The latest articles on DEV Community by Ankit Verma (@dockndevai). https://dev.to/dockndevai https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4090691%2F3aebacd1-e265-44ab-b11a-572397751831.png https://dev.to/dockndevai en Ankit Verma Sun, 23 Aug 2026 16:26:47 +0000 https://dev.to/dockndevai/8-safe-by-default-mcp-servers-formcp-ai-devops-opensource-infra-and-the-governance-model-4gi8 https://dev.to/dockndevai/8-safe-by-default-mcp-servers-formcp-ai-devops-opensource-infra-and-the-governance-model-4gi8 <p>Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of <a href="https://modelcontextprotocol.io" rel="noopener noreferrer">Model Context Protocol</a> servers that share one safe-by-default governance model.</p> <h2> The problem </h2> <p>MCP lets an agent call tools. For infra, those tools can be <code>delete_topic</code>, <code>DROP TABLE</code>, <code>delete_resource_group</code>. The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you <em>do</em> need them. I wanted graduated, explicit control instead.</p> <h2> The governance model </h2> <p>Every server shares the same layered policy engine:</p> <ul> <li> <strong>Access modes</strong> — <code>read-only</code> → <code>read-write</code> → <code>admin</code>. Tools above the current mode are <em>never even registered</em>, so the model can't call what it can't see.</li> <li> <strong>Allowlists</strong> — scope to specific realms / namespaces / topics / databases / projects / subscriptions.</li> <li> <strong>Protected resources</strong> — system/prod resources (kube-system, the <code>system</code> DB, internal Kafka topics, the master realm) are readable but never mutable.</li> <li> <strong>Destructive gating</strong> — deletes need an explicit <code>ALLOW_DELETE</code> flag on top of admin mode.</li> <li> <strong>Typed confirmation</strong> — high-impact ops (delete a project / resource group) require a <code>confirm</code> value that echoes the exact target name. A boolean isn't enough.</li> <li> <strong>Secret redaction</strong> — credentials are stripped before anything reaches the model.</li> <li> <strong>Dry-run + audit</strong> — preview writes without executing; every guarded op emits a JSON audit line to stderr.</li> </ul> <h2> The servers </h2> <p>All MIT-licensed, TypeScript, published on npm as <code>@dockndevai/mcp-*</code>:</p> <ul> <li> <strong>mcp-kubernetes</strong> — pods, logs, deployments, scale/restart, apply, exec</li> <li> <strong>mcp-kafka</strong> — topics, consumer groups + lag, create/alter/reset</li> <li> <strong>mcp-clickhouse</strong> — schema, queries, SQL-classified read/write/destructive gating</li> <li> <strong>mcp-debezium</strong> — CDC connector status, config, lifecycle</li> <li> <strong>mcp-oci</strong> — Oracle Cloud discovery + Terraform generation</li> <li> <strong>mcp-azure</strong> — Azure Resource Manager inventory, tags, VM power, lifecycle</li> <li> <strong>mcp-azure-devops</strong> — boards, repos, pipelines, projects</li> <li> <strong>mcp-keycloak</strong> — realms, users, clients, roles, groups</li> </ul> <h2> Try one </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>npx -y @dockndevai/mcp-kubernetes </code></pre> </div> <p>Or in Claude Code:</p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>claude mcp add kubernetes -e KUBECONFIG_PATH=~/.kube/config -e K8S_MODE=read-only -- npx -y @dockndevai/mcp-kubernetes </code></pre> </div> <p>Every repo has per-client setup for Claude, Cursor, Codex, VS Code, and Windsurf.</p> <p>Repos: <a href="https://github.com/dockndevai" rel="noopener noreferrer">https://github.com/dockndevai</a></p> <p>I'd love feedback — especially on whether the mode + typed-confirmation split is the right default for infrastructure MCP servers.</p> mcp ai devops opensource