Skip to main content
Ecosystem & Marketplaces›Open-Source MCP Servers (10)›Traefik MCP Server

Traefik MCP server

The Traefik MCP Server is a Model Context Protocol server for Kubernetes edge routing and ingress governance. It exposes 11 tools and real-time traefik:// resources so AI agents can create IngressRoute and IngressRouteTCP CRDs, configure weighted canary traffic splits, attach rate-limiting and circuit-breaker Middleware chains, mirror production shadow traffic, and automate NGINX-to-Traefik ingress migrations.

11 Edge Routing Tools

Configure weighted canary splits, header/path routing, Middleware CRDs, TCP SNI passthrough, and shadow traffic mirroring.

NGINX-to-Traefik Migration

Scan legacy networking.k8s.io/v1 NGINX Ingress annotations, assess compatibility, and generate equivalent Traefik CRD bundles.

Live Traffic Resources

Monitor active route weights, middleware attachments, Prometheus error/latency metrics, and migration audit trails via traefik://.

Configuration & Security

Configure kubeconfig access, Prometheus metric endpoints, and write-protection controls (MCP_ALLOW_WRITE=false).

Core capabilities​

Capability DomainWhat the Server Provides
Edge Routing & Canary SplitsCreate and update IngressRoute CRDs with exact weighted canary traffic splits (for example, 90/10), host/path/header/cookie matchers, and TLS secret bindings.
Middleware GovernanceGenerate and attach Traefik Middleware CRDs for rate limiting, circuit breaking, retry policies, IP allowlists, strip-prefix, ForwardAuth, and security headers.
NGINX Ingress MigrationAudit existing NGINX Ingress resources and nginx.ingress.kubernetes.io/* annotations, synthesize equivalent Traefik CRDs, handle incompatible annotations with supervised overrides, and support single-command rollback.
Shadow Traffic MirroringDuplicate a configurable percentage of live production traffic to a shadow service asynchronously without impacting user responses.
TCP & SNI RoutingConfigure IngressRouteTCP resources for PostgreSQL, Redis, MQTT, and TLS passthrough workloads.

Architecture​

Quickstart​

1
Verify prerequisites

Ensure your Kubernetes cluster runs the Traefik Ingress Controller (v2.10+ or v3.x) with Traefik CRDs installed, and that you have a valid ~/.kube/config.

2
Start the Traefik MCP Server container

Mount your kubeconfig read-only and expose port 8769:

docker run --rm -it \
  -p 8769:8769 \
  -v ~/.kube/config:/app/.kube/config:ro \
  talkopsai/traefik-mcp-server:latest
3
Connect your MCP client

Register the server URL in your MCP client configuration:

mcp.json
{
  "mcpServers": {
    "traefik": {
      "url": "http://localhost:8769/mcp",
      "description": "MCP Server for managing Traefik Edge Routing and Middlewares"
    }
  }
}

Security and dry-run controls​

  • Manifest preview mode: All routing, middleware, and migration tools support action="generate" (or MCP_ALLOW_WRITE=false) to return validated Traefik CRD YAML without mutating the cluster.
  • Secret isolation: Never embed plaintext credentials inside BasicAuth or ForwardAuth middlewares—reference existing Kubernetes Secret objects.
  • Instant migration revert: NGINX migration tools preserve the original Ingress state so operators can revert a migrated route with a single tool call (revert_nginx_ingress).

Project structure​

traefik-mcp-server/
├── traefik_mcp_server/
│   ├── tools/           # 11 MCP tools (routing, middleware, NGINX migration, mirroring, TCP)
│   ├── resources/       # Traffic distribution, Prometheus metrics, anomalies, migration state
│   ├── services/        # Traefik CRD client and YAML generator services
│   ├── server/          # FastMCP server initialization
│   ├── exceptions/      # Domain error definitions
│   └── config.py        # Environment configuration
├── tests/               # Automated test suite
├── Dockerfile
└── pyproject.toml
On this page