Eks Mcp Server

EKS MCP Server Setup

This skill helps you configure the EKS MCP Server to enable live EKS cluster operations through your AI assistant.

When to Use This Skill

Don't use this skill for:

• Operational cluster work (listing resources, troubleshooting pods, reading K8s state) — use the EKS MCP tools directly once configured
• EKS concept questions — use the other EKS skills

Quick Check: Is EKS MCP Already Configured?

Before proceeding with setup, check if EKS MCP tools are already available:

1. Look for MCP tools in your current environment starting with eks or mcp__eks 2. Try a simple command: Ask to list EKS clusters — if it works, you're already set up

If MCP tools are available and working, skip this skill and proceed with your EKS task directly.

Choose Your Setup Option

Decision Guide

• Choose AWS-Hosted if: You have AWS credentials, want zero maintenance, need CloudTrail audit logging
• Choose Self-Hosted if: You need OIDC/kubeconfig auth, air-gapped environment, or want to run locally without AWS IAM

Setup Instructions

Setup instructions are in separate reference files to avoid loading unnecessary content:

• AWS-Hosted setup: See references/aws-hosted-setup.md
• Self-Hosted setup: See references/self-hosted-setup.md

Read the appropriate reference file based on the user's chosen option, then guide them through configuration.

After Setup

Once the MCP server is configured:

1. Restart your AI assistant (IDE, CLI, or extension) to load the new MCP tools 2. Verify connection: Ask to list EKS clusters or available MCP tools 3. Start using EKS tools: The MCP server provides tools for cluster management, K8s resources, troubleshooting, and observability

This skill's job is done once setup is complete. Hand off to the EKS MCP tools for actual cluster operations.

AWS-Hosted EKS MCP Server Setup

Part of: eks-mcp-server

Note: The AWS-Hosted EKS MCP Server is currently in preview.

The fully managed EKS MCP Server is hosted by AWS, providing enterprise-grade capabilities with zero local maintenance.

Prerequisites

• AWS account with EKS clusters
• AWS CLI installed and configured (aws configure list)
• Python 3.10+ (python3 --version)
• uv package manager (uv --version) — install via curl -LsSf https://astral.sh/uv/install.sh | sh

Step 1: Configure IAM Permissions

Attach the appropriate managed policy to your IAM role/user:

For read-only, attach via IAM console or CLI:

aws iam attach-user-policy --user-name YOUR_USER --policy-arn arn:aws:iam::aws:policy/AmazonEKSMCPReadOnlyAccess

Required IAM actions for the MCP proxy:

• eks-mcp:InvokeMcp — initialization and tool discovery
• eks-mcp:CallReadOnlyTool — read operations
• eks-mcp:CallPrivilegedTool — write operations (optional)

Step 2: Configure Your AI Assistant

Add the EKS MCP server to your assistant's MCP configuration. Replace {region} with your AWS region (e.g., us-west-2).

The same JSON below works for every supported assistant — only the config file path (or UI entry point) differs.

{
  "mcpServers": {
    "eks-mcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://eks-mcp.{region}.api.aws/mcp",
        "--service", "eks-mcp",
        "--region", "{region}"
      ]
    }
  }
}

Config File Locations by Assistant

Optional: Read-Only Mode

Add --read-only to args to disable write operations:

"args": [
  "mcp-proxy-for-aws@latest",
  "https://eks-mcp.{region}.api.aws/mcp",
  "--service", "eks-mcp",
  "--region", "{region}",
  "--read-only"
]

Optional: Multiple AWS Profiles

Specify a profile with --profile:

"args": [
  "mcp-proxy-for-aws@latest",
  "https://eks-mcp.{region}.api.aws/mcp",
  "--service", "eks-mcp",
  "--profile", "production",
  "--region", "{region}"
]

Windows Users

Use this format for the args array:

"args": [
  "--from", "mcp-proxy-for-aws@latest",
  "mcp-proxy-for-aws.exe",
  "https://eks-mcp.{region}.api.aws/mcp",
  "--service", "eks-mcp",
  "--region", "{region}"
]

Step 3: Verify Setup

1. Restart your AI assistant 2. Ask: "List my EKS clusters" or "What EKS MCP tools are available?"

Troubleshooting

References

• AWS EKS MCP Getting Started
• MCP Proxy for AWS

Self-Hosted EKS MCP Server Setup

Part of: eks-mcp-server

The open-source EKS MCP server from awslabs/mcp runs locally on your machine, providing full control over authentication and configuration.

Prerequisites

• Python 3.10+ (python3 --version)
• uv package manager (uv --version) — install via curl -LsSf https://astral.sh/uv/install.sh | sh
• For IAM mode: AWS CLI configured (aws configure list)
• For kubeconfig mode: Valid kubeconfig with cluster access

Authentication Modes

Step 1: Configure IAM (IAM Mode Only)

For IAM authentication, attach these permissions to your IAM role/user:

Read-Only Policy

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "eks:DescribeCluster",
      "eks:DescribeInsight",
      "eks:ListInsights",
      "ec2:DescribeVpcs",
      "ec2:DescribeSubnets",
      "ec2:DescribeRouteTables",
      "cloudformation:DescribeStacks",
      "cloudwatch:GetMetricData",
      "logs:StartQuery",
      "logs:GetQueryResults",
      "iam:GetRole",
      "iam:GetRolePolicy",
      "iam:ListRolePolicies",
      "iam:ListAttachedRolePolicies",
      "iam:GetPolicy",
      "iam:GetPolicyVersion",
      "eks-mcpserver:QueryKnowledgeBase"
    ],
    "Resource": "*"
  }]
}

Write Operations

For write access (cluster creation, deployments), also attach:

• IAMFullAccess
• AmazonVPCFullAccess
• AWSCloudFormationFullAccess
• EKS Full Access: "Action": "eks:*"

Step 2: Configure Your AI Assistant

Basic Configuration (IAM Mode)

{
  "mcpServers": {
    "awslabs.eks-mcp-server": {
      "command": "uvx",
      "args": [
        "awslabs.eks-mcp-server@latest",
        "--allow-write",
        "--allow-sensitive-data-access"
      ],
      "env": {
        "AWS_PROFILE": "default",
        "AWS_REGION": "us-west-2",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    }
  }
}

Kubeconfig Mode (OIDC/Non-IAM)

{
  "mcpServers": {
    "awslabs.eks-mcp-server": {
      "command": "uvx",
      "args": [
        "awslabs.eks-mcp-server@latest",
        "--allow-write",
        "--allow-sensitive-data-access"
      ],
      "env": {
        "EKS_AUTH_MODE": "kubeconfig",
        "KUBECONFIG": "~/.kube/config",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    }
  }
}

Note: In kubeconfig mode, AWS-specific tools are disabled:

• manage_eks_stacks (CloudFormation)
• get_cloudwatch_logs, get_cloudwatch_metrics
• get_eks_vpc_config, get_eks_insights
• get_policies_for_role, add_inline_policy

Read-Only Mode

Remove --allow-write and --allow-sensitive-data-access for safer operation:

"args": ["awslabs.eks-mcp-server@latest"]

Config File Locations by Assistant

Windows Users

Use this format for the args array:

"args": [
  "--from", "awslabs.eks-mcp-server@latest",
  "awslabs.eks-mcp-server.exe",
  "--allow-write",
  "--allow-sensitive-data-access"
]

Command-Line Arguments

To switch between IAM and kubeconfig auth, set the EKS_AUTH_MODE env var (see Environment Variables below) — the JSON examples above use this approach.

Environment Variables

Region pitfall: When used with the AWS-hosted proxy, mcp-proxy-for-aws signs SigV4 against us-west-2 by default while the proxy's --region flag falls back to us-east-1 when unset — always set --region (and AWS_REGION) explicitly to the region of your clusters to avoid a region-mismatch failure.

Step 3: Verify Setup

1. Restart your AI assistant 2. Ask: "List my EKS clusters" or "What tools are available?"

Available Tools

Always Available

• list_k8s_resources, manage_k8s_resource (supports create, read, update, delete operations — read replaces the older standalone read_k8s_resource tool)
• apply_yaml, generate_app_manifest
• get_pod_logs, get_k8s_events
• list_api_versions

IAM Mode Only

• manage_eks_stacks — CloudFormation cluster management
• get_cloudwatch_logs, get_cloudwatch_metrics — observability
• get_eks_vpc_config — VPC configuration
• get_eks_insights — upgrade readiness
• get_policies_for_role, add_inline_policy — IAM management
• search_eks_troubleshoot_guide — troubleshooting KB

Troubleshooting

References

• awslabs/mcp EKS Server
• EKS Access Entries