01 Install
Any of the three gives you the janus-mcp CLI.
uv tool install janus-mcp-server pipx install janus-mcp-server pip install janus-mcp-server
One-shot, no install: uvx janus-mcp-server serve. From a source checkout, clone the repo, run uv sync, and prefix every command with uv run.
02 Configure
mkdir -p ~/.config/janus-mcp cp examples/config.yaml ~/.config/janus-mcp/config.yaml $EDITOR ~/.config/janus-mcp/config.yaml
Two settings are required: the pinned context, matched exactly, and the namespaces that actually exist on that cluster.
context: my-context-name scope: allowed_namespaces: ["my-app"]
If your kubeconfig is not at ~/.kube/config, set kubeconfig: as well. Sanity-check before registering anything: janus-mcp serve should print any warnings and wait. It refuses to start with a clear message when the context is missing or permissions are absent. An over-privileged warning means the kubeconfig can read Secrets; janus-mcp never will, but the runbook has the least-privilege ServiceAccount setup.
03 Register with your client
All recipes use janus-mcp-server from PyPI. For a source checkout, replace it with janus-mcp and prefix with uv. Client config formats change; when in doubt check your client's own MCP docs.
{{ snippetCode }}
{{ snippetNote }}
04 Use it
Clients that support MCP resources can pin cluster://summary into context, in Claude Code by typing @ and picking it: a cached, sanitized one-screen health overview the model gets without spending a tool call.
For writes, if enabled in write_tools.enabled, the assistant proposes and you approve. Elicitation-capable clients show an approval card with live state. Others return status=pending with an approval id:
janus-mcp approvals # see what's pending janus-mcp approve <id> # approve it
Then tell the assistant to retry the same call.
05 Managed clusters: EKS, GKE, AKS
Nothing janus-specific to configure. Auth is whatever your kubeconfig says, including exec: credential plugins such as aws eks get-token, gke-gcloud-auth-plugin or kubelogin.
One real gotcha: GUI-launched MCP hosts spawn the server with a minimal PATH, so a kubeconfig that says command: aws can fail with "executable not found" even though it works in your terminal. Use the absolute path to the plugin binary in users[].user.exec.command.
Cloud-targeting metadata such as node provider IDs, external IPs, cloud labels and IAM role annotations is masked by the redaction engine by default.