MyMCPTools
Guides9 min read

Best MCP Servers for Cloud Engineers in 2026

Manage infrastructure faster with MCP servers that give your AI direct access to AWS, GCP, Azure, Kubernetes, Terraform, and your observability stack. Stop describing your infrastructure — show it.

By MyMCPTools Team·

Cloud infrastructure is defined by state — the live state of hundreds of resources across compute, networking, storage, and services. AI assistants that can't read that state can only give you generic advice. An AI that knows your actual VPC CIDR ranges, your current EKS node utilization, and the exact error in your Terraform plan is a different class of tool.

MCP servers give your AI direct access to your infrastructure state, turning it from a documentation reader into an active infrastructure co-pilot.

Cloud Provider Access

AWS MCP Server — Infrastructure State and Resource Management

The AWS MCP server connects your AI to AWS APIs, enabling read access to your actual resource state across EC2, S3, RDS, ECS, Lambda, IAM, and every other AWS service. Instead of describing your setup, you show it.

AWS engineering workflows:

  • Cost analysis: "Query our EC2 instances and identify any running instances that haven't received requests in the last 7 days — potential idle resource waste"
  • Security audit: "List all S3 buckets and flag any with public read ACLs or missing server-side encryption"
  • IAM review: "Find all IAM roles with administrator access policies attached and list the last-used date for each"
  • Capacity planning: "Check current RDS instance sizes across all production databases and compare against CloudWatch average CPU utilization"
  • Incident diagnosis: "Read the last 100 CloudTrail events for this EC2 instance — I need to understand what changed before it became unreachable"

Architecture documentation: A common use case is using the AWS MCP server to generate infrastructure documentation. "Enumerate our VPC topology, subnets, and route tables, then generate a Mermaid diagram of the network architecture" produces accurate documentation from live state instead of from someone's memory.

AWS CLI MCP Server — Command Generation and Execution

The AWS CLI MCP server wraps the AWS CLI for AI-assisted command generation with your actual account context. Instead of constructing complex CLI commands manually, your AI builds them from your resource inventory.

CLI-assisted operations:

  • Generate the exact AWS CLI command to rotate a specific IAM access key, using the real key ID from your account
  • Build a CloudFormation deploy command with the correct parameter overrides for a specific environment
  • Construct an S3 sync command with the correct bucket path and exclusion patterns from your actual setup
  • Generate a Lambda update-function-code command pointing to the correct ECR image tag

GCloud MCP Server — Google Cloud Platform Operations

For GCP-based infrastructure, the gcloud MCP server provides the same pattern: AI access to your actual GCP resource state for assisted operations, diagnostics, and documentation.

GCP engineering workflows:

  • List all GKE cluster configurations and identify nodes running deprecated Kubernetes versions
  • Review Cloud IAM bindings for a specific project to find over-privileged service accounts
  • Check BigQuery dataset access controls before migrating data
  • Generate gcloud commands for Cloud Run service deployments using actual project and region values
  • Audit Cloud Storage bucket lifecycle policies for cost optimization opportunities

Azure CLI MCP Server — Azure Resource Operations

Azure infrastructure teams can use the Azure CLI MCP server to bring the same live-state awareness to Azure resource groups, virtual machines, AKS clusters, and Azure services.

Azure workflows:

  • List all Azure VMs in a resource group and check their current running state and SKU
  • Review Network Security Group rules for a specific subnet before making changes
  • Check AKS node pool configurations and current utilization metrics
  • Generate az CLI commands for Azure Key Vault secret rotation workflows

Container Orchestration

Kubernetes MCP Server — Cluster State and Workload Management

The Kubernetes MCP server gives your AI direct kubectl-equivalent access to your cluster state — pods, deployments, services, configmaps, events, and logs. This is one of the highest-value MCP servers for cloud engineers: Kubernetes troubleshooting is heavily dependent on current state, and describing it manually is error-prone and slow.

Kubernetes operations workflows:

  • Incident diagnosis: "Check the events for pods in the payment namespace over the last hour — I'm getting CrashLoopBackOff alerts"
  • Resource optimization: "List all deployments and compare their requested CPU/memory vs actual usage from metrics-server — identify over-provisioned workloads"
  • Deployment verification: "Verify that the rollout completed successfully and all pods are running the new image tag after the deployment"
  • Config review: "Read the configmap for the auth service and identify any settings that differ between staging and production"
  • Network policy audit: "List all NetworkPolicy objects and identify any pods that have no egress restrictions"

Runbook automation: Complex operational procedures that involve multiple kubectl commands can be described once and executed with AI-assisted command generation. "Walk me through checking cluster health before a maintenance window" becomes a structured checklist executed against real cluster data.

Docker MCP Server — Container Diagnostics

For containerized development and operations, the Docker MCP server provides access to local or remote Docker daemon state — running containers, images, volumes, and network configurations.

Docker workflows:

  • List all running containers and identify any that have been restarting frequently
  • Read container logs for a specific service to diagnose a startup failure
  • Inspect Docker network configuration for multi-container application debugging
  • Identify large images that are consuming excess disk space on build hosts

Infrastructure as Code

Terraform MCP Server — IaC State and Plan Analysis

The Terraform MCP server brings your AI into the infrastructure-as-code workflow — reading Terraform state files, analyzing plan outputs, and understanding resource dependency graphs.

Terraform-assisted IaC workflows:

  • Plan review: "Read the terraform plan output and identify any destructive changes that affect production resources — flag anything that requires manual review"
  • State drift detection: "Compare the Terraform state for the database module against current AWS RDS resource state — are there drift indicators?"
  • Module documentation: "Read the Terraform module files for our VPC module and generate documentation for each variable"
  • Dependency analysis: "Map the resource dependencies in this Terraform configuration — which resources will be affected if I modify the security group?"
  • Refactoring assistance: "Read our current Terraform state and suggest which resources should be moved into modules for better organization"

Observability

Grafana MCP Server — Dashboard and Alert State

The Grafana MCP server gives your AI access to your Grafana dashboards, data sources, and alert configurations — enabling AI-assisted dashboard building and alert review using your actual metric schema.

Grafana operations:

  • Read an existing dashboard JSON and generate a new panel using the same data source configuration and query patterns
  • List all firing alerts across all dashboards during an incident investigation
  • Review alert thresholds across all services and identify alerts that have never fired (potential dead alerts)
  • Generate dashboard documentation from actual panel configurations

OpenTelemetry MCP Server — Trace and Metric Context

The OpenTelemetry MCP server connects your AI to your observability data — traces, metrics, and logs — enabling AI-assisted performance analysis and incident diagnosis using real telemetry.

Observability-driven diagnosis:

  • Fetch recent traces for a specific service and identify the slowest spans in the critical path
  • Query P95 latency metrics for a service over the last 24 hours to contextualize a performance regression
  • Find distributed traces that crossed the error threshold and identify their common characteristics

Documentation and Research

Brave Search MCP Server — Current Cloud Documentation

Cloud provider documentation changes constantly — new service features, deprecated APIs, updated pricing models, and security advisories. The Brave Search MCP server ensures your AI generates advice based on current documentation rather than potentially outdated training data.

Cloud documentation research:

  • "Look up the current AWS Lambda limits for provisioned concurrency — I'm designing an auto-scaling policy"
  • "Find the latest GKE Autopilot documentation for custom node pools — the behavior changed in a recent release"
  • "Search for recent AWS RDS changes to automated backup retention policies"
  • "Find the current Kubernetes documentation for the PodDisruptionBudget API — I need the exact field names"

GitHub MCP Server — Infrastructure Code Examples

Infrastructure patterns, Terraform modules, Helm charts, and Kubernetes manifests are extensively documented in open-source repositories. The GitHub MCP server gives your AI access to production-quality examples to reference when generating infrastructure code.

IaC research workflows:

  • Find production-quality Terraform modules for EKS cluster setup in the AWS Terraform modules repository
  • Search for Helm chart examples that match your application type and deployment pattern
  • Browse GitHub Actions workflow examples for your specific deployment target (ECS, Lambda, GKE)
  • Find Kubernetes operator implementations that match the pattern you're building

Recommended Stack by Cloud Engineering Role

AWS cloud engineer: AWS + Kubernetes + Terraform + Grafana + Brave Search

GCP cloud engineer: GCloud + Kubernetes + Terraform + OpenTelemetry + Brave Search

Multi-cloud / platform engineer: AWS + GCloud + Azure CLI + Kubernetes + Terraform + Grafana

SRE / on-call engineer: Kubernetes + Grafana + OpenTelemetry + AWS + Brave Search

DevOps / IaC engineer: Terraform + AWS + Docker + Kubernetes + GitHub + Brave Search

Start with your primary cloud provider's MCP server and Kubernetes — together they cover the live state access that makes AI assistance genuinely useful for infrastructure work. Add Terraform for IaC workflows and Grafana or OpenTelemetry for observability. Brave Search is always valuable for ensuring your AI's recommendations reference current documentation.

Browse the full cloud MCP servers catalog or see Best MCP Servers for DevOps Engineers for CI/CD pipeline integrations that complement this cloud infrastructure stack.

Recommended Tools

Better Stack

Free Plan

Get alerted when your APIs, browser tests, payment pipelines, or MCP server dependencies go down. Used by 100K+ developers.

Start monitoring free →

1Password

14-day Free Trial

Store and inject API keys, payment credentials, tokens, and file access secrets into your MCP server configs. Trusted by 150K+ developers.

Try 1Password free →

🔧 MCP Servers Mentioned in This Article

☁️

AWS MCP Servers

AWS Labs maintains a monorepo of specialized, open-source MCP servers that bring AWS best practices directly into AI-assisted development workflows, spanning infrastructure, data, AI/ML, cost management, and healthcare/life-sciences domains. Rather than one monolithic server, the project ships dozens of focused servers you install individually depending on the task: the AWS Documentation MCP Server for real-time official docs and API references, dedicated servers for Terraform/CDK/CloudFormation infrastructure-as-code, container and serverless platforms (ECS, EKS, Lambda), SQL/NoSQL databases (DynamoDB, RDS, Aurora), search and analytics (OpenSearch), messaging (SQS/SNS), and cost/billing analysis. Most servers install via uvx with a package name like awslabs.aws-documentation-mcp-server, run locally over stdio, and use standard AWS credential chains (IAM roles, profiles, or access keys) rather than exposing raw account credentials to the model. AWS also now offers a managed, remote "AWS MCP Server" (in preview) that combines full API coverage with pre-built agent SOPs, syntactically validated API calls, and complete CloudTrail audit logging for teams that want centralized governance instead of running servers locally. The Getting Started with Kiro/Cursor/VS Code/Claude Code sections in the repo provide one-click install configs for each server, making it straightforward to wire up only the AWS services a given project actually touches.

Local✓
🔧

Kubernetes MCP Server

The Kubernetes MCP server (mcp-server-kubernetes, built by Flux159) brings cluster management capabilities into AI assistant workflows, letting developers and platform engineers query and manage Kubernetes resources through natural-language interactions with Claude, Cursor, and other MCP-compatible clients. It loads your existing kubeconfig automatically, so it works with any cluster — local minikube and kind setups, Amazon EKS, Google GKE, Azure AKS, or on-premises deployments — with no separate credential setup required. Core tools exposed by the server include: listing pods, deployments, services, and namespaces; describing individual resources and their status; fetching pod logs for debugging; applying and updating manifests; scaling deployments; checking rollout status and history; and querying resource utilization and cluster events. A built-in non-destructive mode can disable delete/scale-down operations entirely, making it safe to point at production clusters for read-only diagnostics. DevOps engineers use it to debug failing deployments by asking Claude to inspect pod logs and recent events, identify resource constraints causing OOMKilled pods, or summarize the current state of a namespace before a production release. For SREs responding to incidents, it enables rapid triage through conversational commands — no memorizing kubectl flags or switching terminal windows mid-incident — and optional OpenTelemetry integration adds observability into what the AI agent actually did against the cluster. Install with: `npx mcp-server-kubernetes`. Pairs well with the GitHub MCP server for full GitOps review workflows.

Local
🔧

Terraform MCP Server

live Terraform Registry data — provider schemas, module inputs and outputs, policy libraries — plus full HCP Terraform and Terraform Enterprise workspace management, so an AI assistant writes HCL against the real resource arguments instead of inventing attribute names from memory. HashiCorp distributes it as a Go binary and a Docker image, not as an npm package: `@hashicorp/terraform-mcp-server` returns 404 on the npm registry, so npx configurations copied from older write-ups cannot work. The supported install is the hashicorp/terraform-mcp-server image on Docker Hub (v1.1.0, released 2026-07-14), run with `docker run -i --rm hashicorp/terraform-mcp-server:1.1.0`, or the release binary invoked as `terraform-mcp-server stdio`. Both transports are supported: stdio for local clients, and streamable-http via `terraform-mcp-server streamable-http --transport-port 8080 --mcp-endpoint /mcp` for shared deployments. Registry lookups need no credentials at all — only the HCP Terraform and Terraform Enterprise tools do, via TFE_TOKEN plus TFE_ADDRESS (which must include the protocol, e.g. https://app.terraform.io, and in streamable-http mode can only be set as an environment variable, never supplied by a client header). Two flags matter before you expose it to a team: ENABLE_TF_OPERATIONS is false by default and gates the tools that mutate infrastructure, and the HTTP server defaults to strict CORS with 10:20 global and 5:10 per-session rate limits, an MCP_ORGANIZATION_ALLOWLIST for restricting which HCP organisations can connect, and required MCP_TLS_CERT_FILE / MCP_TLS_KEY_FILE for any non-localhost bind. Server instructions live in cmd/terraform-mcp-server/instructions.md and are meant to be replaced with your own conventions if the default answers do not match how your organisation writes Terraform.

Local✓
🔧

Docker MCP Server

The Docker MCP server (ckreiling/mcp-server-docker) gives an AI assistant direct control of a Docker daemon over the Model Context Protocol: containers, images, networks and volumes, as tools rather than shell commands. It is the community server most people mean by "Docker MCP" — distinct from Docker’s own Docker MCP Gateway, which does not manage your containers at all but runs *other* MCP servers inside containers. If you want to ask Claude why the postgres container keeps restarting, you want this one; if you want a single secure endpoint in front of twenty catalog servers, you want the gateway. The tool surface is explicit and small enough to reason about: list_containers, create_container, run_container, recreate_container, start_container, fetch_container_logs, stop_container and remove_container for containers; list_images, pull_image, push_image, build_image and remove_image for images; list_networks / create_network / remove_network and list_volumes / create_volume / remove_volume for the rest. Two resource templates, docker://containers/{id}/logs and docker://containers/{id}/stats, let a client read logs and live stats by container ID or name without a tool call. It also ships a docker_compose prompt that puts the model into a plan-then-apply loop — you describe the containers you want under a project name, the model proposes a concise plan, and nothing runs until you approve it; reopening the prompt with the same project name re-reads the state of everything created under it, which is how you clean up after a lost chat. It runs on the Python Docker SDK’s from_env, so DOCKER_HOST applies: set ssh://user@host and the same server administers a remote engine. Two limits are deliberate and stated by the project — privileged options like --privileged and --cap-add/--cap-drop are not supported, and container configuration passes through the model, so no secrets belong in it.

Local📘
📊

Grafana MCP Server

The official Grafana MCP server connects Claude and other AI assistants directly to your Grafana instance and its surrounding observability ecosystem, turning natural-language questions into dashboard lookups, incident investigations, and datasource queries. Dashboard tools cover search, retrieval, JSONPath-scoped property extraction, patch-based editing, and per-panel query/datasource introspection, with context-window-aware helpers like get_dashboard_summary so an agent never has to pull a full multi-megabyte dashboard JSON just to answer a simple question. Query tools speak PromQL against Prometheus (including histogram-percentile helpers), LogQL against Loki, and native query languages for InfluxDB, ClickHouse, CloudWatch, Graphite, Athena, Snowflake, Elasticsearch/OpenSearch, and Quickwit datasources — most gated behind opt-in --enabled-tools flags to keep the default tool surface lean. It also wraps Grafana Incident for creating and updating incidents, Sift for automated error-pattern and slow-request investigations, full alerting CRUD (rules, contact points, notification policies) across Grafana-managed and external Alertmanager sources, Grafana OnCall schedule/shift/alert-group management, RBAC-gated admin tools for teams/users/roles, deeplink generation so the LLM never has to guess a dashboard URL, annotations, snapshots, PNG rendering via the Grafana Image Renderer, and provisioning-repo validation for git-sync workflows. Authentication is a Grafana service account token (Editor role, or granular RBAC scopes) passed as GRAFANA_SERVICE_ACCOUNT_TOKEN alongside GRAFANA_URL, and every tool category can be individually disabled to control context-window usage. On install, the recommended route is uvx: `uvx mcp-grafana` pulls the PyPI package mcp-grafana, which is published by Grafana Labs from this same repository — so despite the server being written in Go, the copy-paste command most Claude Desktop and Cursor configs use is a Python-tooling one, not a binary download. The alternatives are `go install github.com/grafana/mcp-grafana/cmd/mcp-grafana@latest` for a real binary, or the grafana/mcp-grafana container — `-t stdio` for local clients, or the default HTTP mode on :8000 (add `-t streamable-http`) with MCP_GRAFANA_SERVER_TOKEN set to authenticate callers when you expose it.

Local✓
🔧

OpenTelemetry

Collect and query distributed traces, metrics, and logs using OpenTelemetry standards. Analyze application performance and correlate signals across services.

Local✓
☁️

AWS CLI

Execute AWS CLI commands via MCP. Query any AWS service, manage resources across regions, configure profiles, and automate complex multi-service workflows.

Local
☁️

Google Cloud CLI

Execute gcloud commands via MCP. Manage GCP resources across all services, configure projects and IAM, and automate Google Cloud workflows.

Local
☁️

Azure CLI

Execute az commands via MCP. Manage Azure resources, subscriptions, and services. Automate infrastructure deployments and resource group management.

Local
🔍

Brave Search MCP Server

The Brave Search MCP Server is the official server from Brave that gives AI assistants privacy-first web search through the independent Brave Search API — no tracking, no profiling, and results drawn from Brave's own web index rather than Google or Bing. It exposes five distinct tools that map directly to the Brave Search API endpoints: brave_web_search for general queries with pagination, freshness filters, and safe-search controls; brave_local_search for businesses, restaurants, and points of interest with automatic location filtering; brave_news_search for recent articles and current events; brave_image_search for image discovery; and brave_video_search for finding videos across the web. Authentication uses a single BRAVE_API_KEY (free tier available at brave.com/search/api) or a mounted BRAVE_API_KEY_FILE for Docker-secret setups. Install in Claude Desktop, Cursor, Windsurf, or VS Code with one npx command and choose stdio or streamable-HTTP transport. Because Brave operates its own crawler and index, the Brave Search MCP server is a strong choice for developers who want an alternative to Google-dependent search tools, need reproducible non-personalized results, or care about data privacy in agent workflows — Claude can pull fresh web context, verify facts, and research topics without leaking queries to ad-tech pipelines.

Local✓
💻

GitHub MCP Server

authenticated access to the whole GitHub platform — repositories, files, branches, issues, pull requests, Actions runs, security alerts, discussions and notifications — from Claude, Cursor, VS Code, Copilot CLI and any other MCP host. There is no npm package for this server, and that trips up most people who try to install it: `@github/mcp-server` is not published to the npm registry, so any `npx` line you find for it will fail. GitHub ships it three other ways. The easiest is the hosted remote server at https://api.githubcopilot.com/mcp/, which needs no install at all — point an HTTP-transport MCP client at that URL and log in with OAuth (VS Code 1.101+, Claude Desktop, Claude Code, Cursor and Windsurf all support this). The second is the official Docker image ghcr.io/github/github-mcp-server, which is what the copy-paste command on this page runs; on github.com it now performs a browser-based OAuth login on first use and keeps the token in memory only, which is why the published Docker configs map a fixed loopback callback port (-p 127.0.0.1:8085:8085 with GITHUB_OAUTH_CALLBACK_PORT=8085) so the container can receive the callback. Prefer a token? Set GITHUB_PERSONAL_ACCESS_TOKEN instead — it takes precedence over OAuth, and the minimum useful scopes are repo, read:org and read:packages. The third is the native Go binary from the repository's releases, which needs no fixed port for the OAuth flow. GitHub Enterprise Server has no hosted option: use the local server with --gh-host or GITHUB_HOST set to your instance (include the https:// scheme — it defaults to http://, which GHES rejects). Toolsets can be narrowed with GITHUB_TOOLSETS, and an insiders channel is available at /mcp/insiders or via the X-MCP-Insiders header.

Auth required📘✓
📁

Filesystem MCP Server

sandboxed read, write, edit, move and search access to an explicit whitelist of local directories, and it is the reference implementation most other filesystem MCP servers are modelled on. Shipped by Anthropic in the official modelcontextprotocol/servers monorepo (89,000+ stars, actively maintained), it is a Node.js server published to npm as @modelcontextprotocol/server-filesystem. The part worth understanding before you install is the access-control model, because there are now two ways to grant directories and they do not compose. Method one is command-line arguments: `npx -y @modelcontextprotocol/server-filesystem /path/one /path/two`. Method two, and the one the maintainers recommend, is MCP Roots — a client that supports the roots protocol sends its roots at initialization, and those roots COMPLETELY REPLACE any directories passed on the command line, then get replaced again on every `notifications/roots/list_changed`. That means allowed directories can change at runtime without restarting the server, but it also means a roots-capable client silently overrides your CLI arguments. If the server starts with no arguments and the client either does not support roots or sends an empty list, initialization throws an error. The tool surface is broad: `read_text_file` (with mutually exclusive `head`/`tail` line windows), `read_media_file` returning base64 image/audio content blocks, `read_multiple_files` which keeps going when individual reads fail, `write_file`, `edit_file`, `create_directory`, `list_directory`, `list_directory_with_sizes`, `move_file`, `search_files`, `directory_tree`, `get_file_info` and `list_allowed_directories`. `edit_file` is the one to learn — it does line-based and multi-line pattern matching with indentation detection and preservation, returns a git-style diff with context, and supports `dryRun: true` so you can preview a change before applying it; the maintainers recommend always running a dry run first. Every operation is refused outside the allowed set, and `list_allowed_directories` is the fastest way to confirm what the server actually believes it can touch.

Local✓

📚 More from the Blog

Guides

Best MCP Servers for Developers in 2026: The Complete Guide

Discover the top MCP servers that every developer should know about. From filesystem access to database queries, these Model Context Protocol servers supercharge your AI coding workflow.

8 min readGuides

Best MCP Servers for Data Engineering: Database, ETL & Analytics

Top MCP servers for data engineers and analysts. Connect your AI to PostgreSQL, BigQuery, Snowflake, and more for AI-powered data workflows.

7 min readTutorials

Getting Started with MCP: A Beginner's Guide to Model Context Protocol

New to MCP? Learn what Model Context Protocol is, how it works, and how to set up your first MCP server in under 5 minutes. Complete beginner's guide.

10 min read