istio

The Istio MCP Server provides read-only access to Istio resources in a Kubernetes cluster via the MCP (Model Context Protocol). It exposes a safe interface to query Virtual Services, Destination Rules, service mesh hosts, and Envoy proxy configurations without allowing any modification operations. You can connect to the server using MCP clients over STDIO, SSE, or HTTP, enabling AI assistants or tooling to fetch configuration and telemetry data from Istio without impacting the cluster. Tools exposed by the server include retrieval of Virtual Services and Destination Rules by name, discovery of namespaces with Istio sidecars, health/status of Envoy proxies, and full Envoy configuration dumps, among others. This makes it suitable for AI agents, dashboards, or automation that needs rich Istio visibility while maintaining strict read-only guarantees.

Prerequisites:

• Node.js and npm (for npm/npx usage) or Go toolchain (if building from source)
• Kubernetes cluster with Istio installed
• kubectl configured with appropriate permissions
• istioctl installed (optional for advanced proxy features)

Option A: Install via npm (recommended for quick start)

1. Install globally using npm:

npm install -g istio-mcp-server

2. Run or integrate into your tooling; for Claude Desktop, see the configuration example in the README to use npx with istio-mcp-server@latest.

Option B: Build from source

1. Clone the repository:

git clone https://github.com/krutsko/istio-mcp-server.git
cd istio-mcp-server

2. Build the project (Go toolchain required):

make build

3. Run the built binary from the bin directory, e.g.:

./bin/istio-mcp-server --kubeconfig ~/.kube/config

Option C: Using Claude Desktop or IDE integrations

• Add the MCP server entry using the provided npx configuration (as shown in the mcp_config section of this doc).
• Ensure your environment has network access to npm registries to fetch istio-mcp-server@latest when using npx.

Prerequisites recap (for all methods):

• A Kubernetes cluster with Istio installed
• kubeconfig configured for cluster access
• kubectl available in PATH
• Optional: istioctl for advanced proxy options

Tips and common issues:

• The server is read-only by design. Attempts to perform destructive or mutating operations will be blocked by the MCP layer.
• If you see connectivity issues, verify your kubeconfig context and cluster permissions. Ensure your MCP client is configured to reach the server endpoint (STDIO, SSE, or HTTP depending on your deployment).
• When running via npx, ensure network access to fetch istio-mcp-server@latest. If you pin a version, replace latest with the desired tag.
• If you need broader Envoy telemetry, ensure Istio control plane permissions allow exporting the necessary Envoy configuration data and that the relevant namespaces are included in the discovery scope.
• Environment variables can be added to customize logging, timeouts, or proxy data collection as needed by your MCP client or orchestration tooling.