mcp-sre-tools, an OpenShift MCP server wired into Claude Desktop and n8n, ships with nine read-only diagnostic tools and zero write paths. The team's write-access remediation mode stalled on a specific RBAC gap: Secrets access breaks namespace-scoped sandboxing.
Key facts
- Nine diagnostic tools ship in mcp-sre-tools
- READ_ONLY_MODE is on by default; zero write tools
- Kill switch and rollback automation never built
- No default rbac.yaml ships; teams write their own
- Server covers ARO, ROSA HCP, OSD-GCP clusters
The team behind mcp-sre-tools, a Model Context Protocol server exposing OpenShift and Kubernetes diagnostics to LLMs, shipped a deliberately read-only system. According to the project write-up, the server covers ARO, ROSA HCP, OSD-GCP, and generic clusters with nine diagnostic tools: get_cluster_health, diagnose_crashloop, get_failing_pods, and others in that family. READ_ONLY_MODE is on by default, and there are no write tools in the codebase at all.
The friction began when the team scoped a remediation mode where the agent would patch broken deployments, not just diagnose them. Platform engineers and developers split on trust: developers were comfortable treating agent-proposed changes like a colleague's pull request, while platform engineers objected that an LLM's proposed patch lacks the inspectable reasoning trail of a code review comment. Business stakeholders worried about an autonomous agent breaking critical production applications.
The RBAC hole
The instinctive answer is namespace-scoped RBAC: bind the agent's service account to a Role/RoleBinding, grant patch permissions on Deployments, and operate inside a fence. The team found that fence has a hole. Meaningful remediation eventually needs to touch Secrets or environment variables — a misconfigured database connection string, an expired credential reference, a missing env var causing a crash loop. The moment remediation scope includes Secrets, namespace-scoped RBAC stops being clean sandboxing and becomes a much larger trust surface.
The team fell back to a narrower, defensible justification for read-only: even without write access, a diagnostic agent cuts human mean-time-to-resolution. It is a smaller value proposition than full self-healing, but one they could defend without hand-waving.
The paper-only architecture
The proposed write-access flow is a maturity-gated design that was never implemented. It routes agent-proposed, RBAC-scoped remediation actions through risk-based routing: low-risk actions get lighter review, high-risk actions route to human approval. A kill-switch check precedes execution, a full audit record is captured, and a pre-captured rollback plan must exist before the action runs. Two components were never built: the kill switch and the rollback automation. The repo intentionally ships without a default rbac.yaml, leaving deployment teams to write their own scoped ClusterRole/RoleBinding tailored to their access model.
The structural lesson here extends beyond this one server. The MCP ecosystem, standardized by Anthropic in November 2024, has produced hundreds of read-only tool servers; the write-access problem is where the industry's safety rhetoric meets reality. This team's honest accounting — that the hard parts remain on paper — is more useful than the typical vendor demo of an agent patching a staging cluster. The failure mode they identified, an agent recommending a correct-looking fix built on stale, deprecated config, is precisely what a forward-pass reasoning trail cannot surface.
Key Takeaways
- An OpenShift MCP server shipped read-only with nine diagnostic tools after write-access remediation hit an RBAC wall: Secrets break namespace scoping.
- Kill switch and rollback remain paper designs.
What to watch
Watch whether the team ships a write-capable remediation mode with the kill switch and rollback automation actually implemented. More broadly, watch whether MCP tool servers begin shipping with write access and real rollback defaults, or whether the read-only ceiling becomes the de facto standard for production infrastructure agents.
Source: dev.to
