Kube Audit MCP by Mozillazg is an MCP server for AI agents, assistants, and chatbots, designed to query Kubernetes Audit Logs. Running on the mcp platform, this free tool enables detailed investigations into Kubernetes cluster activities. It connects to various cloud audit log providers, including Alibaba Cloud Log Service, AWS CloudWatch Logs, and Google Cloud Logging, offering a unified interface for audit data. Its design caters to AI-driven analysis, providing essential tools for understanding cluster events. Confirmed compatible with clients like Claude Code and kubectl-ai, Kube Audit MCP supports STDIO Transport, making it accessible for a range of AI applications.

What does Kube Audit MCP connect to?

Kube Audit MCP connects to multiple configured providers of Kubernetes Audit Logs. Specifically, it integrates with Alibaba Cloud Log Service, AWS CloudWatch Logs, and Google Cloud Logging. This server acts as a central point for AI agents, assistants, and chatbots to access and query audit data from these diverse cloud environments. Its primary function is to enable detailed investigation of activities within Kubernetes clusters by consolidating access to their respective audit log sources.

Core features and tools

Kube Audit MCP exposes three callable tools for interacting with Kubernetes audit logs. The primary tool, query_audit_log, allows investigation of cluster activity, accepting parameters for cluster name, start time, and end time. Users can discover available clusters using list_clusters. Additionally, list_common_resource_types helps identify common Kubernetes resource types, aiding in refining audit queries. These tools collectively provide a structured way for AI agents and human users to analyze Kubernetes cluster events.

Who is it for?

The primary audience for Kube Audit MCP includes AI agents, assistants, and chatbots, along with developers and operations teams who use these AI tools for Kubernetes auditing. It helps these groups investigate specific activities, discover clusters, and identify resource types efficiently. This server tool enhances the capabilities of AI in monitoring and understanding Kubernetes environments. Skip this if your primary need is not querying Kubernetes Audit Logs via an AI agent or assistant.

How to get started

Access is granted through a configuration file, typically located at "~/.config/kube-audit-mcp/config.yaml" or specified via the "--config" flag, defining connection details for cloud providers. The tool supports STDIO Transport as its default protocol.

Use cases

• Investigating specific activities within Kubernetes clusters by querying audit logs for a given cluster and time range.
• Discovering available Kubernetes clusters that are being audited.
• Identifying common Kubernetes resource types to refine audit queries.

Kube Audit MCP offers a focused solution for AI agents and operations teams to interact with Kubernetes Audit Logs. Its integration with major cloud log services provides a unified access point for audit data. The tool's clear set of callable functions supports detailed cluster activity analysis. Compatible with various AI clients, it extends AI capabilities into Kubernetes auditing.