Developer ships eight safe-by-default MCP servers with shared governance for infra

A developer publishing as dockndevai has released eight Model Context Protocol (MCP) servers for infrastructure work, all built on a single shared governance model designed to make agent access to production systems safe by default. According to the project's announcement on dev.to, the servers are written in TypeScript, MIT-licensed and published on npm under the @dockndevai/mcp-* scope, covering Kubernetes, Kafka, ClickHouse, Debezium, Oracle Cloud, Azure, Azure DevOps and Keycloak.

The problem being solved

As the author frames it on dev.to, MCP tools for infrastructure inevitably include genuinely dangerous operations: deleting a Kafka topic, running a DROP TABLE, removing an entire cloud resource group. The standard mitigation is to withhold the risky tools entirely, but that leaves a server useless the moment a destructive action is genuinely required. The project's answer is a tiered set of controls that let an operator hand over more capability deliberately, instead of choosing between everything and nothing.

The governance model

Every server ships with the same layered policy engine, which the dev.to post breaks down into seven mechanisms:

• Access modes — a three-step ladder of read-only, read-write and admin. Tools above the active mode are never registered with the agent, so the model cannot invoke capabilities it has never been shown.
• Allowlists — operations can be scoped to particular realms, namespaces, topics, databases, projects or subscriptions.
• Protected resources — built-in system and production assets such as the kube-system namespace, a system database, internal Kafka topics or a master realm stay readable but permanently non-mutable.
• Destructive gating — deletes require an explicit ALLOW_DELETE flag on top of admin mode, making them a separate decision rather than a side effect of elevated access.
• Typed confirmation — high-impact operations like deleting a project or resource group require a confirm value that echoes the exact target name; a plain boolean will not do.
• Secret redaction — credentials are stripped from data before anything reaches the model.
• Dry-run and audit — writes can be previewed without executing, and every guarded operation emits a JSON audit line to stderr.

The eight servers

Per the post, the family consists of:

• mcp-kubernetes — pods, logs, deployments, scale and restart, apply, exec
• mcp-kafka — topics, consumer groups and lag, create, alter and reset operations
• mcp-clickhouse — schema inspection and queries, with SQL classified into read, write and destructive tiers
• mcp-debezium — CDC connector status, configuration and lifecycle
• mcp-oci — Oracle Cloud discovery plus Terraform generation
• mcp-azure — Azure Resource Manager inventory, tags, VM power state and lifecycle
• mcp-azure-devops — boards, repos, pipelines and projects
• mcp-keycloak — realms, users, clients, roles and groups

Trying them out

Any server can be launched directly with npx — for example, npx -y @dockndevai/mcp-kubernetes. The post also shows registering the Kubernetes server in Claude Code with a K8S_MODE environment variable set to read-only, so the agent starts with the narrowest possible capability set. Each repository includes per-client setup instructions for Claude, Cursor, Codex, VS Code and Windsurf, and the source code lives under the dockndevai organisation on GitHub.

Why it matters

Handing an agent the keys to production infrastructure turns an ambiguous prompt into an operational incident, and the usual all-or-nothing approach to dangerous tools does not fit real workflows. Two design choices here stand out. First, unauthorised tools are hidden from the model entirely rather than merely denied: a model cannot attempt — or be tricked into attempting — a call it has never seen. Second, typed confirmation raises the bar above the boolean "are you sure?" pattern by demanding the exact target name, which makes accidental approvals structurally harder.

The project is a single developer's contribution rather than an established standard, and the author is explicitly inviting feedback on whether the mode-plus-typed-confirmation split is the right default for infrastructure MCP servers. As agentic operations move from demos toward production, though, the pattern on display — capability ladders, protected resources, secret redaction and audit logging baked into every server — offers a concrete template for anyone exposing infrastructure to an AI agent.