Ecosystem & Marketplaces›Open-Source MCP Servers (10)›ArgoCD MCP Server›Configuration

Configuration

Configure the ArgoCD MCP Server using environment variables to connect to your ArgoCD v2.x API server, manage HTTPS/SSH Git repository credentials, and enforce read-only vs. write-enabled access control (MCP_ALLOW_WRITE).

Prerequisites

Requirement	Description
ArgoCD Server	Running ArgoCD instance (v2.x) reachable over HTTPS
Authentication	Valid ArgoCD API token (ARGOCD_AUTH_TOKEN)
Git Credentials	HTTPS Personal Access Token (GIT_PASSWORD) or SSH private key for repository onboarding
Runtime	Docker (recommended) or Python 3.12+ with uv

Fetching an ArgoCD API token

Use the included fetch_argocd_token.py helper script to generate an authentication token from your ArgoCD admin credentials:

cd argocd_mcp_server/scripts

export ARGOCD_SERVER="https://localhost:8080"
export ARGOCD_USERNAME="admin"
export ARGOCD_PASSWORD="your-password"
export ARGOCD_VERIFY_TLS="false"

python fetch_argocd_token.py --output env
# Output: export ARGOCD_AUTH_TOKEN='eyJhbGc...'

Installation and startup

Option 1: Docker (recommended)

Read-only mode (default):

docker run --rm -it \
  -p 8770:8770 \
  -e ARGOCD_SERVER_URL="https://argocd.example.com" \
  -e ARGOCD_AUTH_TOKEN="your-token-here" \
  -e MCP_PORT=8770 \
  -e MCP_PATH="/mcp" \
  talkopsai/argocd-mcp-server:latest

Write mode enabled (with Git credentials and local port-forward):

docker run --rm -it \
  -p 8770:8770 \
  -e ARGOCD_SERVER_URL="https://host.docker.internal:8080" \
  -e ARGOCD_AUTH_TOKEN="your-token-here" \
  -e MCP_PORT=8770 \
  -e MCP_PATH="/mcp" \
  -e ARGOCD_INSECURE="true" \
  -e MCP_ALLOW_WRITE="true" \
  -e GIT_USERNAME="your-github-username" \
  -e GIT_PASSWORD="your-github-pat" \
  talkopsai/argocd-mcp-server:latest

Use host.docker.internal:8080 when connecting from inside Docker to a locally port-forwarded ArgoCD service (kubectl port-forward svc/argocd-server -n argocd 8080:443).

Option 2: Local installation with uv

git clone https://github.com/talkops-ai/talkops-mcp.git
cd talkops-mcp/src/argocd-mcp-server

uv venv --python=3.12
source .venv/bin/activate
uv pip install -e .

uv run argocd-mcp-server

Environment variables

Server settings

Variable	Default	Description
MCP_SERVER_NAME	argocd-mcp-server	Server identifier returned during MCP initialization
MCP_TRANSPORT	streamable-http	Transport protocol: streamable-http or stdio
MCP_HOST	0.0.0.0	Bind address for the HTTP server
MCP_PORT	8770	Bind port for the HTTP server
MCP_PATH	/mcp	HTTP endpoint path
MCP_ALLOW_WRITE	false	Permit mutating operations (create, update, delete, sync, rollback)
MCP_LOG_LEVEL	INFO	Logging verbosity (DEBUG, INFO, WARNING, ERROR)

ArgoCD connection settings

Variable	Default	Description
ARGOCD_SERVER_URL	(Required)	Base URL of the ArgoCD API server
ARGOCD_AUTH_TOKEN	(Required)	ArgoCD Bearer authentication token
ARGOCD_INSECURE	false	Skip TLS certificate verification (use only for local self-signed certs)
ARGOCD_TIMEOUT	300	API request timeout in seconds

Git repository credentials

Variable	Default	Description
GIT_USERNAME	""	Git username for HTTPS repository onboarding
GIT_PASSWORD	(Required for HTTPS)	Git personal access token (stored server-side, never exposed to LLMs)
SSH_PRIVATE_KEY_PATH	~/.ssh/id_rsa	Filesystem path to the SSH private key for SSH repository onboarding

Write access control (MCP_ALLOW_WRITE)

The MCP_ALLOW_WRITE environment variable enforces a server-side write gate across all 29 tools:

Operation Category	MCP_ALLOW_WRITE=false (Default)	MCP_ALLOW_WRITE=true
List applications, repositories, and projects	Allowed	Allowed
Inspect status, pod logs, events, and metrics	Allowed	Allowed
Validate configs and preview manifest diffs	Allowed	Allowed
Run dry-run sync (sync_application with dry_run=true)	Allowed	Allowed
Create, update, or delete applications, projects, or repos	Blocked	Allowed
Execute live syncs, prunes, or rollbacks	Blocked	Allowed

When a mutating tool is called while MCP_ALLOW_WRITE=false, the server returns a deterministic error without contacting the ArgoCD API:

ArgoCDOperationError: ArgoCD [operation] is not allowed.
This MCP server is configured for read-only operations.
To enable write operations, set environment variable: MCP_ALLOW_WRITE=true

MCP client configuration

Register the streamable-http endpoint in your MCP client (mcp.json, .cursor/mcp.json, or claude_desktop_config.json):

mcp.json

{
  "mcpServers": {
    "argocd-mcp-server": {
      "url": "http://localhost:8770/mcp",
      "disabled": false,
      "disabledTools": []
    }
  }
}

Troubleshooting

Symptom	Cause	Resolution
ArgoCDConnectionError: Failed to connect to ArgoCD	Unreachable ARGOCD_SERVER_URL or self-signed TLS certificate	Verify the URL and port-forward status; set ARGOCD_INSECURE="true" for local self-signed certificates.
GIT_PASSWORD environment variable is not set	Calling onboard_repository_https without server-side Git credentials	Export GIT_PASSWORD="ghp_..." with repo scope in the MCP server environment.
SSH key not found	Calling onboard_repository_ssh with an unmounted key path	Set SSH_PRIVATE_KEY_PATH and mount the key read-only with 0600 permissions.
ArgoCD [operation] is not allowed	Calling a mutating tool while MCP_ALLOW_WRITE=false	Set MCP_ALLOW_WRITE="true" and restart the server container.