I build safe-by-default MCP servers — so AI agents can work with real systems, from infrastructure to your own documents, without being handed the keys.
🌐 dockndevai.github.io — the whole suite on one page, with the security model and copy-paste installs.
A family of Model Context Protocol servers that share one governance model: read-only by default, layered access modes, resource allowlists, protected resources, delete gating, typed confirmation for high-impact ops, secret redaction, dry-run, and JSON audit logging. Mostly MIT-licensed and on npm as @dockndevai/mcp-* (plus the Apache-2.0 ossian-mcp).
| Server | What it does | Install | Stars |
|---|---|---|---|
| mcp-kubernetes | Pods, logs, deployments, scale/restart, apply, exec | npx -y @dockndevai/mcp-kubernetes |
 |
| mcp-kafka | Topics, consumer groups + lag, create/alter/reset | npx -y @dockndevai/mcp-kafka |
 |
| mcp-clickhouse | Schema, queries, SQL-classified read/write/destructive gating | npx -y @dockndevai/mcp-clickhouse |
 |
| mcp-debezium | CDC connector status, config, lifecycle | npx -y @dockndevai/mcp-debezium |
 |
| mcp-oci | Oracle Cloud discovery + Terraform generation | npx -y @dockndevai/mcp-oci |
 |
| mcp-azure | Azure Resource Manager inventory, tags, VM power, lifecycle | npx -y @dockndevai/mcp-azure |
 |
| mcp-azure-devops | Boards, repos, pipelines, projects | npx -y @dockndevai/mcp-azure-devops |
 |
| mcp-keycloak | Realms, users, clients, roles, groups | npx -y @dockndevai/mcp-keycloak |
 |
| mcp-percona-pg | Percona PostgreSQL + PgBouncer: pooling, tuning, backups/PITR, DR, upgrades | npx -y @dockndevai/mcp-percona-pg |
 |
| mcp-grafana | Dashboards, datasource queries (PromQL/LogQL/SQL), alerts & annotations | npx -y @dockndevai/mcp-grafana |
 |
| ossian-mcp | Ask your own documents with citations + durable agent memory (RAG) | npx -y ossian-mcp |
 |
| mcp-macos | Observe & operate a Mac — files, processes, apps, screenshots, shell, AppleScript, GUI (safe by default) | npx -y @dockndevai/mcp-macos |
 |
Each works with Claude, Cursor, OpenAI Codex, VS Code, and Windsurf — per-client setup in every repo's docs/CLIENTS.md.
The agent tools sit on top of real systems I also build and run.
| Project | What it is |
|---|---|
| ossian | Open-book RAG over your own documents — Spring Boot + Spring AI, a React console, Keycloak OAuth2, Postgres/pgvector and Redis. Answers with citations, plus a maintenance side for ingestion, re-indexing and coverage gaps. ossian-mcp is its agent adapter. |
| spring-llm-gateway | An LLM gateway on Spring Cloud Gateway (WebFlux): virtual keys, token quotas, usage metering and failover for self-hosted OpenAI-compatible backends (vLLM, Ollama). |
A realtime, voice-driven assistant with Claude as the brain: local Whisper STT, streaming TTS with barge-in, subagents, and a web dashboard.
- orrin-site — the site
- homebrew-otto — a
brewtap to install it
Runnable reference environments — every claim measured, every failure documented. Each pairs with an MCP server above.
| Lab | What it covers |
|---|---|
| percona-pg-lab | PostgreSQL + PgBouncer on Kubernetes with the Percona Operator — HA, DR, connection pooling, backups, observability. Pairs with mcp-percona-pg. |
| kafka-lifecycle-lab | Operating Apache Kafka on Kubernetes with Strimzi — provision, upgrade, DR with MirrorMaker 2, and read-only agent triage. Pairs with mcp-kafka. |
⭐ If any of these save you time, a star helps other engineers find them.