8 safe-by-default MCP servers for infra — and the governance model behind them

Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of Model Context Protocol servers that share one safe-by-default governance model.

The problem

MCP lets an agent call tools. For infra, those tools can be delete_topic, DROP TABLE, delete_resource_group. The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you do need them. I wanted graduated, explicit control instead.

The governance model

Every server shares the same layered policy engine:

• Access modes — read-only → read-write → admin. Tools above the current mode are never even registered, so the model can't call what it can't see.
• Allowlists — scope to specific realms / namespaces / topics / databases / projects / subscriptions.
• Protected resources — system/prod resources (kube-system, the system DB, internal Kafka topics, the master realm) are readable but never mutable.
• Destructive gating — deletes need an explicit ALLOW_DELETE flag on top of admin mode.
• Typed confirmation — high-impact ops (delete a project / resource group) require a confirm value that echoes the exact target name. A boolean isn't enough.
• Secret redaction — credentials are stripped before anything reaches the model.
• Dry-run + audit — preview writes without executing; every guarded op emits a JSON audit line to stderr.

The servers

All MIT-licensed, TypeScript, published on npm as @dockndevai/mcp-*:

• mcp-kubernetes — pods, logs, deployments, scale/restart, apply, exec
• mcp-kafka — topics, consumer groups + lag, create/alter/reset
• mcp-clickhouse — schema, queries, SQL-classified read/write/destructive gating
• mcp-debezium — CDC connector status, config, lifecycle
• mcp-oci — Oracle Cloud discovery + Terraform generation
• mcp-azure — Azure Resource Manager inventory, tags, VM power, lifecycle
• mcp-azure-devops — boards, repos, pipelines, projects
• mcp-keycloak — realms, users, clients, roles, groups

Try one

npx -y @dockndevai/mcp-kubernetes

Or in Claude Code:

claude mcp add kubernetes -e KUBECONFIG_PATH=~/.kube/config -e K8S_MODE=read-only -- npx -y @dockndevai/mcp-kubernetes

Every repo has per-client setup for Claude, Cursor, Codex, VS Code, and Windsurf.

Repos: https://github.com/dockndevai

I'd love feedback — especially on whether the mode + typed-confirmation split is the right default for infrastructure MCP servers.