MCP Kubectl problems and fixes

Check the selected kubeconfig and, inside a pod, the mounted service-account credentials. Set KUBECONFIG to the intended valid file or provide ~/.kube/config, then retry mcp-kubectl cli config current-context. Even local CLI commands need usable client configuration; top-level help, version and completion can inspect the executable without it.

Check the namespace and the identity selected when the server started. Restart that server after changing context and pass the intended namespace explicitly. Pod and deployment tools use the configured namespace by default; resource summary instead uses default when its namespace is omitted.

get -A currently sends common namespaced reads to default. Check a known object with its explicit authorized namespace and repeat for each namespace you need. An unqualified summary or this flag does not establish complete cluster coverage.

run --dry-run and autoscale --dry-run still create resources. Inspect the exact named target and involve its owner before cleanup. For a preview-only manifest task use the documented apply --dry-run client|server modes; do not assume other commands share that behavior.

Check with mcp-kubectl cli top nodes, which exposes the metrics error. Optional health metrics can be omitted when unavailable or denied. Repair metrics-server access or the required permissions before relying on those measurements.

Check the denied verb, resource and namespace with a specific authorization query, such as mcp-kubectl cli auth can-i list pods -n prod. Request the missing permission through your cluster owner. Resource summary also reports zero when a list request fails, so read the affected resource type directly. auth reconcile does not apply permission changes in this release.

Compare total nodes with ready and not-ready counts. Nodes without status or conditions enter neither count, and an empty list can be labeled healthy. Read the intended node directly and verify the application separately before declaring recovery.

Check how much data the call requests. These calls have a fixed 60-second deadline: narrow the namespace and, for pod status, provide pod_name. The client cannot raise this limit.

Check the pod’s default-container annotation. Without -c, its valid named container or the first regular container is used. Pass -c <container> explicitly or correct the annotation before retrying.

Check the complete --for expression: use create, delete, condition=<name>[=<value>] or jsonpath=<expression>[=<value>]. Quote JSONPath expressions and allow enough time for all requested names; repeated conditions must all pass. Deletion wait requires NotFound, not a permission error.

Check the supported action and retained revision history for that workload kind. Use a fresh rollout status read and the application’s health check after the action. Replica counts alone do not establish rollout completion.

Check remote tar support, destination access and the remote exit status. Verify copied files at the destination; preserve both output streams for a failed command. For forwarding, use a supported pod or service target, check the allocated local port, and reconnect after the selected pod is replaced.

Inspect the named target before retrying. replace deletes and recreates even without --force; an error after deletion can leave the resource absent, and the fixed pause does not wait for finalizers. Confirm deletion with an authorized named-object read or record that verification is unavailable.

Compare the explicit command namespace with the namespaced object’s own namespace. Correct them to the intended target rather than removing scope blindly. Cluster-scoped objects follow their own scope.

Check for a local directory containing kustomization.yaml and local resource files. Remote URLs are not downloaded; use a reviewed local copy and unified patches. Inspect the rendered objects before applying them.

Check that neither the wrapper nor logging writes diagnostics into the protocol stream. Leave MAIT_LOG_FORMAT unset and keep stderr separate from stdout; for example, mcp-kubectl serve 2>mcp-kubectl.log captures diagnostics separately.

Check which completion command generated the script. Use top-level mcp-kubectl completion <shell>; the cli completion variant omits the required cli prefix from its suggestions.

Check whether you are using the proxy placeholder. It prints settings without opening a listener. Use a separately supported and authorized API access path; changing firewall rules will not make this command serve requests.