Argo CD MCP Server

About

the Argo CD MCP server, an Argo Project Labs implementation (argoproj-labs/mcp-for-argocd) that lets an assistant drive a live Argo CD instance in natural language over stdio or HTTP stream transport. Install it with npx argocd-mcp@latest stdio on Node 18+ and give it two things: ARGOCD_BASE_URL and ARGOCD_API_TOKEN. The tool surface is genuinely operational rather than read-only — list_applications, get_application, create_application, update_application, delete_application and sync_application for the application lifecycle; get_application_resource_tree, get_application_managed_resources, get_application_workload_logs, get_resource_events, get_resource_actions and run_resource_action for the Kubernetes objects underneath; plus list_clusters and get_appproject. get_application_workload_logs is the one that changes day-to-day work: it pulls Pod and Deployment logs for a failing app without a kubectl context, so an agent can go from 'this app is degraded' to the actual stack trace in one hop. Two configuration details cause most first-run failures. Self-signed or private-CA certificates on the Argo CD endpoint need NODE_TLS_REJECT_UNAUTHORIZED=0 in the client config, which is a development-only workaround. And the API token is deliberately never accepted as a tool-call argument — it is read only from the x-argocd-api-token header or the ARGOCD_API_TOKEN environment variable, so it never enters a prompt, model context, or tool-call log. For fleets, ARGOCD_TOKEN_REGISTRY_PATH points at a JSON file mapping each base URL to its own token; a call then targets an instance with the non-secret argocdBaseUrl argument and the server pairs it with the registered credential. The default token is bound to the default base URL and is never sent to another host, which is what stops a prompt-injected argocdBaseUrl from exfiltrating it. If the registry file is set but missing or malformed the server fails closed at startup rather than falling back. One more thing worth knowing before you expose it: the http and sse transports open a listener that reaches delete_application and run_resource_action, and ARGOCD_API_TOKEN does not protect it — that token authenticates the server to Argo CD, not the caller to the server. It binds 127.0.0.1 by default; set MCP_AUTH_TOKEN to require Authorization: Bearer on every inbound request before changing MCP_BIND_ADDRESS.

Installation

npx argocd-mcp@latest stdio

Setting up the Argo CD MCP server

1. 1.Create an Argo CD API token

   The server authenticates to Argo CD with an API token, not your login. Generate one per the Argo CD API authorization docs and scope it to what the assistant should be allowed to do — a token that can only read is the difference between a bad answer and a deleted application, because Argo CD, not the MCP server, is what enforces the limit.

2. 2.Add the server to your client

   Node 18 or newer. The published package is argocd-mcp; stdio is the transport to start with. The same JSON shape works in Cursor (.cursor/mcp.json), VS Code (.vscode/mcp.json) and Claude Desktop, with ARGOCD_BASE_URL pointing at your Argo CD endpoint.

   .cursor/mcp.json

   {
     "mcpServers": {
       "argocd-mcp": {
         "command": "npx",
         "args": ["argocd-mcp@latest", "stdio"],
         "env": {
           "ARGOCD_BASE_URL": "<argocd_url>",
           "ARGOCD_API_TOKEN": "<argocd_token>"
         }
       }
     }
   }

3. 3.If your Argo CD uses a self-signed certificate

   A private CA or self-signed cert on the Argo CD endpoint makes every call fail at the TLS handshake. Adding NODE_TLS_REJECT_UNAUTHORIZED to the env block disables Node certificate validation and gets you moving, but it disables it for the whole process — the README flags it as a development-only workaround, and it should not follow you into a shared or production deployment.

   env entry

   "NODE_TLS_REJECT_UNAUTHORIZED": "0"

4. 4.For several Argo CD instances, use a token registry

   Point ARGOCD_TOKEN_REGISTRY_PATH at a JSON file mapping each base URL to its own token — a mounted Kubernetes secret is the intended shape. A call then names an instance with the non-secret argocdBaseUrl argument and the server pairs it with the registered token, so no credential passes through the tool call. Restrict the file to the server user (chmod 400); if it is set but missing or malformed the server throws at startup rather than falling back to the default credential.

   token-registry.json

   [
     { "baseUrl": "https://argo-a.example.com", "token": "<token-a>" },
     { "baseUrl": "https://argo-b.example.com", "token": "<token-b>" }
   ]

What the server can do

Applications, the Kubernetes resources beneath them, and the cluster registry. Six of these tools mutate state, which is what the exposure settings below are protecting.

What people use it for

Which one should you use?

Argo CD MCP addresses the delivery layer. The two below sit either side of it, and the split is clean enough that teams often run this one alongside one of them rather than choosing.

Categories

Works With

Frequently Asked Questions

Related Guides