HermesWatcher
Search⌘K For brandsSetup help
StartStart hereSetup plannerInstall Hermes AgentChat from your phoneYour first 24 hours
Use casesWorkflow blueprintsCase studiesUse-case collectionsCommunity libraryPrompt library
LearnWhat is Hermes Agent?GuidesTopicsFAQCommand cheat sheetGlossarySOUL.md gallery
ToolsTools & integrationsAll messaging platformsSkills directoryPlugins directorySkills, plugins & MCP
TroubleshootReleases
Work with usServicesNewsletterFor brands: partner with usFor AI agentsContactAboutFollow @HermesWatcher on X ↗ (opens in a new tab)

Kubernetes

Write one namespace in cluster.json to approve the scope, then use four reads: list pods, get one pod, list events, and read logs. Kubernetes is a registered trademark of The Linux Foundation. kubernetes-mcp-server 0.0.68 is the GitHub release binary. The plugin downloads kubernetes-mcp-server-<os>-<arch> from https://github.com/containers/kubernetes-mcp-server/releases/download/v0.0.68/ into the plugin data directory, checks the sha256 against constants taken from that release's GitHub asset digest, and starts that file. MCP initialize and tools/list are answered before that download. A partial download is kept and continued with HTTP Range. A mismatch, including a file that was already there, is refused. read_only is true, toolsets stay core, and only pods_list_in_namespace, pods_get, events_list, and pods_log are enabled. Helm is not offered. Secret, ConfigMap, and ServiceAccount are denied. configuration_view is not listed. prod, production, live, and prd names are refused unless allow_production is true. Public and link-local hosts are always refused. The host must be local, and DNS is not resolved. readOnlyHint is true, so no approval card is shown. Before the call, name the namespace, the object, and that it only reads, because status, events, and logs reach the model. This plugin does not create a cron job.

Good to know before installing

Reads the kubeconfig you name in cluster.json (read-only) and sends its token only to that kubeconfig's API host (plain http sends it unencrypted); on the first tool call downloads the kubernetes-mcp-server 0.0.68 GitHub release binary (~90 MB) into the plugin data directory, refuses it unless its sha256 matches the pinned release digest, and runs it as a subprocess (a file swap between the check and the start is not fully excluded); pod status, events and logs reach the model, with password-like env values and last-applied-configuration redacted; no HTTP proxy is used; gateway users can call these read tools with that kubeconfig; stop with hermes plugins disable kubernetes or hermes tools disable mcp-kubernetes.

From the plugin's catalog listing.

How to install

  1. Install it. Hermes asks for any API keys it needs, then asks whether to turn it on.
    hermes plugins install kubernetes
  2. Said no? Turn it on later:
    hermes plugins enable kubernetes
  3. Restart Hermes so it loads the plugin.

Some plugins also need a sign-in or settings: see Full setup & settings. Memory plugins ask whether to become your memory provider instead. Steps follow the official plugins guide (opens in a new tab).

Category
Security & privacy · AI models & providers
Maintained by
TakeshiTGAL (Community)
Needs
No API keys declared
Adds tools
mcp__kubernetes__pods_list_in_namespace mcp__kubernetes__pods_get mcp__kubernetes__events_list mcp__kubernetes__pods_log
Needs Hermes
0.21.4 or newer
Version
0.1.0
In the catalog
2026-10-29

Full setup & settings ↗Source code ↗

More in security & privacy

All security & privacy plugins

New Hermes Agent updates every day on X. Follow @HermesWatcher

← All plugins