Model Context Protocol (MCP)

The Model Context Protocol (MCP) is an open standard that lets an AI assistant call tools and read data from external systems. An MCP server exposes what a system can do as a set of named tools with typed inputs. An MCP client, built into assistants such as Claude Code, Claude Desktop, and Cursor, lets the model discover those tools and call them. For infrastructure teams, MCP is how an AI agent gets from "explain this" to "do this" against a real cluster, a scheduler, or a cloud account.

How MCP works

An MCP server is a small program that speaks the protocol over one of two transports. Over stdio, the client spawns the server as a child process and the two exchange messages on standard input and output, which is the usual arrangement when the agent and the server run on the same machine. Over HTTP, the server listens on an address and clients connect to it, which suits an agent that runs somewhere else. That connection needs authentication, either a bearer token the server checks itself or a proxy in front of it.

When a client connects, the server lists its tools. Each tool has a name, a description the model reads, and an input schema. The model decides to call a tool, the client sends the call, the server does the work and returns a result, and the result goes back into the model's context. Servers can also expose resources (data the model can read) and prompts (templates the client can offer), but tools are what make MCP matter for operations.

MCP for infrastructure

A Kubernetes MCP server turns the cluster API into tools: list pods, read logs, describe a node, apply a manifest, scale a deployment. Several exist. The Kubernetes MCP Server project runs against any Kubernetes or OpenShift cluster as a separate component, with a read-only mode and a list of denied resource types. Frameworks such as kagent ship their own MCP toolbox for the agents they run. CIQ Stratum Pro has one built in: stratum mcp, which ships in CIQ Stratum Kubernetes Engine (SKE), the engine CIQ Stratum Pro is built on. The agent interface comes with the cluster.

CIQ products use MCP at two layers. Fuzzball, the HPC and AI workflow orchestrator, has an MCP server pointed at the workload: an agent inspects an environment and drafts, submits, and monitors workflows, with explicit permission required for writes, runs, and deletes. CIQ Stratum Pro points its MCP server at the cluster itself. A team running both gets agent access to the cluster and to the computational work on it.

What makes an MCP server safe to turn on

The protocol doesn't decide which tools a server exposes or what those tools may touch, so each server's design decides what an agent can do.

• Tiers set at startup. The MCP server in CIQ Stratum Pro registers only read tools unless it is started with --allow-write or --allow-destructive, and tools above the enabled tier are never registered, so the client cannot see them.
• A least-privilege credential. The server should run as its own service account that cannot read Secrets or write role bindings. The tiers decide what is offered; RBAC is the boundary.
• Hard refusals. Operations that should never be reachable through an agent, such as Secret reads and RBAC writes, should be refused at every tier regardless of the credential.
• Untrusted-data fencing. Tool results carry text the model did not write, and some of it may be written to steer the model: a pod log, an annotation, a ConfigMap value. A server that wraps every result in untrusted-data markers with a per-call random id lets the client tell cluster output from its own instructions. This is the main defense against prompt injection through infrastructure.
• No passthrough. A server that forwards arbitrary kubectl or shell commands has no tier at all. Named tools with schemas are what make the permission model real.

MCP and agentic Kubernetes

In agentic Kubernetes, MCP is how an agent operating a cluster issues its actions. The server a cluster offers, and how it's built, decide whether you can hand an agent a triage task or have to keep it away from production. Our guide to letting an AI agent operate a cluster safely with CIQ Stratum Pro covers the service account, the read tier, and when to switch writes on.