Ankra documentation in October 2026.