talkopsai/traefik-mcp-server repository overview

⁠Traefik MCP Server by TalkOps.ai⁠

Traefik MCP Server empowers AI assistants (like Claude, Cline, or your own agent) to autonomously manage your Kubernetes edge traffic seamlessly. Without writing any YAML, your AI can execute advanced Canary routing, enable zero-impact Shadow Traffic mirroring, and instantly apply resilient Middlewares like rate limits and circuit breakers. It also ships with an intelligent migration pipeline—automatically translating complex legacy NGINX configurations into pristine Traefik resources natively via the Model Context Protocol.

⁠✨ Features

• Automated NGINX Migrations: Convert legacy NGINX Ingress annotations directly to Traefik CRDs securely with built-in "Supervised Autonomy" to override breaking annotations on the fly.
• Effortless Traffic Splitting: Orchestrate weighted canary routes effortlessly.
• Shadow Testing / Mirroring: Copy production traffic to canary pods safely without impacting real user responses or latency.
• Instant App Protections: Attach rate limiters, circuit breakers, IP allowlists, and header manipulations as Traefik Middlewares instantaneously.
• Native TCP Routing: Manage non-HTTP routes simply and effectively, mapping custom ports via TCP Ingresses.
• Deep Network Insights: Expose live traffic weight topologies, middleware boundaries, and routing anomalies directly to the AI's context window.

⁠🚀 How to use this image

This Docker image is designed to be used as an MCP server. It requires access to your Kubernetes cluster via a kubeconfig file.

⁠Running Standalone (HTTP Transport)

Run the container mapping port 8769 so clients can connect locally:

docker run --rm -it \
  -p 8769:8769 \
  -v ~/.kube:/app/.kube:ro \
  -e K8S_KUBECONFIG=/app/.kube/config \
  talkopsai/traefik-mcp-server:latest

Then configure your MCP client to connect over HTTP/SSE:

{
  "mcpServers": {
    "traefik": {
      "url": "http://localhost:8769/mcp",
      "description": "MCP Server for managing Traefik Edge Routing and Middlewares"
    }
  }
}

⁠Important: Kubeconfig Access

Cluster access is entirely handled via the mounted kubeconfig. Ensure your kubeconfig has appropriate RBAC permissions for Traefik CRDs (IngressRoute, Middleware, TraefikService, IngressRouteTCP, etc.) and native Kubernetes networking types (Ingress, Service).

⁠🛠️ Configuration (Claude Desktop - Stdio)

To use this image securely over stdio transport directly inside Claude Desktop, format the invocation like this:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "traefik-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-v", "/Users/YOUR_USERNAME/.kube:/app/.kube:ro",
        "-e", "K8S_KUBECONFIG=/app/.kube/config",
        "-e", "K8S_CONTEXT=production-cluster",
        "-e", "MCP_TRANSPORT=stdio",
        "-e", "MCP_LOG_LEVEL=INFO",
        "-e", "MCP_ALLOW_WRITE=true",
        "talkopsai/traefik-mcp-server:latest"
      ]
    }
  }
}

Replace /Users/YOUR_USERNAME/.kube with your actual kubeconfig path (e.g. C:\Users\YourUser\.kube on Windows).

⁠⚙️ Environment Variables

The image supports several environment variables for cluster access and advanced configuration:

⁠🔐 Security Best Practices

1. RBAC Least Privilege: Ensure the kubeconfig identity has only the permissions needed for Traefik traffic management. Avoid blanket cluster-admin if not necessary.
2. Read-Only Mount: Always mount kubeconfig with :ro so the container cannot modify your credentials.
3. Namespace Isolation: Use K8S_CONTEXT and namespace-scoped RBAC to limit the AI to specific clusters or namespaces.
4. Agentic Controls: Always begin working with MCP_ALLOW_WRITE=false to test generation offline via action=generate before trusting your Agent with live cluster-mutating workflows.

⁠🔗 Links and Resources

• Documentation: Traefik MCP Server Documentation⁠
• Source Code: GitHub Repository⁠
• Model Context Protocol: MCP Official Site⁠
• Traefik Docs: Traefik Official Documentation⁠
• Report Issues: GitHub Issues⁠

If you find this MCP server useful, consider leaving a ⭐ on the GitHub repository⁠!