Open source · Apache-2.0 · v0.1.0

kuberoutectl skills

Operator skills that teach any AI assistant to discover, verify, and route Kubernetes access across Azure, AWS, GCP, and kubeconfig.

Install Quick start Safety model CLI docs

Works with Azure AKS AWS EKS GCP GKE kubeconfig

Why these skills

kuberoutectl brokers identities and destinations for Kubernetes across providers. These skills teach an assistant to use it correctly — which field to trust, which command looks right and is not, and when to stop and ask.

Inventory discovery

Find what access you have. Prerequisites, provider setup, multi-account AWS, sync — and how to tell an empty cache from a permissions boundary.

skills/inventory-discovery/SKILL.md

Target selection

Point kubectl at the right cluster, and prove it is the right one first. Aliases are not unique; the scope is the authority.

skills/target-selection/SKILL.md

Access triage

Why access is not working. Separates a missing prerequisite, an expired identity, a stale cache, and a cluster that is genuinely gone.

skills/access-triage/SKILL.md

Shared patterns

Field reference and the action_hint table, alias-vs-id resolution, safety tiers, selector grammar, the MCP tool map. Linked, never repeated — which is why three skills cover what twelve used to.

patterns/*.md

Install

Installing the plugin also registers the MCP server, so the skills can prefer tools over shelling out.

/plugin marketplace add ymedlop/kuberoutectl-skills
/plugin install kuberoutectl-skills

Without the plugin: clone the repository and point a shell-capable assistant at it, or register kuberoutectl mcp --read-only in any client that can launch a stdio MCP server. The CLI itself must be installed either way — see installation.

Quick start

Discover what you can reach, then route at it.

kuberoutectl doctor            # do the provider CLIs resolve?
kuberoutectl sync gcp          # discover clusters and credential health
kuberoutectl target list       # what is selectable
kuberoutectl target inspect <alias>   # verify the scope before you switch
kuberoutectl target use <id>   # rewrites ~/.kube/config

Read ACTION, not just HEALTH: use is ready, renew is an expired identity, manual must be fixed at its source. And unknown means never observed — not broken.

Safety model

Every command and MCP tool sits in exactly one tier, and each skill states which. The shipped server runs --read-only; no delete, no clear, no renew is exposed over MCP in either mode.

Tier	Effect	Examples
1 — read-only	Nothing changes	`doctor · target list · target inspect · credential list · current`
2 — local cache	Refreshes the cache; your labels, collections and visibility survive	`sync <provider>`
3 — kubeconfig	Rewrites ~/.kube/config and moves the active context	`target use`
4 — destructive	Confirm first, always	`target delete · target clear · credential renew`

How this stays true

There is no hand-maintained "verified against version X" line anywhere, because such a claim goes stale in silence. 6 guards run in CI and weekly against the latest stable release; the run log is the authority.

Guard	Catches
`verify-commands.sh`	a renamed or removed CLI command, or a flag that no longer exists
`verify-mcp-tools.py`	a new or removed MCP tool, or a doc claiming a write tool is read-only-safe
`verify-links.py`	a cross-link broken by a rename, or written the non-canonical way
`verify-frontmatter.py`	a missing required field, or a name that drifted from its directory
`verify-manifests.py`	a skill no manifest lists, a dead path, or a shipped server missing --read-only
`verify-neutrality.py`	an assistant or vendor name leaking into a skill or pattern

Learn more

Skill index — tags, routing by symptom, and what is deliberately not covered
MCP tool map — the inventory, and where the CLI is the only path
Contributing — the rules a new skill has to clear
kuberoutectl documentation — the CLI itself