# OpenShift MCP Server (npm · mcp-server-openshift)

OpenShift/Kubernetes cluster management via the oc CLI for MCP clients

- Trust score: 56/100 (low)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mcp-server-openshift`: 56/100 (this document), [markdown](https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift.md), [page](https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift)
- oci · `docker.io/sanjaypsachdev/mcp-server-openshift:1.2.0`: 8/100, [markdown](https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/docker-io-sanjaypsachdev-mcp-server-openshift-1-2-0.md), [page](https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/docker-io-sanjaypsachdev-mcp-server-openshift-1-2-0)

## Channel facts

- Registry: `npm`
- Package: `mcp-server-openshift`
- Version: `1.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 71/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 0.7.0, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (17 of 18), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 38 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3050 tokens (~179/item across 17 items; 14 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add sanjaypsachdev-mcp-server-openshift -- npx -y mcp-server-openshift
```

### Codex

```bash
codex mcp add sanjaypsachdev-mcp-server-openshift -- npx -y mcp-server-openshift
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sanjaypsachdev-mcp-server-openshift": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-server-openshift"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sanjaypsachdev-mcp-server-openshift --command npx --arg -y --arg mcp-server-openshift
```

### Hermes

```yaml
mcp_servers:
  sanjaypsachdev-mcp-server-openshift:
    command: "npx"
    args: ["-y", "mcp-server-openshift"]
```

### Other

```json
{
  "mcpServers": {
    "sanjaypsachdev-mcp-server-openshift": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-server-openshift"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 56, +43)

- [security regression] Known CVEs: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-08-01 (score 13, −31)

- [security regression] Known CVEs: fail → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Dependency health: partial → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: fail → unverified

### 2026-07-31 (score 44, −5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 49, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 67, +16)

- [security regression] CVE-2025-66414 affects this package: high
- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-07-27 (score 51)

First indexed and scored.

## MCP tools (14)

### `oc_get` (~153 tokens)

Get OpenShift resources like pods, deploymentconfigs, routes, projects, etc.

Input parameters:

- `allNamespaces` (boolean): List resources across all namespaces
- `context` (string): OpenShift context to use (optional)
- `fieldSelector` (string): Filter resources by field selector
- `labelSelector` (string): Filter resources by label selector (e.g., app=nginx)
- `name` (string): Name of the resource (optional - if not provided, lists all resources)
- `namespace` (string): OpenShift namespace/project
- `output` (string): Output format
- `resourceType` (string, required): Type of resource to get (e.g., pods, deploymentconfigs, routes, projects, services)

### `oc_create` (~189 tokens)

Create OpenShift resources like projects, deploymentconfigs, routes, etc.

Input parameters:

- `context` (string): OpenShift context to use (optional)
- `description` (string): Description for project
- `displayName` (string): Display name for project
- `dryRun` (boolean): Validate only, don't create
- `filename` (string): Path to YAML file to create resources from
- `hostname` (string): Hostname for route
- `image` (string): Container image for deploymentconfig
- `manifest` (string): YAML manifest to create resources from
- `name` (string): Name of the resource
- `namespace` (string): OpenShift namespace/project
- `replicas` (number): Number of replicas
- `resourceType` (string): Type of resource to create (project, deploymentconfig, route, service, etc.)
- `service` (string): Service name for route

### `oc_install_operator` (~216 tokens)

Install an Operator on the OpenShift/Kubernetes cluster using OLM, Helm, or direct manifests

Input parameters:

- `channel` (string): Update channel for the operator (stable, alpha, beta, etc.)
- `context` (string): OpenShift context to use (optional)
- `createNamespace` (boolean): Create namespace if it does not exist
- `helmRepo` (string): Helm repository URL (required if source is helm)
- `installPlanApproval` (string): Install plan approval strategy for OLM
- `manifestUrl` (string): URL to operator manifest (required if source is manifest)
- `namespace` (string): Target namespace for operator installation
- `operatorName` (string, required): Name of the operator to install (e.g., "prometheus-operator", "cert-manager")
- `source` (string): Installation method: olm (Operator Lifecycle Manager), helm (Helm chart), or manifest (direct YAML)
- `version` (string): Version of the operator to install (if not specified, installs latest available)

### `oc_new_app` (~271 tokens)

Create a new application from a GitHub repository using S2I build and expose it with an edge-terminated route

Input parameters:

- `appName` (string): Name for the application (if not specified, derives from repo name)
- `builderImage` (string): Builder image for S2I build (e.g., "nodejs:18-ubi8", "python:3.9-ubi8")
- `context` (string): OpenShift context to use (optional)
- `contextDir` (string): Context directory within the Git repository
- `createNamespace` (boolean): Create namespace if it does not exist
- `env` (array): Environment variables in KEY=VALUE format
- `exposeRoute` (boolean): Create an edge-terminated route to expose the application
- `gitRef` (string): Git reference (branch, tag, or commit) to build from (default: main/master)
- `gitRepo` (string, required): GitHub repository URL for the source code
- `labels` (array): Labels in KEY=VALUE format
- `namespace` (string): Target namespace for the application
- `routeHostname` (string): Custom hostname for the route (if not specified, uses default)
- `strategy` (string): Build strategy: source (S2I) or docker

### `oc_scale` (~109 tokens)

Scale the number of pods in a deployment, deploymentconfig, replicaset, or statefulset to the specified number of replicas

Input parameters:

- `context` (string): OpenShift context to use (optional)
- `name` (string, required): Name of the resource to scale
- `namespace` (string): OpenShift namespace/project
- `replicas` (number, required): Number of replicas to scale to
- `resourceType` (string): Resource type to scale (deployment, deploymentconfig, replicaset, statefulset)

### `oc_describe` (~114 tokens)

Describe any OpenShift resource and share the output in various formats including human-readable summary

Input parameters:

- `context` (string): OpenShift context to use (optional)
- `name` (string, required): Name of the resource to describe
- `namespace` (string): OpenShift namespace/project
- `output` (string): Output format: text (default oc describe), yaml, json, or human-readable (concise summary)
- `resourceType` (string, required): Type of resource to describe (pod, deployment, service, route, etc.)

### `oc_apply` (~291 tokens)

Apply YAML manifests to OpenShift cluster with comprehensive error handling and validation for all scenarios

Input parameters:

- `cascade` (string): Deletion cascade strategy
- `context` (string): OpenShift context to use (optional)
- `dryRun` (boolean): Validate only, don't apply (client or server)
- `fieldManager` (string): Field manager name for server-side apply
- `filename` (string): Path to YAML file to apply
- `force` (boolean): Force apply, ignore conflicts
- `gracePeriod` (number): Grace period for resource deletion (seconds)
- `kustomize` (boolean): Apply kustomization directory
- `manifest` (string): YAML manifest content to apply
- `namespace` (string): OpenShift namespace/project
- `overwrite` (boolean): Overwrite existing resources
- `prune` (boolean): Prune resources not in current configuration
- `pruneWhitelist` (array): Resource types to include in pruning
- `recursive` (boolean): Process directory recursively
- `selector` (string): Label selector for pruning
- `serverSideApply` (boolean): Use server-side apply
- `timeout` (string): Timeout for wait operation (e.g., "60s", "5m")
- `url` (string): URL to YAML manifest to apply
- `validate` (boolean): Validate resources before applying
- `wait` (boolean): Wait for resources to be ready

### `oc_delete` (~308 tokens)

Delete OpenShift resources with comprehensive safety checks, validation, and error handling

Input parameters:

- `all` (boolean): Delete all resources of the specified type
- `allNamespaces` (boolean): Delete resources across all namespaces
- `cascade` (string): Deletion cascade strategy
- `confirm` (boolean): Require explicit confirmation for destructive operations
- `context` (string): OpenShift context to use (optional)
- `dryRun` (boolean): Show what would be deleted without actually deleting
- `fieldSelector` (string): Delete resources matching field selector
- `filename` (string): Path to YAML file to delete resources from
- `force` (boolean): Force deletion (bypass finalizers)
- `gracePeriodSeconds` (number): Grace period for deletion in seconds
- `ignore404` (boolean): Ignore 404 errors if resource does not exist
- `labelSelector` (string): Delete resources matching label selector
- `manifest` (string): YAML manifest defining resources to delete
- `name` (string): Name of the resource to delete
- `namespace` (string): OpenShift namespace/project
- `recursive` (boolean): Process directory recursively
- `resourceType` (string): Type of resource to delete (required if not using manifest/filename)
- `timeout` (string): Timeout for deletion operation (e.g., "60s", "5m")
- `url` (string): URL to YAML manifest defining resources to delete
- `wait` (boolean): Wait for deletion to complete

### `oc_logs` (~261 tokens)

Get logs from OpenShift resources like pods, deployments, builds, etc. with advanced filtering and streaming options

Input parameters:

- `allContainers` (boolean): Get logs from all containers in the pod
- `container` (string): Container name (for pods with multiple containers)
- `context` (string): OpenShift context to use (optional)
- `follow` (boolean): Follow logs output (stream live logs)
- `limitBytes` (number): Maximum bytes to return
- `maxLogRequests` (number): Maximum number of concurrent log requests when using selectors
- `name` (string, required): Name of the resource
- `namespace` (string): OpenShift namespace/project
- `previous` (boolean): Show logs from previous terminated container
- `resourceType` (string): Type of resource to get logs from
- `selector` (string): Label selector to filter pods
- `since` (string): Show logs since relative time (e.g. 5s, 2m, 3h) or absolute time
- `sinceTime` (string): Show logs since absolute timestamp (RFC3339)
- `tail` (number): Number of lines to show from end of logs (-1 for all)
- `timestamps` (boolean): Include timestamps in log output

### `oc_patch` (~233 tokens)

Patch OpenShift resources with strategic merge, JSON merge, or JSON patch operations

Input parameters:

- `context` (string): OpenShift context to use (optional)
- `dryRun` (boolean): Perform a dry run without making actual changes
- `fieldManager` (string): Field manager name for server-side apply tracking
- `force` (boolean): Force the patch operation, ignoring conflicts
- `name` (string, required): Name of the resource to patch
- `namespace` (string): Namespace/project for the resource (not required for cluster-scoped resources)
- `patch` (string, required): Patch content as JSON string or YAML. For strategic merge patch (default), provide the fields to update. For JSON patch, use RFC 6902 format.
- `patchType` (string): Type of patch operation
- `recordHistory` (boolean): Record the patch operation in the resource annotation for rollback purposes
- `resourceType` (string, required): Type of resource to patch (pod, deployment, service, route, configmap, secret, etc.)
- `subresource` (string): Subresource to patch (e.g., status, scale)

### `oc_login` (~189 tokens)

Securely log into an OpenShift cluster using username/password or token authentication

Input parameters:

- `authMethod` (string, required): Authentication method to use
- `certificateAuthority` (string): Path to certificate authority file for TLS verification
- `context` (string): Context name to save the login session (optional)
- `insecureSkipTlsVerify` (boolean): Skip TLS certificate verification (not recommended for production)
- `namespace` (string): Default namespace to set after login
- `password` (string): Password for password authentication (required if authMethod is password)
- `server` (string, required): OpenShift cluster server URL (e.g., https://api.cluster.example.com:6443)
- `timeout` (number): Login timeout in seconds
- `token` (string): OpenShift authentication token (required if authMethod is token)
- `username` (string): Username for password authentication (required if authMethod is password)

### `oc_api_resources` (~136 tokens)

List all available API resources in the OpenShift cluster with their details

Input parameters:

- `apiGroup` (string): Filter by specific API group (e.g., apps, extensions, networking.k8s.io)
- `categories` (boolean): Group resources by categories (core, apps, networking, etc.)
- `context` (string): OpenShift context to use (optional)
- `namespaced` (boolean): Filter by namespaced resources only
- `output` (string): Output format for the API resources list
- `verbs` (array): Filter by supported verbs (e.g., ["get", "list", "create", "delete"])

### `oc_explain` (~135 tokens)

Explain OpenShift/Kubernetes resource schemas, fields, and API documentation

Input parameters:

- `apiVersion` (string): Specific API version to explain (e.g., apps/v1, route.openshift.io/v1)
- `context` (string): OpenShift context to use (optional)
- `field` (string): Specific field path to explain (e.g., spec.containers, metadata.labels)
- `output` (string): Output format for the explanation
- `recursive` (boolean): Show all fields recursively
- `resource` (string, required): Resource type to explain (e.g., pod, deployment, service, route.route.openshift.io)

### `oc_expose` (~377 tokens)

Expose an OpenShift resource (service, deployment, etc.) with secure route endpoints supporting SSL/TLS termination

Input parameters:

- `annotations` (array): Annotations to apply to the route in KEY=VALUE format
- `caCertificate` (string): Path to CA certificate file
- `certificate` (string): Path to TLS certificate file
- `context` (string): OpenShift context to use (optional)
- `destinationCaCertificate` (string): Path to destination CA certificate file (for reencrypt)
- `dryRun` (boolean): Show what would be created without actually creating it
- `hostname` (string): Custom hostname for the route
- `insecureEdgeTerminationPolicy` (string): Policy for insecure traffic: None (reject), Allow (allow), Redirect (redirect to secure)
- `key` (string): Path to TLS private key file
- `labels` (array): Labels to apply to the route in KEY=VALUE format
- `name` (string, required): Name of the resource to expose
- `namespace` (string): OpenShift namespace/project
- `path` (string): Path for the route (e.g., /api)
- `port` (string): Target port to expose (port name or number)
- `resourceType` (string, required): Resource type to expose (service, deploymentconfig, deployment)
- `routeName` (string): Name for the route (if not specified, derives from resource name)
- `routeType` (string): Type of secure route: edge (SSL termination at router), passthrough (SSL passthrough), reencrypt (SSL re-encryption)
- `tlsTermination` (string): TLS termination type (deprecated, use routeType instead)
- `weight` (number): Weight for this route (0-256)
- `wildcardPolicy` (string): Wildcard policy for the route

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift#diagnostics

## Score history

- 2026-08-03: 56
- 2026-08-02: 56
- 2026-08-01: 13
- 2026-07-31: 44
- 2026-07-30: 49
- 2026-07-28: 67
- 2026-07-27: 51

## Links

- npm package: https://www.npmjs.com/package/mcp-server-openshift
- Socket report: https://socket.dev/npm/package/mcp-server-openshift
- Repository: https://github.com/sanjaypsachdev/mcp-server-openshift
- Changelog RSS feed: https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sanjaypsachdev-mcp-server-openshift/mcp-server-openshift