ProductsMCP
Governed tools for your own AI agents
Give AI agents governed access to your infrastructure.
Subnomic runs a remote Model Context Protocol server. Point Cursor, Claude Code or any MCP client at it with a credential you mint, and the agent can read your Kubernetes clusters, hosts and databases, and change them only if you allow it. Every call passes the same scopes, guardrails and records as a person’s.
- Endpoint
- app.subnomic.com/mcp
- Transport
- Streamable HTTP
- Credential
- scoped, expiring
- Plans
- Team · Enterprise
What it is
Your agent brings the model. Subnomic brings the rules.
An agent that helps with infrastructure needs to reach it, and the usual ways are a kubeconfig, an SSH key or a database password pasted into its configuration. Those carry everything their owner can do, they do not expire, and nothing records what the agent did with them.
The MCP server replaces them with one credential that names what the agent may do and where. Calls run through the outbound agent already on your hosts and clusters, so nothing new is opened in your network. The MCP surface runs no model of its own: the intelligence is your client’s, the permissions are yours.
- Capabilities you tick, from reading a cluster to running SQL, and nothing else.
- Targets you pick: these databases, servers, apps and clusters, not the rest of the workspace.
- An expiry of 7, 30, 90, 180 or 360 days. There is no credential without one.
- Never more than the person who minted it can do, checked again on every request, so a demoted author takes it down with them.
- Revoke it in the console and the next call fails.
Connect a client
A URL, a header, and a check that it answers.
Mint a credential
In the console, under Runa, create an MCP client: a name, capabilities, targets and an expiry. The token, subnomic_live_agt_…, is shown once and stored only as a hash. Owners and admins can mint one.
Add it to the client
Clients that take a remote URL and a header, such as Cursor and Claude Code, connect directly. A client that only starts local stdio servers can reach it through npx mcp-remote; the docs have that configuration.
Check what it sees
Ask for the tool list before wiring anything else in. The list holds only the tools the credential’s capabilities allow.
$ curl -s https://app.subnomic.com/mcp \
-H "Authorization: Bearer $SUBNOMIC_AGENT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'The endpoint speaks MCP over Streamable HTTP, protocol version 2025-06-18, as stateless JSON-RPC POSTs. It opens no server-sent event stream, so a client that only supports the older SSE transport cannot connect. How this differs from running an open-source Kubernetes MCP server yourself is in Kubernetes MCP servers compared.
What an agent can do
About eighty tools, offered by capability.
| Family | Tools, for example | Reads or changes |
|---|---|---|
| Kubernetes, observe | kube_list_resources, kube_describe, kube_events, kube_logs, kube_get, rollout_status, rollout_history | Reads |
| Investigate | investigate_resource, diagnose, crashloop_report, recent_changes | Reads |
| Security review | rbac_audit, secret_audit, exposure_audit, workload_security_audit, security_review | Reads |
| Databases | list_schemas, describe_table, query_database | Reads; maintenance or writes only with their own capability |
| Hosts and Docker | host_metrics, docker_logs, run_command | Reads; commands with agent.host_exec, each one guardrail-checked |
| Change workloads | rollout_restart, rollout_scale, rollout_set_image, kube_apply, kube_drain, docker_set_image | Changes, only with resource.write |
| Delete | kube_delete, docker_delete | Changes, only with resource.delete as well |
| Operate the workspace | run_workflow, declare_incident, resolve_alert, post_to_channel | Changes records, each with its own capability |
| Access | search_activity, request_access | Reads the log; files a request a person approves |
Not on this surface: Sites, Storage and Registry, provisioning or destroying cloud machines, and interactive terminal sessions. Those stay in the console and in Runa’s chat, in a conversation a person is having.
What stops a change
Nobody is there to ask, so asking means no.
A tool call is checked in order: does the credential hold the capability, is the target on its list, and what do the guardrails say. A rule that denies refuses the call. A rule that requires approval refuses it too, because an MCP call has no way to stop and ask a person.
That cuts both ways. An agent holding resource.write can restart, scale or re-image a workload without anyone confirming that call. What bounds it is the capabilities you tick, the targets you grant and the guardrails you write, so write one for anything you would want to be asked about.
- Database statements are classified as read, maintenance or write before they run, and need the matching capability.
- A server or cluster that requires approval to connect needs an active just-in-time grant. An agent can request one, never approve it.
- Change-management rules apply to agent changes as they do to people’s.
- Each credential is rate-limited, and a workspace IP allowlist can apply to agents too.
What is recorded
Every call, tied to the credential that made it.
The call log
Each credential’s page lists its recent calls: the tool, the outcome, how long it took and the first line of any error. The newest 300 calls per credential are kept there.
The activity log
Changes go through the same task pipeline as a person’s and land in the workspace activity log, attributed to the agent. So do minting, rotating and revoking a credential.
Database sessions
Queries are recorded as a replayable database session: the statement, the row count and the timing, never the rows themselves.
Plans
Where MCP starts.
| Plan | Free | Pro | Team | Enterprise |
|---|---|---|---|---|
| MCP for external clients | — | — | ✓ | ✓ |
| Agent credentials | — | — | 10 | 100 |
| Servers & clusters | — | 3 | 25 | 250 |
MCP tool calls use no AI credits: the model runs in your client, on your own account with its provider. Servers and clusters count against the plan’s fleet limit whichever way they are reached.
Questions
Before you hand an agent a token.
Can an AI agent use Kubernetes through Subnomic MCP?
Yes, on the clusters the credential names. With kube.read and resource.read it can list, describe, read events and logs and run investigations; changes need resource.write, and deletes resource.delete. The cluster needs the Subnomic agent running in it.
How are the tools authorized?
By the credential: its capabilities decide which tools exist for it, its targets decide where they work, and both are bounded by the current permissions of the person who minted it. Guardrails then judge each call.
Are write operations protected?
They are off unless you grant them, and a guardrail that denies or requires approval refuses them. There is no per-call confirmation on this surface, so a write you grant is a write the agent can make.
Is this the same thing as Runa?
No. Runa is Subnomic’s own assistant, with its own harness and the console around it. MCP is for agents you already use. Both act through the same kind of scoped access and the same guardrails.
Read next
Where the rules come from.
Give your agent a credential you can read.
Create a workspace, connect a cluster or a server, and mint an MCP credential on Team.