OpenShift MCP Server

NPM · MCP-SERVER-OPENSHIFT · 2 COMPONENTS · SCANNED AUG 3

OpenShift/Kubernetes cluster management via the oc CLI for MCP clients

Available components

npm · mcp-server-openshift 56 oci · docker.io/sanjaypsachdev/mcp-server-openshift:1.2.0 8

+5 this week 56 56 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security71

No malware found by supply-chain analysis.Pass
CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.7.0, a direct dependency. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (17 of 18), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 38 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability74

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 3050 tokens (~179/item across 17 items; 14 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities20

Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · mcp-server-openshift

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add sanjaypsachdev-mcp-server-openshift -- npx -y mcp-server-openshift

# add to Codex CLI

codex mcp add sanjaypsachdev-mcp-server-openshift -- npx -y mcp-server-openshift

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sanjaypsachdev-mcp-server-openshift": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-server-openshift"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add sanjaypsachdev-mcp-server-openshift --command npx --arg -y --arg mcp-server-openshift

# ~/.hermes/config.yaml

mcp_servers:
  sanjaypsachdev-mcp-server-openshift:
    command: "npx"
    args: ["-y", "mcp-server-openshift"]

// mcp.json

{
  "mcpServers": {
    "sanjaypsachdev-mcp-server-openshift": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-server-openshift"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +43
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → fail ▼ functional
- Dependency health: unverified → partial ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
1 Aug 26 −31
- Known CVEs: fail → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Dependency health: partial → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: fail → unverified ▼ functional
31 Jul 26 −5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
28 Jul 26 +16
- CVE-2025-66414 affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Licence: MIT functional
27 Jul 26 51

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-w48q-cv73-mx4w	CVE-2025-66414	high		yes

Dependencies 17 packages

17 packages in the resolved dependency tree · 16 deprecated · 7 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 14 exposed · ~2,982 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

oc_api_resources ~136

List all available API resources in the OpenShift cluster with their details

Input Output Examples

Name	Type	Req	Description
apiGroup	string	—	Filter by specific API group (e.g., apps, extensions, networking.k8s.io)
categories	boolean	—	Group resources by categories (core, apps, networking, etc.)
context	string	—	OpenShift context to use (optional)
namespaced	boolean	—	Filter by namespaced resources only
output	string	—	Output format for the API resources list
verbs	array	—	Filter by supported verbs (e.g., ["get", "list", "create", "delete"])

No output schema declared.

No examples provided.

oc_apply ~291

Apply YAML manifests to OpenShift cluster with comprehensive error handling and validation for all scenarios

Input Output Examples

Name	Type	Req	Description
cascade	string	—	Deletion cascade strategy
context	string	—	OpenShift context to use (optional)
dryRun	boolean	—	Validate only, don't apply (client or server)
fieldManager	string	—	Field manager name for server-side apply
filename	string	—	Path to YAML file to apply
force	boolean	—	Force apply, ignore conflicts
gracePeriod	number	—	Grace period for resource deletion (seconds)
kustomize	boolean	—	Apply kustomization directory
manifest	string	—	YAML manifest content to apply
namespace	string	—	OpenShift namespace/project
overwrite	boolean	—	Overwrite existing resources
prune	boolean	—	Prune resources not in current configuration
pruneWhitelist	array	—	Resource types to include in pruning
recursive	boolean	—	Process directory recursively
selector	string	—	Label selector for pruning
serverSideApply	boolean	—	Use server-side apply
timeout	string	—	Timeout for wait operation (e.g., "60s", "5m")
url	string	—	URL to YAML manifest to apply
validate	boolean	—	Validate resources before applying
wait	boolean	—	Wait for resources to be ready

No output schema declared.

No examples provided.

oc_create ~189

Create OpenShift resources like projects, deploymentconfigs, routes, etc.

Input Output Examples

Name	Type	Req	Description
context	string	—	OpenShift context to use (optional)
description	string	—	Description for project
displayName	string	—	Display name for project
dryRun	boolean	—	Validate only, don't create
filename	string	—	Path to YAML file to create resources from
hostname	string	—	Hostname for route
image	string	—	Container image for deploymentconfig
manifest	string	—	YAML manifest to create resources from
name	string	—	Name of the resource
namespace	string	—	OpenShift namespace/project
replicas	number	—	Number of replicas
resourceType	string	—	Type of resource to create (project, deploymentconfig, route, service, etc.)
service	string	—	Service name for route

No output schema declared.

No examples provided.

oc_delete ~308

Delete OpenShift resources with comprehensive safety checks, validation, and error handling

Input Output Examples

Name	Type	Req	Description
all	boolean	—	Delete all resources of the specified type
allNamespaces	boolean	—	Delete resources across all namespaces
cascade	string	—	Deletion cascade strategy
confirm	boolean	—	Require explicit confirmation for destructive operations
context	string	—	OpenShift context to use (optional)
dryRun	boolean	—	Show what would be deleted without actually deleting
fieldSelector	string	—	Delete resources matching field selector
filename	string	—	Path to YAML file to delete resources from
force	boolean	—	Force deletion (bypass finalizers)
gracePeriodSeconds	number	—	Grace period for deletion in seconds
ignore404	boolean	—	Ignore 404 errors if resource does not exist
labelSelector	string	—	Delete resources matching label selector
manifest	string	—	YAML manifest defining resources to delete
name	string	—	Name of the resource to delete
namespace	string	—	OpenShift namespace/project
recursive	boolean	—	Process directory recursively
resourceType	string	—	Type of resource to delete (required if not using manifest/filename)
timeout	string	—	Timeout for deletion operation (e.g., "60s", "5m")
url	string	—	URL to YAML manifest defining resources to delete
wait	boolean	—	Wait for deletion to complete

No output schema declared.

No examples provided.

oc_describe ~114

Describe any OpenShift resource and share the output in various formats including human-readable summary

Input Output Examples

Name	Type	Req	Description
context	string	—	OpenShift context to use (optional)
name	string	yes	Name of the resource to describe
namespace	string	—	OpenShift namespace/project
output	string	—	Output format: text (default oc describe), yaml, json, or human-readable (concise summary)
resourceType	string	yes	Type of resource to describe (pod, deployment, service, route, etc.)

No output schema declared.

No examples provided.

oc_explain ~135

Explain OpenShift/Kubernetes resource schemas, fields, and API documentation

Input Output Examples

Name	Type	Req	Description
apiVersion	string	—	Specific API version to explain (e.g., apps/v1, route.openshift.io/v1)
context	string	—	OpenShift context to use (optional)
field	string	—	Specific field path to explain (e.g., spec.containers, metadata.labels)
output	string	—	Output format for the explanation
recursive	boolean	—	Show all fields recursively
resource	string	yes	Resource type to explain (e.g., pod, deployment, service, route.route.openshift.io)

No output schema declared.

No examples provided.

oc_expose ~377

Expose an OpenShift resource (service, deployment, etc.) with secure route endpoints supporting SSL/TLS termination

Input Output Examples

Name	Type	Req	Description
annotations	array	—	Annotations to apply to the route in KEY=VALUE format
caCertificate	string	—	Path to CA certificate file
certificate	string	—	Path to TLS certificate file
context	string	—	OpenShift context to use (optional)
destinationCaCertificate	string	—	Path to destination CA certificate file (for reencrypt)
dryRun	boolean	—	Show what would be created without actually creating it
hostname	string	—	Custom hostname for the route
insecureEdgeTerminationPolicy	string	—	Policy for insecure traffic: None (reject), Allow (allow), Redirect (redirect to secure)
key	string	—	Path to TLS private key file
labels	array	—	Labels to apply to the route in KEY=VALUE format
name	string	yes	Name of the resource to expose
namespace	string	—	OpenShift namespace/project
path	string	—	Path for the route (e.g., /api)
port	string	—	Target port to expose (port name or number)
resourceType	string	yes	Resource type to expose (service, deploymentconfig, deployment)
routeName	string	—	Name for the route (if not specified, derives from resource name)
routeType	string	—	Type of secure route: edge (SSL termination at router), passthrough (SSL passthrough), reencrypt (SSL re-encryption)
tlsTermination	string	—	TLS termination type (deprecated, use routeType instead)
weight	number	—	Weight for this route (0-256)
wildcardPolicy	string	—	Wildcard policy for the route

No output schema declared.

No examples provided.

oc_get ~153

Get OpenShift resources like pods, deploymentconfigs, routes, projects, etc.

Input Output Examples

Name	Type	Req	Description
allNamespaces	boolean	—	List resources across all namespaces
context	string	—	OpenShift context to use (optional)
fieldSelector	string	—	Filter resources by field selector
labelSelector	string	—	Filter resources by label selector (e.g., app=nginx)
name	string	—	Name of the resource (optional - if not provided, lists all resources)
namespace	string	—	OpenShift namespace/project
output	string	—	Output format
resourceType	string	yes	Type of resource to get (e.g., pods, deploymentconfigs, routes, projects, services)

No output schema declared.

No examples provided.

oc_install_operator ~216

Install an Operator on the OpenShift/Kubernetes cluster using OLM, Helm, or direct manifests

Input Output Examples

Name	Type	Req	Description
channel	string	—	Update channel for the operator (stable, alpha, beta, etc.)
context	string	—	OpenShift context to use (optional)
createNamespace	boolean	—	Create namespace if it does not exist
helmRepo	string	—	Helm repository URL (required if source is helm)
installPlanApproval	string	—	Install plan approval strategy for OLM
manifestUrl	string	—	URL to operator manifest (required if source is manifest)
namespace	string	—	Target namespace for operator installation
operatorName	string	yes	Name of the operator to install (e.g., "prometheus-operator", "cert-manager")
source	string	—	Installation method: olm (Operator Lifecycle Manager), helm (Helm chart), or manifest (direct YAML)
version	string	—	Version of the operator to install (if not specified, installs latest available)

No output schema declared.

No examples provided.

oc_login ~189

Securely log into an OpenShift cluster using username/password or token authentication

Input Output Examples

Name	Type	Req	Description
authMethod	string	yes	Authentication method to use
certificateAuthority	string	—	Path to certificate authority file for TLS verification
context	string	—	Context name to save the login session (optional)
insecureSkipTlsVerify	boolean	—	Skip TLS certificate verification (not recommended for production)
namespace	string	—	Default namespace to set after login
password	string	—	Password for password authentication (required if authMethod is password)
server	string	yes	OpenShift cluster server URL (e.g., https://api.cluster.example.com:6443)
timeout	number	—	Login timeout in seconds
token	string	—	OpenShift authentication token (required if authMethod is token)
username	string	—	Username for password authentication (required if authMethod is password)

No output schema declared.

No examples provided.

oc_logs ~261

Get logs from OpenShift resources like pods, deployments, builds, etc. with advanced filtering and streaming options

Input Output Examples

Name	Type	Req	Description
allContainers	boolean	—	Get logs from all containers in the pod
container	string	—	Container name (for pods with multiple containers)
context	string	—	OpenShift context to use (optional)
follow	boolean	—	Follow logs output (stream live logs)
limitBytes	number	—	Maximum bytes to return
maxLogRequests	number	—	Maximum number of concurrent log requests when using selectors
name	string	yes	Name of the resource
namespace	string	—	OpenShift namespace/project
previous	boolean	—	Show logs from previous terminated container
resourceType	string	—	Type of resource to get logs from
selector	string	—	Label selector to filter pods
since	string	—	Show logs since relative time (e.g. 5s, 2m, 3h) or absolute time
sinceTime	string	—	Show logs since absolute timestamp (RFC3339)
tail	number	—	Number of lines to show from end of logs (-1 for all)
timestamps	boolean	—	Include timestamps in log output

No output schema declared.

No examples provided.

oc_new_app ~271

Create a new application from a GitHub repository using S2I build and expose it with an edge-terminated route

Input Output Examples

Name	Type	Req	Description
appName	string	—	Name for the application (if not specified, derives from repo name)
builderImage	string	—	Builder image for S2I build (e.g., "nodejs:18-ubi8", "python:3.9-ubi8")
context	string	—	OpenShift context to use (optional)
contextDir	string	—	Context directory within the Git repository
createNamespace	boolean	—	Create namespace if it does not exist
env	array	—	Environment variables in KEY=VALUE format
exposeRoute	boolean	—	Create an edge-terminated route to expose the application
gitRef	string	—	Git reference (branch, tag, or commit) to build from (default: main/master)
gitRepo	string	yes	GitHub repository URL for the source code
labels	array	—	Labels in KEY=VALUE format
namespace	string	—	Target namespace for the application
routeHostname	string	—	Custom hostname for the route (if not specified, uses default)
strategy	string	—	Build strategy: source (S2I) or docker

No output schema declared.

No examples provided.

oc_patch ~233

Patch OpenShift resources with strategic merge, JSON merge, or JSON patch operations

Input Output Examples

Name	Type	Req	Description
context	string	—	OpenShift context to use (optional)
dryRun	boolean	—	Perform a dry run without making actual changes
fieldManager	string	—	Field manager name for server-side apply tracking
force	boolean	—	Force the patch operation, ignoring conflicts
name	string	yes	Name of the resource to patch
namespace	string	—	Namespace/project for the resource (not required for cluster-scoped resources)
patch	string	yes	Patch content as JSON string or YAML. For strategic merge patch (default), provide the fields to update. For JSON patch, use RFC 6902 format.
patchType	string	—	Type of patch operation
recordHistory	boolean	—	Record the patch operation in the resource annotation for rollback purposes
resourceType	string	yes	Type of resource to patch (pod, deployment, service, route, configmap, secret, etc.)
subresource	string	—	Subresource to patch (e.g., status, scale)

No output schema declared.

No examples provided.

oc_scale ~109

Scale the number of pods in a deployment, deploymentconfig, replicaset, or statefulset to the specified number of replicas

Input Output Examples

Name	Type	Req	Description
context	string	—	OpenShift context to use (optional)
name	string	yes	Name of the resource to scale
namespace	string	—	OpenShift namespace/project
replicas	number	yes	Number of replicas to scale to
resourceType	string	—	Resource type to scale (deployment, deploymentconfig, replicaset, statefulset)

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug