For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Look up the MCP servers that a kagent installation ships with, the tools that each one serves, and the community servers that you can add.

A kagent installation ships with two Model Context ProtocolModel Context ProtocolAn open protocol for exposing tools and resources to a model. kagent reaches an MCP server through a RemoteMCPServer resource, and an AgentTemplate binds individual tools from it.Learn more (MCP) servers already registered, and you can register more of your own. This page is the catalog: what is installed, what each server serves, and how to narrow the set. For the schema that binds a server to an agent, see About tools.

Servers that a kagent installation registers

Both servers arrive as subcharts of the kagent chart, and each one creates its own RemoteMCPServerRemoteMCPServerA Kubernetes custom resource pointing at a Model Context Protocol server that the cluster can reach. It is the only server kind that an AgentTemplate tool binding accepts.Learn more in the kagent namespace. Neither is bound to an agent for you, so an agent reaches a server’s tools only through a tool bindingTool bindingOne entry in an AgentTemplate's spec.tools list. Each binding selects exactly one source: tools from a Model Context Protocol server, or another AgentTemplate used as a tool.Learn more that you add to its AgentTemplateAgentTemplateA Kubernetes custom resource defining what an agent does: its model, system prompt, tools, skills, and plugins. It runs only once a Harness accepts it.Learn more.

The kagent release pins the kagent-tool-server version, which is currently 0.2.1. For the full set of pinned component versions, see Version support.

Read the tools that a server serves

The controller connects to each RemoteMCPServer, asks it what it serves, and records the answer in status.discoveredTools. That status reports the server that your cluster actually runs, so it is more reliable than any list on this page.

kubectl get remotemcpserver kagent-tool-server -n kagent \
  -o jsonpath='{range .status.discoveredTools[*]}{.name}{"\t"}{.description}{"\n"}{end}'

Your first MCP tool runs the same command as the first step of binding one of these tools to an agent.

kagent-tool-server

One Go binary serves every tool in this section, grouped into eight providers. A provider’s tools shell out to the matching command line tool inside the server’s own container, so the Kubernetes, Helm, Istio, and Cilium providers act on your cluster with the server’s ServiceAccount rather than with the caller’s credentials.

Tools marked * perform write operations, and --read-only skips them at registration. The following sections list each provider’s tools by the name that an agent sees.

Kubernetes

Agents use the Kubernetes provider the most, and it covers both inspection and modification of any resource that kubectl can reach.

Helm

The Helm provider manages releases and chart repositories with the Helm configuration inside the server’s container, so a repository that one tool adds is available to the others.

Istio

Istio’s tools wrap istioctl, and most of them read mesh state rather than change it. Waypoint management is the exception, as generating a waypoint resource and applying it are separate tools.

Argo Rollouts

Argo Rollouts tools cover progressive delivery. A rollout tool fails confusingly when the controller or one of its plugins is missing, so four of the eight tools verify the installation instead of acting on a rollout.

Cilium

Cilium is the largest provider, with 58 tools ranging from installation to individual BPF maps. An agent that can see every tool spends its context on tool descriptions, so bind only the handful that an agent needs rather than the whole provider.

Prometheus

The Prometheus provider queries a Prometheus server directly. Each tool takes the server’s URL as an argument and defaults to http://localhost:9090, which does not resolve from inside the tool server’s container, so have the agent pass the in-cluster address.

Kubescape

Kubescape’s tools read scan results that the Kubescape operator has already produced, so they return nothing useful until that operator is installed and has completed a scan. Start with kubescape_check_health, which reports whether the rest of the provider can work.

Utilities

Two tools sit outside any product. shell runs an arbitrary command in the server’s container with the server’s ServiceAccount, so treat it as the widest permission that this server grants.

Narrow what kagent-tool-server serves

Serving all 124 tools costs an agent context on every turn, and it grants the server broad authority over your cluster. Two independent settings narrow it, and each one acts at a different layer.

kagent-tools:
  tools:
    enabledTools:
      - k8s
      - helm
    args:
      - "--read-only"
  rbac:
    readOnly: true
    additionalRules:
      - apiGroups: ["networking.istio.io"]
        resources: ["virtualservices", "destinationrules", "gateways"]
        verbs: ["get", "list", "watch"]

Because the settings are per-installation, they change what every agent sees. To give one agent a smaller set while leaving the server intact, list the tools on the tool binding instead, as described in About tools.

kagent-grafana-mcp

The kagent-grafana-mcp server runs mcp-grafana, Grafana’s own MCP server. The kagent chart packages it as a subchart. Its tools fall into four groups:

• Grafana dashboards, data sources, and alert rules.
• PromQL queries against Grafana’s Prometheus data sources.
• LogQL queries against Loki.
• Grafana incidents and on-call schedules.

Set the Grafana instance that the server queries, along with its credentials, at install time.

grafana-mcp:
  enabled: true
  grafana:
    url: "grafana.kagent:3000/api"
    serviceAccountToken: "<token>"

Community and contributed servers

kagent’s repository carries example servers in contrib/tools. Each one is a starting point rather than a supported component, and their manifests were written against different kagent API versions, so check the apiVersion before you apply one.

To register any other MCP server, write a RemoteMCPServer that points at its URL. Your first MCP tool works through a complete example.

Next steps