Best MCP Servers for DevOps and Cloud in 2026
Six official and community servers ranked by real capability, guardrails, and cloud coverage, not marketing.
For AWS shops, start with the official AWS MCP Servers: one suite covers documentation, cost, infrastructure, and any AWS API under your own IAM credentials. For clusters, the Kubernetes MCP Server is the strongest pick because it ships --read-only and --disable-destructive flags and talks to the Kubernetes API natively instead of shelling out to kubectl. For infrastructure as code, the Terraform MCP Server keeps apply and destroy disabled until you set ENABLE_TF_OPERATIONS=true, which is the plan-then-apply guardrail you want. Azure teams get 40 plus services in Microsoft's official server, Docker's MCP Gateway sandboxes every server in a container with isolated secrets, and Cloudflare's hosted servers fit edge and Workers stacks. Toolradar tracks 328 plus MCP servers with editorial scoring, and these six lead the DevOps and cloud category.
DevOps agents live or die on the servers they connect to. An MCP server is the bridge between an AI agent and your control plane, so its tools, authentication model, and guardrails decide whether the agent is a safe assistant or a fast way to break production. This guide ranks the six best MCP servers for DevOps and cloud work in 2026 by what they actually expose, how they scope credentials, and what they stop an agent from doing by default.
All six are free and open source. The differences that matter are coverage (one cloud versus many, one control plane versus a gateway for all of them), guardrails (read-only modes, destructive operations off by default, IAM or RBAC scoping), and maintenance (official vendor releases versus community projects). Every pick links to its Toolradar profile, where its editorial score and alternatives sit alongside the 328 plus MCP servers we track.
Top Picks
Based on features, user feedback, and value for money.
| Tool | Starting price | Rating | Best for |
|---|---|---|---|
| AWS MCP Servers | Free | n/a | Teams standardized on AWS that want broad, official coverage under their own IAM roles. |
| Kubernetes MCP Server | Free | n/a | Cluster operators who want native API access and true inspection-only mode for agents. |
| Terraform MCP Server | Free | n/a | Infrastructure-as-code teams that want grounded module choices and safe-by-default exec... |
| Azure MCP Server | Free | 4.4(2,151) | Azure-centric teams, especially those working inside Visual Studio 2026 and Copilot. |
| Docker MCP Server | Free | n/a | Teams running many MCP servers that want container isolation and one central secret store. |
| Cloudflare MCP | Free | n/a | Teams building on Cloudflare Workers and edge who want zero-install remote servers. |
Teams standardized on AWS that want broad, official coverage under their own IAM roles.
Value 100/100. The pricing for AWS MCP Servers is exceptionally generous, as all calls are completely free of charge.
Watch out: No hidden costs for the MCP Server service itself.
Cluster operators who want native API access and true inspection-only mode for agents.
Value 100/100. The pricing for Kubernetes MCP Server is exceptionally fair and generous, as it is entirely free and open-source.
Watch out: No direct hidden costs due to open-source nature
Infrastructure-as-code teams that want grounded module choices and safe-by-default execution.
Value 95/100. The pricing for Terraform MCP Server is extremely generous, as it's entirely free through its Open Source tier.
Watch out: Infrastructure costs for self-hosting
Azure-centric teams, especially those working inside Visual Studio 2026 and Copilot.
Teams running many MCP servers that want container isolation and one central secret store.
Value 95/100. The Docker MCP Server's 'Open Source' tier is exceptionally generous, offering full source code access and self-hosting for free.
Watch out: Requires internal IT resources for setup/maintenance
Teams building on Cloudflare Workers and edge who want zero-install remote servers.
Value 100/100. The Cloudflare MCP pricing is exceptionally generous, as it is entirely free through its 'Open Source' tier.
Watch out: Requires self-hosting infrastructure investment
Other DevOps worth considering
Beyond the editorial top picks, these are also strong choices we evaluated.
What a DevOps MCP server actually is
An MCP server for DevOps exposes your cloud and infrastructure control planes to an AI agent as callable tools. Instead of the model guessing at kubectl syntax or an SDK call, it invokes a typed tool like list_pods, search_modules, or call_aws_api, and the server executes it against the live API using your credentials.
Two shapes exist. Provider servers (AWS, Azure, Cloudflare, Terraform, Kubernetes) each talk to one control plane and expose that platform's operations. Gateway servers (Docker) run and secure other MCP servers as sandboxed containers rather than managing a cloud themselves. Most provider servers run locally over stdio; a growing set, including Cloudflare's catalog, run as remote servers with OAuth so there is nothing to install.
Why the right server matters for DevOps
The wrong server hands an agent unscoped write access to production. The right one ships guardrails: a read-only mode, destructive operations disabled by default, and credential scoping through IAM or RBAC so the agent can only touch what its role allows.
DevOps work is also multi-account, multi-cluster, and multi-region, so a server that only sees one context forces constant reconfiguration. And because these tools run real infrastructure commands, auditability (CloudTrail, call logging, and IAM condition keys that distinguish agent actions from human ones) is the difference between a useful assistant and an incident waiting to happen.
Key Features to Look For
A flag to run inspection-only, plus write and delete operations that stay off until you explicitly enable them. The Kubernetes server has --read-only and --disable-destructive; Terraform keeps apply and destroy behind ENABLE_TF_OPERATIONS=true.
The server inherits your credentials, so a least-privilege IAM role or RBAC binding is the real blast-radius control. Never point a server at an admin credential you would not hand a junior engineer.
For IaC, the agent should read the Registry, propose a plan, and apply only under an explicit toggle and human review. Terraform's default of disabling destructive operations enforces exactly this loop.
Real environments span accounts, subscriptions, and clusters. A server that handles multiple kubeconfig contexts, AWS profiles, or Azure subscriptions saves constant reconfiguration.
Servers that surface billing and cost data (the AWS suite exposes Cost Explorer) let an agent answer spend questions and flag waste without you leaving the chat.
Prefer vendor-maintained servers for security response, and match transport to your setup: stdio binaries for local and air-gapped use, remote OAuth servers for hosted convenience.
Mistakes to Avoid
- ×
Pointing a server at an admin credential instead of a scoped, least-privilege IAM role or RBAC binding, which hands the agent your entire account as its blast radius.
- ×
Enabling write and destructive operations before you trust the agent, for example setting ENABLE_TF_OPERATIONS on Terraform or skipping --read-only on the Kubernetes server on day one.
- ×
Loading every service tool set into context at once, which bloats the prompt and confuses the model; load only the namespaces and toolsets you actually use.
- ×
Treating a gateway like Docker as a cloud provider server; it secures and runs other servers, it does not itself manage AWS, Azure, or Kubernetes.
- ×
Running mutating cloud operations without CloudTrail or call logging and without a human approval step on apply and delete.
Expert Tips
- →
Start read-only. Ship agents against a --read-only Kubernetes server and a Registry-only Terraform server first, then add write scopes per operation once you have watched the agent behave.
- →
Scope with IAM or RBAC, not the server. The server inherits your credentials, so a least-privilege role is your real control over what the agent can reach.
- →
Use the Docker MCP Gateway to run several cloud servers behind one secret store and one audit log instead of pasting tokens into each client config.
- →
On AWS, prefer the Agent Toolkit's IAM condition keys so CloudTrail can tell agent actions apart from human ones during an incident review.
- →
Match transport to the environment: use Cloudflare's hosted OAuth servers for convenience, and self-host the stdio binaries for air-gapped clusters and tighter control.
The Bottom Line
For most DevOps teams the answer is a small stack, not one server. Put the official AWS MCP Servers or Azure MCP Server on your cloud, add the Kubernetes MCP Server for clusters and the Terraform MCP Server for infrastructure as code, and run them behind the Docker MCP Gateway for container isolation and centralized secrets. Reach for Cloudflare's hosted servers only if you actually live on Workers and the edge. Whatever you pick, start every server read-only, scope credentials with IAM or RBAC, and keep destructive operations behind an explicit toggle with human review.
Frequently Asked Questions
What is the best MCP server for AWS?
The official AWS MCP Servers from awslabs, now shipped as the Agent Toolkit for AWS. The suite covers documentation, Cost Explorer, the Cloud Control API for resource CRUD, and a single tool to call any AWS API, all under your own IAM credentials. Scope it with a least-privilege role and lean on the IAM condition keys and CloudTrail visibility to keep agent actions auditable.
What is the best MCP server for Kubernetes?
The Kubernetes MCP Server from the containers org. It is Go-native and talks directly to the Kubernetes API, so it needs no kubectl or helm binaries, and it works with both Kubernetes and OpenShift. It stands out for DevOps because of its --read-only and --disable-destructive flags, which let you run inspection-only agents, and it authenticates through kubeconfig or an in-cluster service account.
What is the best MCP server for Terraform and infrastructure as code?
The official HashiCorp Terraform MCP Server. It integrates the public Registry for provider, module, and policy search plus HCP Terraform and Terraform Enterprise workspace management. Critically for safety, it disables destructive operations by default; apply, destroy, and workspace deletion only work once you set ENABLE_TF_OPERATIONS=true, which enforces a plan-then-apply workflow.
Are these DevOps MCP servers safe to run in production?
They can be, if you configure them defensively. Start every server read-only, scope its credentials with a least-privilege IAM role or RBAC binding rather than an admin credential, keep destructive operations behind an explicit toggle, and require human approval on apply and delete. Run them behind the Docker MCP Gateway for container isolation and secret injection, and keep CloudTrail or call logging on so every agent action is auditable.
Are MCP servers for DevOps free?
Yes. All six picks here are free and open source, including the official AWS, Azure, Terraform, and Cloudflare servers, the community Kubernetes server, and the Docker MCP Gateway. You still pay for the underlying cloud resources the agent operates, and some IDE integrations like GitHub Copilot may require their own subscription. Toolradar tracks 328 plus MCP servers with editorial scoring if you want to compare beyond this list.
Related Guides
From the team behind Toolradar
Editorial content for AI startups
We turn AI product expertise into content that ranks, gets cited by LLMs, and reaches 720K+ tech buyers.
See how we workReady to Choose?
Compare features, read reviews, and find the right tool.