Four tools, twenty-two actions.
MCP Helm gives your agent four tools, with twenty-two actions between them, covering releases, charts, repositories and previews. A tool is chosen by what it works on (releases, charts, repositories or templates), and an action string chooses the operation. Unknown tools, actions and fields are refused. Check the JSON-RPC error and then the result's isError; successful data is JSON inside a text item. Paths belong to the server's filesystem, not your computer, so prefer absolute ones.
Install, change and remove a release.
| Tool | Use it to | Parameters |
|---|---|---|
helm_release | Install, upgrade, roll back, uninstall and read a release. Every action needs an explicit namespace, and actions on a named release also need its name. | action (required), namespace, name, chart, values, version, revision, keep_history |
The actions of helm_release:
| Action | Required besides action | Use it to |
|---|---|---|
install | name, namespace, chart | Install a local chart directory or archive as revision 1; values is a YAML or JSON string and version must match the chart's. An existing name fails, retained history included |
upgrade | name, namespace, chart | Write a new revision. Omitted values keep the previous ones; supplied values replace them, even "{}". A missing release fails |
rollback | name, namespace | Write a new revision from the stored chart and values of revision (an integer); without one, the previous revision. The current revision fails |
uninstall | name, namespace | Re-render the latest chart and delete its resources; keep_history: true keeps the records |
list | namespace | List the stored revisions: name, namespace, version, status, chart and chart version |
get | name, namespace | Read one revision (the latest unless revision is given) with its chart and values |
status | name, namespace | Read the latest recorded status |
history | name, namespace | List every revision with its status, chart, chart version and info |
test | name, namespace | Not supported; check the workload with kubectl |
Why: one tool for the life of a release. A result of Deployed means the apply was accepted and recorded, not that the workload is ready, so check the resources after every change. Install, upgrade and rollback can leave a pending revision and partly changed resources, with no automatic recovery; read history and the resources before you retry. Apply can take ownership of fields on resources that already exist. Upgrade and rollback do not remove resources the chosen chart omits, and uninstall sees only the latest stored chart.
Inspect, package and pull charts.
| Tool | Use it to | Parameters |
|---|---|---|
helm_chart | Pull, show, lint, create, package and verify a chart. It works on local paths and does not need a release in the cluster. | action (required), source, chart_path, repository, chart, version, name, destination |
The actions of helm_chart:
| Action | Required besides action | Use it to |
|---|---|---|
pull | repository, chart, destination | Download a chart from a repository registered in the same server; version is exact, and omitted means the first listed, not the highest |
show | source | Read a chart's name, version, description, home, sources, maintainers, keywords and dependencies |
lint | chart_path | Check the chart's structure and run the limited renderer |
create | name, destination | Write a scaffold, which can overwrite scaffold files and needs adapting before it installs |
package | chart_path, destination | Write a .tgz named from Chart.yaml; keep the output outside the chart directory |
verify | chart_path | Check the chart structure. Signature and provenance checks are not supported; compare the chart's checksum with the one its publisher gives |
Why: look at a chart before you install it. After a pull, confirm the chart with helm_chart show and compare its checksum with the one the chart's publisher gives.
Add, refresh, search and remove repositories.
| Tool | Use it to | Parameters |
|---|---|---|
helm_repository | Register chart repositories and search their index. Registrations are saved, but the downloaded index is kept only while the server runs. | action (required), name, url, type, query, max_results |
The actions of helm_repository:
| Action | Required besides action | Use it to |
|---|---|---|
add | name, url | Save a registration and fetch its index; type is http (the default) or oci, and only http gives usable downloads (OCI is not supported). It can replace a registration with the same name |
list | none | List the registrations (it loads the saved ones after a restart) |
remove | name | Remove the registration and its cached index, not downloaded files or releases |
update | none | Refresh one named repository, or all of them. Updating all hides individual errors, so refresh by name to diagnose one |
search | query | Match chart names in the loaded indexes, case-insensitively, up to max_results (default 50); the order is not guaranteed and it does not query Artifact Hub |
Why: keep the add, search and pull in one connection to one server. Repository authentication and OCI transfer are not supported. After a restart, call list and then a named update before you search.
Preview what a chart would create.
| Tool | Use it to | Parameters |
|---|---|---|
helm_template | Render a chart's manifests, or validate them, without touching the cluster. The renderer is limited, as described below. | action (required), chart_source, release_name, namespace, values |
The actions of helm_template:
| Action | Required besides action | Use it to |
|---|---|---|
render | chart_source, release_name, namespace | Return one manifest per non-empty document, with a source comment, and a count; values overrides the chart defaults |
validate | chart_source | Render with release name validation and namespace default, discard the output and report valid |
Why: the default renderer replaces only {{ .Release.Name }}, {{ .Release.Namespace }}, {{ .Chart.Name }} and {{ .Chart.Version }}, written exactly like that. .Values, pipelines and control flow stay as written in the output, and valid does not prove the chart is complete, valid Kubernetes YAML or ready to run. Install and uninstall accept only one YAML document per .yaml template file, although the preview also visits other files.
What to expect when a call fails.
| Limit | Value |
|---|---|
| One call | A fixed 120-second deadline over download, rendering and cluster work; it cannot be raised, and a timeout does not undo writes |
| Cluster | One kubeconfig for the whole server, chosen at startup; no per-call cluster or context |
| Transport | stdio by default. Keep HTTP on loopback, or put an authenticated, encrypted proxy that you operate in front of it. For a Unix socket, create the socket's parent as a private directory only your account can enter; the server deletes any file already at the socket path, so use a path that holds nothing else. Do not use /tmp. |
| Release records | Release history is stored in the release's namespace and is read with mcp-helm cli history; restrict read access with your cluster's access controls |
| Integers | Keep revision between 1 and 2147483647 and max_results between 0 and 2147483647 |
A failed or lost call can follow completed writes: inspect the release record, the real resources and any local files before you retry. See Troubleshooting.