Index Agentica

DevOps and observability MCP servers compared

Eight official MCP servers for infrastructure and operations work (Kubernetes, Terraform, Buildkite, Azure DevOps, Heroku, Datadog, Grafana and Sentry) compared on what they cover, where they run, how they authenticate and how far their read-only modes actually go.

Type
Comparison
Author
Agentica Author
Published
Last verified

Comparison

DevOps and observability MCP servers compared
EntryCoversWhere it runsAuthRead-only and write controlsTools we countedLicense
Kubernetes MCP ServerAny Kubernetes or OpenShift resource (generic CRUD), pods (logs, exec, run, top), events, namespaces, nodes; optional toolsets for Helm, Tekton, KubeVirt, Kiali and moreYou run it: single Go binary, npx, uvx or container; stdio by default, Streamable HTTP at /mcp when port is set; uses your kubeconfig or in-cluster configKubernetes credentials from kubeconfig or the pod's ServiceAccount; optional OAuth in HTTP modeTOML read_only = true keeps only readOnlyHint tools; disable_destructive = true drops delete/update tools but keeps pods_run; toolsets limit what is loadedv0.0.67, default toolsets: 20 tools; read_only: 14; disable_destructive: 15Apache-2.0
Terraform MCP ServerTerraform Registry search (providers, modules, policies); with a token, HCP Terraform / Terraform Enterprise orgs, workspaces, variables, runs, plans, state and teamsYou run it: binary or Docker; stdio or Streamable HTTP, with an organization allowlist and token pass-through for central deploymentsNone for the public registry; TFE_TOKEN for HCP Terraform / EnterpriseNo token means registry-only (read). ENABLE_TF_OPERATIONS (default false) gates the tools that need explicit approval; in our run it added action_run, delete_project, delete_team, delete_workspace_safely and force_unlock_workspacev1.3.0: 9 tools with no token; 56 with a token; 61 with a token and ENABLE_TF_OPERATIONS=trueMPL-2.0
Buildkite MCP ServerPipelines, builds, jobs, logs, artifacts, annotations, clusters and queues, Test Engine runs and tests; build comparison and failure summariesHosted by Buildkite at mcp.buildkite.com (recommended), or run the Go server yourself over stdio or HTTPHosted: OAuth at /mcp, or a Buildkite API token as a bearer token at /direct. Local: BUILDKITE_API_TOKENHosted read-only endpoint /mcp/readonly; local --read-only; --enabled-toolsets (a retries toolset can retry jobs without write_builds); token scopes still applyv1.28.0 local: 72 tools; with --read-only: 49MIT
Azure DevOps MCP ServerProjects, teams, repos and pull requests, work items, pipelines and builds, wikis, test plans, iterations, Advanced Security alertsHosted remote server at mcp.dev.azure.com/{organization} (recommended; will replace the local one) or local stdio via npx @azure-devops/mcp (Node.js 20+)Remote: Microsoft Entra ID (OAuth); local: PAT or Entra ID. Docs say Claude Desktop and Codex need the local server, and Cursor and Claude Code need a custom Entra app registration for the remote oneX-MCP-Readonly header restricts the remote server to read-only tools; local server can load selected domains onlyNot counted: the local server would not start here (its keytar dependency needs libsecret); see Microsoft's tool tablesMIT
Heroku Platform MCP ServerApps (create, deploy, info), dynos and scaling, add-ons, logs and maintenance mode, pipelines, teams and Private Spaces, Heroku PostgresYou run it locally over stdio; needs the Heroku CLI 10.8.1 or laterheroku mcp:start reuses the CLI login; npx @heroku/mcp-server takes HEROKU_API_KEYNo read-only switch documented in the README; limit what the logged-in account can do. Heroku calls the server early developmentNot counted (needs the Heroku CLI)Apache-2.0
Datadog MCP ServerLogs, metrics, traces/APM, monitors, dashboards, incidents, security signals and more, grouped into toolsetsManaged by Datadog only; one endpoint per Datadog site (US1 mcp.datadoghq.com/v1/mcp, EU mcp.datadoghq.eu); not on GovCloud sitesOAuth, or a personal/service access token, or API + application keys as headersRuns with the signed-in user's permissions, so RBAC and data access controls apply; write tools need the matching permission (e.g. monitors_write); toolsets and omit_tools trim the list; every call is in Audit TrailNot counted (needs a Datadog account). Fair-use limits: 50 requests per 10 s, 100,000 tool calls a monthNot stated (hosted service; the GitHub repo holds examples)
Grafana MCP ServerDashboards, data sources, Prometheus, Loki, Tempo and Pyroscope queries, alerting, incidents, OnCall, Sift investigations, annotations, snapshots, pluginsYou run it: Go binary, Docker or Helm; stdio, SSE or Streamable HTTP; works with self-hosted Grafana and Grafana CloudGrafana service account token (or per-request headers over Streamable HTTP)--disable-write removes create/update/delete tools and switches alerting tools and grafana_api_request to read-only (GET only); --disable-<category> and --enable-write-tools fine-tune itv1.6.3: 81 tools; with --disable-write: 65, all annotated readOnlyHintApache-2.0
Sentry MCPOrganizations, projects, issues and events search, issue updates, Seer analysis; built for human-in-the-loop debugging in coding agents rather than all of SentryHosted by Sentry at mcp.sentry.dev/mcp, or stdio via npx @sentry/mcp-server (also for self-hosted Sentry with --host)Hosted: OAuth, or a Sentry token sent as Sentry-Bearer; local: a user auth tokenSkills select tool groups (--skills / ?skills=, e.g. inspect without triage drops update_issue); --disable-skills removes groups; token scopes still applyv0.42.0 stdio: 9 tools by default; --skills=inspect: 7; --skills=inspect,triage: 8FSL-1.1-Apache-2.0

Verdict: For an investigation or on-call agent, start read-only everywhere: Grafana with --disable-write, Buildkite's /mcp/readonly, Azure DevOps with X-MCP-Readonly, Kubernetes with read_only = true and a read-only ServiceAccount, Terraform without ENABLE_TF_OPERATIONS, Sentry with the inspect skill. Datadog and Heroku have no server-side read-only switch, so their safety comes from the user or account you connect as. Add write access one tool group at a time, and only where a human approves the call.

What this covers

These are the official MCP servers an operations or on-call agent is most likely to be given: the cluster (Kubernetes MCP Server), infrastructure as code (Terraform), CI (Buildkite, Azure DevOps), a PaaS (Heroku) and production telemetry (Datadog, Grafana, Sentry). For source hosting and pull requests, see the GitHub and GitLab servers. For cloud accounts, see AWS MCP Servers and Cloudflare's servers.

What was checked by running things on 2026-10-20: we started five of the servers on a Linux box and called initialize and tools/list with a small stdio client, with and without each read-only setting. We used dummy credentials and called no tools, so these numbers show which tools a client sees. They do not show what the backend would allow.

What "read-only" means in each server

Read-only switches mostly work by hiding tools from the model. The cluster or service still enforces only what the credential allows, so treat the switch as one layer and the credential as the real boundary.

Credentials: who the agent is

The hosted servers (Buildkite, Azure DevOps, Datadog, Sentry, and Mapbox outside this list) use OAuth for interactive clients. Most also accept a token header for headless agents: Buildkite's /direct with a bearer token, Datadog's access tokens or API and application keys, and Sentry's Sentry-Bearer header. Sentry keeps Bearer reserved for MCP OAuth tokens. For a background agent, create a dedicated service account with the narrowest role rather than reusing a person's token. Datadog records every call in Audit Trail and tags it as an MCP action, which helps reviews. Agent auth and delegated access and agent identity and MCP auth cover the patterns, and the MCP authorization spec defines the OAuth flow these hosted servers use.

For Kubernetes, the server's README links a setup guide for a dedicated ServiceAccount with read-only access. That is worth doing even with read_only = true, because the RBAC role is what the API server enforces.

Keeping the tool list small

Large tool lists cost context and make wrong picks more likely. With a token, Terraform offers 56 tools and Grafana 81 by default. All eight servers can be trimmed. Kubernetes and Buildkite use toolsets, Grafana uses --disable-<category> flags, Datadog uses the toolsets URL parameter or header (and omit_tools), Sentry uses skills, and Azure DevOps' local server loads selected domains. Datadog also truncates long responses and gives most tools a max_tokens parameter. The Toolathlon benchmark found that most models lose accuracy when tool output is very long.

A read-only investigation setup

  1. Telemetry: Grafana with --disable-write, or Datadog as a read-only user, plus Sentry with --skills=inspect.
  2. Changes and CI: Buildkite at https://mcp.buildkite.com/mcp/readonly, or Azure DevOps with X-MCP-Readonly: true, plus the GitHub server in read-only mode.
  3. Cluster: the Kubernetes MCP Server with read_only = true and a read-only ServiceAccount kubeconfig.
  4. Let the agent propose fixes, such as a rollback, a retried job or a silence, as text or a pull request, and have a human approve the action. If you later enable a write tool, enable one group at a time (for example Buildkite's retries toolset, which can retry jobs without write_builds).

To choose servers in general, see pick an MCP server. To run untrusted code that the agent writes during an investigation, see self-hosted agent sandboxes.

Directory entries in this comparison

Related

Sources

Machine-readable