An implementation of Model Context Protocol (MCP) server for Argo CD.
# Add to your Claude Code skills
git clone https://github.com/argoproj-labs/mcp-for-argocdGuides for using mcp servers skills like mcp-for-argocd.
Last scanned: 5/18/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: Prototype Pollution via parse() in NodeJS flatted",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-18T08:04:04.494Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
An implementation of Model Context Protocol (MCP) server for Argo CD, enabling AI assistants to interact with your Argo CD applications through natural language. This server allows for seamless integration with Visual Studio Code and other MCP clients through stdio and HTTP stream transport protocols.
The server provides the following ArgoCD management tools:
list_clusters: List all clusters registered with ArgoCDlist_applications: List and filter all applicationsget_application: Get detailed information about a specific applicationcreate_application: Create a new applicationupdate_application: Update an existing applicationdelete_application: Delete an applicationsync_application: Trigger a sync operation on an applicationget_application_resource_tree: Get the resource tree for a specific applicationget_application_managed_resources: Get managed resources for a specific applicationget_application_workload_logs: Get logs for application workloads (Pods, Deployments, etc.)get_resource_events: Get events for resources managed by an applicationget_resource_actions: Get available actions for resourcesrun_resource_action: Run an action on a resource.cursor/mcp.json file in your project:{
"mcpServers": {
"argocd-mcp": {
"command": "npx",
"args": [
"argocd-mcp@latest",
"stdio"
],
"env": {
"ARGOCD_BASE_URL": "<argocd_url>",
"ARGOCD_API_TOKEN": "<argocd_token>"
}
}
}
}
.vscode/mcp.json file in your project:{
"servers": {
"argocd-mcp-stdio": {
"type": "stdio",
"command": "npx",
"args": [
"argocd-mcp@latest",
"stdio"
],
"env": {
"ARGOCD_BASE_URL": "<argocd_url>",
"ARGOCD_API_TOKEN": "<argocd_token>"
}
}
}
}
claude_desktop_config.json configuration file:{
"mcpServers": {
"argocd-mcp": {
"command": "npx",
"args": [
"argocd-mcp@latest",
"stdio"
],
"env": {
"ARGOCD_BASE_URL": "<argocd_url>",
"ARGOCD_API_TOKEN": "<argocd_token>"
}
}
}
}
If your Argo CD instance uses self-signed certificates or certificates from a private Certificate Authority (CA), you may need to add the following environment variable to your configuration:
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
This disables TLS certificate validation for Node.js when connecting to Argo CD instances using self-signed certificates or certificates from private CAs that aren't trusted by your system's certificate store.
Warning: Disabling SSL verification reduces security. Use this setting only in development environments or when you understand the security implications.
If you want to run the MCP Server in a ReadOnly mode to avoid resource or application modification, you should set the environment variable:
"MCP_READ_ONLY": "true"
This will disable the following tools:
create_applicationupdate_applicationdelete_applicationsync_applicationrun_resource_actionBy default, all the tools will be available.
By default, the HTTP transport assigns a session ID to each client connection and keeps an in-memory map of active sessions. This works well for single-instance deployments but causes 400 errors when multiple replicas are running without sticky sessions, because a request routed to a different pod will not find the session that was created on the original pod.
To run without session affinity requirements, start the server with the --stateless flag:
node dist/index.js http --stateless
Or with Docker:
docker run -e ARGOCD_BASE_URL=<argocd_url> -e ARGOCD_API_TOKEN=<argocd_token> \
argoprojlabs/mcp-for-argocd http --stateless
In stateless mode:
Mcp-Session-Id is returned or required — any replica can handle any requestx-argocd-base-url / x-argocd-api-token headersGET /mcp and DELETE /mcp return 405 Method Not Allowed (session-level SSE and termination are not supported)This mode is recommended for Kubernetes deployments with Horizontal Pod Autoscaling (HPA) where network-level sticky sessions are not available.
git clone https://github.com/argoproj-labs/mcp-for-argocd.git
cd mcp-for-argocd
pnpm install
pnpm run dev
Once the server is running, you can utilize the MCP server within Visual Studio Code or other MCP client.
To update the TypeScript type definitions based on the latest Argo CD API specification:
Download the swagger.json file from the ArgoCD release page, for example here is the swagger.json link for ArgoCD v2.14.11.
Place the downloaded swagger.json file in the root directory of the argocd-mcp project.
Generate the TypeScript types from the Swagger definition by running the following command. This will create or overwrite the src/types/argocd.d.ts file:
pnpm run generate-types
Update the src/types/argocd-types.ts file to export the required types from the newly generated src/types/argocd.d.ts. This step often requires manual review to ensure only necessary types are exposed.
The project was initially created and donated by @jiachengxu, @imwithye, @hwwn, and @alexmt from Akuity.