Ocm MCP Server

What a managed cluster actually applied, read from the spoke itself. The hub's ManifestWork status reports what the hub believes; AppliedManifestWork is the agent's own record on the cluster of the resources it created. Use it to verify a fix really landed, and is still present, rather than trusting hub status alone. Args: cluster: managed cluster name (needs a configured spoke read context).

Every cluster's ClusterClaims (id, platform, region, version) rolled up from status.

List fleet-level add-on definitions (ClusterManagementAddOn) and their install strategy.

ClusterPermission objects distributing RBAC to a managed cluster. This is what grants or withholds permission on the spoke, so it is where to look when an apply is refused by RBAC rather than by policy or guardrails. Args: cluster: managed cluster name (its hub namespace).

List ManagedClusterSetBindings (which ClusterSets a namespace's Placements may use). Args: namespace: limit to one namespace; empty lists bindings across all namespaces.

List ManagedClusterSets with their selector type and member clusters.

List all managed clusters with availability, version, labels, and capacity.

List HyperShift HostedClusters, when the hub is the HCP hosting cluster. Args: namespace: limit to one namespace; empty lists across all namespaces. HostedCluster objects live on whichever cluster hosts the control plane. If your HCPs are hosted on a separate management cluster, they are not on this hub - this reports that clearly, and the spokes still appear via list_clusters.

List ManifestWorkReplicaSets (a template fanned across a Placement) with rollout summary. Args: namespace: limit to one namespace; empty lists across all namespaces.

List ManifestWorks targeting a cluster (what the hub is managing there). Args: cluster: managed cluster name.

List HyperShift NodePools (worker groups), optionally filtered to one HostedCluster. Args: namespace: limit to one namespace; empty lists across all namespaces. cluster: optional HostedCluster name to filter node pools by.

List pending cluster-join / add-on registration CSRs awaiting hub approval.

List proposals (ManifestWorks and cluster actions) waiting for human approval.

List Placements and how many clusters each currently selects. Args: namespace: limit to one namespace; empty lists across all namespaces.

List governance Policies and per-cluster compliance (only if the add-on is installed). Args: namespace: limit to one namespace; empty lists across all namespaces.

Only the NonCompliant / Pending Policy-cluster pairs across the fleet - the open risks.

Generic list over an allow-list of OCM API types (identity + conditions only). Args: resource: an OCM resource type, e.g. managedclusters, placements, placementdecisions, manifestworks, managedclusteraddons, clustermanagementaddons, managedclustersets, policies, klusterlets. namespace: for namespaced types, limit to one namespace; empty lists all. Only Open Cluster Management types are allowed. Secrets and other credential resources are not on the allow-list and cannot be read through this tool.

Propose an OCM cluster lifecycle action. Does NOT apply anything. Args: cluster: target managed cluster name. action: one of 'cordon' (taint out of scheduling), 'uncordon' (undo cordon), 'set_label' (params: {"key","value"}; empty value removes the label), 'accept' (set hubAcceptsClient=true and approve pending join CSRs), 'enable_addon' (params: {"addon","install_namespace"?}; create a ManagedClusterAddOn), 'disable_addon' (params: {"addon"}; delete it). summary: one or two sentences the human approver will read. params_json: JSON object of act…

Propose a change to one cluster as an OCM ManifestWork. Does NOT apply anything. Args: cluster: target managed cluster name. name: a short kebab-case name for the ManifestWork. summary: one or two sentences a human approver will read. Be precise about what changes and why. manifests_json: JSON array of complete Kubernetes manifests (allowed kinds only; all namespaced; images pinned). The proposal must pass static guardrails and a Kyverno dry-run on the hub. On success it is stored pending and the human operator must run `ocm-mcp approve <id>` to mint an approv…

Propose rolling back an applied ManifestWork. Applies nothing; needs its own approval. Args: proposal_id: id of an already-applied ManifestWork proposal. Creates a distinct rollback proposal bound to the exact ManifestWork name and UID. The human approves it separately (`ocm-mcp approve <rollback-id>`), and the token can only authorize a rollback - an old apply token can never delete a workload.

Recent Kubernetes events from a managed cluster, newest first. Args: cluster: managed cluster name. namespace: optional namespace filter; empty means all namespaces. limit: maximum number of events to return (default 40). Use this to find the 'why' behind unhealthy pods.

Delete a ManifestWork after a rollback proposal has been approved. Args: rollback_proposal_id: id returned by propose_rollback. approval_token: a rollback token from `ocm-mcp approve <rollback-id>`.