mcp:readreaches every read-only tool, plus a curated set of safe creations (ephemeral workspace operations and throwaway pull request demos) that cannot damage existing infrastructure.mcp:writeadds the mutating tools - everything markedmcp:writebelow. Write access implies the read surface.
cluster_id argument (a UUID); call list_clusters first to discover IDs. Ankra verifies the cluster belongs to the token’s organisation before dispatch. Tools that are not cluster-scoped operate at the organisation level.
Creating a credential is deliberately not available over MCP or chat. Creating one would mean passing the secret itself as a tool argument, and Ankra refuses mutating tool calls whose parameters contain literal secrets. Create credentials in the portal or CLI; over MCP you can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan or apply a GitHub credential rotation.
Clusters & Kubernetes
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_clusters | mcp:read | No | List every cluster in the organisation with state, environment, and Kubernetes version |
get_cluster_details | mcp:read | No | Detailed information about one cluster by name or ID |
get_cluster_attention_summary | mcp:read | No | The exact signals behind a cluster’s Needs Attention badge |
get_cluster_status | mcp:read | Yes | Cluster health overview |
get_cluster_snapshot | mcp:read | Yes | Full cluster overview in a single call |
get_cluster_cost | mcp:read | Yes | Estimated cloud infrastructure cost for the cluster |
get_stack_cost | mcp:read | Yes | Estimated cost attributed to one Stack, derived from its namespaces |
get_security_reports | mcp:read | Yes | Trivy Operator image-vulnerability summary |
get_cluster_bastion | mcp:read | Yes | Public IP of the Ankra-managed bastion/gateway host |
list_namespaces | mcp:read | Yes | List namespaces with their status |
get_resource_quotas | mcp:read | Yes | Resource quotas and current usage per namespace |
list_recent_executions | mcp:read | Yes | Recent platform executions (deployments, write operations) |
get_execution_details | mcp:read | Yes | Full details for one execution, including steps and error excerpts |
cluster_query | mcp:read | Yes | Structured lookup against the live cluster resource index |
cluster_search | mcp:read | Yes | Full-text search over the live cluster resource index |
cluster_describe | mcp:read | Yes | Full body of one named resource from the live cluster index |
get_pods | mcp:read | Yes | Pod status, restarts, and placement, with namespace/name/label filters |
get_pod_logs | mcp:read | Yes | Logs from a specific pod |
get_deployments | mcp:read | Yes | Deployment information |
get_statefulsets | mcp:read | Yes | StatefulSet information |
get_daemonsets | mcp:read | Yes | DaemonSet information |
get_services | mcp:read | Yes | Service information |
get_ingresses | mcp:read | Yes | Ingress information |
get_events | mcp:read | Yes | Kubernetes events (Normal/Warning) |
get_nodes | mcp:read | Yes | Node information |
get_configmaps | mcp:read | Yes | ConfigMap information |
get_secrets | mcp:read | Yes | Secret metadata (never secret values) |
get_jobs | mcp:read | Yes | Job information |
get_cronjobs | mcp:read | Yes | CronJob information |
get_pvcs | mcp:read | Yes | PersistentVolumeClaim information |
get_cluster_role_bindings | mcp:read | Yes | ClusterRoleBindings and RoleBindings for RBAC analysis |
describe_resource | mcp:read | Yes | Detailed YAML/JSON for one Kubernetes resource |
describe_resources | mcp:read | Yes | Batch-fetch multiple Kubernetes resources in one call |
restart_deployment | mcp:write | Yes | Rolling restart of a deployment |
scale_deployment | mcp:write | Yes | Scale a deployment to a replica count |
scale_statefulset | mcp:write | Yes | Scale a StatefulSet to a replica count |
delete_pod | mcp:write | Yes | Delete a specific pod |
delete_resource | mcp:write | Yes | Delete any Kubernetes resource, including custom resources |
apply_manifest | mcp:write | Yes | Apply a Kubernetes manifest to create or update resources |
patch_resource | mcp:write | Yes | Patch a Kubernetes resource (strategic merge or JSON patch) |
add_helm_registry | mcp:write | No | Add a Helm chart registry to the organisation’s catalog |
Stacks
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_stacks | mcp:read | Yes | List the cluster’s Stacks with their add-ons, manifests, and state |
get_stack_details | mcp:read | Yes | One Stack in full, including add-on and manifest configuration |
get_stack_history | mcp:read | Yes | Version history: who changed what and when, per resource |
get_stack_deployments | mcp:read | Yes | Deployment status grouped per resource, with failure detail |
export_cluster_iac | mcp:read | Yes | Export the cluster’s Stacks as an Infrastructure-as-Code YAML document |
validate_stack | mcp:read | Yes | Validate a Stack specification without applying it |
list_available_charts | mcp:read | No | Browse the Helm chart catalog with search and category filters |
create_stack | mcp:write | Yes | Create a new Stack on the cluster |
update_stack | mcp:write | Yes | Update a Stack’s add-ons, manifests, or configuration |
rename_stack | mcp:write | Yes | Rename a Stack |
redeploy_stack | mcp:write | Yes | Re-deploy a Stack to reconcile it onto the cluster |
clone_stack | mcp:write | Yes | Clone a Stack within or across clusters |
addon_install | mcp:write | Yes | Install a chart from the catalog into a Stack |
delete_stack | mcp:write | Yes | Delete an entire Stack and everything it deployed |
uninstall_addon_from_stack | mcp:write | Yes | Uninstall one add-on from a deployed Stack |
disconnect_manifest_from_stack | mcp:write | Yes | Remove a manifest from a deployed Stack |
list_stack_profiles | mcp:read | No | List reusable stack profiles, including public ones |
get_stack_profile | mcp:read | No | A stack profile’s metadata, version history, and contents |
create_stack_profile | mcp:write | Yes | Save a deployed Stack as a new reusable stack profile |
save_stack_profile_version | mcp:write | Yes | Snapshot a deployed Stack as a new version of an existing profile |
update_stack_profile | mcp:write | Yes | Update a stack profile’s metadata |
delete_stack_profile | mcp:write | Yes | Delete a stack profile and all its versions |
instantiate_stack_profile | mcp:write | Yes | Instantiate a stack profile onto the cluster |
Add-ons
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_addons | mcp:read | Yes | List installed add-ons with sync status, health, and version |
get_addon_details | mcp:read | Yes | One add-on in detail, including its resource tree |
get_addon_status | mcp:read | Yes | Status of the add-ons Ankra manages on the cluster |
get_addon_history | mcp:read | Yes | Deployment history: previous versions and sync operations |
get_addon_settings | mcp:read | Yes | An add-on’s settings (chart version, namespace, sync options) |
get_addon_configuration | mcp:read | Yes | An add-on’s Helm values, with secret values redacted |
sync_addon | mcp:write | Yes | Trigger a sync to apply pending changes from the source repository |
rollback_addon | mcp:write | Yes | Roll an add-on back to a previous deployment version |
update_addon_settings | mcp:write | Yes | Update an add-on’s settings |
update_addon_configuration | mcp:write | Yes | Update an add-on’s Helm values |
Applications
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_applications | mcp:read | No | List the organisation’s applications with state and analysis status |
get_application | mcp:read | No | One application’s repository, artifacts, pull request, and lifecycle state |
get_application_jobs | mcp:read | No | The platform jobs behind an application’s analysis and generation |
get_application_deployments | mcp:read | No | Where an application is deployed and its readiness |
list_application_installations | mcp:read | No | List the installations of an application across clusters |
list_application_workflow_runs | mcp:read | No | CI workflow runs for an application’s repository |
get_application_workflow_run_jobs | mcp:read | No | Jobs and step detail for one application workflow run |
create_application | mcp:write | No | Connect a repository as a new application and start analysis |
deploy_application | mcp:write | No | Deploy an application onto a cluster as part of a Stack |
retry_application | mcp:write | No | Re-run analysis and generation after a failure |
reconcile_application | mcp:write | No | Re-evaluate an application against its repository and refresh its state |
rerun_application_workflow | mcp:write | No | Re-run a CI workflow run for an application |
delete_application | mcp:write | No | Disconnect an application from Ankra |
Credentials
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_credentials | mcp:read | No | List every credential across all providers, with availability and sync state |
get_credential | mcp:read | No | One credential’s identity, availability, and dependents - secret fields are always redacted |
validate_credential_name | mcp:read | No | Check whether a credential name is valid and free to use |
get_github_credential_usages | mcp:read | No | Everything that depends on a GitHub credential |
verify_github_credential | mcp:read | No | Probe a GitHub App credential’s installation and report each check |
get_github_credential_activity | mcp:read | No | Recent GitHub App installation activity events for a credential |
plan_github_credential_replacement | mcp:read | No | Build the plan for rotating a deprecated GitHub OAuth credential to a GitHub App credential |
list_provider_credentials | mcp:read | No | List cloud provider and SSH key credentials |
list_gitops_credentials | mcp:read | No | List GitHub credentials available for GitOps |
list_gitops_repositories | mcp:read | No | List repositories reachable under a GitHub credential |
delete_credential | mcp:write | No | Delete a credential that is not in use |
replace_github_credential | mcp:write | No | Apply a planned GitHub credential rotation (organisation admins only) |
GitOps
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_gitops_conflicts | mcp:read | No | Open GitOps merge conflicts: resources changed in both Git and the cluster |
get_gitops_conflict_diff | mcp:read | No | The Git, cluster, and base sides of one conflict, with secrets redacted |
resolve_gitops_conflict | mcp:write | No | Resolve one GitOps merge conflict by picking the winning side |
Source Control & Workspaces
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
github_list_repositories | mcp:read | No | List GitHub repositories the connected account can reach |
github_list_repository_files | mcp:read | No | List files and directories in a repository |
github_read_file | mcp:read | No | Read one file from a repository |
github_list_workflow_runs | mcp:read | No | Recent GitHub Actions workflow runs for a repository |
github_get_workflow_run_jobs | mcp:read | No | Jobs and step-level detail for one workflow run |
github_get_job_logs | mcp:read | No | Log output for one GitHub Actions job |
github_list_artifacts | mcp:read | No | GitHub Actions artifacts for a repository |
github_download_artifact | mcp:read | No | Download and read the contents of an artifact |
github_commit_files | mcp:write | No | Commit one or more files to a repository |
github_create_pull_request | mcp:write | No | Create a pull request with file changes |
scm_create_pull_request | mcp:write | No | Open a pull request on a GitHub repository - the pull request itself is the review gate |
workspace_search_code | mcp:read | No | Search an application’s source repository from an ephemeral, locked-down workspace |
workspace_read_file | mcp:read | No | Read one file from an application’s source repository via an ephemeral workspace |
workspace_list_files | mcp:read | No | List an application repository’s files via an ephemeral workspace |
deploy_pr_demo | mcp:read | No | Deploy a throwaway, time-limited demo of a pull-request build into an isolated namespace |
demo_stop | mcp:read | No | Tear down a pull-request demo |
Observability & Alerts
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_alerts | mcp:read | No | The organisation’s alert definitions, firing state, and alert metrics |
query_prometheus | mcp:read | Yes | PromQL instant query against the cluster’s Prometheus |
query_prometheus_range | mcp:read | Yes | PromQL range query over a time window |
Provisioning & Nodes
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_instance_types | mcp:read | No | Instance types and pricing per cloud provider |
list_proxmox_options | mcp:read | No | Provisioning options a Proxmox VE credential can reach |
list_morpheus_options | mcp:read | No | Provisioning options an HPE Morpheus credential can reach |
create_hetzner_cluster | mcp:write | No | Create and provision a Kubernetes cluster on Hetzner Cloud |
create_ovh_cluster | mcp:write | No | Create and provision a Kubernetes cluster on OVHcloud |
create_upcloud_cluster | mcp:write | No | Create and provision a Kubernetes cluster on UpCloud |
create_digitalocean_cluster | mcp:write | No | Create and provision a Kubernetes cluster on DigitalOcean |
create_proxmox_cluster | mcp:write | No | Create and provision a Kubernetes cluster on Proxmox VE |
create_morpheus_cluster | mcp:write | No | Create and provision a Kubernetes cluster on HPE Morpheus |
list_cluster_nodes | mcp:read | No | The provisioned VM nodes of a cluster, with live provider status |
restart_node | mcp:write | No | Restart one provisioned node - control plane, worker, or bastion |
ssh_diagnose_node | mcp:read | No | Diagnose a node at the OS level over SSH via the bastion |
ssh_repair_node | mcp:write | No | Repair a node’s Kubernetes service unit through the node-recovery engine |
Cluster Lifecycle & Node Groups
Day-2 operations for Ankra-provisioned clusters on every self-managed provider (Hetzner, OVHcloud, UpCloud, DigitalOcean, Scaleway, Proxmox VE, HPE Morpheus). These tools acceptcluster_name or cluster_id directly, so they work from any conversation.
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_node_groups | mcp:read | No | Node groups, control plane topology, and worker counts for one cluster |
scale_workers | mcp:write | No | Scale the default worker pool, or one named node group |
add_node_group | mcp:write | No | Add a node group with instance type, count, and optional labels, taints, and autoscaling |
update_node_group | mcp:write | No | Change one aspect of a node group: instance type, autoscaling bounds, labels, or taints |
delete_node_group | mcp:write | No | Delete a node group and its nodes |
change_control_plane | mcp:write | No | Change the control plane’s node count or instance type (cluster must be stopped) |
stop_cluster | mcp:write | No | Stop a cluster: its virtual machines are terminated while configuration is preserved |
start_cluster | mcp:write | No | Start (re-provision) a stopped cluster, optionally control plane only |
upgrade_cluster | mcp:write | No | Upgrade the cluster’s Kubernetes version |
delete_cluster | mcp:write | No | Deprovision a cluster entirely; requires re-typing the cluster name to confirm |
Managed Kubernetes
Create and operate provider-managed control planes - EKS (AWS), AKS (Azure), GKE (Google Cloud), DOKS (DigitalOcean), UKS (UpCloud), OVHcloud MKS, and Kapsule (Scaleway).| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_managed_k8s_options | mcp:read | No | Regions, versions, and machine sizes a credential can deploy; per-cluster options and available upgrades |
create_managed_cluster | mcp:write | No | Create a managed Kubernetes cluster with one or more node pools |
list_managed_node_pools | mcp:read | No | Node pools of a managed cluster with counts and autoscaling state |
add_managed_node_pool | mcp:write | No | Add a node pool with size, count, and optional autoscaling |
update_managed_node_pool | mcp:write | No | Update a node pool’s count or autoscaling configuration |
delete_managed_node_pool | mcp:write | No | Delete a node pool |
upgrade_managed_cluster | mcp:write | No | Upgrade a managed cluster’s Kubernetes version |
stop_managed_cluster | mcp:write | No | Stop a managed cluster through provider-native power control when supported (AKS today) |
start_managed_cluster | mcp:write | No | Start a stopped managed cluster through provider-native power control when supported |
CI/CD & Deploy Analysis
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
cicd_propose_application_pipeline | mcp:read | No | Render the canonical Ankra CI/CD pipeline for a target repository |
cicd_validate_workflow_yaml | mcp:read | No | Validate a GitHub Actions workflow against Ankra’s platform invariants |
cicd_validate_chart_values | mcp:read | No | Validate Helm chart values against Ankra’s Kubernetes security defaults |
deploy_inspect_chart_values | mcp:read | Yes | Probe a chart’s values for the paths the deploy wizard cares about |
deploy_inspect_repo | mcp:read | Yes | Inspect key repository files for the application’s runtime needs |
deploy_finalize_analysis | mcp:read | Yes | Finalise a deploy analysis with the full analysis payload |
Tickets & Collaboration
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
ticket_list | mcp:read | No | List the organisation’s AI work board tickets |
ticket_get | mcp:read | No | One ticket in full: plan, review state, timeline, and links |
file_ticket | mcp:write | No | File a new ticket on the AI work board |
ticket_comment | mcp:write | No | Post a comment on a ticket |
ticket_update_status | mcp:write | No | Move a ticket through its lifecycle |
ticket_draft_plan | mcp:write | No | Write or revise a ticket’s plan document |
ticket_request_review | mcp:write | No | Ask for a review of the ticket’s drafted plan |
ticket_submit_review | mcp:write | No | Deliver a peer-review verdict on a ticket’s plan |
ticket_attach_demo | mcp:write | No | Attach a demo environment to a ticket |
Memory & Miscellaneous
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
search_memories | mcp:read | No | Search past conversation memories for relevant context |
save_memory | mcp:write | No | Save a fact, decision, or preference to long-term memory |
web_fetch | mcp:read | No | Fetch content from a public HTTPS URL as readable text |
Related
- MCP Server - endpoint, tokens, and client setup
- AI Assistant - the same tools in the product chat
- API Tokens