Helm v4 MCP server over helm-python-sdk exposing Helm operations to MCP clients
Server exposes 15 well-named Helm tools with consistent verb_noun naming (helm_release_*, helm_install_*, etc.). All tools have descriptions (10 - 200 chars, within baseline 194 avg). Input schemas are present and typed for all tools. However, output schemas are NOT documented, responses are dumped as JSON strings without field-level documentation, forcing LLMs to parse unstructured text. Parameter descriptions are minimal (5 - 15 chars typical); many lack format/constraint guidance. Error handling is generic (@tool_errors decorator) with no recovery guidance. No tool annotations (readOnlyHint/destructiveHint) despite clear risk stratification (READ_ONLY, WRITE, DESTRUCTIVE). Destructive tools (uninstall, rollback) require confirmation strings but lack dry-run support.
Available tags of an oci://host/path/chart reference, newest first.
Install a chart. Runs as a server-side dry run unless apply=true (real installs also need HELM_AI_ALLOW_WRITES=1 in the server env).
Lint a local chart; returns findings (severity 1=info 2=warn 3=error).
List Helm releases (all states). name_filter is a regex on names.
A release's revision history, oldest first.
The full rendered Kubernetes manifest stored for a release revision.
Status of a release: state, chart, versions, notes (manifest omitted).
Output schemas not documented. Tools return JSON strings via dump() with no field-level schema. LLMs cannot plan downstream calls or extract structured data without parsing unstructured text.
Parameter descriptions are minimal (5 - 15 chars). Lack format constraints, ranges, and usage guidance. E.g., 'namespace' is described as 'Namespace of the release (optional)' but does not explain format, validation, or when to omit.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 69 | <=2025-11-25 | v2 |
A release's user-supplied values (computed values with all_values).
Roll a release back to a revision (previous when omitted). confirm must equal the release name; needs HELM_AI_ALLOW_DESTRUCTIVE=1.
Chart names and recent versions from an HTTP chart repository index.
Show a chart's definition/values/readme/crds without installing it.
Render a local chart offline. values is a JSON object of overrides.
Uninstall a release. confirm must equal the release name exactly, and the server env must set HELM_AI_ALLOW_DESTRUCTIVE=1.
Upgrade a release. Runs as a server-side dry run unless apply=true (real upgrades also need HELM_AI_ALLOW_WRITES=1 in the server env).
Versions of the Helm SDK stack this server is running on.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools are stratified by risk (READ_ONLY, WRITE, DESTRUCTIVE) but this is not exposed to the MCP client. Clients cannot warn users or apply safety gates.
Error handling is generic (@tool_errors decorator). No recovery guidance, categorization (retryable vs fatal), or actionable error messages. LLMs receive stack traces or generic errors with no next-step guidance.
Destructive tools (uninstall, rollback) require confirmation strings but lack dry-run support. No pattern to preview changes before execution, increasing risk of accidental destruction.