Radar Kubernetes MCP Server

Recommend CPU/memory requests for Deployments, StatefulSets, and DaemonSets using 7 days of usage. scope=workload is cheap and precise; namespace/cluster scans run in the background for up to 3 minutes. Follow nextCall while scanStatus=running. Results are retained up to 15 minutes; use refresh=true after changes. Scans rank safety risks and increases before reductions. Scan once, then inspect workloads. Check confidence, missing evidence, and manual-review reasons. Request reductions do not directly imply bill savings.

Which running workloads use which runtime version, for runtime CVEs (PHP, Node, Python, Go, Java, …). Reads the version each running image declares in its config (PHP_VERSION etc., set by Docker official images and inherited by images built FROM them) for the digest the Pod runs: manifest and config only. Declared, not proof; misses runtimes installed from distro packages, so also search Trivy reports for the CVE. Pass runtime and fixed_in to rank images below their branch's fix. A status other than ok means unknown, not absent.

Use without verb/resource to inspect effective RBAC, granting bindings, flat rules, and, for ServiceAccounts, Pods running under it (`usedByPods`). `usedByPods` is best-effort and omitted when unavailable; absence is not proof no Pod uses the ServiceAccount. For ServiceAccount subjects, effective permissions include implicit-group grants such as `system:authenticated` and `system:serviceaccounts`; `inheritedFromGroup` identifies those bindings, while `flatRules` merges them without provenance. User and Group subjects include only bindings that name them directly. Supply both verb and resource …

Use to map a multi-service incident or dependency graph, preferably scoped to a namespace. Returns Kubernetes resource nodes and edges (Services, workloads, Pods, Ingresses, ConfigMaps, Secrets, owners) so you can see service-to-workload routing and ownership relationships instead of inspecting resources one by one. Use view=traffic for routing/connectivity questions and view=resources for ownership/deployment hierarchy. NOTE: view=traffic is SPEC-DERIVED routing (Ingress→Service→Pod declarations) — it does not show observed traffic, request rates, or live connections. Always specify namespace…

Get aggregated logs from all pods of a workload (Deployment, StatefulSet, DaemonSet, Job, or Argo Workflow). Logs are collected from all matching pods concurrently, then server-side filtered to errors, warnings, panics, and stack traces using deterministic regex patterns and deduplicated. When grep is set, it replaces diagnostic filtering and returns only regex matches, like `kubectl logs --timestamps | grep PATTERN`. More useful than get_pod_logs when you need logs across all replicas of a workload. If the target is a config value, feature flag, CRD field, env ref, or YAML/spec content, use s…

Use for 'what's broken right now?': live state, not posture. Returns grouped critical/warning failures in workloads, Jobs/CronJobs, HPAs, PVCs, Nodes, NetworkPolicies, references, pod startup, native Helm, False controller conditions. Use CEL `filter` for source/taxonomy slices; no source parameter. `unchecked_sources`: issues may be missing; don't assume healthy. `kinds`/`namespaces` scope the gap. `kind_sync_pending`: loading; retry shortly. `diagnostic_context.role` marks roots, rollups, symptoms, or context; `related_issues[].count` is the root's affected subset, not the linked issue total…

List all Helm releases in the cluster with their status, resource health, storage namespace, Flux ownership when detected, lastOperation when Helm history indicates a current failed upgrade, rollback-after-failure, rollback, or stuck pending operation, and a capped operations trail for failed upgrades, rollbacks, and stuck operations. Use this first for Helm deployment debugging; if storageNamespace is present, pass that value as namespace to get_helm_release. Follow with get_helm_release include=history,operations for the full revision trail.

List all Kubernetes namespaces with their status. Use to discover available namespaces before filtering other queries.

Use for a unified inventory of installed packages, versions, and health across Helm, workload labels, CRDs, Argo, and Flux. `sources` and the returned `sourceLegend` explain why each row exists; inspect `contributors` when sources disagree because aggregate health is worst-of while version follows source priority. Use this instead of manually merging list_helm_releases and list_resources when the question spans package sources; use list_helm_releases for Helm-only deployment debugging. Filter by namespace, source, or chart substring. Non-empty `sourcesErrored` means results are partial, not pr…

Use for a jq-like namespace sweep when you know the resource kind (pods/po, deployments/deploy, services/svc, configmaps/cm, CRDs). Returns compact Kubernetes-shaped rows plus summaryContext by default (managedBy, health, issueCount) so you can compare many similar resources and pick suspects before calling get_resource. For unknown kind/name searches, use search. For broad health triage, use get_dashboard or issues first.

Operate on a Kubernetes CronJob: 'trigger' runs a Job now from the CronJob's template, to check a fix without waiting for the schedule when an extra run is safe; 'suspend' pauses the schedule (no new Jobs are created); 'resume' re-enables a suspended schedule.

Perform operations on GitOps resources (ArgoCD or FluxCD). For ArgoCD: actions are 'sync' (trigger deployment), 'refresh', 'terminate', 'rollback', 'suspend' (disable auto-sync), 'resume' (re-enable auto-sync). Resource kind is always Application. For FluxCD: actions are 'reconcile' (trigger sync), 'sync-with-source', 'suspend', 'resume'. Requires 'kind' parameter (kustomization, helmrelease, gitrepository, etc.).

Cordon, uncordon or drain a node. Drain waits for deletion. outcome: complete/incomplete/unconfirmed/started. started: status ok; incomplete/unconfirmed: partial. expectedSkip: normal exclusions. Complete does not certify shutdown safety.

Drive an Argo Rollout's progressive delivery (the verbs with no Deployment equivalent). 'abort' reverts traffic to the last stable version at once without touching spec, and stays aborted until retried — the incident-response verb; 'retry' clears an abort; 'promote' clears the current pause to advance one step; 'promote-full' skips ALL remaining steps, pauses, and analysis (emergency hotfix) — straight after a rollback it may report that the Argo Rollouts controller has not caught up, which is safe to retry; 'skip-step' advances exactly one canary step (canary only). For rollback, restart, or …

Perform operations on a Kubernetes workload (Deployment, StatefulSet, DaemonSet, or Argo Rollout). Supported actions: 'restart' triggers a rolling restart, 'scale' changes the replica count (requires 'replicas' parameter), 'rollback' reverts to a previous revision (requires 'revision'; enumerate valid numbers with get_resource include=revisions). Use list_resources or get_dashboard first to identify the target. On a Rollout, 'rollback' rewrites the pod template and so starts a NEW rollout that re-runs every canary step, pause, and analysis — to revert traffic now use manage_rollout abort, or f…

Patch one existing Kubernetes resource with JSON Patch, JSON Merge Patch, or strategic merge patch. Use this for precise field/list mutations such as removing a bad dnsConfig, hostPort, initContainers field, sidecar container, nodeSelector, or replacing one scalar value. Prefer this over apply_resource when you know the exact field to mutate and do not want to rewrite the full manifest or take broad server-side-apply ownership. For patch_type=json, patch must be an RFC 6902 JSON Patch array. For patch_type=merge, patch must be a JSON object. For patch_type=strategic, use a JSON object against …

Use when the question needs metric VALUES or history: CPU/memory over time, request rates, error ratios, saturation, restarts trend, 'was there a spike?'. Executes PromQL against the cluster's Prometheus (auto-discovered or configured in Radar; also works with PromQL-compatible backends: Thanos, VictoriaMetrics, Mimir). type=instant returns current values; type=range returns time series for a window (since=1h default). For live top-N snapshots prefer top_resources; for metric/label NAME discovery use discover_metrics first — do not guess metric names. For cluster or namespace spend use get_cos…

Find resources by content/term match when you do not know which object contains a string, config key, env ref, image, label/annotation value, ConfigMap data, CRD field, or status message. Tokens are AND'd. Secret content is intentionally NOT indexed — Secret names match by metadata, but data values won't appear in snippets to avoid leaking secret material through search results. Examples: `readinessProbe user-service`, `image:flagd`, `kind:Pod label:app=cart error`. Use the namespace parameter for structured namespace scoping. Modifiers such as kind:Pod, ns:foo, label:app=bar, and image:redis …

Use when investigating high CPU, memory pressure, OOMKills, slow services, noisy pods, or uneven node load. Returns live metrics ranked like `kubectl top pods|nodes | sort`, joined with Kubernetes context: pod status, readiness, restarts, owner workload, requests, and limits. kind=pods ranks individual Pods, kind=workloads aggregates Pods to Deployments/StatefulSets/DaemonSets/Jobs, and kind=nodes ranks Nodes. This is live usage, not recommendations — for whether requests/limits should change, use get_rightsizing. Use before reading logs when the symptom mentions CPU, memory, GC, OOM, latency,…

Wait until a change takes effect, like kubectl rollout status and kubectl wait; use it after a fix instead of sleeping and re-reading. condition: rollout (default for Deployment, StatefulSet, DaemonSet, Argo Rollout), complete (default for Job), ready (default for Pod), deleted, a status condition type that must be True (Type=Status for another value), or jsonpath={.status.field}=value. Target one object by name, every match of label_selector, or all of the kind in the namespace. One call waits at most 45s and returns state: met; waiting (not yet: call again, passing back uid if one was return…